Search: “PrivacyLens”

LLMs and Contextual Integrity

Bruce Schneier highlights two papers: the CIMemories benchmark shows frontier LLMs leak memory attributes up to 69%, and an RL method reduces inappropriate disclosures.

Bruce Schneier discusses contextual integrity in LLMs, referencing the CIMemories benchmark, which uses synthetic profiles with 100+ attributes per user to test whether models with persistent memory disclose sensitive information appropriately. Evaluation showed frontier models exhibit up to 69% attribute-level violations, with GPT-5's violation rate rising from 0.1% to 9.6% across 40 tasks and reaching 25.1% with repeated prompting, showing unstable leakage behavior. A second paper introduces a reinforcement learning framework trained on a synthetic 700-example dataset that substantially reduces inappropriate disclosure while maintaining task performance, with improvements transferring to the human-annotated PrivacyLens benchmark.

Schneier on Security·Aug 18, 10:40 UTC · 29d agoAI safety & security

PrivAudit: A Dual-Lens Auditing Framework for Website Privacy Practices under the CCPA

PrivAudit framework audits 998 websites for CCPA compliance, finding stronger disclosures but pervasive, weakly responsive third-party cookie tracking.

PrivAudit is an automated dual-lens auditing framework combining LLM-based analysis of privacy policies grounded in CCPA provisions with automated browser measurements of cookie writes under diverse privacy configurations. Applied to 998 websites, it finds CCPA-subject sites disclose opt-outs, data sharing, and user rights more frequently, yet tracking remains pervasive: 6,392 targeting cookies, 49% third-party writes. Cookies show limited-to-moderate responsiveness to privacy signals and consent choices even when sites claim to honor them. The framework is open-sourced and shared with regulators.

arXiv cs.CR·Sep 9, 04:31 UTC · 7d agoResearch

Understanding the Privacy-Preserving Potential of HTTP/2 Against Webpage Fingerprinting

Researchers show HTTP/2 features can emulate website fingerprinting defenses like FRONT and Tamaraw with tunable privacy-overhead trade-offs.

An arXiv paper demonstrates that application-layer defenses such as HTTPOS, LLaMA, FRONT, ALPaCA, and Tamaraw can be emulated through HTTP/2 features at both the client and server side, including proactive resource suggestion, multiplexing, and flow control. The authors propose a unified evaluation blueprint that calibrates defense parameters per dataset, combines practical attacks with information-theoretic leakage estimators, and measures overheads to map each defense's privacy-overhead trade-offs.

arXiv cs.CR·Sep 4, 13:16 UTC · 12d agoResearch

19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto

Socket found 19 malicious Chrome and Edge extensions, active since February 2024, stealing wallet seed phrases and credentials and draining crypto from about 80,000 users.

Socket researcher Karlo Zanki documented a cluster of 18 Chrome and one Edge extensions with wallet secret stealing and cryptocurrency draining capabilities, tracked as campaign Superior and possibly active since February 2024. The actor created 14 extensions and bought five legitimate ones, later pushing malicious updates; the largest, Enable Right Click & Copy, has roughly 80,000 installs across both browsers. The extensions maintain WebSocket C2 connections with endpoint rotation, strip CSP headers, and load 16 modules including multi-chain wallet drainers, hardware-wallet seed-phrase harvesters, credential grabbers, and ClickFix-style lures.

The Hacker News·Aug 28, 15:27 UTC · 19d agoMalware in the wild

Scareware ads keep running on Google's transparency tool, even after they're reported

NYU and Radboud researchers built AdLens, which found 238 scareware and 3,346 false-claim ads in Google's ad archive; reported ads often stayed live.

The AdLens tool, built by NYU and Radboud University researchers, mined Google's Ads Transparency Center and screened 188,000 software ad creatives using similarity search plus a panel of open-source language models, finding 238 scareware ads, 3,346 false-claim ads, and 258 anonymity-avoiding ads with over 100 million impressions in Europe. Reporting ads through Google's standard flow produced inconsistent removals: some ads acknowledged as violations stayed live, and after one takedown tied to the TamperedChef malware domain, 41 other ads pointing to the same domain kept running. The pipeline runs entirely on open-weight models at low cost (a $96 DigitalOcean VM plus $1.57/hour L40S inference) and is designed to extend to Meta and Amazon ad libraries.

Help Net Security·Sep 2, 00:00 UTC · 14d agoResearch

PIA-Bench: Towards Automated Privacy Impact Assessment with Large Language Models

Researchers release PIA-Bench, the first open benchmark evaluating how accurately LLMs can automate privacy impact assessments using 73 curated federal PIAs.

PIA-Bench is the first open benchmark for evaluating large language models on real-world privacy impact assessments (PIAs). The authors audited 499 expert-authored PIAs published by US federal agencies and curated 73 structured PIAs comprising 451 privacy risk items and 831 mitigation items. Off-the-shelf LLMs were found to produce meaningful assessments while identifying clear avenues for improvement. The paper calls for domain-specific LLM agent workflows, accountable LLM infrastructure, and new quality standards for PIAs.

arXiv cs.CR·Sep 11, 08:16 UTC · 5d agoResearch1

Some Claude Chats Are Searchable on Google

Schneier on Security·Aug 4, 10:13 UTC · Aug 4, 2026Data breach2

IT help-desk vishing tricks executives into handing over Microsoft 365 access

Arctic Wolf tracks PREY-0058 (linked to UNC6671), a vishing campaign stealing Microsoft 365 session tokens via AiTM panels for SaaS data theft and extortion.

Arctic Wolf is tracking a campaign, PREY-0058, sharing tradecraft with Google Threat Intelligence Group's UNC6671, in which callers posing as internal IT talk employees through fake passkey/MFA setups. Operator-controlled adversary-in-the-middle pages harvest passwords and MFA approvals to seize session tokens, then actors enumerate and bulk-exfiltrate data from SharePoint, OneDrive, Exchange, and Box. Extortion brands include BlackFile, Pink, Helix, Cinder, and Redact; targets are mostly US-based executives in construction, healthcare, real estate, finance, and professional services, with exfiltration shifting to residential proxies like NodeMaven.

Help Net Security·Sep 8, 11:17 UTC · 8d agoThreat actor in the wild1

Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities

Attackers exploit newly disclosed PaperCut auth bypass CVE-2026-81578 and RCE CVE-2026-82078 to steal credentials from schools and universities in the US and Europe.

Arctic Wolf observed threat actors chaining CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution) in PaperCut to execute commands, perform reconnaissance, and create privileged accounts on servers at K-12 schools and universities in the US and Europe. Post-exploitation includes registry hive collection with lsa_collect.exe delivered via certutil, Meterpreter Java payloads from 194.180.48.134, and searches of PaperCut config files for passwords, LDAP bindings, and tokens. Stolen logins could provide a pathway into other critical systems across compromised environments.

The Hacker News·Sep 5, 07:31 UTC · 11d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-820781

40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets

Socket found 40 malicious Firefox extensions impersonating OKX, Rabby Wallet, and TronLink to steal cryptocurrency wallet recovery phrases and private keys.

The Socket Threat Research team identified 40 malicious Firefox extensions masquerading as Web3 products including OKX, Rabby Wallet, and TronLink, part of a broader set of 77 add-ons sharing source code and infrastructure overlaps. The campaign, dubbed Offside Wallet Theft Factory, has been active since March 2026 and remains unattributed. Of the 40 confirmed malicious extensions, 15 capture recovery phrases and private keys exfiltrated through Cloudflare Workers, 13 modified Rabby Wallet builds exfiltrate serialized keyrings before local encryption, seven use attacker-controlled Supabase projects as remote switches, and five capture credentials and clipboard data via hard-coded C2. Some extensions began as sports score or utility shells before being repurposed into wallet stealers under the same Firefox ID.

The Hacker News·Aug 20, 08:42 UTC · 27d agoMalware in the wild

Rare Not Random Using Token Efficiency for Secrets Scanning

Researcher proposes token efficiency (string length divided by BPE token count) as a better post-regex filter than entropy for secrets scanning, validated on CredData.

The post explores whether Byte-Pair Encoding tokenization can replace Shannon entropy as the primary filter for candidate secrets captured by regex in tools like Gitleaks. It defines 'token efficiency' as string length divided by token count under the cl100k_base tokenizer; secret-like strings such as GitHub tokens tokenize into many small tokens and score low, while natural text scores high. Evaluating labeled secrets from the CredData dataset shows a usable separation, with roughly 2.5 suggested as a minimum cutoff versus Gitleaks' 3.5 entropy threshold. The technique is positioned as a post-regex filtering step rather than a standalone detector.

Lobsters · security·Sep 12, 06:42 UTC · 4d agoResearch

ClickFix Campaigns Abuse Legitimate Services for Persistent Access

Dark Reading reports two ClickFix social engineering campaigns abusing legitimate services to compromise organizations and maintain persistent access.

Dark Reading describes two separate attacks in which threat actors used the ClickFix social engineering tactic to compromise organizations. The campaigns abuse legitimate, trusted services to gain and maintain persistent access to victim environments. No specific victims, actors, or indicators were named in the available text.

Dark Reading·Sep 8, 17:25 UTC · 7d agoThreat actor in the wild

Private Information Retrieval With Arbitrary Privacy Requirements: Introduction and Capacity Results

Researchers formulate private information retrieval under arbitrary graph-based privacy requirements, deriving capacity bounds and introducing pyramid storage graphs.

The paper generalizes classical private information retrieval (PIR) to arbitrary privacy requirements over graph-based storage systems, where each message is retrieved privately from a pre-specified server subset. The authors derive lower and upper capacity bounds for general graphs and exact capacity results for path and cyclic storage graphs. They also introduce a new pyramid storage graph structure that models symmetric message storage and replication patterns.

arXiv cs.CR·Sep 14, 17:03 UTC · 1d agoResearch

Differential Privacy Meets Fixed Parameter Tractability: Algorithms and Lower Bounds

Theory paper combines differential privacy with fixed-parameter tractable encoders, improving approximation guarantees for combinatorial optimization and proving new lower bounds.

The paper studies combinatorial optimization under epsilon-differential privacy within the implicit encoder-decoder framework of Gupta et al. (SODA 2010), generalizing it to allow fixed-parameter tractable encoders. This circumvents approximation barriers inherent to polynomial-time algorithms and yields improved guarantees for fundamental combinatorial optimization problems. The authors establish the first representation-independent lower bounds: assuming a non-uniform variant of the Gap Exponential Time Hypothesis, no epsilon-DP encoder-decoder pair can achieve certain approximation guarantees with a subexponential-time decoder for sufficiently small epsilon. Representation-dependent lower bounds are also provided for larger epsilon.

arXiv cs.CR·Sep 11, 07:13 UTC · 5d agoResearch

StopAndProtect Turns 2,000 Hacked WordPress Sites Into a Criminal Network

Check Point uncovered StopAndProtect, a cybercrime operation using ~2,000 hacked WordPress sites for ClickFix-driven malware delivery, data theft, surveillance, and ransomware.

Check Point Research identified the StopAndProtect operation in May 2026; it abuses close to 2,000 compromised WordPress sites, many running outdated software, to host malware stages, act as C2, and store stolen data. Infection starts with fake CAPTCHA ClickFix prompts that trick visitors into running a PowerShell command, followed by .NET downloaders deploying ransomware, SMB/USB worm, lockscreen, chat, and credential-stealing components. Rather than always encrypting, operators selectively exfiltrate file lists and specific files; researchers found 700+ stolen-data archives, roughly 31,000 screenshots, and 6,000+ unique victim IP addresses, including WhatsApp activity monitoring.

Security Affairs·Aug 20, 07:20 UTC · 27d agoThreat actor in the wild

Who’s Tracking You? Use This New Service to Find Out

KrebsOnSecurity covers DecryptAds, a free service that scrapes and correlates adtech data to reveal which entities track users across sites and apps.

KrebsOnSecurity wrote about DecryptAds, a free service that scrapes and correlates adtech data. The service makes it simple to identify which entities are responsible for ads shown on websites and data harvested by mobile apps, information that is semi-public but traditionally walled away inside large advertising platforms. No security incident is involved; the piece is an introduction to a privacy-research tool.

Krebs on Security·Aug 14, 11:24 UTC · Aug 14, 2026Tools

Levi Strauss says hackers breached employee computers, accessed corporate data

The Record·Aug 7, 13:37 UTC · Aug 7, 2026Data breach

PaperCut Flaws Exploited in Attacks on U.S. and European Schools

Attackers are chaining recently disclosed PaperCut flaws CVE-2026-81578 and CVE-2026-82078 to steal credentials and create privileged accounts at US and European schools.

Arctic Wolf researchers observed threat actors exploiting PaperCut servers via CVE-2026-81578 and CVE-2026-82078, chaining an authentication bypass with remote code execution. Post-exploitation included creating a privileged account named Administrator17, downloading credential-harvesting tools with certutil, Meterpreter Java payloads, and registry hive collection to recover the Windows BootKey and reach the SAM database. PaperCut disclosed active exploitation on August 27, 2026, and CISA added both flaws to its Known Exploited Vulnerabilities catalog on August 31. PaperCut has a history of exploitation, including attacks that delivered LockBit ransomware.

Security Affairs·Sep 5, 18:49 UTC · 10d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-82078

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

SOCRadar disclosed PEEP, a post-exploitation Chromium extension toolkit that turns Chrome and Edge into host-level backdoors via native messaging and C2 polling.

SOCRadar researchers detailed PEEP, a Chromium-based post-exploitation toolkit masquerading as a 'Smart Bookmarks' extension injected directly into Chrome and Edge profiles by forging Secure Preferences integrity values, bypassing Web Store checks. A native-messaging host binary (nm_host.exe) extends the browser agent to host-level command execution, file management, credential theft, and session hijacking, while the extension polls C2 endpoints at 206.237.30.232 or xfjcc.fun every 30 seconds over plaintext HTTP and exfiltrates browsing history, cookies, and tab metadata. PEEP is derived from the open-source RedExt red teaming framework, adds PowerShell persistence scripts, and includes a Linux-targeting Python script, suggesting cross-platform intent. The activity is unattributed but contains Chinese-language artifacts; a C2 /health endpoint showed 34 agent entries and 10 active sessions.

The Hacker News·Sep 7, 18:12 UTC · 8d agoMalware in the wild1

Predicting Privacy Leakage from Weight Spectral Density

Study shows WeightWatcher spectral metrics like stable rank correlate with membership inference vulnerability, enabling cheaper ML privacy auditing.

The paper tests whether spectral metrics from the heavy-tailed self-regularisation framework can proxy membership inference attack (MIA) vulnerability without training expensive shadow models. On image and tabular classification tasks, stable rank correlates positively with overall MIA success, while Log alpha-Norm correlates negatively at the low false-positive regime. These correlations are stronger than those obtained from the generalisation gap, suggesting weight spectra capture leakage information overfitting measures miss. The authors propose spectral analysis as a scalable direction for privacy auditing.

arXiv cs.CR·Sep 10, 16:34 UTC · 5d agoResearch

Once popular for attacking AI, ASCII smuggling is embraced by spammers

Spammers adopt ASCII smuggling—invisible Unicode tag characters—to evade email filters, with Microsoft Defender detections spiking to 2.5 million per day.

ASCII smuggling hides text in Unicode tag characters (e.g., U+E0041 for "A") that are invisible to humans but readable by LLMs and text processors. The technique gained attention as a stealthy prompt-injection vector and is now used by spammers to obfuscate keywords from email detectors. Microsoft reported Defender for Office smuggling detections jumped from roughly 21,000 per day to over 1.3 million in early February, reaching 2.5 million within four days, before falling sharply in mid-May.

Ars Technica · Security·Sep 4, 17:18 UTC · 11d agoPhishing & fraud

Attackers use passkey-themed scams to hijack Microsoft 365 accounts

Microsoft tracks ongoing M365 cloud intrusions since May using passkey-themed helpdesk vishing, AiTM phishing, and device-code abuse.

Microsoft Security Research has tracked active cloud intrusions since May in which attackers posing as IT helpdesk staff lured employees with fake passkey/MFA enrollment requests. Attacks used adversary-in-the-middle phishing pages, device-code authentication flows, and Teams messages from compromised accounts. Attackers registered their own MFA methods, enumerated tenants via Microsoft Graph, and accessed SharePoint, OneDrive, and Exchange Online data, throttling activity below 1000 files/emails per hour.

CSO Online·updated 11:58 UTC · 4h ago·first Sep 11, 09:51 UTC · 5d agoThreat actor in the wild 10 sources1

Product showcase: AI Paper Trail shows the privacy cost of talking to AI

Proton launched AI Paper Trail, a free tool that analyzes ChatGPT or Claude exports and reports what personal data can be inferred from AI conversations.

Proton released AI Paper Trail, a free web tool that analyzes the 200 most recent prompts from exported ChatGPT or Claude conversation histories and generates a privacy report with an AI Exposure Score, inferred personal data categories, and an estimated advertising value. In a hands-on test it identified 47 data points, returned a 58/100 exposure score, estimated $185 in advertising value, and flagged five red flags spanning location, interests, finances, and relationships. Proton states that uploaded data is deleted after analysis and is not stored on its Lumo servers.

Help Net Security·Aug 24, 00:00 UTC · 23d agoAI industry

Mathspace Data Breach Exposes Over 1 Million People

Mathspace breach exposed data of 1,079,819 Australian and New Zealand users via exploited Metabase zero-day CVE-2026-72898; ShinyHunters claimed responsibility.

Mathspace disclosed a breach affecting 1,079,819 students, teachers, staff, and parents in Australia and New Zealand. Attackers exploited the Metabase SQL injection zero-day CVE-2026-72898 (CVSS 10), patched August 6, and accessed Mathspace's self-hosted instance from August 10; ShinyHunters claimed the Metabase hacks. Exposed data includes names, usernames, emails, and login dates; no passwords, academic records, or credentials were taken.

SecurityWeek·Sep 8, 10:47 UTC · 8d agoData breach in the wildCVE-2026-72898