Search: “Gemma Scope”

SAEScientist-Bench: Can AI Agents Conduct Autonomous SAE Interpretability Research?

SAEScientist-Bench tests whether AI agents can autonomously run SAE interpretability research on Gemma-2-9B-IT; frontier agents trail expert baselines.

The benchmark requires agents to design contrastive probes and navigate the Gemma Scope dictionary of over 131K features in Gemma-2-9B-IT to discover optimal interpretable features, scored against expert-curated references on Neuronpedia via activation rank, concept selectivity, and causal steering. Across 10 agent configurations and 20 tasks, frontier agents demonstrate genuine discovery capability and approach expert levels at separating target concepts from controls, but lag substantially in causal steering and frequently misinterpret experimental measurements. The authors frame this as establishing experimental model understanding as a measurable capability for closed-loop autonomous AI R&D and post-hoc monitoring for recursive self-improvement.

arXiv cs.AI / cs.LG / cs.CL·Sep 8, 17:45 UTC · 8d agoAI research1

First Galileo SAS Authenticated Time Solution

Researchers demonstrate the first timing solution computed from Galileo's new Signal Authentication Service, protecting receivers against GNSS spoofing.

Galileo's new Signal Authentication Service (SAS) on the E6-C signal directly authenticates ranging measurements, closing a gap left by OSNMA, which only protects navigation data. Researchers built a snapshot software receiver implementing a simplified SAS protocol and computed an authenticated receiver clock bias from recordings of both SAS-capable satellites, collected with a Septentrio SDR prototype. The results demonstrate feasible authenticated timing ahead of full SAS operational deployment.

arXiv cs.CR·Sep 14, 16:26 UTC · 2d agoResearch

SAEScientist-Bench: Can AI Agents Conduct Autonomous SAE Interpretability Research?

SAEScientist-Bench evaluates whether AI agents can autonomously conduct SAE interpretability research in Gemma-2-9B-IT, finding frontier agents trail expert baselines.

SAEScientist-Bench tests if AI agents can act as scientists using SAE tools for autonomous mechanistic discovery, requiring them to design contrastive probes and navigate a Gemma Scope dictionary of 131K+ features in Gemma-2-9B-IT. Across 10 agent configurations and 20 tasks, frontier agents showed genuine discovery capability but remained well behind expert reference features, lagging most in causal steering. Agents frequently misinterpreted experimental measurements even when designing effective contrasts.

Hugging Face daily papers·Sep 7, 20:00 UTC · 9d agoAI research

Realtime-Venus: A full-duplex interaction system with asynchronous delegation

Realtime-Venus introduces two 9B full-duplex interaction models (Omni and Audio) that outperform Gemini 3.1 Live and GPT-4o on continuation metrics.

Realtime-Venus is a proactive full-duplex interaction system built on two separately trained 9B models: Realtime-Venus-Omni for audio-visual interaction and Realtime-Venus-Audio for spoken interaction. A dual-loop runtime lets foreground interaction continue while Realtime-Venus-Harness asynchronously executes background reasoning and tool tasks. Realtime-Venus-Omni leads on six of eight video benchmarks, including StreamingBench (70.2%), OVO-Bench (64.7%), and Daily-Omni (81.3%), while Realtime-Venus-Audio tops MMAU (78.0%) and MMAU-Pro (63.2%). On Full-Duplex-Bench v1.5, Realtime-Venus-Audio handles 75% of interruptions and exceeds Gemini 3.1 Live and GPT-4o on all three continuation metrics.

Hugging Face daily papers·Sep 11, 20:00 UTC · 5d agoAI research

After accusations of selling ‘perv glasses,’ Meta prepares to sell a pair without a camera

Meta is preparing camera-less Luna smart glasses with microphones and an AI button to access its chatbot and Muse agent, per reports.

The Information reports Meta is developing Luna, a camera-free smart glasses model with six built-in microphones and a side button that activates Meta's AI chatbot and its Muse consumer agent, possibly unveiled at next week's Meta Connect event. The move follows consumer backlash over camera-equipped glasses that critics called 'perv glasses.' Meta's Reality Labs continues to post large losses despite the smart glasses line's relative market success.

TechCrunch · AI·20:12 UTC · 2h agoAI industry

Mars Security brings threat intelligence to detection in real time

Mars Security launched Real-Time Intel-Based Detection, converting advisories from CISA and Mandiant into backtested MITRE ATT&CK-mapped detection rules for CrowdStrike, Wiz, and Splunk.

Mars Security announced a capability that automatically turns newly published threat intelligence from sources like CISA, Mandiant, Unit 42, and Microsoft into MITRE ATT&CK-mapped detection rules. Each rule is written in the native query language of the customer's telemetry (CrowdStrike Falcon, Wiz, Splunk, firewalls, identity providers, AWS, Snowflake, Databricks) and backtested against 30 days of the customer's data before deployment, with indicator scoring to drop noisy or stale indicators. The platform also maps existing detection coverage, flags gaps such as AWS CloudTrail tampering and pass-the-hash movement, and delivers some recommendations as open pull requests for detection-as-code workflows.

Help Net Security·Sep 8, 13:43 UTC · 8d agoTools

Managing the cyber risk of agentic AI

UK NCSC guidance recommends safeguards, sandboxing, and active oversight to manage cyber risks of autonomous agentic AI systems.

The UK National Cyber Security Centre published guidance on managing the cyber risk of agentic AI systems. It recommends safeguards, sandboxing, and active human oversight to limit unintended autonomous activity while realizing the benefits of these systems. The publication is official national guidance for organizations deploying agentic AI.

NCSC UK·Aug 20, 12:00 UTC · 27d agoAdvisory

Using Cyber Decoys to Strengthen Detection and Response

CISA released guidance on cyber decoys—tripwires, breadcrumbs, honeytokens—to help defenders detect adversaries using valid credentials and living-off-the-land techniques.

CISA published guidance to help defensive teams of varying maturity plan and implement cyber decoys—assets that mimic legitimate systems, accounts, or data, such as tripwires, breadcrumbs, and honeytokens—to detect adversaries using legitimate credentials and living-off-the-land techniques. The guidance frames decoys as complementing Zero Trust by producing high-fidelity alerts, reducing alert fatigue, and exposing post-compromise activity like discovery, lateral movement, and data access. It maps decoy operations to the MITRE Engage and MITRE ATT&CK frameworks with low-complexity implementation steps.

CISA Advisories·12:00 UTC · 10h agoAdvisory

numbat - AI agent observability, (Fri, Sep 4th)

SANS reviews Perplexity's open source numbat, a Go-based tool giving security teams observability, detection rules, and enforcement for AI agents like Claude and Gemini.

Numbat, Perplexity AI's open source observability tool, monitors desktop, CLI, IDE, and gateway AI agents through local hooks, OTLP/HTTP logs, and on-disk session artifacts. It ships detection rules mapped to MITRE ATT&CK (e.g., recon.network_sweep / T1046), supports enforcement mode, and packages investigations with SHA256-verified manifests and timelines. The SANS review positions it as a response to unmanaged AI agent and MCP server sprawl highlighted by the OpenAI/Hugging Face incident.

SANS Internet Storm Center·Sep 5, 03:39 UTC · 11d agoAI tools & infra

Iran-Linked Hackers Use Fake LinkedIn Job Offers to Deploy NodeRabbit and PollCat RATs

Iran-linked Mirage Kitten targets software engineers with fake LinkedIn recruiter coding tests deploying new NodeRabbit and PollCat RATs.

Kaspersky researchers link the campaign to Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm, Nimbus Manticore), with victims in aviation, aerospace and fintech in Egypt, Ethiopia and Afghanistan. Trojanized npm dependencies (colorized_terminal, pretty-log) bundled in coding-challenge archives launch the Node.js implants across Windows, Linux and macOS. NodeRabbit uses AES-256-GCM-encrypted C2 via Azure, and its third variant persists through a fake GitHub Copilot Helper VS Code extension plus Git post-merge/post-checkout hooks. PollCat is an obfuscated JavaScript RAT that registers with C2 before OTP authentication and inventories tools from 24 security vendors.

GBHackers·Sep 9, 12:52 UTC · 7d agoThreat actor in the wild1

Mars Security Launches Real-Time Intel-to-Detection Engine That Turns Live Threat Intelligence Into Backtested Detections in Minutes

Mars Security launched Real-Time Intel-Based Detection, converting advisories into MITRE ATT&CK-mapped, backtested detection rules for CrowdStrike, Wiz, and Splunk within minutes.

The capability turns newly published threat intelligence from CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence into validated detection rules within minutes, each backtested against 30 days of the customer's own telemetry before deployment. Rules are written in native query languages across CrowdStrike Falcon, Wiz, Splunk, firewalls, Linux Sysmon, identity providers, AWS telemetry, and data lakes such as Snowflake and Databricks, with no data ingestion or stack changes. The feature is available at no additional cost to existing customers and on AWS Marketplace. Mars also flags detection coverage gaps and extends monitoring to credentials leaked by AI coding agents.

Cyber Security News·Sep 8, 13:20 UTC · 8d agoTools1

Mapping the malware blast radius a single alert won't show you

Help Net Security·Aug 9, 04:34 UTC · Aug 9, 2026Malware

The VMs Powering Mobile Agents (Instinct, Claude Code)

A teardown reveals Claude Code runs in Firecracker microVMs with a Rust PID 1 and MITM'd egress, while Instinct rents E2B sandboxes with git-based memory.

The author inspects the virtual machines hosting cloud agents: Claude Code runs in a Firecracker microVM with a custom Rust init (process_api) as PID 1, a 324 MB Bun harness on a read-only disk, and 443-only MITM'd SSE egress to api.anthropic.com with host-rotated OAuth tokens and no inbound access. Instinct rents E2B sandbox-as-a-service Firecracker microVMs (Ubuntu 22.04, 2 vCPU, 1.9 GB RAM) where agent memory is a git repo of Markdown committed by the agent and pushed to S3 as a single bundle, using short-lived STS credentials. Both platforms rely on Firecracker, differing mainly in fleet operator and guest boot configuration.

Hacker News · AI·Sep 8, 04:36 UTC · 8d agoAI tools & infraHN 58↑ · 19 comments1

Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs

Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.

PolySwarm documented a campaign by Iran-linked Mirage Kitten (UNC1549) that uses fake recruiter personas and technical hiring challenges on LinkedIn to deliver the newly documented RATs NodeRabbit and PollCat, which run on Windows, Linux, and macOS. A challenge archive bundles a fake npm package (colorized_terminal 2.1.0) in node_modules that loads NodeRabbit, while a React-based challenge delivers PollCat with an attacker-controlled OTP screen. NodeRabbit persists through a malicious Visual Studio Code extension and Git post-merge/post-checkout hooks; PollCat persists via scheduled tasks, cron, and LaunchAgents. Victims were observed in fintech, aviation, and aerospace, with confirmed targets in Egypt, Ethiopia, and Afghanistan.

Cyber Security News·Sep 9, 14:07 UTC · 7d agoMalware in the wild

What We Missed: Did ShinyHunters 'Breach' ReliaQuest?

Dark Reading editors discuss whether ShinyHunters breached ReliaQuest and new research questioning the prevalence of AI-generated malware.

Dark Reading editors review stories they had not previously covered in a video discussion, centered on recent activity attributed to the ShinyHunters threat actor and whether it constitutes a breach of security services firm ReliaQuest. The conversation also touches on new research about how common AI-generated malware actually is. No new indicators, victims, or technical details are provided beyond the discussion format.

Dark Reading·Sep 3, 19:42 UTC · 13d agoThreat actor

ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Response

ANY.RUN integrates its interactive sandbox, IOC lookups, and STIX/TAXII threat feeds natively into SentinelOne for faster automated malware triage.

ANY.RUN and SentinelOne launched connectors that embed interactive sandbox analysis and threat intelligence into the SentinelOne console via Singularity Hyperautomation. Suspicious files and URLs from alerts are automatically submitted to the ANY.RUN sandbox, with behavioral verdicts and risk scores returned into alert notes. On-demand IOC lookups draw on sandbox history from 16,000 organizations and 700,000 analysts. A separate STIX/TAXII feed streams verified malicious IPs, domains, and URLs through the SentinelOne Marketplace TAXII Connect app.

ANY.RUN·06:40 UTC · 15h agoTools

Citrix adds AI-powered browser activity analysis to SecurAccess

Citrix launched Session Insights for SecurAccess with Chrome Enterprise, using AI to record and analyze browser activity from users and autonomous agents.

Citrix Session Insights adds automatic session recording and AI-powered risk detection for browser activity by human users and autonomous AI agents within Citrix SecurAccess with Chrome Enterprise. The capability creates visual forensic records, highlights risky behavior for faster investigations, and recommends policy adjustments or changes to agent authority levels. It is designed to support audits and governance as enterprise AI agent workflows expand.

Help Net Security·10:14 UTC · 12h agoTools

AI agent authorization risks remain a gap in new NIST-CISA token security guidance

NIST and CISA release IR 8587 guidance on securing signed tokens, but AI agent authorization and delegation risks remain out of scope.

NIST, with CISA support, published 'Protecting Tokens and Assertions from Forgery, Theft, and Misuse' (NIST IR 8587), recommending continuous monitoring and tighter token lifecycle controls for SSO and API access. The guidance does not yet fully address AI agent identity, delegation chains, or prompt injection steering agents with valid tokens, and NIST says new or expanded standards are needed. Experts recommend treating AI agents as low-trust non-human identities, maintaining agent inventories, expiring credentials after task completion, and requiring human approval for high-risk actions. The report references shared-signal mechanisms like CAEP and RISC, and follows a May incident where a CISA contractor GitHub repository exposed AWS and GitHub tokens.

CSO Online·15:42 UTC · 6h agoAdvisory

Security Data Isn’t the Problem. Security Context Is.

Horizon3 blog argues security context, not data volume, is the SOC bottleneck, promoting its NodeZero integration with CrowdStrike Falcon Next-Gen SIEM.

Horizon3.ai published a vendor blog explaining how its NodeZero Proactive Security Platform integration with CrowdStrike Falcon Next-Gen SIEM brings validated exposure findings into existing security operations workflows. The post argues SOCs are now limited by confidence rather than visibility, needing context to decide which issues matter. It cites a global chemical manufacturer that validated exploitable exposures with NodeZero before completing a $2 billion merger.

Horizon3.ai·Sep 15, 13:12 UTC · 1d agoTools

Exaforce extends its AI security tool to monitor more than just Claude

Exaforce AI Security extends beyond Claude to monitor OpenAI, Gemini, and Copilot agents using existing SOC telemetry, no new endpoint agents.

Exaforce expanded its June Claude Compliance API integration into Exaforce AI Security, adding monitoring for OpenAI, Gemini, Microsoft Copilot, and OAuth-connected AI apps. The tool inventories AI agents by correlating EDR, cloud, SaaS, and model-provider logs without new gateways or endpoint agents, and can respond by revoking sessions, deactivating API keys, isolating devices, or killing agent processes via existing controls. Analysts note the agentless approach lowers friction but lacks runtime inspection and inline blocking offered by competitors such as Palo Alto Prisma AIRS, SentinelOne Prompt AI Agent Security, and CrowdStrike Falcon Guardian. A March 2026 Cloud Security Alliance survey found 68% of organizations cannot distinguish human from AI-agent activity and 74% report AI agents receive excessive access.

CSO Online·Sep 15, 13:00 UTC · 1d agoTools

New Python-Based Payload MechaFlounder Used by Chafer

Unit 42 identified MechaFlounder, a new Python backdoor used by the Chafer group to target a Turkish government entity via HTTP-based C2.

Unit 42 reports that in November 2018 the Chafer group targeted a Turkish government entity, reusing the win10-update[.]com infrastructure reported earlier in 2018 by ClearSky. The new secondary payload, tracked as MechaFlounder, is Python compiled with PyInstaller and acts as a backdoor supporting file upload/download and command execution. It beacons over HTTP using anomalous GET requests containing the username and hostname, suggesting a custom C2 server rather than a standard web server. Code overlap with OilRig's Clayside VBScript was noted, but Chafer and OilRig remain tracked as separate groups.

Palo Alto Unit 42·Aug 17, 13:22 UTC · Aug 17, 2026Threat actor

IT help-desk vishing tricks executives into handing over Microsoft 365 access

Arctic Wolf tracks PREY-0058 (linked to UNC6671), a vishing campaign stealing Microsoft 365 session tokens via AiTM panels for SaaS data theft and extortion.

Arctic Wolf is tracking a campaign, PREY-0058, sharing tradecraft with Google Threat Intelligence Group's UNC6671, in which callers posing as internal IT talk employees through fake passkey/MFA setups. Operator-controlled adversary-in-the-middle pages harvest passwords and MFA approvals to seize session tokens, then actors enumerate and bulk-exfiltrate data from SharePoint, OneDrive, Exchange, and Box. Extortion brands include BlackFile, Pink, Helix, Cinder, and Redact; targets are mostly US-based executives in construction, healthcare, real estate, finance, and professional services, with exfiltration shifting to residential proxies like NodeMaven.

Help Net Security·Sep 8, 11:17 UTC · 8d agoThreat actor in the wild1

North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters

Sekoia and Kudelski Security reclassify North Korea's Lazarus umbrella into six clusters spanning espionage, financial theft, and fake IT worker operations.

New research by Sekoia and Kudelski Security, published September 7, divides the former Lazarus umbrella into TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima, mostly under North Korea's military intelligence bureau (GRIB). The former APT38 likely split into CryptoCore and Jade Sleet, focused on cryptocurrency, Web3, and blockchain targets. Moonstone Sleet combines espionage with financially motivated operations, using custom malware alongside Qilin ransomware-as-a-service. Thousands of fake IT workers generate regime revenue and provide access, linked to incidents like the $62.5M Munchables protocol theft.

Infosecurity Magazine·Sep 7, 11:00 UTC · 9d agoThreat actor

11 Best CSPM Tools Compared (2026): Features & Pricing

CSPM comparison ranks Wiz first for agentless attack-path analysis; notes Ermetic absorbed into Tenable and Lacework into Fortinet FortiCNAPP.

An editorial comparison of eleven CSPM tools ranks Wiz as the agentless attack-path momentum leader, Prisma Cloud as the breadth benchmark, and Orca as the agentless SideScanning pioneer. It highlights consolidation: Ermetic now powers Tenable Cloud Security and Lacework became Fortinet's FortiCNAPP. The guide recommends starting with free tiers from Defender for Cloud, Prowler, and native cloud tools before buying.

GBHackers·Sep 15, 06:37 UTC · 1d agoIndustry1

Iran-linked APT Mirage Kitten Uses Fake Job Tests to Spread Malware

Kaspersky reports Iran-linked Mirage Kitten delivers new NodeRabbit and PollCat malware to fintech and aviation targets via fake LinkedIn coding assessments.

Kaspersky researchers documented two previously undocumented Node.js malware families, NodeRabbit and PollCat, attributed with high confidence to Iran-linked APT group Mirage Kitten. The malware is delivered via fake recruiter personas on LinkedIn offering coding assessments hosted on Amazon S3, with instructions banning AI assistants so AI code-review tools would not flag the trojanized npm packages. NodeRabbit is cross-platform (Windows, Linux, macOS), uses AES-256-GCM-encrypted C2 on Azure, includes sandbox checks, and one variant installs a fake 'GitHub Copilot Helper' VS Code extension plus Git hook persistence. Victims identified so far are in fintech and aviation organizations across Egypt, Ethiopia, and Afghanistan.

Security Affairs·Sep 2, 10:37 UTC · 14d agoThreat actor in the wild2

Horizon3 Announces Integration with CrowdStrike Falcon® Next-Gen SIEM

Horizon3 announces NodeZero integration pushing validated exposure findings into CrowdStrike Falcon Next-Gen SIEM for correlated investigations.

Horizon3 announced an integration enabling validated NodeZero findings to flow into CrowdStrike Falcon Next-Gen SIEM, available now in the CrowdStrike Marketplace. Security teams can ingest and correlate exposure data with endpoint, identity, cloud, and other telemetry during investigations. CrowdStrike claims Falcon Next-Gen SIEM delivers up to 150x faster search than legacy SIEMs at up to 80% lower total cost of ownership.

Horizon3.ai·Sep 15, 13:10 UTC · 1d agoTools

NCSC Urges Stronger Controls for Agentic AI Systems

UK's NCSC urges organizations to apply sandboxing, human oversight, and strict access controls when deploying autonomous AI agents.

The UK National Cyber Security Centre published guidance recommending stronger controls for autonomous agentic AI systems. Recommended measures include sandboxing, active human oversight, and tightly scoped access controls to limit unintended agent activity. The guidance aims to help organizations realize the benefits of agentic AI while managing its cyber risk.

Infosecurity Magazine·Aug 20, 12:45 UTC · 27d agoAI safety & security

How a Real Estate Company Turned a SQL Lockout Into Actionable Security Insight

A real estate company used Horizon3.ai's NodeZero to trace a SQL account lockout to a hidden privilege path and remediate it.

A Horizon3.ai customer story describes a large real estate company using NodeZero to investigate a SQL account lockout. The assessment traced the lockout to a deeper privilege path in the environment. The findings reportedly drove immediate remediation of the exposed privilege risk.

Horizon3.ai·Aug 25, 12:54 UTC · 22d agoTools

CISA promotes a fresh way to deter cyberattackers: Lie to them

CISA issued first-time guidance advising critical infrastructure operators to deploy honeypots, honeytokens, and decoys to detect and distract intruders.

CISA published 'Using Cyber Decoys to Strengthen Detection and Response,' a 22-page guide marking the agency's first guidance on decoys such as honeypots and honeytokens. Acting executive director Chris Butera described decoys as a low-cost, high-fidelity way to detect adversaries already inside networks, complementing zero-trust and assume-compromise approaches. The guidance covers decoy principles, definitions, deployment scenarios, and is aimed especially at resource-constrained critical infrastructure sectors.

CyberScoop·20:22 UTC · 1h agoAdvisory

Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

Kaspersky reports Mirage Kitten targeting aviation and fintech organizations across the Middle East and Africa with new NodeRabbit and PollCat backdoors.

Kaspersky researchers documented new Mirage Kitten operations against aviation and fintech organizations in the Middle East and Africa. The campaign uses two previously undocumented backdoors: NodeRabbit, written in Node.js, and PollCat, written in JavaScript. The findings expand the group's known toolset and TTPs.

Kaspersky Securelist·Sep 1, 07:00 UTC · 15d agoThreat actor in the wild1

GreyNoise + CrowdStrike: Real-Time Edge Intelligence in Falcon Next-Gen SIEM and Charlotte Agentic SOAR

GreyNoise expanded its CrowdStrike Falcon integration with Next-Gen SIEM dashboards, correlation rules, and Charlotte Agentic SOAR playbooks.

GreyNoise announced an expanded integration with the CrowdStrike Falcon platform, adding purpose-built content for Falcon Next-Gen SIEM and Charlotte Agentic SOAR. The integration includes a dedicated SIEM dashboard, correlation rules that detect allowed inbound traffic from malicious infrastructure, and SOAR playbooks that inject GreyNoise threat context into automated response workflows.

GreyNoise·Aug 31, 00:00 UTC · 16d agoTools

IT Help Desk Impersonation Lets Hackers Bypass MFA

Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.

Arctic Wolf documented a threat cluster tracked as PREY-0058 that impersonates internal IT help desk staff by phone, luring Directors, VPs, and executives to authentication-themed URLs formatted as victim-organization lure domains. Adversary-in-the-middle panels intercept credentials and MFA approvals, and stolen sessions are replayed through residential proxies such as NodeMaven from IPs matching the victim's geo-location and ASN, defeating impossible-travel alerts. Attackers perform discovery against SharePoint and Entra ID, then harvest data from OneDrive, Exchange, and Box before issuing extortion demands. Defenders are advised to require managed devices, use phishing-resistant MFA like FIDO2, enable Continuous Access Evaluation, and monitor sign-ins, SharePoint SearchQueryPerformed, and MailItemsAccessed events.

Security Affairs·Sep 8, 07:41 UTC · 8d agoPhishing & fraud in the wild1