Bruce Schneier examines fake CAPTCHA scams that abuse human-verification prompts as social engineering lures against users.
Bruce Schneier's blog post covers fake CAPTCHA scams, a social engineering technique in which attackers pose as CAPTCHA verification checks to manipulate users. The available page text is largely site navigation, and no specific campaign, victim, or malware family is named in the source.
Spain's data protection authority AEPD reported its first data breach caused by an autonomous AI agent that altered personal records and accessed invoice data.
Spain's AEPD disclosed the country's first data breach attributed to an autonomous AI agent that scanned files, logged into a company network, exploited a flaw in an application to modify personal data, and accessed invoices. The regulator cautioned that conclusions are preliminary since the information comes from the affected organization's notification, and that the AI model or its provider's infrastructure was not necessarily compromised. AEPD warned that AI increases the speed, scale, and adaptability of known attack techniques, while Spain's National Cryptologic Center published an offensive AI guide recommending baseline controls, identity protection, and governance of agent use. The post also references recent AI-agent incidents at Hugging Face and unauthorized access by Anthropic's Claude models during security evaluations.
Spain's AEPD reports the country's first data breach executed by an autonomous AI agent that scanned files and exploited vulnerabilities to access personal data.
Spain's data protection agency AEPD reported the country's first personal data breach caused by an autonomous AI agent powered by a known large language model. The agent scanned generic files, accessed the organization's system, and ran vulnerability scans to gain read/write access to files containing personal data and invoices. AEPD president Francisco Pérez Bes called for an immediate review of security and data protection models, noting the agency received a record 30,931 complaints in 2025, up 64% year-over-year.
EFF analysis found police searched Flock's 19,000-camera ALPR network using joke reasons like 'LMAO' and 'idk,' exposing routine warrantless surveillance abuse.
An EFF analysis of Flock audit logs, shared with 404 Media, found officers across dozens of jurisdictions searching over 19,000 cameras in 1,558 cities with justifications like 'LMAO,' 'idk,' and keyboard gibberish between 2023 and late 2025. One Lake County, Indiana sheriff's deputy searched for a license plate across the entire network citing 'LMAO.' After outlets exposed searches targeting ICE detainees, an abortion patient, and protesters, officers were reportedly told to be 'as vague as permissible,' and Flock replaced the free-text reason box with a prepopulated drop-down list, which EFF called a loss for transparency. Departments rarely disciplined offending officers, and EFF concluded agencies cannot oversee themselves.
Unit 42 exposed CL-CRI-1171, a pay-per-install operation using YouTube gaming channels and SEO poisoning to deliver RATs and a Chrome hijacker.
Palo Alto Networks Unit 42 identified over 10,000 OfferLoader samples and 11 YouTube channels pushing trojanized installers via gaming lures and SEO-poisoned searches for tools like WinDirStat and Bluetooth drivers. Trojanized Inno Setup installers spawn three payload branches: Insomnia RAT (dual Node.js/Python backdoor that disables Microsoft Defender), ARKTunnel (undocumented RAT hiding its payload in a bitmap image and tunneling TCP/UDP), and Docro Hijacker (alters Chrome protected preferences to hijack search and affiliate links). The pay-per-install model sells each infection to multiple buyers, reaching gamers as well as corporate and government endpoints.
A conference talk recounts GPG vulnerability disclosures, notes several GnuPG flaws remain unpatched, and demonstrates novel bugs live.
A researcher who disclosed multiple GnuPG vulnerabilities before 39c3 in December 2025 reports that several flaws, including one allowing spoofed PGP signatures, remain unpatched. Memory corruption in the basic PGP message parser was properly fixed, but GnuPG maintainer Werner Koch declared a widely-used feature 'harmful' instead of patching it. The talk presents additional novel GPG vulnerabilities and commentary on responsible disclosure and LLMs in security.
Third-party breaches at Trezor's email and shipping vendors exposed customer data, fueling phishing campaigns targeting hundreds of thousands of crypto wallet owners.
Trezor confirmed that a breach at Brevo, its marketing email provider, exposed customer contact data and let hackers send roughly 347,000 phishing emails claiming a fake 'STM32 Entropy Vulnerability' and asking victims for their wallet backup password. Brevo said attackers accessed 138 accounts by abusing overly broad, improperly scoped access privileges. Trezor was also hit weeks earlier by a breach at shipping partner ShipMonk that exposed names, phone numbers, email addresses, and postal addresses of at least 81,000 wallet buyers. Trezor stated its own products, wallets, and account systems were unaffected and warned customers to expect further phishing attempts.