In a moment of clarity after initially moving forward a deeply flawed piece of legislation, the French National Assembly has done the right thing: it rejected a dangerous proposal that would have gutted end-to-end encryption in the name of fighting drug trafficking. Despite heavy pressure from the Interior Ministry, lawmakers voted Thursday night (article in French) to strike down a provision that would have forced messaging platforms like Signal and WhatsApp to allow hidden access to private conversations.

The vote is a victory for digital rights, for privacy and security, and for common sense.

The proposed law was a surveillance wishlist disguised as anti-drug legislation. Tucked into its text was a resurrection of the widely discredited “ghost” participant model—a backdoor that pretends not to be one. Under this scheme, law enforcement could silently join encrypted chats, undermining the very idea of private communication. Security experts have condemned the approach, warning it would introduce systemic vulnerabilities, damage trust in secure communication platforms, and create tools ripe for abuse.

The French lawmakers who voted this provision down deserve credit. They listened—not only to French digital rights organizations and technologists, but also to basic principles of cybersecurity and civil liberties. They understood that encryption protects everyone, not just activists and dissidents, but also journalists, medical professionals, abuse survivors, and ordinary citizens trying to live private lives in an increasingly surveilled world.

A Global Signal

France’s rejection of the backdoor provision should send a message to legislatures around the world: you don’t have to sacrifice fundamental rights in the name of public safety. Encryption is not the enemy of justice; it’s a tool that supports our fundamental human rights, including the right to have a private conversation. It is a pillar of modern democracy and cybersecurity.

As governments in the U.S., U.K., Australia, and elsewhere continue to flirt with anti-encryption laws, this decision should serve as a model—and a warning. Undermining encryption doesn’t make society safer. It makes everyone more vulnerable.

This victory was not inevitable. It came after sustained public pressure, expert input, and tireless advocacy from civil society. It shows that pushing back works. But for the foreseeable future, misguided lobbyists for police national security agencies will continue to push similar proposals—perhaps repackaged, or rushed through quieter legislative moments.

Supporters of privacy should celebrate this win today. Tomorrow, we will continue to keep watch.

Source: https://www.eff.org/deeplinks/2025/03/win-encryption-france-rejects-backdoor-mandate

On Wednesday, web infrastructure provider Cloudflare announced a new feature called “AI Labyrinth” that aims to combat unauthorized AI data scraping by serving fake AI-generated content to bots. The tool will attempt to thwart AI companies that crawl websites without permission to collect training data for large language models that power AI assistants like ChatGPT.

Cloudflare, founded in 2009, is probably best known as a company that provides infrastructure and security services for websites, particularly protection against distributed denial-of-service (DDoS) attacks and other malicious traffic.

Instead of simply blocking bots, Cloudflare’s new system lures them into a “maze” of realistic-looking but irrelevant pages, wasting the crawler’s computing resources. The approach is a notable shift from the standard block-and-defend strategy used by most website protection services. Cloudflare says blocking bots sometimes backfires because it alerts the crawler’s operators that they’ve been detected.

“When we detect unauthorized crawling, rather than blocking the request, we will link to a series of AI-generated pages that are convincing enough to entice a crawler to traverse them,” writes Cloudflare. “But while real looking, this content is not actually the content of the site we are protecting, so the crawler wastes time and resources.”

The company says the content served to bots is deliberately irrelevant to the website being crawled, but it is carefully sourced or generated using real scientific facts—such as neutral information about biology, physics, or mathematics—to avoid spreading misinformation (whether this approach effectively prevents misinformation, however, remains unproven). Cloudflare creates this content using its Workers AI service, a commercial platform that runs AI tasks.

Cloudflare designed the trap pages and links to remain invisible and inaccessible to regular visitors, so people browsing the web don’t run into them by accident.

A smarter honeypot

AI Labyrinth functions as what Cloudflare calls a “next-generation honeypot.” Traditional honeypots are invisible links that human visitors can’t see but bots parsing HTML code might follow. But Cloudflare says modern bots have become adept at spotting these simple traps, necessitating more sophisticated deception. The false links contain appropriate meta directives to prevent search engine indexing while remaining attractive to data-scraping bots.

“No real human would go four links deep into a maze of AI-generated nonsense,” Cloudflare explains. “Any visitor that does is very likely to be a bot, so this gives us a brand-new tool to identify and fingerprint bad bots.”

This identification feeds into a machine-learning feedback loop—data gathered from AI Labyrinth is used to continuously enhance bot detection across Cloudflare’s network, improving customer protection over time. Customers on any Cloudflare plan—even the free tier—can enable the feature with a single toggle in their dashboard settings.

A growing problem

Cloudflare’s AI Labyrinth joins a growing field of tools designed to counter aggressive AI web crawling. In January, we reported on “Nepenthes,” software that similarly lures AI crawlers into mazes of fake content. Both approaches share the core concept of wasting crawler resources rather than simply blocking them. However, while Nepenthes’ anonymous creator described it as “aggressive malware” meant to trap bots for months, Cloudflare positions its tool as a legitimate security feature that can be enabled easily on its commercial service.

The scale of AI crawling on the web appears substantial, according to Cloudflare’s data that lines up with anecdotal reports we’ve heard from sources. The company says that AI crawlers generate more than 50 billion requests to their network daily, amounting to nearly 1 percent of all web traffic they process. Many of these crawlers collect website data to train large language models without permission from site owners, a practice that has sparked numerous lawsuits from content creators and publishers.

The technique represents an interesting defensive application of AI, protecting website owners and creators rather than threatening their intellectual property. However, it’s unclear how quickly AI crawlers might adapt to detect and avoid such traps, potentially forcing Cloudflare to increase the complexity of its deception tactics. Also, wasting AI company resources might not please people who are critical of the perceived energy and environmental costs of running AI models.

Cloudflare describes this as just “the first iteration” of using AI defensively against bots. Future plans include making the fake content harder to detect and integrating the fake pages more seamlessly into website structures. The cat-and-mouse game between websites and data scrapers continues, with AI now being used on both sides of the battle.

Source: https://arstechnica.com/ai/2025/03/cloudflare-turns-ai-against-itself-with-endless-maze-of-irrelevant-facts/

See also: https://techcrunch.com/2025/03/27/open-source-devs-are-fighting-ai-crawlers-with-cleverness-and-vengeance/ and https://www.theregister.com/2025/03/21/cloudflare_ai_labyrinth/

Update January 29, 14:15 EST: Seizure banners were added to the cracked[.]io, cracked[.]to, nulled [.]to, starkrdp[.]io, mysellix[.]io, and sellix[.]io, confirming that the domains had been seized in a joint law enforcement action dubbed “Operation Talent” that included authorities from the United States, Italy, Spain, Europe, France, Greece, Australia, and Romania.

“This website, as well as the information on the customers and victims of the website, has been seized by international law enforcement partners,” the banners read.

Cracked.io’s staff has released a new statement on Telegram confirming that law enforcement has seized the cracked.io domain.

“Now that everyone has more clarity on the situation, Cracked.io has been seized under operation talent with specific reasons being undisclosed,” they said.

“We are still waiting for the official court documentation from the data centre and the domain host. We will inform you guys further on those details once we have it. A sad day indeed for our community.”

Update January 29th 16:54 EST: Europol said that an operation is currently undergoing and more information will be available at a later date.

Original story below

The FBI has seized the domains for the infamous Cracked.io and Nulled.to hacking forums, which are known for their focus on cybercrime, password theft, cracking, and credential stuffing attacks.

While some of their members also engaged in ethical hacking discussions, the sites were widely regarded as a hub for cybercriminal activity.

They also hosted content related to software cracks, hacking tools like “configs” used by credential stuffing attack tools (e.g., OpenBullet and SilverBullet), and other illicit activities, including a “combo lists” marketplace with stolen credentials or databases.

When trying to open the sites, web browsers display “Error 1000. DNS points to prohibited IP” and Error 1016. Origin DNS error” messages.

Today, the FBI seized the forums’ domains and changed their name servers to ns1.fbi.seized.gov and ns2.fbi.seized.gov from their previous Cloudflare name servers.

Cracked.io’s staff published an announcement on their Telegram channel earlier today, blaming a data center issue for the ongoing access problems.

“There is an active issue in our data centre which the staff is working on. Hence services remain offline till the issue is resolved. We will get detailed report later,” they said.

“We can only hope it is resolved without further issue. No estimated time at this moment. The current status from data centre is that it may take up to 1 day.”

Today, the FBI also seized domains used by:

• MySellIX (mysellix.io) and SellIX (sellix.io), two platforms that allowed users to create their own online stores, which threat actors also used to sell stolen data, software keys, and compromised accounts, and
• StarkRDP (starkrdp.io), a Windows RDP virtual hosting provider that some threat actors allegedly used for credential stuffing attacks.

An FBI spokesperson was not immediately available for comment when contacted by BleepingComputer earlier today.

While the law enforcement agency has yet to share more information about this wave of seizures, all signs point to a crackdown on platforms involved in credential stuffing and stolen account credentials.

Source: https://www.bleepingcomputer.com/news/security/fbi-seizes-crackedio-nulledto-hacking-forums-in-operation-talent/

Court-Authorized Operation Removes PlugX Malware from Over 4,200 Infected U.S. Computers

The Justice Department and FBI today announced a multi-month law enforcement operation that, alongside international partners, deleted “PlugX” malware from thousands of infected computers worldwide. As described in court documents unsealed in the Eastern District of Pennsylvania, a group of hackers sponsored by the People’s Republic of China (PRC), known to the private sector as “Mustang Panda” and “Twill Typhoon,” used a version of PlugX malware to infect, control, and steal information from victim computers.

According to court documents, the PRC government paid the Mustang Panda group to, among other computer intrusion services, develop this specific version of PlugX. Since at least 2014, Mustang Panda hackers then infiltrated thousands of computer systems in campaigns targeting U.S. victims, as well as European and Asian governments and businesses, and Chinese dissident groups. Despite previous cybersecurity reports, owners of computers still infected with PlugX are typically unaware of the infection. The court-authorized operation announced today remediated U.S.-based computers infected with Mustang Panda’s version of PlugX.    

“The Department of Justice prioritizes proactively disrupting cyber threats to protect U.S. victims from harm, even as we work to arrest and prosecute the perpetrators,” said Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division. “This operation, like other recent technical operations against Chinese and Russian hacking groups like Volt Typhoon, Flax Typhoon, and APT28, has depended on strong partnerships to successfully counter malicious cyber activity. I commend partners in the French government and private sector for spearheading this international operation to defend global cybersecurity.”

“Leveraging our partnership with French law enforcement, the FBI acted to protect U.S. computers from further compromise by PRC state-sponsored hackers,” said Assistant Director Bryan Vorndran of the FBI’s Cyber Division. “Today’s announcement reaffirms the FBI’s dedication to protecting the American people by using its full range of legal authorities and technical expertise to counter nation-state cyber threats.”

“This wide-ranging hack and long-term infection of thousands of Windows-based computers, including many home computers in the United States, demonstrates the recklessness and aggressiveness of PRC state-sponsored hackers,” said U.S. Attorney Jacqueline Romero for the Eastern District of Pennsylvania. “Working alongside both international and private sector partners, the Department of Justice’s court-authorized operation to delete PlugX malware proves its commitment to a ‘whole-of-society’ approach to protecting U.S. cybersecurity.”

“The FBI worked to identify thousands of infected U.S. computers and delete the PRC malware on them. The scope of this technical operation demonstrates the FBI’s resolve to pursue PRC adversaries no matter where they victimize Americans,” said Special Agent in Charge Wayne Jacobs of the FBI Philadelphia Field Office.

The international operation was led by French law enforcement and Sekoia.io, a France-based private cybersecurity company, which had identified and reported on the capability to send commands to delete the PlugX version from infected devices. Working with these partners, the FBI tested the commands, confirmed their effectiveness, and determined that they did not otherwise impact the legitimate functions of, or collect content information from, infected computers. In August 2024, the Justice Department and FBI obtained the first of nine warrants in the Eastern District of Pennsylvania authorizing the deletion of PlugX from U.S.-based computers. The last of these warrants expired on Jan. 3, 2025, thereby concluding the U.S. portions of the operation. In total, this court-authorized operation deleted PlugX malware from approximately 4,258 U.S.-based computers and networks.

The FBI, through the victims’ internet service providers, is providing notice to U.S. owners of Windows-based computers affected by this court-authorized operation.

The FBI’s Philadelphia Field Office and Cyber Division, the U.S. Attorney’s Office for the Eastern District of Pennsylvania, and the National Security Cyber Section of Justice Department’s National Security Division led the domestic disruption operation. This operation would not have been successful without the valuable collaboration of to the Cyber Division of the Paris Prosecution Office, French Gendarmerie Cyber Unit C3N, and Sekoia.io.

The FBI continues to investigate Mustang Panda’s computer intrusion activity. If you believe you have a compromised computer or device, please visit the FBI’s Internet Crime Complaint Center (IC3). You may also contact your local FBI field office directly. The FBI strongly encourages the use of anti-virus software as well as the application of software security updates to help prevent reinfection.

Source: https://www.justice.gov/opa/pr/justice-department-and-fbi-conduct-international-operation-delete-malware-used-china-backed

Infostealer malware is often hidden in pirated or cracked software, and hackers then post the harvested credentials and other data online. Criminals have been infected too.

Cybersecurity researchers are increasingly unmasking or finding new information on suspected criminals from a rich and unlikely source: the tsunami of compromised credentials, browser profiles, and other system information available on Telegram. In other words, criminals are accidentally hacking themselves, perhaps by downloading cracked software laden with malware, which is then exposing their identities to researchers, and potentially law enforcement too.

In the latest example, cybersecurity firm Hudson Rock said last week it had uncovered information on Mujtaba Raza and Mohsin Raza, two alleged fraudsters on the FBI’s Most Wanted list. In April 2021, U.S. authorities charged the two men with conspiracy to produce and transfer in false identification documents, three counts of transferring false identification documents, false use of a passport, and aggravated identity theft. The men allegedly ran an illegal e-commerce business out of Karachi, Pakistan, called SecondEye Solution. This company sold digital images of fake passports, driver’s licenses, and national identity cards for more than 200 countries and territories, and the men advertised the company’s services on at least one hacker forum, according to the DOJ’s press release at the time. The DOJ said that a member of the Internet Research Agency LLC, the Russian social media and election interference organization, bought multiple fake identity documents from SecondEye.

Since those charges, Mujtaba and Mohsin have been fugitives.

Now using data from infostealers, which are a class of malware that harvest credentials and other data from an infected computer, Hudson Rock said it had identified two computers that it believes contained data related to the pair. Various pieces of infostealer malware exist, with names such as RedLine, Raccoon, Mars, BlackGuard, and Erbium. These are spread to victims by fake ExpressVPN applications, cryptocurrency wallets, or cracked or pirated software. Once the malware administrators have harvested credentials, they often sell them to other cybercriminals before posting them for free on Telegram. It’s typically here that researchers can collect the exposed credentials and then warn impacted companies. 

Included in the infostealer logs Hudson Rock found were credentials for SecondEye email accounts; cloud storage accounts linked to the same email addresses; and others for Forwarderz, another associated company.

The data harvested by the infostealers and then reviewed by Hudson Rock included much more than just passwords stored on the computers, though. Hudson Rock says it included the “entire browsing history” from one of the machines; auto-fill data, such as addresses, account numbers, and passport numbers; as well as information on when the computer was hacked, its name, and its related IP address. When one of the computers was initially infected, the malware took a screenshot. It shows a Forwarderz-branded Skype account being used, according to Hudson Rock.

Hudson Rock believes the two compromised computers don’t belong to Mujtaba and Mohsin themselves, but two other associates. Facebook and Github profiles linked to the machines, as well as a physical address included in the data, pointed to two men called Muhammad Qamber and Bakhtawar Abbas. Neither man responded to a request for comment from 404 Media.

Infostealer credentials are responsible for the recent wave of Snowflake breaches, in which hackers accessed data from a series of high profile companies, including AT&T and Ticketmaster.

Hudson Rock’s blog post says it was “reviewed and approved by the Federal Bureau of Investigation (FBI), meeting all necessary guidelines for public disclosure.” The FBI did not respond to a request for comment. Neither did Hudson Rock.

In another case, in July researchers from cybersecurity firm RecordedFuture said they found 3,324 unique credentials used to access known child abuse imagery (CSAM) websites. That data also included those peoples’ usernames, IP addresses, and system information, which could let the researchers or law enforcement unmask the users’ real identities.

RecordedFuture said it “used the data contained in infostealer logs and open-source intelligence (OSINT) to identify two individuals and found further digital artifacts, including cryptocurrency addresses, belonging to a third individual.” RecordedFuture did not respond to a request for comment. 

Whether such information would be admissible in court is a separate question, however, and would in part depend on whether law enforcement consider credentials harvested from infostealer infections to be publicly available information. The FBI did not respond to a request for comment.

Source: https://www.404media.co/criminals-keep-hacking-themselves-letting-researchers-unmask-them/