HBO Max doesn’t let up when it comes to documentaries, and has had some serious standouts this year already, not least of which is Monsters of God, the ongoing saga of the illegal reptile trade that’s 100% fresh on Rotten Tomatoes.
It could soon become easier to identify AI-generated content, even if it’s not the usual “It’s Not X, it’s Y” type of post you’d come across on LinkedIn and other socials. […]
Apple has expanded its threat-notification system for targets of mercenary spyware.
Apple now shows a warning directly on an iPhone’s Lock Screen and in Settings when it believes the device owner has been targeted by mercenary spyware. The new on-device alert is meant to make a high-risk warning harder to overlook and complements notifications by email and through the user’s Apple Account page.
In the explanation, Apple states:
“Apple threat notifications are high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously.”
“Apple Threat Notification
Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to help protect your data and device.”
Apple says its threat notifications are intended for people individually targeted by mercenary spyware attacks, which are highly sophisticated campaigns usually associated with commercial surveillance vendors and their government customers. Apple says it has notified targets in over 150 countries since the launch of the program in 2021, while the latest round of notifications reached people in 110 countries.
Mercenary spyware campaigns are usually not aimed at the average iPhone owner—at least at first. The initial targets are often people selected for who they are, what they know, or the work they do. But it would be a mistake to view this as someone else’s problem.
Attack techniques developed for narrowly targeted operations have a habit of spreading. Exploits can be reused, sold onward, reverse engineered, copied by other surveillance vendors, or adapted by criminal groups. A vulnerability initially valuable because it compromises a small number of carefully chosen devices may become much more dangerous once public disclosure, patch analysis, or exploit sharing makes them available for more widespread campaigns.
Apple advises users to:
We’d like to add:
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
The Netherlands’ National Cyber Security Centre (NCSC) is warning that hackers are actively exploiting a macOS authentication bypass vulnerability after public exploit code emerged. […]
Researchers at Group-IB have discovered a new NFC relay malware family, purpose-built to capture live card data via NFC and forward it in real time to attackers. They dubbed it “WindRelay.”
NFC (Near Field Communication) is wireless technology that allows devices such as smartphones, payment cards, and payment terminals to communicate when they’re very close together. So, instead of stealing your physical bank card, the attackers capture NFC activity on an infected mobile phone and relay it in real time to a criminal-controlled device held against a contactless payment terminal, or an ATM that supports contactless cash withdrawals.
The researchers describe a 13-minute call impersonating a bank, in which a victim was persuaded to install an Android app labelled with the bank’s name. That app was a remote access Trojan (RAT) called SpyNote. SpyNote gave the attacker remote control of the phone and enabled the quiet installation of a second app, WindRelay.
The attackers then opened the victim’s legitimate banking app remotely and arranged a loan in the victim’s name, while also asking them to tap their physical payment card against the phone and enter its PIN. That tap let the second app forward the card’s contactless data in real time to the criminals, allowing them to make purchases or, in some cases, withdraw cash from an ATM.
This division of tasks is the important development here. The remote-access malware (SpyNote) gets the attackers into the phone, and the NFC relay malware (WindRelay) turns the victim’s physical card into something the criminals can use elsewhere at that moment.
It’s not quite as simple as it sounds, because NFC comes in a few different “flavors.” Some produce a static code. Take the card that opens my apartment building door, for example. That kind of signal can easily be copied to a device like my Flipper Zero so I can use it to open the door. But sophisticated contactless payment cards use dynamic codes. Each time you tap to pay, your card’s chip generates a unique, one-time code (often called a cryptogram or token) that cannot be reused.
That’s why the critical feature of NFC relay malware is real-time relaying. Since payment card transactions use dynamic, transaction-specific cryptographic data, timing is central to this kind of fraud.
The telephone call isn’t just the lure. It’s also the attackers’ control channel. It lets them overcome the victim’s hesitation, respond to confusion instantly, and coordinate the precise moments when the victim installs an app, taps their card, and enters a PIN.
This is part of an established and expanding NFC relay fraud category sometimes called ghost tapping. In the past, we’ve discussed NGate and SuperCard X, which are similar malware families. But the combination with SpyNote is what makes this campaign stand out.
As with many security threats, the best defense is you. The cybercriminals behind this attack can’t do anything unless you install the software on your phone, so they go through several steps to convince you to do so.
Malwarebytes for Android detects SpyNote and WindRelay as:
Android/Trojan.NGate.ACRBCF9BBC3C1Android/Trojan.NGate.ACR2401245FC5Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
Shopping for a compact luxury sedan usually means starting with BMW, Mercedes-Benz, or Audi, especially now that several alternatives are disappearing from the market. But there’s still one sedan that makes a pretty strong case for looking beyond the usual German choices.
YouTube Premium has never piqued my interest. While I use YouTube daily, I’m content with ad-supported videos. Plus, my music streaming service of choice is Spotify. Therefore, YouTube Music is a luxury that I don’t need right now.
Researchers have found three vulnerabilities in the popular Zoom meeting platform that could let one meeting participant attack another through malicious collaboration data.
The vulnerabilities, tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, affect the code Zoom uses to process annotation data shared during meetings. The researchers named the set of flaws “Zoomsday.”
Affected applications are:
What this means is that someone in the same Zoom meeting could send data that the Zoom app was not prepared to handle. Instead of simply displaying a drawing, text box, or other annotation, a vulnerable client could be tricked into crashing, leaking information, or even running attacker-controlled code.
Annotation features sound simple, but the underlying process is not. Your Zoom client receives structured data from another participant and turns that data into an object it can display on screen. According to the research, the annotation parser contained several memory-safety bugs. Like any software that processes data supplied by a third party, it has to be very careful about validating lengths, counts, and references before using them.
Remarkably, there is a discrepancy between the severity ratings assigned by the researchers, who rated them as Critical, and Zoom, which rated them as High.
The difference appears to come down to how the vulnerabilities are scored under the Common Vulnerability Scoring System (CVSS score). Zoom considers successful exploitation to require user interaction.
In practice, an attacker would first need to get into the same meeting as the intended victim. That could mean joining an open meeting, abusing a leaked meeting link, posing as an expected attendee, or compromising an account that already has access. Zoom considers it user interaction if the attacker persuades the target to join a meeting with the intent to compromise their machine.
Zoom has published a security bulletin explaining which programs need to be updated and where to find the fixed versions.
To protect yourself from Zoomsday and have safe meetings:
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
Security researchers have disclosed new “Plug and Pwn” attacks that abuse the Windows Plug and Play feature to trigger Windows into installing vulnerable or insecure vendor software and gain SYSTEM privileges. […]
Most people shopping for a used family SUV aren’t looking for something that can move like a sports car. That’s what makes this particular plug-in hybrid so easy to overlook.