Security Stop-Press : MI5 Warns Of Chinese Research Funding Links

MI5 says more than 100 UK-linked academics contributed to research funded through an institute linked to China’s intelligence service.

Its 30 September alert identifies the China General Technology Research Institute as funding projects intended to improve Chinese espionage capabilities, including AI, cybersecurity and covert communications.

Many researchers may have acted in good faith, with some unaware of the ultimate funding source. China has rejected the allegations.

With those links now public, MI5 is urging universities to review collaborations immediately and warns that continuing the work could raise legal risks under the National Security Act 2023.

Businesses involved in research should check who ultimately funds projects, review partners’ access to sensitive information and seek specialist advice where concerns arise.

Security Stop-Press: Deepfake Calls Target Employees

Gartner found that 41 per cent of surveyed cybersecurity leaders reported deepfake incidents involving employee audio calls, while 36 per cent reported video-call incidents.

Its March–May 2026 survey covered 297 leaders reporting on the previous year, without establishing how many attacks succeeded.

Email phishing or business email compromise affected 79 per cent, while 58 per cent reported voice or text scams.

Gartner warns that AI makes impersonation more convincing, reducing the reliability of familiar warning signs.

Businesses should independently verify payment, password-reset and access requests, require approvals and report suspicious approaches rather than trust familiar voices or faces.

Security Stop-Press : Fake Job Interviews Infect 30,000 Devices

An updated international security advisory says North Korean attackers infected at least 30,000 computers across over 100 countries through fake recruitment tests.

Between December 2025 and July 2026, WaterPlum stole at least US$10.71 million, taking funds or credentials from over 7,000 cryptocurrency wallets.

Applicants were tricked into running malicious coding tests or video-call fixes that stole information and maintained remote access.

That access also threatens employers, with agencies warning that stolen information can enable extortion.

Businesses should verify recruiters, isolate unfamiliar tests from company systems and report suspected infections immediately, disconnecting devices and replacing exposed credentials securely.

Security Stop-Press: LG Faces Smart TV Privacy Allegations

South Korean electronics manufacturer LG is facing privacy allegations after researchers reported extensive data collection and security weaknesses in its smart TVs.

Gamers Nexus found audio transcripts and information about nearby networks and devices, describing an “egregious invasion of privacy”.

Researchers demonstrated recording on a compromised TV with its screen off, but this does not prove ordinary LG TVs routinely record conversations.

LG denies unauthorised ambient recording, says advertising-related viewing tracking is opt-in and describes network scanning as a standard connectivity feature.

Businesses should update firmware, disable unnecessary voice and tracking features, and separate smart TVs from sensitive networks, particularly in confidential meeting rooms.

Security Stop-Press : Webpage Tricks Claude Code Into Running Malicious Code

Security researcher Johann Rehberger tricked Claude Code into running malicious code by asking it to summarise a webpage.

Testing Opus 5 in Auto Mode, he steered Claude towards an archive. It rejected a supplied program but wrote a replacement that unknowingly loaded a malicious Python file.

The payload contacted a controlled server and opened Calculator. Another variant launched a second Claude session that ran commands and wrote files outside the working folder.

Three variants succeeded in 60–80 per cent of attempts across five tests each, results Rehberger described as “not comprehensive”.

Rehberger, who publishes his findings on the Embrace The Red blog under the name wunderwuzzi, says Anthropic called the behaviour working as designed. Its guidance acknowledges Auto Mode risks and recommends isolation.

Businesses should isolate coding agents, restrict network access, protect credentials and confidential files, and require human review for sensitive actions.

Security Stop-Press : Cyber Security Event Attendees Targeted With Malicious Google Docs

Cyber criminals targeted Black Hat and DEF CON attendees after the events with convincing follow-up messages and malicious Google Docs.

A Huntress researcher was contacted on X by someone posing as a CoinDesk executive and was sent a Google Doc containing a malicious Apps Script sidebar.

Mac users were targeted with AMOS infostealer malware, while Windows users faced NetSupport RAT and other malicious tools.

When the first attempt failed, the attacker reportedly tried again using a fake Dropbox DocSend share.

Huntress warned that major events create a “target-rich environment” because attendees expect new contacts and shared files.

Businesses should remind staff that trusted platforms do not guarantee trusted content, and unexpected requests to install software or paste commands should always be verified.

Tech Tip : Protect Important Folders From Ransomware

Windows includes a lesser-known security feature called Controlled Folder Access that can stop untrusted apps changing files in important folders such as Documents, Pictures and Desktop, helping protect them from ransomware.

Why Is This Useful?

Ransomware often works by encrypting or changing files so you can no longer access them. Controlled Folder Access adds another layer of protection by allowing trusted apps to make changes while blocking apps Windows does not recognise or trust.

It protects common folders such as Documents, Pictures, Videos, Music and Desktop by default, and you can add other folders if needed.

How To Turn It On

In Windows 10 or 11:

  1. Open Windows Security.
  2. Select Virus & threat protection.
  3. Scroll to Ransomware protection and select Manage ransomware protection.
  4. Turn Controlled folder access on.

Once enabled, Windows will alert you if an app is blocked from changing a protected file.

What If A Trusted App Gets Blocked?

If a legitimate program is stopped from saving or changing files, return to the Controlled Folder Access settings and choose Allow an app through Controlled folder access.

Only allow apps you recognise and trust, because anything added to that list will be able to change files inside your protected folders.

It’s a simple built-in way to make your most important files harder for ransomware to tamper with.

Featured Article : Turn Your Home WiFi Into A Security Motion Sensor

Comcast has begun turning compatible Xfinity home routers into camera-free motion detectors, showing how WiFi infrastructure can now do far more than connect devices while raising important questions about privacy, data use and intelligent buildings.

What Has Comcast Launched?

The new capability forms part of Xfinity Shield, a wider home-protection platform currently being rolled out to Xfinity Internet customers in the United States.

At the centre of the free WiFi Shield tier is WiFi Motion, an opt-in feature that uses an Advanced Xfinity Gateway and connected devices to detect movement inside a home without installing cameras or conventional motion sensors.

An Average Of 36 Devices Already Connected

Comcast says the average Xfinity household now connects 36 devices to WiFi, while its network already identifies, filters and blocks around 30 million online threats every day. Xfinity Shield is intended to combine that existing cyber security capability with physical and family protection in one service.

Wi-Fi Network Can Do More Than Just Connect Devices

Jon Gieselman, Comcast’s Chief Growth Officer for Connectivity & Platforms, said in an online announcement about Xfinity home routers: “We believe the network should do more than connect devices. It should help protect the people, their personal information, and everything within their homes that depend on our most reliable WiFi every day.”

How Can WiFi Detect Movement?

Comcast’s WiFi Motion essentially works by monitoring changes in the radio-frequency signals travelling between the Xfinity Gateway and stationary WiFi-connected devices around the home. For example, when somebody or something moves through that signal path, their body disturbs the radio waves, allowing Comcast’s system to analyse the changes and send an alert through the Xfinity app when unexpected movement is detected.

Doesn’t Record Video

Comcast says WiFi Motion does not record video, capture images or identify individuals, thereby making it different from a conventional security camera. However, Comcast customers can also use Home Watch, Away Watch and Dark Watch modes to change how the system behaves depending on whether they are at home, away or asleep.

The company says the technology works best when connected devices are positioned so WiFi signals cross areas people are likely to move through, meaning the home network itself becomes the sensing infrastructure.

Why Is Comcast Doing This?

Comcast is presenting Xfinity Shield as a way to simplify home protection, but there also appears to be a clear commercial opportunity behind the launch. For example, the company already operates Xfinity Home, and Shield allows it to extend that business by turning broadband equipment already installed in millions of homes into the starting point for a wider security and monitoring service.

In other words, rather than asking customers to buy a completely separate security system, Comcast can offer basic motion awareness through the Xfinity Gateway they already use, then provide a paid upgrade for those wanting more comprehensive protection.

Fraser Stirling, Comcast’s Global Chief Product Officer, said: “Our goal was simple: make protection easier, smarter and more accessible.” He added: “We believe the future of protection should be integrated into the technology people already use every day, not added as another product they have to manage.”

That strategy becomes more evident with Shield Select, which costs US$15 per month and adds an indoor camera, door and window sensor, cloud video storage and 24/7 urgent response. In effect, Comcast is using WiFi Motion not only as a new technical capability, but also as a way of making home security a more natural extension of its broadband service.

Camera-Free Doesn’t Mean Data-Free

The most interesting aspect of WiFi Motion is also the one most likely to attract scrutiny, because a system that detects presence without capturing images could be more privacy-friendly than cameras while still generating potentially sensitive information about movement inside a home.

Comcast says the feature is opt-in and that it doesn’t monitor the motion or alerts generated for customers. Its terms also make clear, however, that information generated by WiFi Motion may be disclosed in certain circumstances, such as police investigations, disputes involving Comcast, court orders or other legally binding requests for information.

The key point here is that the technology demonstrates how devices originally purchased for one purpose can apparently now gain entirely new capabilities, generate more income and open up a new market through the addition of software.

The Router Becomes A Sensor

It should be noted here that WiFi sensing itself isn’t entirely new, although Comcast’s scale makes this deployment particularly significant. Instead of requiring millions of customers to purchase dedicated motion detectors, the company can activate a sensing capability through compatible gateways already installed in homes.

The same principle could eventually support occupancy monitoring in offices, energy management, assisted living, smart buildings and security systems, where knowing whether people are present can be useful without requiring cameras in every room.

The technology therefore changes the role of network infrastructure. A router is no longer simply moving data between devices but increasingly, the radio environment around those devices can itself become a source of information.

What Does This Mean For Your Business?

For businesses, Comcast’s launch highlights how existing technology infrastructure can acquire valuable new capabilities without additional hardware.

In offices, warehouses, hotels and other commercial environments, WiFi-based sensing could potentially help organisations understand occupancy, automate lighting and heating, identify unexpected movement and improve building security while reducing dependence on cameras and separate sensors.

The commercial opportunity is significant, although so are the governance questions. Businesses adopting similar technologies will need to understand exactly what information is collected, how long it is retained, who can access it and whether employees, customers or visitors have been properly informed.

Perhaps most importantly, WiFi Motion demonstrates that the connected devices organisations already own may increasingly become sensors as well as communications tools. That could make buildings smarter and more efficient, but it also means businesses will need to think more carefully about the hidden capabilities of their infrastructure and the data those capabilities can create.

Security Stop-Press : Expired Visa Cards Can Be Revived For Contactless Payments

Researchers at the University of Massachusetts Amherst have shown how some expired Visa cards could be manipulated to make contactless payments after they should have stopped working.

The “Zombie Card” attack uses NFC relays to alter the expiry date seen by a payment terminal without breaking the card’s encryption.

Researchers demonstrated payments of US$1, US$100 and US$500, although success depended partly on the issuing bank’s checks.

The flaw affected the Visa contactless configuration tested, while Mastercard, American Express and Discover rejected the altered expiry information.

The attack requires physical possession of the expired card, making carelessly discarded cards a potential risk.

Businesses should securely destroy expired cards by cutting through the chip and magnetic stripe, while monitoring accounts for unexpected transactions.

Security Stop-Press: Hackers Use Expired Domains To Spread Malware

Cyber crime groups are spending millions on expired domains, exploiting their inherited trust and traffic to spread scams and malware.

DNS security company Infoblox recorded around 65,000 daily “dropcatch” registrations in early 2026, almost one in five new domains. Its Vice President, Renée Burton, called them “a shortcut to both trust and traffic”.

The cyber crime operation dubbed “Sable Squirrel” controls over 10,000 domains, is estimated to have spent more than US$7 million and is linked to 31,000 malware samples.

Some pose as illegal sports-streaming sites while promoting gambling or controlling infected devices. Others remain embedded in compromised websites, providing ready-made victim traffic.

Businesses should catalogue domains, enable automatic renewal, remove obsolete links and DNS records, and treat ownership changes as a warning.