← Feed

Posts

• View post

  NEW: We spoke to hacking law experts to learn if OpenAI and Anthropic could be prosecuted for their AI agents’ hacks against Hugging Face, and three unnamed victims.  The answers are complicated, as we are in “uncharted territory,” as one lawyer put it. But another lawyer said there is a potential avenue to hold the two AI giants liable for negligence. And for him, it would be a "no brainer" to sue the two companies. https://techcrunch.com/2026/08/03/whos-legally-to-blame-for-anth...

• View post

  ~ Personal news ~  I left TechCrunch a few days ago. First, I will now focus on finishing my book about Hacking Team and the history of government spyware. After that, and in the meantime as well, I will be freelancing. So if you are looking for some cool stories about cybersecurity and surveillance; or help researching and reporting for a larger project, and similar services, please let me know. You can contact me via email: Lorenzofb.writes@gmail.com or via Signal: @LorenzoFB.1337 (+1 917...

• View post

  NEW: Another AI model escaped its supposedly isolated environment in a cybersecurity test. This time it was the model Kimi K3, made by Chinese company Moonshot. At least this time it didn't hack anyone. This is the latest incident of its kind after incidents at OpenAI, Anthropic, Meta and AISI. https://techcrunch.com/2026/08/07/chinese-ai-model-kimi-escaped-its-cybersecurity-testing-environment-researchers-say/

• View post

  NEW: Connor Moucka, 26-year-old Canadian, pleaded guilty to hacking more than 165 companies, most of them customers of cloud provider giant Snowflake, including AT&T and Ticketmaster. DOJ said Moucka made around $3 million from ransom payments and from selling personal data on hacking forums. https://techcrunch.com/2026/08/06/hacker-pleads-guilty-to-stealing-data-from-more-than-165-snowflake-customers

• View post

  NEW: Several hackers have been stealing $130 million — and counting — in Bitcoin from the owners of supposedly secure offline hardware wallets.  The heists rely on a security flaw in the Coldcard wallet. By knowing how to make the keys, the hackers did not need to break into the safe that holds them. The cybercriminals essentially figured out how to cut keys at scale. “Perhaps the hardest part about this is that I did everything right,” Jonathan Goodman, who claimed to have had $1.6 million st...

• View post

  NEW: After the UK government sent a secret legal request to access users’ encrypted iCloud data, Apple has reportedly filed a new legal challenge against it. This is the latest in a legal fight that started early last year. Critics see these demands as a threat to Apple users worldwide.  https://techcrunch.com/2026/08/03/apple-challenges-uk-governments-latest-demand-for-icloud-backdoor-report/

• View post

  NEW: Since the advent of LLMs experts have warned that AI would usher in an era of countless bugs, putting pressure on defenders to keep up with hackers. We are starting to see hard data backing up that prediction. In just one month, Google fixed as many bugs in Chrome as in the previous two years. http://techcrunch.com/2026/07/30/google-says-it-fixed-more-chrome-bugs-in-june-than-over-the-past-two-years-thanks-to-ai/

• View post

  This is a great explainer of the OpenAI hack against Hugging Face, particularly of the report that the latter published earlier this week. If you had trouble parsing the highly technical report, this article can walk you through it. https://techcrunch.com/2026/07/29/the-hugging-face-ai-break-in-as-told-through-an-increasingly-committed-bear-metaphor/

• View post

  NEW: I delved into the mystery of Phineas Fisher, probably the most prolific and public hacker never to have gotten caught. This is what we know about the infamous hacktivist and their spectacular hacks against spyware makers FinFisher and Hacking Team. There will be even more in my upcoming book. https://techcrunch.com/2026/07/25/the-hacker-who-humiliated-spyware-makers-and-was-never-caught/

• View post

  NEW: I spoke to several offensive cybersecurity researchers, including zero-day developers, about how the guardrails imposed by OpenAI and Anthropic on their AI models are getting in the way of their work. Most complained that the guardrails are inconsistent and too strict, which pushes them to use open source models instead.  https://techcrunch.com/2026/07/23/how-ai-guardrails-are-impeding-the-work-of-offensive-cybersecurity-researchers/

• View post

  Zero-day startup Paradigm Shift took down the blog post and corresponding Proof-of-Concept code for the iPhone flaw they dubbed Usbliter8. Takedown comes following a judge order in the lawsuit filed by Magnet Forensics, which alleges a former employee now at the startup stole the flaw.

• View post

  NEW: The FBI arrested a 21-year-old student accused of uploaing malware-laden video games on Steam, infecting thousands of victims, and then stealing $220,000 in crypto from some of them. The man, Zyaire Wilkins, worked with unnamed co-conspirators to publish at least five malware-embedded games. https://techcrunch.com/2026/07/17/fbi-arrests-man-accused-of-using-steam-games-to-drain-victims-crypto-wallets/

• View post

  Very interesting detial in NSO Group's training materials for customers: "Pegasus training material describes situations where it may not be possible to attack a target directly, for example if they do not use a smartphone or are highly security conscious in how they use their device. In those circumstances, NSO Group suggests expanding to 'close-circle infection,' targeting others connected to the target, potentially including colleagues, friends or family members of the prima...

• View post

  NEW: Cops say the arrest of two members of the infamous Scattered Spider hacking group have halted the gang’s activities.  On Thursday, two members of Scattered Spider were sentenced to five years and a half in prison for hacking London’s transportation system in 2024.  https://techcrunch.com/2026/07/16/uk-cops-say-arrest-of-two-young-hackers-disrupted-the-operations-of-an-infamous-hacking-group/

• View post

  NEW: The Iranian government abused well-known flaws in the global telecoms infrastructure — specifically SS7 — to locate U.S. military personnel in the Middle East at the beginning of the war. https://techcrunch.com/2026/07/14/iran-abused-mobile-networks-vulnerabilities-to-locate-u-s-military-in-the-middle-east-report-says/

• View post

  NEW: In a major privacy win, the U.S. Supreme Court has ruled that authorities need to get a search warrant when requesting historical "geofence" cellphone location data. Feds will need to show probable cause when requesting these type warrants, the court ruled, as "an individual has a reasonable expectation of privacy in his cell-phone location information.” The Supreme Court ruled that historical cellphone location data, even if collected by a third party such as Google, is pr...

• View post

  NEW: Apple fixed the bug that law enforcement agencies, like the FBI, were taking advantage of to extract chat messages that had been deleted or disappeared automatically. Until now the iPhone stored deleted or disappered messages in a database, allowing authorities to access them with forensic tools. http://techcrunch.com/2026/04/22/apple-fixes-bug-that-cops-used-to-extract-deleted-chat-messages-from-iphones/

• View post

  NEW:** **Google is rolling out a new security feature for Android called Intrusion Logging, which is designed specifically to help security researchers investigate attacks done with spyware and forensic tools. Amnesty, who worked with Google in developing the feature, says this is ““a fundamental shift in the amount and quality of forensic data available on Android devices.”  https://techcrunch.com/2026/05/12/google-launches-new-android-security-feature-to-help-uncover-spyware-attacks...

• View post

  NEW: U.S. bank Community Bank says customer data, including names, dates of birth, and Social Security numbers, was exposed due to “an unauthorized artificial intelligence-based software application.” The bank has not disclosed how many customers are affected. https://techcrunch.com/2026/05/12/u-s-bank-disclose-security-lapse-after-sharing-customer-data-with-ai-app/

• View post

  NEW: Polish intelligence says hackers broke into 5 water treatment systems, and could have tampered with the safety of water supply. Poland did not accuse Russia for these attacks, but it said the Russian government has been targeting military and civilian infrastructure — a threat the U.S. and other Western countries face too. https://techcrunch.com/2026/05/08/poland-says-hackers-breached-water-treatment-plants-and-the-u-s-is-facing-the-same-threat/

• View post

  NEW: Hackers have taken down the infrastructure of the Linux-based operating system Ubuntu, and some of its websites. We verified that updates fail, and developers said the outage is affecting some APIs too. A group of hacktivists claimed responsibility, saying they used a DDoS-for-hire service. https://techcrunch.com/2026/05/01/ubuntu-services-hit-by-outages-after-ddos-attack/

• View post

  NEW: Researchers have have exposed yet another spyware maker that makes fake Android apps for its government customers. The apps were pushed with help of telecom providers. And it's yet another Italian company: IPS. Until now, IPS was only known to make traditional wiretapping surveillance systems. The researchers tied the spyware to IPS thanks to an IP address used in its infrastructure that was registered to “IPS Intelligence Public Security.” http://techcrunch.com/2026/04/24/another-...

• View post

  NEW: David Vincenzetti, the founder of spyware maker Hacking Team, has been arrested. Vincenzetti is accused of attempted murder. He allegedly stabbed a relative at his home. A judge has ordered him to stay in prison as a precautionary measure, and has ordered a psychological evaluation, according to Italian media reports. I'm honestly in shock. Hacking Team's story is still getting crazier, eight years after it got spectacularly hacked. https://techcrunch.com/2023/11/29/founder-of-s...

• View post

  NEW: Booking says hackers accessed customers’ personal data, including names, emails, physical addresses, phone numbers, and booking details. The company refused to say how many customers' were affected by this incident. http://techcrunch.com/2026/04/13/booking-com-confirms-hackers-accessed-customers-data/

• View post

  NEW: A hack-for-hire group targeted victims with Android spyware and with phishing attacks to break into iCloud backups. The group, codenamed BITTER, has alleged ties with Indian government, and attacked victims in the Middle East and North Africa, including journalists and government officials. "These operations have become cheaper and it’s possible to evade responsibility, especially since we won’t know who the end customer is, and the infrastructure won’t reveal the entity behind it,&q...

• View post

  NEW: WhatsApp alerted around 200 users who were tricked into installing a fake app that was actually government spyware. The company accused Italian spyware maker SIO of being behind the app, and announced it plans to send the company "a formal legal demand to stop any such malicious activity." http://techcrunch.com/2026/04/01/whatsapp-notifies-hundreds-of-users-who-installed-a-fake-app-that-was-actually-government-spyware/

• View post

  SCOOP: Apple says it's not aware of anyone using Lockdown Mode getting hacked with spyware, on all kinds of devices. There have already been a couple of documented cases of Lockdown Mode stopping spyware attacks. And there's been one case where an advanced hacking toolkit was designed to bail out if it detected Lockdown Mode on the target device. If you're worried about spyware, you should use turn this security feature on. https://techcrunch.com/2026/03/27/apple-says-no-one-usi...

• View post

  SCOOP: Someone has found new samples of the iPhone spyware DarkSword and published them on GitHub, putting millions of iOS users at risk. A cybersecurity researcher told us that the leaked spyware is "way too easy to repurpose" and "we need to expect criminals and others to start deploying this." "The exploits will work out of the box," iVerify's Matthias Frielingsdorf said. "There is no iOS expertise required." http://techcrunch.com/2026/03/23/some...

• View post

  NEW: A group of hacktivists calling themselves "Department of Peace" claims to have hacked an office wihin the Department of Homeland Security. The hacktivists leaked data on more than 6,000 contracts between DHS and ICE and private companies to the transparency website Distributed Denial of Secrets. "The DHS is killing us and people deserve to know which companies support them and what they’re working on,” the hackers wrote in a manifesto. http://techcrunch.com/2026/03/02/hack...

• View post

  I just learned that Trend Micro re-branded to TrendAI...uhm, OK.