60
57
55
30
55
30
35
30
55
30
30
30
45
30
42
47
PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks
PAPERMILL phishing campaign abuses a signed Notepad++ copy and tax-audit lures to deploy VenomRAT against targets in India.
JUMPSEC tracks PAPERMILL as an emerging cluster whose emails pass SPF, DKIM, and DMARC and deliver tax-audit themed disk images. The mounted image pairs a legitimately signed, renamed executable with a rogue libcurl.dll for DLL sideloading, then uses a Donut shellcode loader to run VenomRAT 6.0.3 in memory with hidden VNC, data-stealing, and file-grabbing capabilities. The loader includes anti-analysis checks and RunOnce persistence, and lures plus China-connected infrastructure overlap with the Silver Fox ecosystem, though attribution remains unconfirmed.
55
Who gets to define the rules for AI?
Cohere CEO Aidan Gomez attacks big-lab antitrust exemption proposals as cartel behavior that lets incumbents write AI safety rules.
Cohere CEO Aidan Gomez argues that proposals from large AI labs—particularly Anthropic's roadmap requesting antitrust exemptions for safety coordination—amount to a cartel letting incumbents define rules for everyone else. He draws parallels to the 1975 SEC NRSRO credit-rating designations and the EU's 1985 Motor Vehicle Block Exemption, where safety justifications produced incumbent-protecting market structures. Gomez supports independent review of highly capable AI systems but disputes who writes the standards, who conducts review, and who participates. He also warns AI cyber offense is getting cheaper faster than defenses are improving.
25
First ‘Take It Down Act’ Sentencing Puts Man Behind Bars for 15 Years
Ohio man James Strahler gets the first US Take It Down Act sentence: 15 years for distributing real and AI-generated abuse imagery.
James Strahler, 38, became the first person convicted under the Take It Down Act, receiving a 15-year federal prison sentence after investigators found more than 3,000 real and AI-generated abuse images across his devices, including over 700 he posted online. He pleaded guilty to cyberstalking, producing obscene visual representations of child sexual abuse, and publication of digital forgeries after victims received threats, extortion demands, and AI-fabricated explicit images; the FBI took over the case in June. The federal law, which took effect in May, criminalizes knowingly publishing or threatening to publish nonconsensual intimate imagery, and free-speech advocates have criticized its 48-hour platform removal window as a censorship risk.
50
VU#859658: Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability
Skullcandy Dime 3 earbuds (CVE-2025-20701) accept Bluetooth pairings without owner consent, letting in-range attackers hijack audio or capture microphone; no firmware update path exists.
CERT/CC's VU#859658 describes CVE-2025-20701 in the Airoha Bluetooth audio SDK, present in Skullcandy Dime 3 (Model S2DCW) firmware 1.0.0.28. A direct Bluetooth Classic pairing request with no PIN or physical confirmation completes via NoInputNoOutput, adding the attacker's device as trusted. Attackers in radio range can hijack the A2DP audio session, access the Hands-Free/Headset profile, and capture live microphone audio. Firmware 1.0.0.30 contains the effective patch, but Skullcandy says the Dime 3 does not support app-based firmware updates, leaving existing units unpatchable.
24
Authors push back as publishers and agents make claims on Anthropic settlement
Authors report publishers and agents wrongly claiming shares of Anthropic's $1.5 billion copyright settlement, which pays $3,000 per pirated work across roughly 500,000 titles.
Anthropic's $1.5 billion copyright settlement, given final approval in July, pays $3,000 per pirated work for nearly 500,000 titles, split 50-50 with publishers for in-print books. Authors including April Henry report publishers claiming payments for works whose rights reverted years ago, and some agents claiming percentages despite not being rightsholders. Authors Guild CEO Mary Rasenberger attributes the disputes to poor recordkeeping rather than deliberate overreach. Full author claims require rights reversion before the settlement's August 10, 2022 download date.
45
US Authorizes Private Cyber Firms to Hack Transnational Criminal Networks
Trump signed a national security memorandum letting vetted private US cybersecurity firms run government-approved offensive cyber operations against transnational criminal organizations.
The August 13 memorandum creates a program managed by the National Coordination Center covering Cyber Surveillance Operations and Cyber Effects Operations against Cyber-Enabled Transnational Criminal Organizations, explicitly excluding entities that are parts of foreign governments. DOJ and DHS executive directors must co-approve every operation in writing, with extra authorization for operations raising laws-of-armed-conflict questions. Participating firms must pass vetting, annual evaluations and hold a $1 million bond or escrow. Operating procedures are due within 60 days, and the unresolved CFAA exemption question is addressed by requiring direct government control.
65
White House authorizes private US companies to hack foreign criminal networks
Trump memorandum authorizes vetted private US companies to conduct government-supervised offensive cyber operations against foreign criminal networks.
The National Security Presidential Memorandum signed August 12 lets vetted private companies run offensive cyber operations against transnational criminal organizations behind ransomware, phishing and sextortion, under US government oversight. The Homeland Security Task Force's National Coordination Center, led by DOJ and DHS executive directors, must give written approval for both Cyber Surveillance Operations and Cyber Effects Operations. Participating companies must post a $1 million bond or escrow, undergo annual review, and notify authorities if they unintentionally target US persons or systems.
68
30
42
60
60
57
60
30
30
50
55
42
60
57
30
42
57
60