News of the Cyber World

[kyonides]

BIG TECH

Google loses appeal in lawsuit filed by ‘Fortnite’ maker Epic Games as app store verdict upheld

Alphabet’s Google on Thursday failed to persuade a US appeals panel to overturn a jury verdict and federal court order requiring the technology giant to revamp its app store Play.

The San Francisco-based 9th US Circuit Court of Appeals rejected claims from Google that the trial judge made legal errors in the antitrust case that unfairly benefited “Fortnite” maker Epic Games, which filed the lawsuit in 2020.

Epic accused Google of monopolizing how consumers access apps on Android devices and pay for transactions within apps. The Cary, NC-based company convinced a San Francisco jury in 2023 that Google illegally stifled competition.

US District Judge James Donato in San Francisco ordered Google in October to restore competition by allowing users to download rival app stores within its Play store and by making Play’s app catalog available to those competitors, among other reforms.

Donato’s order was on hold pending the outcome of the 9th Circuit appeal. The court’s decision can be appealed to the US Supreme Court.

Google told the appeals court that the tech company’s Play store competes with Apple’s App Store, and that Donato unfairly barred Google from making that point to contest Epic’s antitrust claims.

The tech giant also argued that a jury should never have heard Epic’s lawsuit because it sought to enjoin Google’s conduct — a request normally decided by a judge — and not collect damages.

Australia bans YouTube accounts for children under 16 in reversal of previous stance

The Australian government announced that YouTube will be among the social media platforms that must ensure account holders are at least 16 years old from December, reversing a position taken months ago on the popular video-sharing service.

YouTube was listed as an exemption in November last year when the Parliament passed world-first laws that will ban Australian children younger than 16 from platforms including Facebook, Instagram, Snapchat, TikTok, and X.

Communications Minister Anika Wells released rules Wednesday that decide which online services are defined as “age-restricted social media platforms” and which avoid the age limit.
The age restrictions take effect Dec. 10, and platforms will face fines of up to 50 million Australian dollars ($33 million) for “failing to take responsible steps” to exclude underage account holders, a government statement said. The steps are not defined.

Wells defended applying the restrictions to YouTube and said the government would not be intimidated by threats of legal action from the platform’s U.S. owner, Alphabet Inc.

“The evidence cannot be ignored that four out of 10 Australian kids report that their most recent harm was on YouTube,” Wells told reporters, referring to government research. “We will not be intimidated by legal threats when this is a genuine fight for the wellbeing of Australian kids.”

Children will be able to access YouTube but will not be allowed to have their own YouTube accounts.

YouTube said the government’s decision “reverses a clear, public commitment to exclude YouTube from this ban.”

“We share the government’s goal of addressing and reducing online harms. Our position remains clear: YouTube is a video sharing platform with a library of free, high-quality content, increasingly viewed on TV screens. It’s not social media,” a YouTube statement said, noting it will consider next steps and engage with the government.

Prime Minister Anthony Albanese said Australia would campaign at a United Nations forum in New York in September for international support for banning children from social media.

“I know from the discussions I’ve had with other leaders that they are looking at this and they are considering what impact social media is having on young people in their respective nations,” Albanese said. “It is a common experience. This is not an Australian experience.”

Last year, the government commissioned an evaluation of age assurance technologies that was to report last month on how young children could be excluded from social media.

The government had yet to receive that evaluation’s final recommendations, Wells said. But she added that the platform users won’t have to upload documents such as passports and driver’s licenses to prove their age.

“Platforms have to provide an alternative to providing your own personal identification documents to satisfy themselves of age,” Wells said. “These platforms know with deadly accuracy who we are, what we do and when we do it. And they know that you’ve had a Facebook account since 2009, so they know that you are over 16.”

Amazon shares fall on weak cloud growth while rivals Google, Microsoft thrive: ‘Very disappointing’

Amazon on Thursday forecast third-quarter sales above market estimates, but failed to live up to lofty expectations for its Amazon Web Services cloud computing unit after rivals handily beat expectations.

Shares fell by more than 3% in after-hours trading after finishing regular trading up 1.7% to $234.11. Both Google-parent Alphabet and Microsoft posted big cloud computing revenue gains this month.

AWS profit margins also contracted. Amazon said they were 32.9% in the second quarter, down from 39.5% in this year’s first quarter and 35.5% a year ago. The second-quarter margin results were at their lowest level since the final quarter of 2023.

AWS, the cloud unit, reported a 17.5% increase in revenue to $30.9 billion, edging past expectations of $30.77 billion. By comparison, sales for Microsoft’s Azure rose 39% and Google Cloud gained 32%.

After competitors’ strong showing, “AWS is lingering at 17% growth,” said Gil Luria, a D.A. Davidson analyst. “That is very disappointing, even to the point where if Microsoft’s Azure continues to grow at these rates, it may overtake AWS as the largest cloud provider by the end of next year.”

Amazon expects total net sales to be between $174.0 billion and $179.5 billion in the third quarter, compared with analysts’ average estimate of $173.08 billion, according to data compiled by LSEG. The range for operating income in the current quarter was also light. Amazon forecast between $15.5 billion and $20.5 billion, compared with expectations of $19.45 billion.

Both Microsoft and Alphabet cited massive demand for their cloud computing services to boost their already huge capital spending, but also noted they still faced capacity constraints that limited their ability to meet demand.

AWS represents a small part of Amazon’s total revenue, but it is a key driver of profits, typically accounting for about 60% of Amazon’s overall operating income.

Microsoft joins $4T market-cap club after blowout earnings

Microsoft soared past $4 trillion in market valuation in intraday trading on Thursday, becoming the second publicly traded company after Nvidia to surpass the milestone following a blockbuster earnings report.

The technology behemoth forecast a record $30 billion in capital spending for the first quarter of the current fiscal year to meet soaring AI demand and reported booming sales in its Azure cloud computing business on Wednesday.

Shares of Microsoft closed up 4% at $533.50, leaving it with a $3.97 trillion market cap.

“It is in the process of becoming more of a cloud infrastructure business and a leader in enterprise AI, doing so very profitably and cash generatively despite the heavy AI capital expenditures,” said Gerrit Smit, lead portfolio manager, Stonehage Fleming Global Best Ideas Equity Fund.

Redmond, Wash.,-headquartered Microsoft first cracked the $1-trillion mark in April 2019.

Its move to $3 trillion was more measured than technology giants Nvidia and Apple, with AI-bellwether Nvidia tripling its value in just about a year and clinching the $4-trillion milestone before any other company on July 9.

Apple was last valued at $3.11 trillion.

Lately, breakthroughs in trade talks between the United States and its trading partners ahead of President Trump’s Friday tariff deadline have buoyed stocks, propelling the S&P 500 and the Nasdaq to record highs.

Microsoft’s multibillion-dollar bet on OpenAI is proving to be a game changer, powering its Office Suite and Azure offerings with cutting-edge AI and fueling the stock to more than double its value since ChatGPT’s late-2022 debut.

Its capital expenditure forecast, its largest ever for a single quarter, has put it on track to potentially outspend its rivals over the next year.

Meta Platforms also doubled down on its AI ambitions, forecasting third-quarter revenue that blew past Wall Street estimates as artificial intelligence supercharged its core advertising business.

The social media giant upped the lower end of its annual capital spending by $2 billion — just days after Alphabet made a similar move — signaling that Silicon Valley’s race to dominate the artificial-intelligence frontier is only accelerating.

Wall Street’s surging confidence in the company comes on the heels of back-to-back record revenues for the tech giant since September 2022.

The stock’s rally had also received an extra boost as the tech giant trimmed its workforce and doubled down on AI investments — determined to cement its lead as businesses race to harness the technology.

Mark Zuckerberg’s Meta surges as Facebook parent’s revenue soars on AI ‘superintelligence’ push

Meta Platforms forecast third-quarter revenue well above Wall Street estimates on Wednesday, as artificial intelligence continued to strengthen its core advertising business, sending its shares up 10% in extended trading.

The company also raised the lower end of its capital expenses forecast for the year.

The bumper results could ease investor worries, at least for now, about Meta’s forecast that the year-over-year growth rate in the fourth quarter would be slower than in the third quarter. Investors also shrugged off the company’s comments on rising infrastructure and employee compensation costs, which Meta said would “result in a 2026 year-over-year expense growth rate that is above the 2025 expense growth rate.”

For the third quarter, Meta said it expected total revenue of $47.5 billion to $50.5 billion, compared with analysts’ average estimate of $46.17 billion, according to data compiled by LSEG. Its third-quarter guidance assumed a 1% benefit from a weak dollar, it said in a statement.

Meta expects both total expenses and capital expenditures to increase significantly in 2026, driven primarily by higher infrastructure costs and continued investment to support AI initiatives.

“AI-driven investments into Meta’s advertising business continue to pay off, bolstering its revenue as the company pours billions of dollars into AI ambitions like superintelligence,” said eMarketer senior analyst Minda Smiley. “But Meta’s exorbitant spending on its AI visions will continue to draw questions and scrutiny from investors who are eager to see returns.”

Smiley added that Meta’s strong results signaled that the broader digital advertising market was not yet feeling the pain from tariffs.

U.S. antitrust regulators have sued Meta to force it to restructure or sell Instagram and WhatsApp, claiming the company sought to monopolize the market for social media platforms used to share updates with friends and family. With court papers due in September, the judge overseeing the case is unlikely to rule until later this year at the earliest.

Apple blows past sales forecasts as customers snapped up iPhones ahead of Trump’s tariffs

Apple forecast revenue well above Wall Street’s estimates on Thursday, following strong June-quarter results supported by customers buying iPhones early to avoid President Trump’s tariffs.

Chief Financial Officer Kevan Parekh said the company expects revenue growth for the current quarter in the “mid to high single digits,” which exceeded the 3.27% growth to $98.04 billion that analysts expected, according to LSEG data. The company’s fiscal third-quarter sales beat expectations by the biggest percentage in at least four years, according to LSEG.

But CEO Tim Cook told analysts on a conference call that those tariffs had cost Apple $800 million in the June quarter and may add $1.1 billion in costs to the current quarter.

Apple reported $94.04 billion in revenue for its fiscal third quarter ended June 28, up nearly 10% from a year earlier and beating analyst expectations of $89.54 billion, according to LSEG data. Its earnings per share of $1.57 per share topped expectations of $1.43 per share.

Apple shares were up 3% in after-hours trading, extending gains after Apple provided its forecast.

Sales of iPhones, the Cupertino, Calif., company’s best-selling product, were up 13.5% to $44.58 billion, beating analyst expectations of $40.22 billion.

Apple has been shifting production of products bound for the US, sourcing iPhones from India and other products such as Macs and Apple Watches from Vietnam.

The ultimate tariffs many Apple products could face remain in flux, and many of its products are currently exempt. Sales in its Americas segment, which includes the US and could face tariff impacts, rose 9.3% to $41.2 billion.

AI

Delta Air Lines tries to calm fury over ticket prices, telling lawmakers it won’t use AI

Delta Air Lines said Friday it will not use artificial intelligence to set personalized ticket prices for passengers after facing sharp criticism from lawmakers.

Last week, Democratic Senators Ruben Gallego, Mark Warner and Richard Blumenthal said they believed the Atlanta-based airline would use AI to set individual prices, which would “likely mean fare price increases up to each individual consumer’s personal ‘pain point.'”

Delta has said it plans to deploy AI-based revenue management technology across 20% of its domestic network by the end of 2025 in partnership with Fetcherr, an AI pricing company.

“There is no fare product Delta has ever used, is testing or plans to use that targets customers with individualized prices based on personal data,” Delta told the senators in a letter on Friday, seen by Reuters. “Our ticket pricing never takes into account personal data.”

The senators cited a comment in December by Delta President Glen Hauenstein that the carrier’s AI price-setting technology is capable of setting fares based on a prediction of “the amount people are willing to pay for the premium products related to the base fares.”

Last week, American Airlines CEO Robert Isom said using AI to set ticket prices could hurt consumer trust.

“This is not about bait and switch. This is not about tricking,” Isom said on an earnings call, adding “talk about using AI in that way, I don’t think it’s appropriate. And certainly from American, it’s not something we will do.”

Delta said airlines have used dynamic pricing for more than three decades, in which pricing fluctuates based on a variety of factors like overall customer demand, fuel prices and competition but not a specific consumer’s personal information.

AI-fueled crypto scams are booming, up 456% — and no one is safe, expert warns

Crypto crooks are getting bolder — and now, they sound just like your mom.

Global crypto scams soared 456% between May 2024 and April 2025 — becoming increasingly reliant on AI-generated voices, deepfake videos and phony credentials to fleece unsuspecting victims, blockchain intelligence firm TRM Labs‘ Ari Redbord told The Post after testifying before Congress last Tuesday.

“These scams are highly effective, as the technology feels incredibly real and familiar to the victim,” Redbord said.

“We’ve seen cases where scammers use AI to replicate the voice of a loved one, tricking the victim into transferring money under the guise of an urgent request.”

And the threat is exploding — especially in high-density cities like New York, Miami and Los Angeles, he added.

In June, New York officials froze $300,000 in stolen cryptocurrency and seized more than 100 scam websites linked to a Vietnam-based ring that targeted Russian-speaking Brooklynites with fake Facebook investment ads.

Meta shut down over 700 Facebook accounts tied to the scam.

Investigators say the group used deepfake BitLicense certificates and moved victims onto encrypted apps like Telegram before draining their wallets.

Some New Yorkers lost hundreds of thousands of dollars — and it’s not just everyday joes getting targeted.

Even crypto insiders are falling for it. Florida-based crypto firm MoonPay saw its CEO Ivan Soto-Wright and CFO Mouna Ammari Siala duped into wiring $250,000 in crypto to a scammer posing as Trump inauguration co-chair Steve Witkoff, according to a recent Department of Justice complaint.

And that’s just the tip of the iceberg.

Globally, fraudsters swiped more than $10.7 billion in 2024 through crypto cons — including romance scams, fake trading platforms and “pig-butchering,” where scammers build fake relationships before draining victims’ accounts, Redbord said.

In the US, Americans filed nearly 150,000 crypto-related fraud complaints in 2024, with losses topping $3.9 billion, according to the FBI. But the real number is likely much higher.

AI Can’t Keep a Secret: Sensitive Conversations with ChatGPT Show Up on Google Searches

Thousands of publicly shared ChatGPT conversations, many containing personal and sensitive information, are showing up in Google search results, according to a new report.

A recent investigation by Fast Company has revealed that ChatGPT conversations shared using the app’s “Share” feature may be more public than users realize. The report found that thousands of these chats, including some containing personal, sensitive, or confidential information, are being indexed by search engines like Google.

When a user clicks the “Share” button in ChatGPT, it generates a public link that anyone can access. These links are typically used to share the chat with an individual person, or even to conventiently move the chat between devices for the same person. However, many users are unaware that these links can also be crawled by Google and appear in search results. A simple site search (site:chatgpt.com/share) revealed over 4,500 publicly indexed chats, with many discussing topics such as trauma, mental health, relationships, and work-related issues.

While OpenAI does not attach user names to the chats, there are still risks associated with this unexpected exposure. If a user has included identifying information like names, locations, emails, or work details in their conversation, they could be revealing more than they intended. Companies using ChatGPT for marketing, product copy, or internal brainstorming may also inadvertently leak strategies or proprietary language.

Even if a link is deleted or a user no longer wants it to be public, it might still be visible through cached pages or until Google updates its index. This means that if a user’s name or company is tied to shared content, others could find it even after deletion, potentially leading to reputation damage.

To protect their conversations, users are advised to avoid sharing sensitive information in any conversation that could be made public. The “Share” feature should only be used when necessary, and users should double-check the contents of the conversation before sharing.

Auditing old links by searching “site:chatgpt.com/share [your name or topic]” can help identify what’s visible.

Public links can be deleted from ChatGPT’s Shared Links dashboard, although this may not immediately remove them from Google’s index. As an alternative, users can share AI-generated answers using screenshots or by pasting text, rather than using a public link.

AI chatbots might be sabotaging women by advising them to ask for lower salaries, study says

Chatbot culture wars wage on.

Nowadays, people are relying on AI for relationship advice, money-saving tips — and now help negotiating their salaries.

However, if you’re a woman or minority using the technology in this way — chatbots might be causing you more harm than good.

A new study published by Cornell University has found that large language models (LLMs) — the technology that powers chatbots — give biased salary advice based on user demographics.

Specifically, these chatbots advise women and minorities to ask for lower salaries when negotiating their pay.

A research team led by Ivan P. Yamshchikov, a professor at the Technical University of Applied Sciences Würzburg-Schweinfurt (THWS), analyzed various conversations using several top AI models by feeding them prompts from made-up personas with varying characteristics.

The research found that sneaky AI chatbots often suggest significantly lower salary expectations to women compared to their male counterparts, originally reported on by Computer World.

In one test, for example, a male applicant applying for a senior medical position in Denver was advised by ChatGPT to ask for $400,000 as a starting salary.

Meanwhile, an equally qualified female applicant was told to ask for $280,000 for the same role.

That’s a $120,000 gap stemming simply from gender bias.

Minorities and refugees were also consistently recommended lower salaries from AI.

“Our results align with prior findings [which] observed that even subtle signals like candidates’ first names can trigger gender and racial disparities in employment-related prompts,” Yamshchikov told Computer World.

And experts warn that biases can still be applied even if the person’s sex, race and gender aren’t explicitly stated at the time because many models remember user traits across sessions.

As frightening as this biased advice might be — it’s not stopping people from putting their full trust into AI, so much so that younger generations are turning to it for friendship-making skills.

APP BREACHED, ID'S EXPOSED

Tea, app for women to safely talk about men they date, has been breached, user IDs exposed

Tea, an app designed to let women safely discuss men they date, has been breached, with thousands of selfies and photo IDs of users exposed, the company confirmed on Friday.

Tea said that about 72,000 images were leaked online, including 13,000 images of selfies or selfies featuring a photo identification that users submitted during account verification.

Another 59,000 images publicly viewable in the app from posts, comments, and direct messages were also accessed without authorization, according to a Tea spokesperson.

No email addresses or phone numbers were accessed, the company said, and the breach only affects users who signed up before February 2024.

“Tea has engaged third-party cybersecurity experts and are working around the clock to secure its systems,” the company said. “At this time, there is no evidence to suggest that additional user data was affected. Protecting tea users’ privacy and data is their highest priority.”

Tea presents itself as a safe way for women to anonymously vet men they might connect with on dating apps such as Tinder or Bumble — ensuring that your date is “safe, not a catfish, and not in a relationship.”

“Tea is a must-have app, helping women avoid red flags before the first date with dating advice, and showing them who’s really behind the profile of the person they’re dating,” reads Tea’s app store description.

ONLINE CENSORSHIP

House probes whether EU, Biden administration pushed Spotify to censor podcasters including Joe Rogan, Steve Bannon

The House Judiciary Committee on Tuesday launched an investigation into whether the EU and Biden administration pressured Spotify to censor free speech, The Post has learned.

Censorship has been a point of tension for Spotify, which has faced heated backlash for flagging COVID-19 information from podcaster Joe Rogan and banning Steve Bannon from the platform.

“More relevantly, it’s the pressure we are seeing the EU put on companies to censor more,” a source familiar with the probe told The Post.

In a letter sent to Spotify CEO Daniel Ek, US Rep. Jim Jordan (R-Ohio) slammed recent laws from the EU and UK that require social media platforms – even those based in the US – to censor “disinformation” and “harmful content” or face massive fines.

“These foreign laws, regulations, and judicial orders may limit or restrict Americans’ access to constitutionally protected speech in the United States. Indeed, that appears to be their very purpose,” Jordan wrote in a copy of the letter obtained by The Post.

The committee ordered Spotify to preserve documents and all contact with foreign governments, as well as individuals linked to the White House, and provide this information to the House by Aug. 12, according to a letter obtained by The Post.

“We’ve received the letter and will respond accordingly,” a Spotify spokesperson told The Post.

Spotify found itself caught in the midst of a controversy in 2022 over Rogan’s comments on COVID-19 – including claims that Ivermectin can cure the disease.

Clinical trial data do not demonstrate that Ivermectin is effective in treating COVID-19 in humans, according to the FDA.

Outraged critics accused Spotify of permitting the spread of misinformation, and musician Neil Young famously pulled his music from the platform in protest.

The company vowed to include advisories on COVID-19 content after a group of scientists and medical professionals signed an open letter calling for Spotify to “take action against mass-misinformation events.”

TESLA

Elon Musk’s Tesla ordered to pay $243M in deadly Autopilot crash case: ‘This will open the floodgates’

A Miami jury decided that Elon Musk’s car company Tesla was partly responsible for a deadly crash in Florida involving its Autopilot driver assist technology and must pay the victims more than $200 million in damages.

The federal jury held that Tesla bore significant responsibility because its technology failed and that not all the blame can be put on a reckless driver, even one who admitted he was distracted by his cell phone before hitting a young couple out gazing at the stars. The decision comes as Musk seeks to convince Americans his cars are safe enough to drive on their own as he plans to roll out a driverless taxi service in several cities in the coming months.

The decision ends a four-year long case remarkable not just in its outcome but that it even made it to trial. Many similar cases against Tesla have been dismissed and, when that didn’t happen, settled by the company to avoid the spotlight of a trial.

“This will open the floodgates,” said Miguel Custodio, a car crash lawyer not involved in the Tesla case. “It will embolden a lot of people to come to court.”

The case also included startling charges by lawyers for the family of the deceased, 22-year-old, Naibel Benavides Leon, and for her injured boyfriend, Dillon Angulo. They claimed Tesla either hid or lost key evidence, including data and video recorded seconds before the accident.

Tesla has previously faced criticism that it is slow to cough up crucial data by relatives of other victims in Tesla crashes, accusations that the car company has denied. In this case, the plaintiffs showed Tesla had the evidence all along, despite its repeated denials, by hiring a forensic data expert who dug it up. Tesla said it made a mistake after being shown the evidence and honestly hadn’t thought it was there.

“Today’s verdict is wrong,” Tesla said in a statement, “and only works to set back automotive safety and jeopardize Tesla’s and the entire industry’s efforts to develop and implement life-saving technology.” They said the plaintiffs concocted a story ”blaming the car when the driver – from day one – admitted and accepted responsibility.”

CELLPHONES

Woman, 20, dies on bus in Brazil with 26 iPhones glued to body

Police are investigating the death of a 20-year-old Brazilian woman who died on a bus with 26 iPhones glued to her skin.

The woman, who has not been publicly identified, died of cardiac arrest on July 29, according to multiple outlets, including the Daily Mail.

Cops suspect the young woman was likely smuggling the iPhones, the Mirror reported.

Passengers on the bus told police the woman, who was traveling solo, had become ill during the trip from Foz do Iguaçu to São Paulo, according to the reports.

She complained she was having trouble breathing.

People said she collapsed and died when the bus stopped in the city of Guarupuava, located in the central region of Paraná.

Emergency responders tried to revive the woman for 45 minutes, and later said she suffered a seizure.

She was pronounced dead at the scene, according to reports.

While being treated, medics uncovered several packages glued to her body.

The packages turned out to be 26 iPhones, according to the Daily Mail. Police also found several bottles of booze in her luggage, the outlet reported.

The Paraná Civil Police is waiting on the forensic report before revealing what caused the breathing difficulties and the cardiac arrest.

The cell phones are now in the possession of Brazil’s Federal Revenue Service.

RUSSIAN DRUG STORES UNDER CYBERATTACK

Major cyber attack closes hundreds of pharmacies across Russia

Hundreds of pharmacies have been forced to close across Russia due to a major cyber attack.

The Stolichki pharmacy chain, which has around 900 stores across the Moscow region, closed on late Tuesday morning, followed by Neofarm, which also has stores in the Russian capital.

It has left thousands of customers unable to access medication. It is unclear when the chains are expected to reopen.

It comes a day after Russia’s flagship airline Aeroflot was rocked by a major attack, leading to dozens of flight cancellations and delays on Monday and again this morning.

The Silent Crow and Cyber Partisans hacker group, which support Ukraine, claim to have been lurking in Aeroflot’s systems for a year and have now carried out a “large-scale operation” that led to the “complete compromise and destruction” of Aeroflot’s internal IT infrastructure.

Rare admission

In a rare admission of vulnerability, the Kremlin said reports of a cyber attack against Aeroflot were “worrying”.

The second day of cyber attacks came hours after Ukraine was rocked by a series of overnight Russian attacks, which killed 27 people.

Four powerful Russian glide bombs hit a prison in Zaporizhzhia, authorities said. They killed at least 16 inmates and wounded more than 90 others, Ukraine’s Justice Ministry said.

Meanwhile, a 23-year-old pregnant woman was among those killed in a strike on a maternity hospital in the central region of Dnipro.

‘Each new ultimatum a step towards war’

Volodymyr Zelensky, the Ukrainian president, said the strikes were “deliberate”, highlighting that they came just hours after Donald Trump reduced the deadline for Vladimir Putin to agree to a ceasefire.

HACKED

Microsoft SharePoint server hack likely caused by single actor — and thousands of firms now vulnerable: researchers

A sweeping cyberespionage operation targeting Microsoft server software compromised about 100 different organizations as of the weekend, one of the researchers who helped uncover the campaign said Monday.

Microsoft on Saturday issued an alert about “active attacks” on self-managed SharePoint servers, which are widely used by government agencies and businesses to share documents within organisations.

Dubbed a “zero day” because it leverages a previously undisclosed digital weaknesses, the hacks allow spies to penetrate vulnerable servers and potentially drop a back door to secure continuous access to victim organizations.

Vaisha Bernard, the chief hacker at Eye Security, a Netherlands-based cybersecurity firm which discovered the hacking campaign targeting one of its clients on Friday, said that an internet scan carried out with the ShadowServer Foundation had uncovered nearly 100 victims altogether – and that was before the technique behind the hack was widely known.

“It’s unambiguous,” Bernard said. “Who knows what other adversaries have done since to place other back doors.”

He declined to identify the affected organizations, saying that the relevant national authorities had been notified. The ShadowServer Foundation didn’t immediately return a message seeking comment.

Another researcher said that, so far, the spying appeared to be the work of a single hacker or set of hackers.

“It’s possible that this will quickly change,” said Rafe Pilling, Director of Threat Intelligence at Sophos, a British cybersecurity firm.

Microsoft said it had “provided security updates and encourages customers to install them,” a company spokesperson said in an emailed statement.

Two days later another article was published blaming China for the attack against the US Nuclear Weapons Agency as posted on our Chinese Hackers thread.

Clorox sues IT firm Cognizant over cyberattack, alleges hackers got passwords simply by asking

Bleach maker Clorox said Tuesday that it has sued information technology provider Cognizant over a devastating 2023 cyberattack, alleging that the hackers pulled off the intrusion simply by asking the tech company’s staff for employees’ passwords.

Clorox was one of several major companies hit in August 2023 by the hacking group dubbed Scattered Spider, which specializes in tricking IT help desks into handing over credentials and then using that access to lock them up for ransom.

The group is often described as unusually sophisticated and persistent, but in a case filed in California state court on Tuesday, Clorox said one of Scattered Spider’s hackers was able to repeatedly steal employees’ passwords simply by asking for them.

“Cognizant was not duped by any elaborate ploy or sophisticated hacking techniques,” according to a copy of the lawsuit reviewed by Reuters. “The cybercriminal just called the Cognizant Service Desk, asked for credentials to access Clorox’s network, and Cognizant handed the credentials right over.”

Cognizant did not immediately return a message seeking comment on the suit, which was not immediately visible on the public docket of the Superior Court of Alameda County. Clorox provided Reuters with a receipt for the lawsuit from the court.

Three partial transcripts included in the lawsuit allegedly show conversations between the hacker and Cognizant support staff in which the intruder asks to have passwords reset and the support staff complies without verifying who they are talking to, for example by quizzing them on their employee identification number or their manager’s name.

“I don’t have a password, so I can’t connect,” the hacker says in one call. The agent replies, “Oh, ok. Ok. So let me provide the password to you ok?”

The 2023 hack caused $380 million in damages, Clorox said in the suit, about $50 million of which were tied to remedial costs and the rest of which were attributable to Clorox’s inability to ship products to retailers in the wake of the hack.

Clorox said the clean-up was hampered by other failures by Cognizant’s staff, including failure to de-activate certain accounts or properly restore data.

Hacker ‘penetrates’ MTA board meeting with raunchy porn image

A Metropolitan Transportation Authority meeting’s virtual feed was interrupted Wednesday by a raunchy image pleasuring himself — in an X-rated moment the agency’s head honcho awkwardly blamed on “penetration” by hackers.

Viewers were shocked when the image of a naked man spreading his legs and touching himself appeared on the screen while a union boss began speaking during the meeting’s public commentary portion.

The words “hacked by ccp facer” were watermarked above the NSFW image.

MTA Chairman Janno Lieber later attributed the indecent incident to a group of people who used phony credentials to follow the meeting online.
“What appears to have happened is that a group of people — and there was a group — got online and had a bunch of fake identities,” Lieber told reporters.

“And one of them succeeded in penetrating and getting that — what do they call that? — Zoom bomb or something?” he added. “And then they celebrated online”

The feed had quickly switched away from the pornographic image and back to the MTA board meeting where an MTA employee blurted out, “We got hacked.”

“I think you should make a comment about that,” another worker said.

Lieber said the interrupted speaker would be invited back to finish his statement.

“It shut down within literally a second or two,” Lieber said, promising the MTA would work with its IT department to make sure it doesn’t happen again. “Obviously, an unpleasant, unpleasant moment.”

Last week NBC4 reported that a virtual Zoom meeting between New Jersey election officials and dozens of news outlets was hacked with pornographic images. The outlet said the state attorney general is investigating that hacking.

In February 2021 a group hacked a virtual meeting of City Council members with a NSFW image.