Search: “OPPO”

Iranian Hackers Use Fake MRI Results to Infect Victims With CHOSEN BRICK Spyware

Iranian state-linked hackers deliver CHOSEN BRICK Windows spyware via fake MRI results to surveil dissidents, activists, and journalists in the UK, US, and Netherlands.

A joint advisory from the UK NCSC, FBI, and the Netherlands' AIVD links Iranian state-linked actors to CHOSEN BRICK, a Windows spyware family used for long-term surveillance since at least 2025. Targets are approached on WhatsApp or Telegram with tailored lures such as fake MRI scan results or application files, and operators often redirect victims to personal devices to bypass corporate controls. The malware persists via Run registry keys, adds antivirus exclusions, uses a per-victim Telegram bot for command and control, and exfiltrates data through cloud storage and proxy services. Capabilities include screenshots, audio recording, email and messaging theft, command execution, file deletion, data wiping, and some victims' details have appeared on pro-Iranian leak sites for harassment.

Cyber Security News·updated 12:00 UTC · 8h ago·first 08:31 UTC · 11h agoThreat actor in the wild 5 sources

A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices

Researchers showed malicious SIM cards can issue RUN AT commands to execute code on Qualcomm modems, compromising Quectel-based cellular IoT devices like EV chargers.

Researchers at the University of Birmingham and Fuzzware found 9 of 26 tested devices accept SIM proactive commands, including six Qualcomm-based cellular modules, five of them Quectel. They achieved code execution on a commercial Autel EV charger via the Quectel EC25's atfwd_daemon unsafe format string, and demonstrated an irreversible 2G downgrade, modem power-off, and arbitrary file reads via a root TFTP daemon on a Quectel EG25-G. Attacks require a hostile SIM already in the slot or an interposer; no attacks have been reported in the wild. Qualcomm has built a hardened configuration disabling the interface by default and Quectel mitigated the file-access flaw; the paper was presented at USENIX WOOT.

The Hacker News·Aug 11, 12:12 UTC · Aug 11, 2026VulnerabilityCVE-2025-48618

Fine-tuning a 350M Model for Better Structured Outputs in 100 GRPO Steps

Hugging Face guide fine-tunes a 350M-parameter model with 100 GRPO steps to improve structured output reliability.

A Hugging Face blog post demonstrates fine-tuning a 350M-parameter model using GRPO (Group Relative Policy Optimization) with TRL over 100 training steps. The stated goal is more reliable structured outputs from small language models. No article body was available, so details beyond the title are limited.

Hugging Face Blog·Sep 3, 00:00 UTC · 13d agoAI tools & infra

Malicious SIMs can hijack smartphones, steal files, and lock them onto 2G

Help Net Security·Aug 11, 00:00 UTC · Aug 11, 2026VulnerabilityCVE-2025-48618

Pegasus Zero-Click Exploit Infects Serbian Student Activist's iPhone

Citizen Lab and SHARE Foundation confirm a Serbian student activist's iPhone was infected with NSO Group Pegasus via a zero-click iMessage exploit.

Forensic analysis found high-confidence infection indicators on the activist's iPhone during December 2025 and January 2026, using an iMessage zero-click exploit the Citizen Lab believes was patched as of iOS 18.4.1, released April 2025. The target was among at least 14 Apple Threat Notification recipients in Serbia's student movement, civil society, and opposition politics documented by the SHARE Foundation. Targeting occurred ahead of key 2026 election cycles; Amnesty Tech also confirmed a new NoviSpy version on another student movement member's device.

Infosecurity Magazine·Sep 3, 15:25 UTC · 13d agoThreat actor in the wild

Pegasus and NoviSpy Used Against Serbian Protesters

Citizen Lab confirmed zero-click Pegasus infected a Serbian student activist's iPhone, part of the largest documented Serbian spyware wave targeting at least 14 people.

The Citizen Lab, with the SHARE Foundation, confirmed a Serbian student protest movement member's iPhone was infected with NSO Group's Pegasus via an iMessage zero-click exploit between December 2025 and January 2026; Apple patched the exploit in iOS 18.4.1. SHARE Foundation has documented at least 14 targeted individuals since early 2026, including student activists, civil society figures, an opposition MP and a local councilor, coinciding with the March 2026 local elections. SHARE and Amnesty Tech also found a new NoviSpy variant on a student activist's Android phone after Serbian authorities seized it during police questioning.

Security Affairs·Sep 3, 20:17 UTC · 13d agoThreat actor in the wild

Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone

Citizen Lab confirms Pegasus zero-click iMessage spyware infected a Serbian student activist's iPhone amid at least 14 spyware targets in Serbia during 2026.

The Citizen Lab, with the SHARE Foundation, confirmed an iMessage zero-click exploit infected a Serbian student protest movement member's iPhone with NSO Group's Pegasus spyware, with high-confidence indicators from December 2025 to January 2026. The exploit was addressed by Apple in iOS 18.4.1, released April 2025. At least 14 people in Serbia, including students, activists, an MP, and a councilor, were targeted with advanced spyware since the start of 2026, coinciding with March 29, 2026 local elections; a new Android spyware similar to NoviSpy was also found on a confiscated device.

The Hacker News·Sep 3, 08:43 UTC · 13d agoThreat actor in the wild

A Georgia Cop Used Flock to Track 2 Other Cops: His Ex and Her Friend

A Georgia police officer used Flock license plate reader cameras to surveil his ex-partner and another officer after their affair ended.

Internal investigation records show a Georgia officer used the Flock license plate reader network to track the movements of a fellow police officer with whom he had an affair, along with a man whose vehicle frequently appeared near hers. The unauthorized personal use of police surveillance infrastructure surfaced through an internal affairs review. The case highlights oversight gaps around law enforcement access to mass surveillance data.

WIRED · Security·Aug 27, 18:12 UTC · 20d agoPolicy & legal

Async GRPO with LoRA across HF Jobs: a bucket, a proxy, and no NCCL

Hugging Face blog describes running async GRPO reinforcement learning with LoRA across HF Jobs using a storage bucket and proxy instead of NCCL.

A Hugging Face blog post titled 'Async GRPO with LoRA across HF Jobs: a bucket, a proxy, and no NCCL' explains an asynchronous Group Relative Policy Optimization training setup using LoRA adapters distributed across Hugging Face Jobs workers. The architecture coordinates training through an object storage bucket and a proxy server, removing the need for NCCL collective communication. No full article text was available at classification time.

Hugging Face Blog·Sep 10, 00:00 UTC · 6d agoAI tools & infra

Canadian Start-up smartARM Uses AI to Create Intuitive Bionic Prosthetics

Toronto startup smartARM built a bionic prosthetic arm using Meta's DINOv2 vision model and AI glasses to automatically select grips for objects.

Toronto-based smartARM developed a vision-first bionic arm that uses a palm-embedded camera and Meta's open-source DINOv2 model to recognize objects from a few reference photos and automatically select suitable grips. It integrates Meta AI Glasses and the Meta Wearables Device Access Toolkit for additional egocentric context, letting users add new objects via a phone app. The arm adapts to new objects almost instantly instead of the weeks previously required, and is used by former NFL player Shaquem Griffin.

Meta Newsroom·updated 16:39 UTC · 3h ago·first 16:00 UTC · 4h agoAI industry 2 sources

Cyber Op Targets South Korean Media & Automotive Sectors

Likely North Korean APT compromised load balancers at South Korean media and automotive firms using a previously undocumented Linux espionage toolkit.

A cyber operation attributed to a likely North Korean APT group targeted South Korean media and automotive sectors. The attackers deployed a previously undocumented Linux espionage toolkit to compromise load balancers, gaining access to communications and enabling further network exploitation. Specific victims, toolkit names, and indicators of compromise were not disclosed in the report summary.

Dark Reading·01:00 UTC · 19h agoThreat actor in the wild

Android car head units infected with proxy botnet malware through built-in software updaters

Kaspersky found malware delivered via car head unit updaters, attributed to the MoYu Group's BADBOX operation, recruiting devices into a proxy botnet.

Kaspersky discovered malware delivered through the built-in TWCore system updater in Android-based car head units running DoFun infotainment firmware, turning devices into ad-fraud tools and nodes in a proxy botnet. The three-stage infection chain (JarService dropper, loader, and final payload supporting nine commands) installs the zhima reverse-proxy module, which Nokia's Deepfield team independently found on TV set-top boxes. Kaspersky attributes the operation with high confidence to the MoYu Group, linked to the BADBOX supply-chain botnet first identified by HUMAN Security in 2023. DoFun closed the gap after Kaspersky's responsible disclosure.

Help Net Security·Aug 24, 00:00 UTC · 23d agoMalware in the wild

OpenAI buys smartphone camera maker Glass Imaging for $300 million, report says

OpenAI acquired smartphone camera startup Glass Imaging for over $300 million, deepening rumored hardware ambitions after its $6.5 billion io deal.

OpenAI bought Glass Imaging, a Los Altos startup founded in 2019 by former Apple engineers Ziv Attar and Tom Bishop who led Apple's Portrait Mode team, per a Wall Street Journal report. Glass Imaging had raised about $30 million and uses neural networks that learn individual camera systems to improve image quality at capture time. The acquisition fuels speculation about OpenAI hardware plans including smartphones, earbuds, and AI companion devices, following its $6.5 billion purchase of Jony Ive's io startup in 2025.

TechCrunch · AI·Sep 14, 20:44 UTC · 1d agoAI industry

Iranian cyber targeting of dissidents, activists and journalists

UK NCSC, FBI, and Dutch AIVD expose CHOSEN BRICK spyware used by Iranian state actors against dissidents, activists, and journalists worldwide.

A joint advisory from the UK NCSC, FBI, and Dutch AIVD details CHOSEN BRICK, a Windows spyware family used by Iranian state cyber actors since at least 2025 against dissidents, activists, and journalists in the UK, US, and Netherlands. Actors build rapport on WhatsApp and Telegram impersonating known contacts or platform support, then deliver disguised payloads resembling apps such as Telegram, Norton, RunwayML, or fake MRI results. The malware persists via HKCU Run registry keys, adds Microsoft Defender exclusions, and uses a unique Telegram bot C2 per victim. Capabilities include screen capture, microphone recording, process enumeration, email and messaging data theft, file deletion, and system wiping; victim data has appeared on pro-Iranian leak sites.

NCSC UK·Sep 15, 12:00 UTC · 1d agoThreat actor in the wild2

Product showcase: Is this image real? Slop or Not investigates

Slop or Not is an offline iPhone/Mac app using on-device Apple Neural Engine models to detect AI-generated images, text and SynthID watermarks.

Slop or Not is an AI text and image detector for iPhone and Mac that runs entirely offline via the Apple Neural Engine, with no account required. It returns AI-probability scores and checks for Google's invisible SynthID watermark to verify AI-origin images on-device. The hands-on review found strong detection of obvious AI images, a borderline 50.4% AI call on a realistic one, and correct identification of real photos, citing survey data that 85% of people struggle to distinguish AI-generated content.

Help Net Security·Aug 13, 00:00 UTC · Aug 13, 2026AI tools & infra

Automobile Camouflage to Hide from Flock Cameras

Schneier on Security highlights a printed vehicle-camouflage pattern tested to defeat Flock surveillance cameras and Axon body cameras.

The post discusses covering cars with printed patterns designed to fool Flock automated license-plate recognition software, with testing reportedly done against Flock and Axon body cameras. Reader comments question effectiveness against other ALPR vendors, Flock's RF MAC-address upgrade, and whether such camouflage might become regulated. The page also contains off-topic comment threads about anti-bot over-blocking and privacy.

Schneier on Security·Sep 7, 11:06 UTC · 9d agoResearch

Fashion app Daydream uses Apple Intelligence to help you shop the outfits in your camera roll

Fashion app Daydream uses iOS 27 Apple Intelligence APIs to turn saved outfit photos into shoppable matches and enable Siri voice search.

Daydream launched photo-based outfit shopping and Siri natural-language search built on Apple's iOS 27 developer tools, matching images against roughly 3 million products from 325+ retailers and 10,000 brands. The app claims over 1.5 million shoppers and frames the features as steps toward a cross-surface shopping agent. Competitors include Google, Amazon, Onton, and Alta.

TechCrunch · AI·Sep 14, 17:00 UTC · 2d agoAI industry

AgenticGen: Reward-Guided Agentic Video Generation for Advertising

AgenticGen applies DPO and GRPO reward-guided reasoning to ad video generation, improving TikTok CTR 2.72%, CVR 2.63%, and Advv 9.61%.

AgenticGen decomposes advertising video generation into two trainable reasoning stages, strategy selection and draft generation, supervised by online business feedback. It learns a performance-based reward from accumulated online feedback plus a rubric-based reward aligned with human quality standards, then optimizes policies with DPO followed by GRPO using process and outcome rewards. Online A/B experiments in the TikTok advertising system show CTR up 2.72%, CVR up 2.63%, and Advv up 9.61% over an SFT baseline.

Hugging Face daily papers·Aug 30, 20:00 UTC · 17d agoAI research

Fake OpenAI Codex download tricks macOS users into installing malware

Cato Networks uncovered a malware campaign using sponsored search ads and fake OpenAI Codex pages to deliver an AMOS-like infostealer to macOS users.

Cato Networks researchers discovered a campaign using sponsored search results and a fake OpenAI Codex download portal on Google Sites to lure macOS users. Victims are instructed to paste a Terminal command that decodes a Base64-encoded URL and runs a multi-stage infection chain ending in a universal Mach-O binary. The delivery chain closely resembles Atomic macOS Stealer (AMOS), and related infrastructure impersonating Claude Code was also found. Operators use iframe-based hosting and path/device gating to evade analysts and automated scanners.

Help Net Security·Aug 25, 00:00 UTC · 22d agoMalware in the wild

The invisible passenger in your car

Kaspersky discovered Android adware and proxy-botnet malware delivered inside legitimate DoFun car head-unit software.

Kaspersky researchers uncovered Android malware distributed through legitimate software for DoFun automotive head units. The malware displays ads on infotainment screens and enrolls infected devices into a proxy botnet for resale of residential-style proxy traffic. Delivery via trusted vendor software means victims receive it through a legitimate update channel, raising infection likelihood.

Kaspersky Securelist·Aug 21, 08:00 UTC · 26d agoMalware in the wild

Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’

UK, US, and Dutch agencies expose CHOSEN BRICK spyware used by Iranian MOIS hackers to surveil dissidents, journalists, and activists via fake MRI lures.

The UK NCSC, FBI, and Dutch AIVD jointly warned that Iranian state-sponsored hackers deploy CHOSEN BRICK Windows spyware against dissidents, activists, and journalists since at least 2025. Operators build rapport over WhatsApp and Telegram, often posing as known contacts or tech support, then deliver malicious files disguised as an MRI scan or installers for Pictory, RunwayML, Norton, Telegram, Adobe Flash Player, and KeePass. The malware steals contacts, emails, and social media messages, captures screen content and microphone audio, adds Microsoft Defender exclusions, and uses per-victim Telegram bots for command and control. The FBI attributes the tradecraft to Iran's Ministry of Intelligence and Security, including the 'Handala Hack' persona, and stolen data has surfaced on pro-Iranian leak sites.

The Record·Sep 15, 16:28 UTC · 1d agoThreat actor in the wild1

‘DO NOT MENTION ALPR USAGE’: How Cops Are Trying to Hide Their Use of Flock

404 Media·Aug 4, 14:28 UTC · Aug 4, 2026Industry

Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories

Gen Digital found infostealers like Amatera and Remus stealing AI coding agent tokens, prompt histories, and MCP configs from infected Windows and macOS machines.

Gen Digital analysts observed Amatera and Remus detections among tens of thousands of protected Windows users over three months, with Amatera targeting Cline and Continue data and Remus targeting Claude, Cursor, and OpenCode. CallbackBeaver added Cursor and Claude to its collection scope with more than 5,000 samples in 30 days, while macOS-focused Djinn Stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo. The stealers harvest access and refresh tokens, prompt histories, and MCP configuration files that can expose source control, ticketing, databases, cloud resources, and sensitive project context for follow-on fraud. Many stealers add targets via remotely managed rules, meaning this is an adaptation of existing infostealers rather than a new vulnerability in the AI tools themselves.

Cyber Security News·Sep 9, 11:41 UTC · 7d agoMalware in the wild2

Malware Hijacks Android Car Head Units

Kaspersky reports first known malware infecting Android car head units via firmware updaters, repurposing vehicles as BADBOX proxy nodes for ad fraud.

Kaspersky documented the first known malware infection of Android-based car head units, delivered through the built-in TWCore firmware updater on DoFun devices via an MQTT-driven installation flag. A multi-stage chain installs the JarService dropper and a loader that pulls a clicker and reverse proxy module ('zhima') used for ad fraud and proxy botnet infrastructure. The malware supports nine commands, including clipboard changes, HTTP requests, and JavaScript loading, checking in with C2 every 90 minutes. Kaspersky attributes the campaign with high confidence to MoYu Group, linked to the BADBOX botnet.

Security Affairs·Aug 22, 09:04 UTC · 25d agoMalware in the wild

Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS

New Panzer ransomware-as-a-service operation lists Italian firms Doimo Cucine and NTE Italia as victims, offering encryptors for Windows, Linux, FreeBSD, and ESXi.

Panzer, a ransomware-as-a-service operation that surfaced August 5, listed a kitchen manufacturer in Treviso (Doimo Cucine) and a telecommunications engineering firm in Catanzaro (NTE Italia) among alleged victims, claiming 30 GB and 16 GB of stolen data respectively. The group advertises encryptors for Windows, Linux, FreeBSD, and VMware ESXi, a Tox-based affiliate recruitment process with screening, an affiliate dashboard, and an 80/20 revenue split. Neither victim had publicly confirmed the incidents when researcher Andrea Fortuna's report was published, and the group's first access method and payload have not been independently analyzed. Panzer posted victims across 11 countries as claimed Italian ransomware incidents reached 212 by September 6, already above 2025's full-year total of 169.

Cyber Security News·Sep 8, 09:10 UTC · 8d agoRansomware in the wild

ThinkPrior: Zero-Rollout Difficulty Priors for Cold-Start Prompt Selection in RLVR

ThinkPrior builds zero-rollout difficulty priors via an offline verifier-anchored pass, halving silent groups in RLVR and cutting wasted rollouts on Qwen2.5-Math-7B.

In GRPO-based RLVR, groups where all rollouts are correct or all are wrong yield zero advantages and consume about 39% of a run's rollouts under uniform sampling. ThinkPrior initializes a Beta posterior from an external anchor pass's verifier-scored pass rate, selecting prompts by expected learnability before any target-policy rollout, without changing the loss or optimizer. On Qwen2.5-Math-7B across sixteen seeds it more than halves early silent groups and cuts wasted rollouts through step 30 by nearly a fifth, with no detected final-accuracy difference. The ThinkPrior+DAPO composition reduces generated rollouts by 10.6% at an equal 3,840-rollout update budget.

arXiv cs.AI / cs.LG / cs.CL·Sep 8, 17:30 UTC · 8d agoAI research1

Nscale adds former OpenAI exec Fidji Simo to its board ahead of potential IPO

AI data center startup Nscale appointed former OpenAI executive Fidji Simo to its board ahead of a planned fall IPO and reported $3.5 billion raise.

Nscale, a UK-based AI data center startup founded two years ago, appointed Fidji Simo to its board. Simo was formerly CEO of AGI Deployment at OpenAI (the lab's No. 2 executive), and previously served as Instacart CEO through its 2023 IPO and as head of the Facebook app at Meta. She joins Sheryl Sandberg, Susan Decker, and Nick Clegg on the board as the company prepares for an anticipated IPO this fall. Nscale is reportedly attempting to raise up to $3.5 billion ahead of the IPO, according to Bloomberg.

TechCrunch · AI·Sep 11, 16:46 UTC · 5d agoAI industry

Iranian spies hit Windows machines with Chosen Brick data-stealing malware

FBI, UK NCSC, and Dutch AIVD warn Iranian intelligence uses Chosen Brick spyware against dissidents, stealing contacts, emails, and messaging data.

A joint advisory from the FBI, UK NCSC, and Dutch AIVD says Iranian state cyber actors have used the Chosen Brick Windows malware since at least 2025 to surveil dissidents, activists, and journalists. Attacks begin with heavily researched WhatsApp and Telegram messages impersonating trusted contacts, tricking victims into opening fake installers resembling Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass. The malware persists via the HKCU Run registry key, adds Microsoft Defender exclusions, uses victim-specific Telegram bots for C2, captures screen and audio, steals emails and Telegram/WhatsApp data, and can wipe systems.

The Register · Security·Sep 15, 18:01 UTC · 1d agoThreat actor in the wild1

SlipSense: Multimodal Tactile Learning for Low-Latency and Generalized Slip Detection

SlipSense fuses a 32x32 piezoresistive array and MEMS accelerometer to detect robotic grip slips within 23.1 ms, generalizing zero-shot across platforms.

SlipSense is a multimodal tactile slip-detection framework built on TacV5, a sensor combining a 32x32 piezoresistive array at 240 Hz and a 3-axis MEMS accelerometer at 8 kHz. It performs modality-specific encoding, intra-sensor fusion, and cross-modal attention with causal temporal prediction at 240 Hz. On a 1.4-million-frame dataset spanning 37 objects it achieves 96.7% Macro F1 with a false-positive rate below 1.6%, detecting 76% of slip events within 23.1 ms. Trained solely on UMI data, it transfers zero-shot to a Tesollo dexterous hand across unseen objects, sensor units, and platforms.

arXiv cs.AI / cs.LG / cs.CL·Sep 14, 17:23 UTC · 2d agoAI research

ICE Wants to Know Everyone Who Bought a Certain Green Beanie From REI in the Last 2 Years

DHS subpoenaed REI for all Minneapolis-area customers who bought a specific green beanie since 2024, part of an investigation into 39 ICE protest defendants.

Court filings allege Homeland Security Investigations agents subpoenaed REI in March for transaction records of all persons in the greater Minneapolis–St. Paul area who purchased a specific dark green beanie since 2024. The subpoena was one of 92 sent in a federal case against 39 people, including journalists, who attended an ICE protest at a church. Companies responded differently: T-Mobile handed over six months of a defendant's call and text logs, Google refused a request for YouTube viewers, Reddit withdrew after a First Amendment objection, and Meta pushed back on at least one summons. The 1509 customs summonses require no judicial oversight, and the total number issued under the Trump administration is unknown.

WIRED · Security·Sep 4, 10:30 UTC · 12d agoPolicy & legal