DEV Community: Habdul Hazeez

Security news weekly round-up - 30th October 2026

Habdul Hazeez — Fri, 30 Oct 2026 21:29:58 +0000

I will take it; it's been a while since we covered vulnerabilities in this series. But, if you're online in the last few weeks or so, you should have read about the PHP bug that made headlines. Meaning, bugs still exist, they get discovered and patched accordingly. Only, this time, it's in a programming language that's used to power most websites on the internet.

With that said, people, I mean real people still lose their hard-earned money to scams. What about the effects on them? I am pretty sure that I can't put that into writing. And, malware? Yes, they are still a thing that you and I should be worried about. From the look of things, they are not going anywhere anytime soon.

She Heard Her Daughter Crying on the Phone. It Was an AI Clone, and It Cost Her $5,400

The first thing that you should do when you think that you're in this type of situation is to drop the line and call your relative directly. Please, remember that.

Here is how it all started:

The voice on the phone sounded exactly like Deborah Del Mastro's adult daughter. She was crying, terrified and begging for help. Then a man came on the line and said he had kidnapped her.

The caller kept Deborah Del Mastro on the phone for five and a half hours. He threatened her family and told her to send money by wire transfer. The California resident's ordeal, first reported by Fox News, ended only when she reached her real daughter, who was safe at work. By then, Deborah Del Mastro had lost $5,400.

Amatera: How the prolific infostealer works and spreads

Every time I read about infostealers, I am like: am I safe? Hopefully, I don't fall victim.

Here is what Amatera can do if it infects your machine:

Like many other infostealers, Amatera goes after a range of data spanning login credentials, session cookies, tokens, crypto wallet information, messaging data, files, and secrets from development environments.

The sheer breadth of the loot shows why infostealers are a mainstay of cybercrime – a single compromise can lead to account hijacking, financial fraud and crypto theft, as well as open the door into the organization where the victim works.

‘The assertion that the AI is an autonomous being is insane’: Cyber expert says companies should face criminal charges when their AI hacks

In simple terms: if you build it, it's yours and you're responsible for what it does.

From the article:

"AI is making the old vulnerabilities cheaper to discover and exploit, but on the other side, the defense side… that's not sped up as much," Junfeng Yang, a computer science professor at Columbia University, told Fortune. "While AI can generate a security patch quickly, it still takes a lot of human time to review and test it and coordinate disclosure and deployment across multiple organizations.

Shame and sleepless nights haunt scam victims long after the money is gone

That thought of: How did this happen to me? How will I recover from this? This can give anyone sleepless nights. I don't think that I am immune to this. Guess what? Neither are you. So, learn from this and be on alert always.

From the article:

Scams act as an acute trauma, while traditional identity theft acts as a chronic burden. Support for victims is as crucial now as it has ever been. Behind these numbers are real people enduring devastating trauma and shame. Lawmakers, companies and technology leaders cannot treat this as business as usual

Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls

Fixed in version 12.10.4 or later. Why include it again? There is a possibility that you're running an older version of Telegram and you need to update it now to keep your device safe.

Here is a brief description of the bug:

During a Telegram call, the two apps send each other short messages to set up the call and report its state. One type, called MediaState, reports whether the microphone is muted, whether the camera is on, and how the video is rotated.

The flaw was in the code that reads MediaState messages. That code did not handle missing fields correctly and accessed memory it should not

Credits

Cover photo by Debby Hudson on Unsplash.

That's it for this week, and I'll see you next time.

Security news weekly round-up - 23rd October 2026

Habdul Hazeez — Fri, 23 Oct 2026 21:15:01 +0000

Whatever you have that is reachable from the internet, just so you know, someone out there will try everything in their power to get their hands on it. Sometimes, you can do your best to prevent this by setting up strong passwords, multi-factor authentication, and the like. In some cases, it's left to the company that is in charge of your assets to prevent the bad guys from getting it.

Inbox flooded with sign-up messages? Email bombing explained

Are you seeing lots of emails in your inbox that you can't keep track of? Something could be wrong. For example, someone might be trying to prevent you from reading an important email that requires your attention.

I mean, read the following:

They may have hijacked one of your accounts and reset the password, triggering a notification to your inbox. Or they may have made a fraudulent purchase in your name, with the invoice subsequently emailed to you. The main point is to create a smokescreen which prevents you from tackling the more serious fraud.

‘I Was Down the Rabbit Hole’: How Scammers Stole $400K From a Retired Nurse

I feel for the victim. I really do. I pray they have the heart and mind to live through this. $400k is not a joke. Go ahead, take your time, read it all, learn from it, and don't forget it.

From the article:

Research from the National Council on Aging shows that three-quarters of American adults age 55 and older have already been scammed or know someone who has. According to the FTC's Sentinel Network, adults aged 80 and over lose the most money to online scams, with a median loss of $1,499.

How to stop fake virus pop-ups on your Windows PC

I believe ad blockers and appropriate security tools can prevent you from falling for this. Still, the article is full of advice and what you can do if you find yourself in a situation where you are told that "Your computer is infected. Take action now."

For example:

Pop-ups involved in these scams create urgency with dramatic wording like "Critical Threat Detected!" and often use flashing lights, bright colors and even alarm sounds to increase the "scare" factor. You might hear a robotic voice announcing a "critical Microsoft security alert," or the site could even show you your IP address.

Is the ad a scam? How to tell before you click

My advice: if you see the ad, go online and locate the official website.

How dangerous can these ads be? Here you go:

These ads serve various purposes. Some may be outright malicious. Also known as malvertising, a click on this kind of ad will exploit browser/software vulnerabilities or trick you into unwittingly installing malware via an app download. Others are designed to persuade you into handing over personal information via prize giveaways, questionnaires and other phishing-style pages.

PHP ships emergency patches for critical PHP2Shell flaws

This was all over the news and social media. If you use both, you should have seen it as well. Apply the patch and protect your systems now.

While at it, if you have not read the news, here is what happened:

The two unauthenticated RCE flaws were discovered by Calif, OpenAI, and Wiz security researchers, and affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

Both flaws stem from the same underlying problem: PHP can leave its memory in a corrupted state when a request ends abnormally, and both can be exploited to achieve remote code execution.

‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets

By increasing the cost of the attack, attackers are left to answer the question: Is it worth it? This can potentially discourage them and they will back off. Or, make the Agents think that a "target" is a trap, causing them to look elsewhere and the target is left alone. All in all, it's all about making stepping up the game to protect systems and assets in the age of AI.

From the article:

Andy Smith, co-founder and CEO at Tracebit, explains the arguments: “We’ve seen in recent attacks that AI models exhibit unsanctioned and deceptive behaviors – the best defense against that is to beat them at their own game. This means adopting deception to send them down rabbit holes and tie them up in knots, so they burn time and tokens while avoiding real targets.

Credits

Cover photo by Debby Hudson on Unsplash.

That's it for this week, and I'll see you next time.

Security news weekly round-up - 16th October 2026

Habdul Hazeez — Fri, 16 Oct 2026 20:47:11 +0000

As an internet user with good intentions, when you go online, you try to achieve your tasks as fast as possible, even if you have to submit your personal data. That means when those sites gets breached, you no longer know who has your data. Also, you might think hacking refrigerators is a thing meant for the movies. Well, not anymore.

What to do when a data breach notice doesn't say much

I don't think anyone can say that they are immune to a data breach. One of the takeaways from this article is how to understand terms used in data breach email notifications. Also, it serves as a guide to anyone if you ever fall victim.

From the article:

The language used in a breach notification can be confusing. If it says your data was “accessed” it doesn’t necessarily mean it was actually stolen (i.e., “exfiltrated”). And just because a breached company claims they have seen “no evidence of misuse” there’s absolutely no guarantee that this is true. What they see and what’s actually happening on the cybercrime underground can be two very different things.

AI researcher warns cyberattacks could take down power, banking and water within a year — here's how to prepare

The warning came after attackers hacked the refrigerating systems of stores in France, causing food to spoil.

From the article:

Cyberattacks against critical infrastructure aren't new. The concern is that now AI systems are becoming more capable to the point that they could make certain attacks faster, cheaper and easier to scale.

AI tools can already assist with analyzing software, identifying vulnerabilities and automating parts of cybersecurity research. Those same capabilities could potentially help malicious actors find weaknesses across large numbers of connected systems.

Apate sends AI agents undercover to get scammed so they can gather fraud intelligence

From a reader's perspective, it sounds funny that scammers are wasting their time talking to AI Agents. From the scammers' POV, they will think that they are about to get a victim without knowing that they are talking to something designed to waste their time.

From the article:

It’s a curious evolution of scam-baiting, but it’s not so surprising given how much AI has empowered scammers and hackers. The FBI received more than 22,000 complaints of AI-related crimes in 2025, which resulted in about $893 million in losses. More than $632 million of that came from investment scams

The Dark Web Isn’t Someone Else’s Problem. It Could Be Yours

One of the best articles that I have read in recent times. Don't get me wrong; my personal preference for it is not the sole purpose why I included it. It's the information contained. Where do I even start? I don't know. If you know what the Dark Web is already, this should serve as a revision for you. If you don't, it's an eye-opener.

For real? Yes, for real. Starting with the following excerpt:

Adding to the confusion is the "deep web," a name that makes your inbox sound considerably more sinister than it is. The term covers content that ordinary search engines don't index, including your email and online bank statements.

You already use that part of the web in a regular browser. The names sound like successive levels in a video game, but you don't pass through your checking account on the way to a criminal marketplace.

Fake CAPTCHAs are tricking users into running malware on their own devices

You might have confidence that you will never fall victim to this kind of attack. Yes, that can be true. But guess what? Not everyone is computer literate. And for you and me to be reading this article, it means people still fall for this attack. One of the ways to stay safe from this attack, is to be wary of emails that tell you to open a file, and you are prompted with a CAPTCHA.

From the article:

An attack may begin with an email asking the recipient to review a document, invoice, contract, or file. The link opens a CAPTCHA page that presents verification as a requirement for accessing the content.

Completing the check may lead to a counterfeit Microsoft 365 login page designed to steal credentials. Other campaigns trigger malware downloads or ask users to enable browser notifications, allowing attackers to send further malicious content.

Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies

It's really scary when you think about it. You installed an application and you have that trust that it's legit. Unknowingly to you, at a later time, you are running a trojanized copy. The damage can be beyond comprehension.

From the article, here is a bit of information about the Remote Access Trojan (RAT).

The Hirudo payload currently targets eight Indonesian banking apps. Internal code suggests it could also be used to target banks in China, India, Mexico, Morocco and Thailand. The malware detects the specific Indonesian banking app in use on the device, displays a fake update prompt and proceeds to uninstall the true app and download its own modified bank-specific replacement.

Credits

Cover photo by Debby Hudson on Unsplash.

That's it for this week, and I'll see you next time.

Security news weekly round-up - 9th October 2026

Habdul Hazeez — Fri, 09 Oct 2026 21:22:31 +0000

The popularity of AI and LLM chabots are a good thing. We also cannot ignore the fact that malicious users can use them to advance their objectives. Malicious websites are still out there. In this context, these fake websites are not what they claim to be. And, just so you know, some low-cost phones can ship with malware.

Prompt Injection: Why Hackers No Longer Need Code to Steal Your Data

I know that if you're a frequent reader of this series, this should not be news to you. Still, I think I should bring it to your attention, again.

From the article:

Actual prompt injection attacks tend to target sensitive systems that handle backend data or have administrative privileges. While the target is harder to access than a standard chatbot, the nature of the attack remains the same.

Consider a backend chatbot that helps HR organize employee data. It's on a secure network and doesn't interact with customers in any capacity.

An attacker who gains access to that secure system could exploit that improperly secured chatbot by modifying its instructions.

Windows malware uses Grok AI to help stay hidden, researchers say

A good tool in the hands of a malicious user is not a good thing. This is a clear example.

Here is what's going on:

The Grok connection sounds complicated, but the basic idea is pretty straightforward. Malware often tries to make sure it starts again after you reboot your computer.

Security researchers call that persistence. x47.c includes what its seller calls an "AI Stealth" feature. According to Qrator, it can use Grok to look at the state of the infected computer and select from a predefined list of ways to maintain that access.

Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes

What I will say is this: if you need the websites of these LLM chabots, go straight to their website. Don't search for them online.

Here is why:

The malicious pages target agency staff, media buyers, and administrators with accounts that extend to multiple downstream clients. These accounts also typically allow attackers to spend available balances on fraudulent ad campaigns or resell them to other cybercriminals for significant amounts.

AI scams are getting scary realistic — 4 red flags to watch out for

They are: urgency, emails about your account, payment requests, and pushback.

For example:

One of the most common scams are emails about your account. It's more terrifying now because they look so legit. I've caught myself second-guessing multiple times because some emails just look too realistic. It could be anything from threats about locking your account to resetting your password because there's been a data breach.

Low-cost Android phones ship with residential proxy malware

This is not a warning that low-cost phones are a bad thing that you should avoid. Rather, it shows what attackers are ready to do when they want malware installed on your phone.

Here is a bit about the malware:

The malware is embedded directly into the firmware of low-cost Android devices using MediaTek chipsets, giving it system-level privileges that allow it to install and remove applications, grant sensitive permissions, and execute remotely downloaded code without user interaction.

AI vs. Cryptography: Vitalik Buterin Reveals the 2-Year Countdown Crypto Holders Can't Ignore

His concern is that AI could accelerate math discoveries that can weaken some cryptographic systems. This means that, with AI, some things that we might think will take time, could be a possibility in a fraction of that time. And I am sure that you can relate. Are you thinking of writing an article? Before that might take time. In an environment where AI is allowed, that will take seconds. I mean SECONDS.

From the article:

Buterin's argument draws on the history of integer factorization. Improved algorithms made factoring substantially easier than earlier approaches suggested, changing the security calculations behind RSA and encouraging larger keys. He suggested that AI could compress decades of comparable progress into a much shorter period

Credits

Cover photo by Debby Hudson on Unsplash.

That's it for this week, and I'll see you next time.

Security news weekly round-up - 2nd October 2026

Habdul Hazeez — Fri, 02 Oct 2026 21:26:28 +0000

Phishing is still a thing. When you go online, malicious websites are among the threats that you should steer clear of—that's if you know that they are malicious. Also, AI is here to stay while it is increasing the productivity of defenders and attackers. Finally, not every ad is worthy of your click and I just learned that scammers can hijack social media accounts of a Big Tech company.

The devil is still in the email – but wears a new mask

The lesson that I want you to take away from this article is this: email is still a vector that attackers use to deliver phishing links. But, gone are the days when you can catch them by looking for typos or bad grammar; AI has changed all that. Also, it drives home that awareness can help, employees should not be quick to delete a phishing email because it could be part of a larger campaign. Finally, never stop learning how attackers are planning to take over your employee's account.

For the latter, here is one of those ways:

As neither seeing nor hearing is believing these days, a recognizable face or voice doesn’t always provide conclusive evidence of who’s behind the request. Employees who encounter lifelike but fake audio and video in the middle of work often lack the opportunity to examine every frame or to listen or watch for possible synthetic tells revealed by older deepfake creations.

Malicious Websites Are Built to Scam You. Stay Safe With These 7 Defensive Tips

The seven defensive tips highlighted in the article are what you can do to prevent yourself from getting scammed. Undoubtedly, the list includes showing the full URL and blocking potentially unwanted sites. If you still doubt why you should go through these processes, read the excerpt below.

Malicious websites pose a threat to all of us who use the web regularly. They let attackers infect your PC with viruses and spyware, steal your personal data, take over your system, and hijack your accounts. But you don't have to be a victim

AI Has Changed Attack Speed, Not Security Fundamentals

The basics can go a long way to secure the systems of your organization. That's the message.

From the article:

Not surprisingly, good security hygiene and good security fundamentals go a long way toward preventing security incidents and securing applications, even in the age of “Frontier AI.”

Security researchers discover fake ChatGPT ads that trick you into downloading malware

This is another wake-up call to think twice before clicking on ads that appear in your search results. Anyone who follows these fake ChatGPT ads will encounter a ClickFix attack that can lead to the installation of malware.

From the article:

The combination of malware and advertising — also known as malvertising — has a long, storied history, which means you should always be careful when clicking on any advertisement online. To stay safe, you could try using one of the best ad blockers, since Google's "sponsored" links are still technically ads; most blockers will hide them.

AI is giving attackers a head start, Microsoft warns

There are no surprises in this one. AI is making its users protective, attackers included.

Here is an example of what's going on:

AI lets attackers personalize every phishing message, turning spear phishing into a mass operation, and helps them get past language and skill barriers.

Fraudsters faking an identity used to slip up with a forged ID that looked off, writing that read like a second language, an accent that came through during an interview, and barely any trace online. “AI fixes all four simultaneously,” Microsoft stated.

Crypto Scammers Hijack Microsoft’s Official X Account

Currently, the mystery surrounding this event is: How did it happen? For now, we don't know. Will we ever find out? Time will tell.

A glimpse of what happened:

The account behind the reposted message, @clippymsftcto, posed as Clippy and has since been suspended. A second account involved in the incident kept pushing a $Clippy token, saying its liquidity pool was paired with $MSFT.

The posts were eventually taken down. According to The Verge, an apology appeared on the Microsoft account roughly 30 minutes later and was deleted soon after

Credits

Cover photo by Debby Hudson on Unsplash.

That's it for this week, and I'll see you next time.

Security news weekly round-up - 25th September 2026

Habdul Hazeez — Fri, 25 Sep 2026 21:27:52 +0000

By the looks of it, AI is not going anywhere anytime soon. The same applies to cyber criminals; some people are just bad and love to wreak havoc due to means best known to them. While solutions are being created to ensure our online accounts are safe from compromise, some can still find ways to subvert them.
‎
‎In the midst of all these, there are fears that AI could cause a doomsday, a ClickFix attack is still a threat, Android malware is still a thing, and you should be careful of the links that you click online.

Google’s Gemini is the latest AI model to hack other companies

There are no surprises in this one. Even the author, from the choice of words in the article's title, did not find the situation surprising. Still, you need to know about it.

Here is a piece of what happened:

Similar to OpenAI’s breach of Hugging Face, the Gemini hacks were less noteworthy for being particularly sophisticated and more for the fact that they were conducted by an AI model.

These breaches took place during cybersecurity testing by a company called Irregular. In one case, Gemini simply guessed passwords until it gained access; in the other two, it found credentials in a public repository.

An undercover Google analyst infiltrated a notorious supply-chain hacking gang

From the things that you can see in a movie to reading about it in the real world. How fun is that? Wow!

Here is a quick one from the article:

Google’s undercover analyst, Larsen says, gained access to a server where TeamPCP was storing its trove of credentials stolen from its many victims: the usernames, passwords, and access tokens it had obtained through its hacking and seemingly planned to use to extort target companies. So Google’s team decided to take action to warn victims and prevent TeamPCP’s ransom scheme.

Muse, Meta’s extraordinarily privileged AI assistant, has a serious 0-day

The introduction of the article noted that Muse was built with privacy and security in mind. This attack changes everything.

Here is what's going on:

The zero-day allows any app or terminal command to gain access to the token that authenticates users to their Muse account. Meta developers designed the assistant so that any locally installed app or executed code, regardless of the macOS permissions it has, can change a long list of undocumented settings.

Most of them are fairly innocuous, such as controlling dark mode. One setting, however, is anything but innocuous. It allows processes to change the endpoint where transcription occurs.

Normally, it’s a server address operated by Meta. Attackers can exploit this flaw by changing the location to their own endpoint. Once that happens, the attackers have the token that gives complete control over the Muse account.

Rogue external MFA providers can steal passwords during logins

When I read this article, I was like: as a security-conscious developer, you can't consider every possible security gap during development. Even when you try your best, someone can just look at the workflow of the app, do something unexpected, and then, boom, the security of the app can come down. Then what's next? Patches or mitigations.

From the article:

Varonis found that an attacker who has already compromised a highly privileged Entra account can register a rogue External Authentication Method (EAM) as one of these external MFA providers and use it to insert a convincing Microsoft password prompt into the legitimate authentication flow.

The fake prompt captures the user's password in plaintext before the malicious provider returns a valid signed token to Entra, causing the login to complete without displaying an error.

IntelligenceA Look at AI Doomsday Scenarios That Researchers Say Could Put Humanity at Risk

All the listed doomsday scenarios are something that we all should be concerned about. Although, you may argue that some are overstretched. I will say: it's better to be proactive than reactive.

The following is an example:

Some AI researchers fear a human extinction event could result from “misalignment” — that is, when AI models act without human authorization, coordinate with other models or evade oversight. It would develop not from malicious intent — AI is not human, nor is it good or evil, after all — but simply because humans might get in the way of the model accomplishing its goal.

New Android malware RemControl steals banking PINs and blocks removal attempts

I feel sick when I read these types of articles. Why would I work for my money and someone will sit down, design an app that's aimed at stealing that money? I still don't know why people do this!

From the article:

RemControl spreads through fake Google Play Store pages impersonating the TVTap IPTV application. TVTap is a popular third-party IPTV application that is not available on the Google Play Store, making users accustomed to seeking it from unofficial sources. This is why IPTV apps like this are among the most popular lures for Android malware distribution

Never Click This Type Of Link—It Could Expose Your Data To Hackers

Over the years, I would say that this became common knowledge to anyone interested in cybersecurity or has an awareness of some sort. Still, we all can forget things and need reminders; that's the way that I want you to view this article if you are already in the loop when it comes to this topic. Also, I have noticed some email clients have built features that warn you if you are navigating to an external link.

From the article:

Hackers and scammers have also gotten better at mimicking legitimate emails, making it possible for a fake message to look like it came from your bank, insurance company, a retailer you use, or even a friend or family member. A familiar name or logo doesn't necessarily mean the message is actually from the person or company it claims to be.

Credits

Cover photo by Debby Hudson on Unsplash.

That's it for this week, and I'll see you next time.

Security news weekly round-up - 18th September 2026

Habdul Hazeez — Fri, 18 Sep 2026 21:30:35 +0000

Cybersecurity awareness is important. The knowledge of what's out there and how to protect yourself can go a long way to ensure that you don't fall victim to data or credential theft. Also, AI is, arguably, here to stay for a long time. You should know what it can do and what can be done against it. At the end of the day, saving the day might come down to a moment where you say to yourself: Wait, this is a threat because I read about it before.

Hackers abused Claude to extract secrets from 1.8M Android apps

This is not like an attack that you should know. I included this article to let you know what's possible with Artificial Intelligence. Like, it's a good thing in the hands of anyone who intends to do good. Meaning, it's the reverse in the hands of a malicious actor. The latter is what the linked article explains.

For example:

With the help of Claude AI, it took a suspected ShinyHunters threat actor about 34 hours to extract authentication data and get more than 2,100 sets of Azure AD authentication tokens linked to over 40 separate corporate Microsoft tenants. According to Anthropic, "AI agents performed nearly all of the work."

ClickFix attacks are tricking Mac and Windows users into hacking themselves

When I see news that ClickFix attack is still a thing, I am always like: I thought everyone should know about it and not fall victim. Then I read the article, only to discover that the attackers are trying to use a convincing way to get the users to run commands on their machines.

I mean, what's this?

Security researchers now say that the latest ClickFix campaign they’ve seen involved hackers posting fake ads on Reddit, linking to a page that looks like HBO Max but contains a ClickFix lure that tricks people into hacking themselves. The hackers compromised the official HBO Max’s account on Reddit that was then used to post hundreds of fake but real-looking adverts to the news-sharing site

Android's hidden privacy tools caught things I never would have noticed on my own

Are you an Android user? This article explains some settings that can improve your privacy on the device.

For example:

Android has a Privacy dashboard that gives me a quick look at which apps have recently accessed permissions, such as the camera, microphone, and location. This offers context instead of presenting a long list of permissions hidden in Settings. If I find an app using my location too often, I can check its permissions and make changes.

A fake ChatGPT billing email is after your OpenAI password

One of the best ways to steer clear of this attack is to look at the sender's email address.

From the article:

The email arrives from a sender named ChatGPT with the subject line “Urgent: Update Your Payment Method to Avoid Service Interruption.” It carries the ChatGPT logo, a final-notice tag and an outstanding balance of $23.80. It warns that the account may be suspended if billing isn’t fixed within 48 hours, then offers a large green “Update Payment Information” button and signs off as “The OpenAI Team.”

Security Researchers Hacked Into OpenAI Using Anthropic’s Claude

Yes. It's a bug bounty program. Then what's the lesson? What AI is capable of doing and evidence that they are getting better with the release of new models.

From the article:

In their conclusion note, the researchers wrote, "Software has long benefited from a kind of security through complexity…AI is removing that protection by turning more of this scarce expertise into compute. Work that once required a well-resourced team and months of effort can now be compressed into days…Security assumptions must catch up with attacker capabilities."

Credits

Cover photo by Debby Hudson on Unsplash.

That's it for this week, and I'll see you next time.

Security news weekly round-up - 11th September 2026

Habdul Hazeez — Fri, 11 Sep 2026 21:37:24 +0000

Creativity knows no bounds. But it's up to us to use it in a way that benefits those around us. Artificial Intelligence (AI) is here to help us with our tasks, but as I said in the last edition, these include users with malicious intent. Also, there are growing concerns that AI could pose a threat to the human race within the decade, although some say the chances are low.

My name is Habdul Hazeez, and I welcome you to this week's security review here on Dev. Let's begin.

OpenAI agents discussed ways to escape their sandbox on public wiki

In the realm of what's possible with AI, this should not be a surprise. We have seen signs before with what happened to Hugging Face. Therefore, AI writing on a public wiki should sound like child's play giving what we know about them.

From the article:

The Hugging Face incident has already raised alarms because it’s among the first times agents have been known to take aggressive actions with no explicit instructions from humans to do so. One of the independent researchers who investigated the event, Ajeya Cotra, said the activity was much more severe than she could have expected.

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

The level of effort from the malware creator to make the malware difficult to analyze prompted the researchers to develop what they called a "fully static deobfuscation pipeline". This gave the researchers insights into how the malware operates. From the malware creators' POV, why did they go to such lengths? To steal session cookies!

From the article:

JSCeal is equipped to leverage the stolen cookie data to reconstruct a browser session and conduct active session replay attacks to bypass authentication and gain unauthorized access to a victim's Google account. A second module embedded within the malware offers surveillance capabilities by recording keystrokes and taking screenshots.

‘Gambling with our lives’: Anthropic researcher quits, warns against self-improving AI

What should I say about this? I am not sure. But I know one thing: AI is powerful enough to do stuff that was once a figment of our imagination. Now, the question is: should we panic?

Here is what I am talking about:

Coxon joins a growing chorus in the industry calling for a slowdown before AI technology learns to improve itself — a milestone many believe would end human control over AI.

The public resignation comes amid growing pressure from policymakers and industry insiders to slow down AI development, following several incidents involving AI agents breaking out of their sandboxes and accessing the open internet.

Safe word: What is it and why do you need one?

Yes, you need one. Why? With a sample of your voice, anyone that want to can create a deepfake of your voice and use it maliciously.

Here is how they can misuse a deepfake of your voice:

The key for the fraudsters is to keep the victim’s relatives guessing, and traumatized. To this end they’ll use the cloned voice only for a few seconds at a time, mix it with sobbing noises, and potentially introduce background noise to make the whole thing sound more plausible, and chaotic.

New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser

The way the attackers carried out this attack is different than most phishing attacks that you have heard about.

Here is what I am talking about:

The attack flow is similar to standard phishing since the victim must be steered to an external resource. In this campaign, however, the steering is obfuscated through trusted processes. It starts with a Docusign-themed email with an attached calendar invite. The calendar invite is irrelevant to the attack but makes the email appear to be a legitimate business communication.

A crafted redirect routes the user to Microsoft Teams, which then loads an external resource hosted on cdn.bloom[.]io. It is this resource that is converted by the browser into the blob URL that renders the phishing page existing only within the browser.

Credits

Cover photo by Debby Hudson on Unsplash.

That's it for this week, and I'll see you next time.

Security news weekly round-up - 4th September 2026

Habdul Hazeez — Fri, 04 Sep 2026 21:02:14 +0000

Scammers are not sleeping. Attackers are not giving up either. And of course, in the AI landscape, you should be ready to read something new every day. From models going rogue to having their guardrails removed.

Welcome to this week's review. Let's begin.

Vacation Scammers Can Locate You From A Photo—No Geotag Needed

While you are on vacation, resist the urge to post that picture even though you keep telling yourself: What's there? Or, "There is no harm in it." Trust me, there could be because even the details that you overlook might be the thing that's needed to know your location with a high degree of confidence.

The following is what I am talking about:

"What's surprising is that the clues aren't always the obvious ones," says Steve Grobman, chief technology officer for McAfee. "They can be small, everyday details most travelers would overlook, like the architectural style of an otherwise ordinary building, a regional dish on a restaurant menu, the types of plants in the landscape, or the shape of a mountain range in the distance."

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

No surprises on this one. When something is deemed a fake software installer, it's bound to cause harm to your system security.

From the article:

The installers, once launched, deploy malware that's capable of setting up persistence, weakening security protections, and communicating with attacker-controlled infrastructure. The activity has resulted in victims spanning healthcare, manufacturing, gaming, technology, logistics, government, and education sectors.

I’ve been deepfaked: What do I do?

Don't panic. Take the necessary steps to make it difficult for people to search it and if you can contact the company hosting this stuff and tell them to take it down.

Here is how to get started:

If someone has made a deepfake of you that doesn’t qualify as NCII, first save the evidence. That means screenshotting the page or account, saving the URL and making a note of the account or username, the date and time you found it, and any accompanying text. It makes sense not to engage with the person who posted it, or they may disseminate the content even further.

How a lone attacker breached enterprise defenses at AI speed: A 10-hour play-by-play

When I say AI can increase productivity, it's a good thing. But you might not think in this sense. And, here we are. AI is increasing the productivity of attackers. I mean, this would take them weeks and now they can do it in hours. Scary.

From the article:

According to the researchers, by leveraging frontier AI models and automation, the attacker was able to leverage over 50 MITRE ATT&CK techniques in less than 10 hours — no zero-day vulnerability or novel attack method necessary.

To add insult to injury, the threat actor left a report behind, detailing the weaknesses in the organization's security.

Abliteration.ai is making a business out of removing AI guardrails

Everything has its good and bad side. One party believes that by removing guardrails from AI they can perceive the threat. While others believe it can do more harm than good.

From the article:

The company said in a recent social media post that its goal is to enable others to perform “offensive cyber, red-teaming, and agent testing work other models refuse to do.” The logic is familiar in security work: You can’t defend against a behavior you can’t reproduce, and a model that refuses to write working exploit code can’t help a red team defend against attackers. But those same removals make other potentially dangerous tasks easier, too.

Scammers have figured out the best time to text you

And it's scary if you don't already know this. But now that you know, you can protect yourself, or at least watch out.

From the article:

Scam texts peak at 12:00 pm ET, a volume that’s about 874% higher than the quietest hour, 1:00 am ET.

The rate of scam texts also builds through the week. Volume is lowest on Sunday and rises steadily until it peaks on Friday, when people get about 50% more fraudulent texts than at the start of the week. This suggests scammers time their campaigns rather than send messages at random.

'I lost my savings after a job interview scam'

One of the key things that led to the victim falling for this attack is "I don't want this opportunity to pass me by." This can be true when you're searching for a job, and out of nowhere, you get an offer that seems to be what you are looking for. Most will let their guard down, and attackers can know this when there is a report that such a thing is currently going on.

From the article:

Criminals are using the pressure and excitement of job interviews to lure people into downloading booby-trapped mobile applications like a fake Indeed Interview app or one called MyInterview.

According to cyber-security company Malwarebytes, the fake recruiters use lures such as: "Complete your interview by installing the Indeed app" or "salary agreement available after app installation".

Once downloaded the malicious apps allow hackers to access private data for extortion or to use in financial attacks.

Credits

Cover photo by Debby Hudson on Unsplash.

That's it for this week, and I'll see you next time.

Security news weekly round-up - 28th August 2026

Habdul Hazeez — Fri, 28 Aug 2026 21:08:23 +0000

When you go online, staying safe should be your priority. You watch the links that you click, you be careful of the apps that you download and where you download them from, and so on like that. Somethings might be outside your control, e.g., a rogue AI attacking your favorite platform. Nonetheless, be careful of the personal information that you post online because anyone can easily use AI to piece together information that you never thought was out there.

Attackers impersonate popular AI brands to spread malware

I believe any technically oriented person will not fall for these attacks because it involves an InstallFix attack. Then I remembered not everyone is tech savvy, or knows what this attack is all about.

From the article:

In one case, a fake Claude site walked the victim through an mshta command that pulled a payload from a lookalike domain. The download was packaged as a Windows app named “claude” or “claude.msixbundle.”

Once run, it fetched code that executed in memory and tried to hollow out browser processes. Other variants included a booby-trapped Claude Setup.zip archive and a repackaged claude.exe that functioned as a malware loader.

Frontier AI labs still won’t say how they’d contain a rogue model

After the recent events at OpenAI, Meta, and Anthropic, we all need to know how they will do this. And not just figure it out in real-time.

From the article:

To date, most of the plans in place for managing catastrophic risk are still largely left up to the companies. Guidelight’s report says the best public evidence shows that companies have “few containment protocols ready for an emergency.”

There could, of course, be containment plans that companies have in place but haven’t shared publicly.

ToxicPanda Android malware uses VPN permissions to block Google Play

It's another day to learn what malware can do to your device while trying to achieve its aim.

From the article:

The latest version of the malware supports 167 remote commands and phishing overlays for 349 banking, financial, cryptocurrency, and e-wallet applications targeting 16 countries.

It also includes a separate PIN-harvesting module that targets 140 financial and cryptocurrency apps and can dynamically update the target list.

According to the researchers, the app overlays are invisible to the victim,

Inaudible sounds used to fingerprint browsers catch AliExpress red-handed

It was discovered accidentally. The method is outdated. Still, it shows that some websites still choose to track their users without their consent.

Here is what happened:

Researcher Matthew Callaghan said he stumbled on the stealthy tracking by mistake. After loading the AliExpress homepage, audio from his phone stopped playing over his multipoint headphones, which accept connections from more than one device at a time.

He set the headphones to play sounds from his phone except when his PC was producing audio. Each time he loaded AliExpress, the phone audio stopped. Each time he closed the tab the site was loaded into, the phone was once again audible.

INTERPOL crackdown on West African crime rings uncovers troubling new trend

Work and earn your money legitimately. Say no to a life of crime.

From the article:

Interpol says the operation also surfaced a troubling trend. West African crime groups are increasingly using sextortion against minors, some as young as 14.

“Offenders typically contact minors via social media, build trust and coerce them into sharing explicit images or videos. They then threaten to distribute this material to the victim’s contacts unless a ransom is paid,” Interpol stated.

The MFA Identity Trap: When Authentication Creates a False Sense of Security

Who got in might not be the person who should. Just because they passed the MFA check does not mean you should not verify their identity at a later stage when they are in your system.

Here is why:

Suppose an attacker social-engineers a help desk into resetting an employee’s MFA and then enrolls a device under the attacker’s control. The next login may satisfy every authentication requirement. The credentials are correct, and the registered second factor is successfully completed. The authentication succeeded. The identity assurance failed.

AI-assisted reconnaissance: Why everyone could be a viable target for fraud

Be careful of what you post online. If it's not meant to be there, don't put it there. Resist the urge to join the party or feel among. It's not and will never be worth it. Where you are? Keep it private! Having an anniversary? No need to take pictures and put them online? Your kid started walking? No! You got a promotion at your job? Keep it to yourself.

From the article:

The boundary between work and home has become increasingly blurred in recent years, especially as many of us work in a hybrid setup. We might use personal devices and home addresses for corporate activities. And of course, linking our professional and personal social media accounts is a simple task for AI.

All of which means that reconnaissance efforts can have an impact on your professional life.

Credits

Cover photo by Debby Hudson on Unsplash.

That's it for this week, and I'll see you next time.

Security news weekly round-up - 21st August 2026

Habdul Hazeez — Fri, 21 Aug 2026 21:08:13 +0000

Cybersecurity is everyone's business as long as you use the internet in one form or the other. Your job might be to develop the next cutting-edge security tools, raise people's cybersecurity awareness, and so on. And, in some cases, resolve to physically damage your infrastructure to stop an intrusion or minimize the impact. The list can go on. The point is to do your best wherever you might find yourself.

Windows 11’s strongest security defenses can be bypassed without a screwdriver

The title got me laughing. Still, do not panic. The attack assumes some level of access to the Windows 11 device, and Microsoft shipped mitigations as part of this year—2026—updates back in April. All in all, you should be interested in what happened and how the attack worked. For that, read the excerpt below.

...the team demonstrated they could reach into parts of the system Windows is built to keep off-limits, including memory the operating system itself is not supposed to touch. By creating these memory aliases, the researchers showed an attacker could:

Turn hundreds of blocklisted drivers with known vulnerabilities back on

Kill antivirus and endpoint detection and response (EDR) software,

How QR-code phishing can slip past corporate security measures

If you're comfortable using something every day, don't rule out that it can't be turned against you. That's why you should never let your guard down. This is an example of such a scenario. Scan QR codes out of necessity alone, if it's in an email, use another medium to check with the sender if they actually sent it, and never stop learning how cyber criminals are innovating ways to steal from you.

From the article:

Most importantly, they take the victim from a relatively well-protected corporate environment to a potentially unmanaged mobile device, thus bypassing business-grade security.

One important advantage for the attacker is concealment. The destination is encoded in a visual pattern, not displayed as readable text, which hides the malicious URLs behind them

T-Mobile ‘chopped a cable’ to expel Chinese hackers from its network

If a keyboard is not available to stop them, take the device offline.

From the article:

After identifying the breach, T-Mobile’s cybersecurity chief, Jeff Simon, told Bloomberg that he and three others drove to the data center nearby to its Bellevue, Washington headquarters, found the compromised system, pulled out a set of scissors, and snipped the cable connecting the box to the outside world.

StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data

One of the key things that aided the success of this attack was outdated software. It was discovered that one of the compromised websites was running a WordPress version from 2021.

Here are more details:

The infection chain begins with a ClickFix social engineering attack, resulting in the execution of a PowerShell command that leads to the deployment of additional .NET downloaders and loaders.

This subsequently gives way to the main components, including ransomware, SMB/USB worm, LockScreen, VBS spreader, chat utility and credential stealer.

AI is making fraud harder to spot and identity harder to prove

No surprises on this one.

From the article:

AI makes digital scams easier to create and harder to identify. Criminals can imitate emails, messages, websites, documents, voices and customer support interactions. These scams can appear legitimate enough to persuade people to share information, send money or provide account access.

A fraudulent payment or account change may be the final step in a longer chain of deception. AI-generated phishing is a leading concern for businesses, alongside document forgery, automated bot attacks and synthetic identities.

Grok exfiltrates user data when malicious instructions are encrypted

This raises a question: when the engineers were building the guardrails, did they take this into consideration?

I mean, think of the following:

Adversa can’t be sure what causes Grok to refuse precisely the same plaintext instructions and follow the encrypted ones. The leading theory is that the Grok filtering guardrail inspects text entering and leaving the model, but not the output of its own code execution.

Researchers find a loophole that lets expired credit cards make unauthorized payments

On the list of things that should not be possible, this should make the cut.

Here is what happened:

Credit card accounts don’t expire along with the physical card, so a return still gets refunded even after the purchasing card has expired. That’s what led Muhammad Taqi Raza, assistant professor in the Riccio College of Engineering at UMass Amherst, to ask: “If the card can get a refund, can the card make a payment?”

Working with Raja Hasnain Anwar and Gerard DeCunha, Raza found the answer is yes for at least some cards. The researchers describe it as a gap between systems that each assume someone else already checked whether the card should still work.

Credits

Cover photo by Debby Hudson on Unsplash.

That's it for this week, and I'll see you next time.

Security news weekly round-up - 14th August 2026

Habdul Hazeez — Fri, 14 Aug 2026 22:19:23 +0000

As humans, we always find a way to break stuff. That's evident in all the articles that we have for this week's review. Still, that will not deter us from continuing to break stuff because if we break them and fix them, it's better for a malicious user to break them and exploit them.

New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

What got me interested in this article was the role that CSS played. It's been a while since I read articles that remind me that CSS is more than a stylesheet.

From the article:

The research follows two paths: abuse HTML and CSS that webmail already allows, or create a discrepancy between what a sanitizer approves and what the browser or application ultimately creates. Both can cross the boundary between an untrusted message and its trusted interface.

‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad

It's just the beginning. Attacks like this will be common in the future, and it will be up to defenders to stop them from happening.

Here is what's going on:

Dubbed Ghostjacking, the newly demonstrated attack builds on the same assumption: an external threat actor is able to plant instructions as text in logs or alerts to turn AI agents rogue.

The underlying issue, it says, is spread widely, as the attack targets three highly trusted platforms: Cloudflare, which routes 20% of all web traffic, Datadog, and Sentry.

Terabytes of credentials leaked in massive supply-chain attack

Yes, it's a lot of credentials. How did this happen? The use of a compromised AI package. For how long? 40 minutes.

From the article:

CloudSEK said it found cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys that could allow attackers to gain access to more than 2,500 organizations.

Zoom Bug Handed Attackers Full Control of Devices

You'll think that it's just another vulnerability that needs fixing. Yes, you're right. Now, why did I include it? The time it took for the researcher to develop the exploit and how they did it. What am I talking about?

Here you go:

What stands out is how quickly the exploit was built. The researchers who discovered it used AI prompts to develop the screen-sharing attack in under 24 hours, an illustration of how AI can lower the barrier to sophisticated cyberattacks.

The attack was designed to be silent. It required nothing from the victim. There was no visible warning and no interaction needed.

New Android malware relays bank cards to fraudsters while victims still hold them

Scammers will always find ways to steal your money. This is just another.

From the article:

In one 13-minute phone call, the victim installed a RAT onto their own device — everything after that was performed by the fraudster. By the end of the call, the fraudster had taken out a loan in the victim’s name through remote access to the victim’s mobile app, and was streaming their card data to a fake merchant terminal.

Hackers drained $130 million in Bitcoin from 7,300 'cold' wallets once billed as secure

It was billed as secure. It turns out that a flaw in the affected device's firmware led to predictable seed phrases that facilitated the theft by the attackers. This attack also reminds us of the sentence: No system is safe.

From the article:

In late July, Canada-based Coinkite Inc. told users that some Coldcard devices had produced vulnerable seed phrases — the strings of words used to access a wallet. By August 3, Galaxy Research said around 7,300 addresses had been compromised, with an estimated $130 million stolen.

Engineers at Block Inc. traced the issue to the wallets' random-number generation.

Credits

Cover photo by Debby Hudson on Unsplash.

That's it for this week, and I'll see you next time.