teamviewer

At the moment, we’re seeing all kinds of sextortion emails. The scam is cheap to run, easy to automate, and apparently profitable enough that cybercriminals keep using it. Some criminals put more effort into their messages than others. Sextortion emails are messages claiming that scammers recorded you through your webcam while you watched pornography and now demand payment. They have been around for years and keep evolving with small changes in wording and fake technical detail. What hasn’t changed is the basic truth: there is no malware, no recording, and no credible evidence behind the threat. Despite seeing countless versions of these emails over the years, I’ve yet to encounter one that was backed up by the evidence the sender claimed to have. Below, we’ll walk through the email line by line, interrupting the scammer’s story with commentary that explains where the claims come from and why they don’t stand up to scrutiny. “Hi there! I regret to inform you about some sad news for you. Approximately a month or two ago I have succeeded to gain a total access to all your devices utilized for browsing internet. Moving forward, I have started observing your internet activities on continuous basis.” The opening sets the tone. “Total access to all your devices” is an immediate red flag because it’s extremely unlikely and technically vague. Real attackers tend to be more specific about what they accessed (which device, which OS, which app), whereas scammers deliberately keep it broad so anyone can think it applies to them. “Go ahead and take a look at the sequence of events provided below for your reference: Initially I bought an exclusive access from hackers to a long list of email accounts (in today’s world, that is really a common thing, which can arranged via internet). Evidently, it wasn’t hard for me to proceed with logging in your email account ( ). “ Here the scammer claims to have bought access to a “long list of email accounts.” That’s a warped reference to real initial access brokers (IABs) and credential markets, where criminals trade stolen passwords or session tokens. In this email, however, no password, login time, or IP address is provided—just an email address they already knew. So, there’s no actual evidence of account takeover or compromise. “Within the same week, I moved on with installing a Trojan virus in Operating Systems for all devices that you use to login to email. Frankly speaking, it wasn’t a challenging task for me at all (since you were kind enough to click some of the links in your inbox emails before). Yeah, geniuses are among us.” The “Trojan virus” claim echoes what we’ve seen in other sextortion campaigns that name‑drop random malware families or exploits to sound believable. Again, there is no specific malware name, file path, or exploit described—just a generic story designed to scare anyone who’s ever clicked on a link. “Because of this Trojan I am able to gain access to entire set of controllers in devices (e.g., your video camera, keyboard, microphone and others). As result, I effortlessly downloaded all data, as well as photos, web browsing history and other types of data to my servers. Moreover, I have access to all social networks accounts that you regularly use, including emails, including chat history, messengers, contacts list etc. My unique virus is incessantly refreshing its signatures (due to control by a driver), and hence remains undetected by any type of antiviruses.” This section tries to sound technical by mentioning things like “controllers,” “drivers,” “refreshing signatures.” But none of this is how security products or malware actually work. Modern Trojans and spyware may use drivers, persistence mechanisms, or encryption, but claims like “any type of antiviruses” and “incessantly refreshing its signatures” are pure bluff aimed at non‑technical readers. “Hence, I guess by now you can already see the reason why I always remained undetected until this very letter… “ This line tries to explain away a major inconsistency. If the attacker truly had full control and had been monitoring the victim for “a month or two,” why is the only evidence an email with no logs, screenshots, or sample video? If someone genuinely has compromising material, they will provide at least some proof, because that’s what forces victims to take it seriously. “During the process of compilation of all the materials associated with you, I also noticed that you are a huge supporter and regular user of websites hosting nasty adult content. Turns out to be, you really love visiting porn websites, as well as watching exciting videos and enduring unforgettable pleasures. As a matter of fact, I was not able to withstand the temptation, but to record certain nasty solo action with you in main role, and later produced a few videos exposing your masturbation and cumming scenes.” Here comes the classic sextortion hook: “I recorded you while you watched porn.” We’ve seen variations of this wording since at least 2018, often reused word-for-word across huge spam campaigns. The scam relies on shame and fear rather than technical credibility. The goal is to make victims panic into paying. “If until now you don’t believe me, all I need is one-two mouse clicks to make all those videos with everyone you know, including your friends, colleagues, relatives and others. Moreover, I am able to upload all that video content online for everyone to see.” Again, note the lack of proof. There’s no preview image, no sample video, no mention of a specific social media account—just a threat to send it to “everyone you know.” It’s deliberately vague. The same message needs to work for millions of recipients with completely different social circles. “I sincerely think, you certainly would not wish such incidents to take place, in view of the lustful things demonstrated in your commonly watched videos, (you absolutely know what I mean by that) it will cause a huge adversity for you. There is still a solution to this matter, and here is what you need to do: You make a transaction of $1490 USD to my account (an equivalent in bitcoins, which recorded depending on the exchange rate at the date of funds transfer), hence upon receiving the transfer, I will immediately get rid of all those lustful videos without delay. After that we can make it look like there was nothing happening beforehand. Additionally, I can confirm that all the Trojan software is going to be disabled and erased from all devices that you use. You have nothing to worry about, because I keep my word at all times.” The price point and payment method—just under $1,500, paid in Bitcoin—are typical for this kind of scam. Cryptocurrency is popular with scammers because payments are difficult to reverse and can be moved quickly. Despite its reputation, Bitcoin is not anonymous, and law enforcement has successfully traced many criminal transactions. “That is indeed a beneficial bargain that comes with a relatively reduced price, taking into consideration that your profile and traffic were under close monitoring during a long time frame. If you are still unclear regarding how to buy and perform transactions with bitcoins – everything is available online. Below is my bitcoin wallet for your further reference: All you have is 48 hours and the countdown begins once this email is opened (in other words 2 days).” Short deadlines and countdown language are psychological pressure tactics, not technical realities. Scammers want you panicking, not thinking, because a calm reader is more likely to spot the holes in the story. “The following list includes things you should remember and avoid doing: > There’s no point to try replying my email (since this email and return address were created inside your inbox). > There’s no point in calling police or any other types of security services either. Furthermore, don’t you dare sharing this info with any of your friends. If I discover that (taking into consideration my skills, it will be really simple, because I control all your systems and continuously monitor them) – your nasty clip will be shared with public straight away. > There’s no point in looking for me too – it won’t result in any success. Transactions with cryptocurrency are completely anonymous and untraceable. > There’s no point in reinstalling your OS on devices or trying to throw them away. That won’t solve the issue, since all clips with you as main character are already uploaded on remote servers.” This section is essentially objection handling. The scammer anticipates common reactions—talking to someone, calling the police, reinstall your system—and tries to shut them down. The claim that the email address was “created inside your inbox” is particularly revealing. It’s an attempt to make a generic sender address look like evidence of compromise. “Things that may be concerning you: > That funds transfer won’t be delivered to me. Breathe out, I can track down everything right away, so once funds transfer is finished, I will know for sure, since I interminably track down all activities done by you (my Trojan virus controls all processes remotely, just as TeamViewer).” Referencing TeamViewer, a legitimate remote‑access tool, is another tactic we’ve seen in recent sextortion emails.. It helps the scammer anchor their story to something users may have heard of or used at work. But there is still no evidence of remote access, and the claim that the malware “controls all processes” ignores how real operating systems and security controls work. “> That your videos will be distributed, even though you have completed money transfer to my wallet. Trust me, it is worthless for me to still bother you after money transfer is successful. Moreover, if that was ever part of my plan, I would do make it happen way earlier! We are going to approach and deal with it in a clear manner! In conclusion, I’d like to recommend one more thing… after this you need to make certain you don’t get involved in similar kind of unpleasant events anymore! My recommendation – ensure all your passwords are replaced with new ones on a regular basis.” Ending with security advice is a manipulative touch. By offering helpful recommendations, the scammer tries to appear credible and trustworthy rather than criminal. It doesn’t change the fact that the email contains no evidence that any of the claims are true. How to react to sextortion emails This example is unusually badly written, but many sextortion emails are far more polished and convincing. Regardless of how professional they look, they should be treated the same way: as unsubstantiated threats designed to scare victims into paying. First and foremost, never reply to emails of this kind. Responding confirms that someone is actively reading messages sent to that address and may encourage further scam attempts. Don’t let yourself get rushed into action or decisions. Scammers rely on the fact that you will not take the time to think this through and subsequently make mistakes. Ask for advice if you’re not sure. An attachment is not proof. Most sextortion emails contain no evidence at all, and cybercriminals often use attachments to spread malware or make their threats appear more convincing. If the email includes a password you have used before, change it immediately anywhere it’s still in use. Then enable two-factor authentication wherever possible. If you are having trouble organizing your passwords, consider using a password manager. Delete the message, report it as spam, and move on. While these sextortion emails are almost always bluffs, if you’re concerned about webcam spying, Malwarebytes Webcam Monitoring can alert you when applications attempt to access your camera.

Security experts have warned that an Iranian ransomware group has returned with enhanced evasion, execution and anti-forensics capabilities. Previously linked to Tehran and usually targeting victims aligned with the regime’s interests, Pay2Key has been active since 2020. However, a new report from Halcyon and Beazley Security warned that “recent US-Iran tensions appear to have accelerated activity from the group.” The report dissected a new attack on a US healthcare provider which appeared to show an evolving set of TTPs. It’s unclear whether the group bought access from an initial access broker or performed reconnaissance on the victim itself. However, with a foothold in the network, the actors used TeamViewer to establish “interactive access” and then began harvesting passwords for lateral movement, using Mimikatz, LaZagne, and ExtPassword. They then used “Advanced IP Scanner" and ns.exe (presumed to be NetScan) to find hosts and validate credentials, the report explained. “The threat actors used harvested credentials to pivot across systems, and interacted with Active Directory via dsa.msc, the built-in AD ‘Users and Computers’ console. We believe this was to prevent tooling from automatically flagging the access as anomalous or suspicious,” it continued. “We believe this was used to identify accounts to be used in concert with ransomware deployment as well as accessing an assortment of backup-related software on victim hosts. Backup systems enumerated include IBackup, Barracuda Yosemite, and Windows Server Backup.” Ransomware execution was performed through a self-extracting 7zip archive (SFX), abc.exe, which is consistent with previous campaigns. Encryption of the entire infrastructure took just three hours. The group also deployed a "No Defender" evasion toolkit, which it then removed to hide its tracks. There was no evidence of data exfiltration, which the report authors claimed “could be due to targeted destruction of evidence by the group.” Questions Over Iran Links The attack follows a previous campaign analyzed by Morphisec that coincided with US missile strikes on Iran last year. Since July 2025, the group has received more than $8m in ransom payments linked to 170 victims. This could indicate that Pay2key remains an Iranian-linked operation whose attacks intensify during periods of geopolitical tension involving the country – but it’s not a given. “The group's attempted sale of its entire operation in late 2025, combined with observed ties to Russian-speaking threat actors on criminal forums, raises unresolved questions about the current ownership, operational control and future trajectory of the group's RaaS platform,” the Halcyon report noted. Whatever the ownership, however, network defenders should be aware of the threat it poses, the report concluded. “The group does not always appear to prioritize extortion and financial gain over the destruction of victim environments for strategic impact,” it said. “Defenders should treat these findings as a clear signal that Pay2Key remains an active, unpredictable, and politically motivated threat whose tactics and objectives warrant ongoing monitoring and proactive intelligence sharing across the security community.”

We’ve become aware of a scam campaign sending fake calendar invites that impersonate Malwarebytes and attempt to trick recipients into calling a scam “billing support” number. We have written before about how calendar invites can be abused for phishing, and even about how Google Calendar invites can be weaponized to steal private data. The amounts in these fake invites are large and attention-grabbing, usually several hundred dollars for multiple years of service. The scammers want you to believe a considerable charge has already gone through so that you react immediately instead of thinking critically. The goal is to get you to call, rather than click a link. The calendar description reads like a receipt, but the real call to action is always the same: urging you to call a number immediately to dispute or cancel the charge. Once you call, the scammer can pressure you in real time. They might ask for payment details, convince you to install remote-access software, or manipulate you into sending money. What the fake calendar invite looks like The body of the calendar invite is crammed with fake details intended to look like they came from a billing system: Multiple ID lines, such as Membership ID, Client UID, Customer ID, Service Number A string of made-up transaction or account codes The language and formatting scream copied-and-pasted scam script rather than professional communication. There are several inconsistencies you can look for: Unnatural or incorrect phrasing: “Membership Duration: 4yrold” “We’re thrilled to have you with us for another year!” (in a 4-year renewal notice) “Your membership benefits remain fully active.” Inconsistent capitalization and formatting: “FOUR YEAR (All Caps)” “04 Year” “USD344.55” Phone numbers written with odd punctuation: 1.810.228.8708 1 865 3849684 Overly effusive, generic greetings and closings: “Dear Sir/Madam,” “Greetings to all,” “Hello there” “Yours in Respect,” “Much Gratitude,” “Always Appreciative,” “With Joy, best regards,” Individually, any one of these might just be sloppy writing. Seeing many of them together in an unsolicited billing notice is a strong indicator of fraud. What happens if you call the number The calendar invite itself doesn’t charge you anything. Its purpose is to trick you into calling the scammer’s phone number. Once they have you on the line, several things can happen. Stealing payment card and bank details A common script goes like this: You call, upset about the huge “renewal.” The scammer agrees it’s a mistake and says they can “reverse the charge.” They then ask for: Your full card number, expiry date, and CVV. Your bank account and routing number. One-time passcodes sent by your bank “to confirm the refund.” Once they have that information, they can: Make unauthorized purchases or withdrawals. Enroll you in other fraudulent subscriptions. Use your card details for further identity theft. The phony renewal is just a pretext to make handing over financial data feel reasonable. Convincing you to send money directly In some versions, the scammer pretends to refund you too much. They may: Ask you to log in to online banking while they’re on the phone. Direct you to move money or manipulate your account, sometimes with remote-access software. Claim there’s been an error, and you must “return” the over-refund, often via unusual methods like gift cards, cryptocurrency, wire transfer, or peer-to-peer payment apps. The result is that you send them real money to fix a problem that never existed. Getting remote access to your computer Tech support-style scammers often escalate the call by asking you to install legitimate remote-access tools like AnyDesk, TeamViewer, and others. They claim they need access: to cancel the subscription to verify your account or to help you process the refund Once on your machine, they can: Capture passwords and session cookies Move files or install malware Manipulate what you see in your browser (for example, by editing HTML to “prove” a refund went through) The longer they stay connected, the more damage they can do. Harvesting personal information for later fraud Even if you hang up before giving bank details, the scammer may still try to extract: Full name, address, and date of birth Email addresses and passwords to “locate your account” Answers to common security questions (first school, mother’s maiden name, etc.) Combined with other breached data, this information can be used later for: New account fraud (like opening loans or credit cards in your name) Account takeovers of your email, cloud storage, or other services Targeted phishing attacks that reference the earlier call Building trust for future scams Don’t be fooled. The person on the phone will usually sound patient, polite, and professional. They’re trying to convince you they work for the company named in the invite and normalize the idea that you should call them any time there’s a billing issue. Once they’ve gained your trust, they may: Call you back weeks or months later with a new story Sell your details to other scammers who know you’re likely to respond The one constant: they want you to act quickly and privately. The objective is to rush you into dealing with them, and only them, instead of checking independently with your bank or the real company. How to recognize calendar scams Legitimate companies send invoices and renewal confirmations as emails, in-app messages, or account notifications. They don’t send them as calendar appointments created by random people using private email addresses. Red flags include: The “bill” appears as an event in Google Calendar, Outlook, or another calendar app. The title looks like a transaction status instead of a meeting: - “Subscription Renewal Notice: [random code]” - “Payment Processed Successfully: [random code]” - “Renewal Approved: [random code]” You didn’t schedule this event yourself. If a “receipt” shows up in your calendar instead of through your normal billing channels, treat it as suspicious by default. How to remove fake entries from your calendar We’ve included instructions in our article how to remove fake entries from your calendar, which covers how to do it on Outlook calendar, Gmail calendar, Android calendar, Mac calendar, and iPhone and iPad calendars. How to prevent calendar spam We’ve covered some of this already, but the main precautions are: Turn off auto-add or auto-processing so invites stay as emails until you accept them. Restrict calendar permissions so only trusted people and apps can add events. In shared or resource calendars, remove public or anonymous access and limit who can create or edit items. Use an up-to-date real-time anti-malware solution with a web protection component to block known malicious domains. Don’t engage with unsolicited events. Don’t click links, open attachments, or reply to suspicious calendar events such as “investment,” “invoice,” “bonus payout,” “urgent meeting”—just delete the event. Enable multi-factor authentication (MFA) on your accounts so attackers who compromise credentials can’t abuse the account itself to send or auto-accept invitations. Pro tip: If you’re not sure whether an event is a scam, you can paste the message into Malwarebytes Scam Guard. It can help you decide what to do next. IOCs Phone numbers involved in these scams are: (810) 228-2614 (810) 228-8708 (810) 268-6113 (865) 384-9684 (865) 385-0070 Something feel off? Check it before you click. Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly. Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.

Cybersecurity researchers have disclosed details of a new mobile spyware platform dubbed ZeroDayRAT that's being advertised on Telegram as a way to grab sensitive data and facilitate real-time surveillance on Android and iOS devices. "The developer runs dedicated channels for sales, customer support, and regular updates, giving buyers a single point of access to a fully operational spyware panel," Daniel Kelley, security researcher at iVerify, said. "The platform goes beyond typical data collection into real-time surveillance and direct financial theft." ZeroDayRAT is designed to support Android versions 5 through 16 and iOS versions up to 26. It's assessed that the malware is distributed via social engineering or fake app marketplaces. The malicious binaries are generated through a builder that's provided to buyers along with an online panel that they can set up on their own server. Once the malware infects a device, the operator gets to see all the details, including model, location, operating system, battery status, SIM, carrier details, app usage, notifications, and a preview of recent SMS messages, through a self-hosted panel. This information allows the threat actor to profile the victim and glean more about who they talk to and the apps they use the most. The panel also extracts their current GPS coordinates and plots them on Google Maps, along with the history of all locations they have been to over time, effectively turning it into spyware. "One of the more problematic panels is the accounts tab," Kelley added. "Every account registered on the device is enumerated: Google, WhatsApp, Instagram, Facebook, Telegram, Amazon, Flipkart, PhonePe, Paytm, Spotify, and more, each with its associated username or email." Some of the other capabilities of ZeroDayRAT include logging keystrokes, gathering SMS messages -- including one-time passwords (OTPs) to defeat two-factor authentication, as well as allowing hands-on operations, such as activating real-time surveillance via live camera streaming and a microphone feed that allows the adversary to remotely monitor a victim. To enable financial theft, the malware incorporates a stealer component that scans for wallet apps like MetaMask, Trust Wallet, Binance, and Coinbase, and substitutes wallet addresses copied to the clipboard to reroute transactions to a wallet under the attacker's control. There also exists a bank stealer module to target online mobile wallet platforms like Apple Pay, Google Pay, PayPal, along with PhonePe, an Indian digital payments application that allows instant money transfers with the Unified Payments Interface (UPI), a protocol to facilitate inter-bank peer-to-peer and person-to-merchant transactions. "Taken together, this is a complete mobile compromise toolkit, the kind that used to require nation-state investment or bespoke exploit development, now sold on Telegram," Kelley said. "A single buyer gets full access to a target's location, messages, finances, camera, microphone, and keystrokes from a browser tab. Cross-platform support and active development make it a growing threat to both individuals and organizations." The ZeroDayRAT malware is similar to numerous others that have targeted mobile device users, either via phishing or by infiltrating official app marketplaces. Over the past few years, bad actors have repeatedly managed to find various ways to bypass security protections put in place by Apple and Google to trick users into installing malicious apps. Attacks targeting Apple's iOS have typically leveraged an enterprise provisioning capability that allows organizations to install apps without the need for publishing them to the App Store. By marketing tools that combine spyware, surveillance, and information-stealing capabilities, they further lower the barrier of entry for less skilled hackers. They also highlight the evolving sophistication and persistence of mobile-focused cyber threats. News of the commercial spyware platform coincides with the emergence of various mobile malware and scam campaigns that have come to light in recent weeks - An Android remote access trojan (RAT) campaign has used Hugging Face to host and distribute malicious APK files. The infection chain begins when users download a seemingly harmless dropper app (e.g., TrustBastion) that, when opened, prompts users to install an update, which causes the app to download the APK file hosted on Hugging Face. The malware then requests accessibility permissions and access to other sensitive controls to enable surveillance and credential theft. An Android RAT called Arsink has been found to use Google Apps Script for media and file exfiltration to Google Drive, in addition to relying on Firebase and Telegram for C2. The malware, which allows data theft and complete remote control, is distributed via Telegram, Discord, and MediaFire links, while impersonating various popular brands. Arsink infections have been concentrated in Egypt, Indonesia, Iraq, Yemen, and Türkiye. A document reader app named All Document Reader (package name: com.recursivestd.highlogic.stellargrid) uploaded to the Google Play Store has been flagged for acting as an installer for the Anatsa (aka TeaBot and Toddler) banking trojan. The app attracted over 50,000 downloads before it was taken down. An Android banking trojan called deVixor has been actively targeting Iranian users through phishing websites that impersonate legitimate automotive businesses since October 2025. Besides harvesting sensitive information, the malware includes a remotely triggered ransomware module capable of locking devices and demanding cryptocurrency payments. It uses Google Firebase for command delivery and Telegram-based bot infrastructure for administration. A malicious campaign codenamed ShadowRemit has exploited fake Android apps and pages mimicking Google Play app listings to enable unlicensed cross-border money transfers. These bogus pages have been found to promote unauthorized APKs as trusted remittance services with zero fees and improved exchange rates. "Victims are instructed to send payments to beneficiary accounts/eWallet endpoints and provide transaction screenshots as proof for verification," CTM360 said. "This approach can bypass regulated remittance corridors and aligns with mule-account collection patterns." An Android malware campaign targeting users in India has abused the trust associated with government services and official digital platforms to distribute malicious APK files through WhatsApp, leading to the deployment of malware that can steal data, establish persistent control, and run a cryptocurrency miner. The operators of an Android trojan and cybercrime tool called Triada have been observed using phishing landing pages disguised as Chrome browser updates to trick users into downloading malicious APK files hosted on GitHub. According to an analysis by Alex, attackers are "actively taking over long-standing, fully verified advertiser accounts to distribute malicious redirects." A WhatApp-oriented scam campaign has leveraged video calls, in which the threat actor poses as a bank representative or a Meta support and instructs them to share their phone's screen to address a purported unauthorized charge on their credit card, and install a legitimate remote access app, such as AnyDesk or TeamViewer, to steal sensitive data. An Android spyware campaign has leveraged romance scam tactics to target individuals in Pakistan to distribute a malicious dating chat app dubbed GhostChat to exfiltrate victims' data. It's currently not known how the malware is distributed. The threat actors behind the operation are also suspected to be running a ClickFix attack that infects victims' computers with a DLL payload that can gather system metadata and run commands issued by an external server, as well as a WhatsApp device-linking attack called GhostPairing to gain access to their WhatsApp accounts. A new family of Android click fraud trojans called Phantom has been found to leverage TensorFlow.js, a JavaScript machine learning library, to automatically detect and interact with specific advertisement elements on a site loaded in a hidden WebView. An alternative "signaling" mode uses WebRTC to stream a live video feed of the virtual browser screen to the attackers' server and allow them to click, scroll, or enter text. The malware is distributed via mobile games published to Xiaomi's GetApps store and other unofficial, third-party app stores. An Android malware family called NFCShare has been distributed via a Deutsche Bank phishing campaign to deceive users into installing a malicious APK file ("deutsche.apk") under the pretext of an update, which reads NFC card data and exfiltrates it to a remote WebSocket endpoint. The malware shares similarities with NFC relay malware families like NGate, ZNFC, SuperCard X, PhantomCard, and RelayNFC, with its command-and-control (C2) server previously flagged as associated with SuperCard X activity in November 2025. In a report published last month, Group-IB said it has witnessed a surge in NFC-enabled Android tap-to-pay malware, most of which is advertised within Chinese cybercrime communities on Telegram. The NFC-based relay technique is also referred to as Ghost Tap. "At least $355,000 in illegitimate transactions have been recorded from one POS vendor alone throughout November 2024 – August 2025," the Singapore-headquartered cybersecurity company said. "In another observed scenario, mobile wallets preloaded with compromised cards are used by mules across the globe to make purchases." Group-IB also said it identified three major vendors of Android NFC relay apps, including TX-NFC, X-NFC, and NFU Pay, with TX-NFC amassing over 25,000 subscribers on Telegram since commencing operations in early January 2025. X-NFC and NFU Pay have more than 5,000 and 600 subscribers on the messaging platform, respectively. The end goal of these attacks is to trick victims into installing NFC-enabled malware and tapping their physical payment cards on their smartphone, causing the transaction data to be captured and relayed to the cybercriminal's device through an attacker-controlled server. Once the card details are exfiltrated, a dedicated app installed on the money mule's device is used to complete payments or cash-out as though the victims' cards were physically present. Calling tap-to-pay scams a growing concern, Group-IB said it observed a steady increase in the detection of malware artifacts between May 2024 and December 2025. "At the same time, different families and variants are also appearing, while the old ones remain active," it added. "This indicates the spread of this technology among fraudsters."

SPONSORED FEATURE The security landscape is getting more perilous day by day, as both nation-state groups and financially-motivated hackers ramp up their activity. According to a PwC report late last year, both the number and scale of cyber incidents are increasing rapidly. Globally, 36 percent of businesses experienced a data breach costing them more than $1 million last year, up from just 27 percent in 2023. And this in turn means that the compliance landscape is becoming increasingly complex. The EU's NIS2 cybersecurity directive came into force last year, aiming to enhance cybersecurity across the bloc, with the Digital Operational Resilience Act (DORA) mandating various security practices for the financial sector. In the US, legislation consists of a combination of federal laws, sector-specific legislation such as the Health Insurance Portability and Accountability Act (HIPAA), and various different state laws. And, in the UK, the Cyber Resilience Bill looks set to come into force late this year or early next, building on the existing Network and Information Security (NIS) regulations with new requirements covering digital supply chains, strengthening the powers of regulators, and improving mandatory incident reporting. "There are many compliance requirements that have come up over the last couple of years: when we talk about NIS2, for example, or the UK's Cyber Resilience Bill, but also in the product space," says Jan Bee, Chief Information Security Officer at TeamViewer, a global leader in digital workplace solutions. "There's quite an overlap between all of those: it's really about fundamental security, and to be able to respond to the threats we are seeing out there in an effective and scalable way." All this means that organizations managing distributed work forces and complex IT infrastructures need to change the way they approach cybersecurity and operational resilience. This means building systems that can adapt to the evolving threats and regulations of the future. In the past, the usual approach was to define an overall security program and Information Security Management System (ISMS) and compliance was then a check-box operation. But, says Bee, all this has changed. "If you define your measures, even before you go into a compliance certification audit nowadays, for example, your measures are already tested by various threat actors out there. It has fundamentally changed how we should think about compliance because of the speed we need to operate at, the speed needed to remediate," he says. "We cannot spend ages figuring out how to restructure something, how to define things. We need to act." Security, baked in TeamViewer's own products, including its TeamViewer DEX platform, designed to monitor and improve the digital employee experience, are built from the start with this in mind, in a security-first approach. The 'shift left security' philosophy, which has been gaining prominence over the last couple of years, means incorporating security at the earliest possible stages of the software development lifecycle (SDLC). "I'm happy about how we managed to incorporate this at TeamViewer," says Bee. "At TeamViewer we have weekly security meetings with our product managers, and they tell us what's planned, what they have in mind and even in this early ideation phase, we discuss what could go wrong and how to adjust the idea or what to take care of in particular during the implementation." As a result, TeamViewer builds enterprise-grade protections into the foundation of every product. These go beyond simple encryption or access controls to include comprehensive audit trails, granular permission management, and proactive threat detection. TeamViewer uses AES-256 encryption that runs end-to-end with all the sensitive data encrypted. Every connection is verified, every time, and device health checks are carried before access is granted. There are role-based access controls, and enterprises can define a list of trusted devices to minimize the chances of unauthorized access. Session activity is logged and recorded, helping with detection and, crucially, compliance. And through TeamViewer Remote and TeamViewer ONE, organizations can securely connect to their IT systems from any location. "It's also about things like how we enable our customers to get visibility into our solution. It's not any more just about the features, it's also about supporting our customers to make our solution most effectively secure at scale," says Bee. "Our customers can go into our security center, for example, and understand what we recommend and how to prioritize these security measures to secure our solution in the best possible way, looking at their specific use-case and needs." A nice hot cup of security In terms of real-world deployments, Bee cites coffee machine La Cimbali. The firm previously relied on technicians, either from Cimbali Group or one of their distributors, who would then investigate and troubleshoot the problem on-site. However, Cimbali Group's fully automatic Series S machines now ship with the TeamViewer client installed. If a customer encounters an issue, they can open a support ticket with their Cimbali Group's service partner and create a session by pressing the TeamViewer icon on the machine's display. Technicians from Cimbali Group or one of its distributors then have reliable and secure remote access to the coffee machine screen, almost as if they were on-site. "You have a coffee machine at a restaurant, quite an expensive device. And these are smart devices now, so you can just go to the menu and basically press a button to get support, where the manufacturer or partner are able to connect to these devices and support you remotely," he says. "I really like this approach, because the problem is solved where the issue actually is, on the UI control panel of a coffee machine. It's quite different from what you usually have, where someone needs to travel there. You solve this issue remotely and at scale." The company says it's seen a 20 percent increase in technician efficiency, alongside reduced service travel costs of up to 15 percent. Achieving this, though, often requires integrations with existing software that need to be as seamless as possible. "Speaking of integrations, for TeamViewer Remote and Tensor, there is the Intune integration, where we allow customers to create sessions directly from their Intune console," says Bee. "And if they already have this trust relationship via Microsoft Intune and they have their devices managed there, then it's easy for us to integrate there in this flow, and allow the IT service desk to address a specific device in their fleet." Thinking about security in four dimensions Third-party and fourth-party risk are becoming an increasing problem. The recent Salesloft Drift breach, for example, is believed to have impacted around 700 organizations. It saw attackers bypassing MFA, exploiting OAuth tokens from the Drift–Salesforce connector to gain unrestricted access to sensitive customer data, cloud credentials, and other critical assets. "This is a really important reminder to all of us that it's not just third-party, but also fourth-party risk," says Bee. "You need to think about how many SaaS applications your organization is using, maybe a couple of hundred, maybe even thousands of applications." "And then it's about understanding for each of them what they need to do to secure them and prevent these fourth-party integrations or at least be able to governance them and control them and get this visibility." Soon to appear in TeamViewer products is the TeamViewer Security Center, giving customers recommendations on what they should focus on, and how they can prioritize over time as users, devices and configurations change. "Similarly, I also envision this for the fourth-party risk and security configuration," says Bee. "And then it comes from the manufacturer of these solutions. They know their solution best, and can give you the right recommendations to address these issues." Speaking of knowing solutions best, Bee is also enthusiastic about TeamViewer's bug bounty programs, through which independent security researchers check out the company's products for bugs and vulnerabilities in return for payment. "We just had a live hacking event last month at Nullcon Berlin that was very successful, and also got us much closer to this community, nicely complementing our overall security program," he says. A comprehensive look at every stage of the secure development lifecycle is crucial. The company also works to define something that it calls a "security RICE" (Reach, Impact, Confidence and Effort) at the early stage of product development to be able to adequately measure security aspects during general feature planning. "The impact could be as simple as closing a weakness, for example, or proving a compliance requirement, or something that's maybe demanded by a certain standard or new compliance needs coming up, but also even things like the ease of use and user experience when it comes to security" says Bee. "It's all really about compliance in various facets. When devices deviate it puts them at risk for various reasons and in various directions. Being able to become aware and address these issues, particularly in large fleets with solutions like TeamViewer ONE, is so important to keeping up with the fast-paced developments we are seeing." Sponsored by TeamViewer.

An ongoing phishing campaign is targeting LastPass and Bitwarden users with fake emails claiming that the companies were hacked, urging them to download a supposedly more secure desktop version of the password manager. The messages direct recipients to download a binary that BleepingComputer has discovered installs Syncro, a remote monitoring and management (RMM) tool used by managed service providers (MSP) to streamline IT operations. The threat actors are using the Syncro MSP program to deploy the ScreenConnect remote support and access software. 'Vulnerable' old .EXE installs In a threat alert this week, LastPass makes it clear that the company did not suffer any cybersecurity incident and that the messages are a social engineering effort by a threat actor. "To be clear, LastPass has NOT been hacked, and this is an attempt on the part of a malicious actor to draw attention and generate urgency in the mind of the recipient, a common tactic for social engineering and phishing emails," LastPass says. According to the company, the campaign started over the weekend, presumably to take advantage of the reduced staffing over the Columbus Day holiday weekend and delay detection. The phishing emails are well crafted and urge recipients to install a more secure desktop app that LastPass developed as an MSI replacement for the "outdated .exe format" that had weakenesses that allowed access to vault information. “Attackers exploited weaknesses in older .exe installations, which could, under certain conditions, allow unauthorized access to cached vault data,” reads the fake security alert from the threat actor. LastPass notes that the fake messages come from ‘hello@lastpasspulse[.]blog’ but BleepingComputer also saw emails delivered from ‘hello@lastpasjournal[.]blog’. Bitwarden users also targeted The phishing emails also impersonate Bitwarden and share the same writing style and lure in an attempt to create a sense of urgency and convince recipients to follow the download link to an improved deskop application. Yesterday, BleepingComputer received a notice from ‘[email protected]’ describing a similar security incident that prompted the release of a secure client app that users need to install. At the time of writing, Cloudflare is blocking access to the landing pages included in the fraudulent emails and is marking them as phishing attempts. Legitmate tools for remote access BleepingComputer retrieved the binary samples distributed in the phishing emails targeting LastPass and Bitwarden users and found that they are functionally the same. The malware installs the Syncro MSP platform agent with parameters that hide its system tray icon in an effort to keep the user unaware of the new tool. Based on our observations, Syncro's single purpose appears to be to deploy the ScreenConnect support tool as a "bring-your-own" installer, which gives the threat actor remote access to the endpoint. The Syncro agent is configured with very few options, suggesting that the threat actor limited to just the functionality they needed. The configuration files shows that the agent checks in with the server every 90 seconds. It does not have enabled the built-in remote access and doesn't deploy the remote support utilities Splashtop, which is bundled with the Syncro platform, or TeamViewer, for which an integration exists. Furthermore, the extracted configuration did not contain policies to deploy security solutions on the compromised endpoint, and disabled the Emsisoft, Webroot, and Bitdefender agents. Once ScreenConnect is installed on a device, the threat actors can remotely connect to a target's computer and deploy further malware payloads, steal data, and potentially access the password vaults of users through saved credentials. Phishing for 1Password accounts Last week, another campaign targeted 1Password users with emails falsely warning that their accounts had been compromised. The indicators for that activity, from the wording in the message and landing URL, to the sender address (watchtower@eightninety[.]com) were different. Researchers at cybersecurity company Malwarebytes say that users clicking on an embedded button were taken to a phishing page (onepass-word[.]com) via a Mandrillapp redirection. The attacks targeting 1Password were first reported by Brett Christensen (Hoax-Slayer) on September 25. Users of password management tools should ignore such alerts and always login to the provider’s official website to check for any security alerts pending review. Important security incidents like those claimed in the emails are also broadly communicated across the companies’ blogs and via press releases, so double-checking on official channels is always a good practice. It is also worth remembering that companies won't ever ask for the master password to your vaults. Update 10/16 - Syncro sent the below statement to BleepingComputer regarding the phishing campaign: "We identified the malicious accounts and have shut down the installs to ensure that no further agents can be installed. The Syncro platform itself was not compromised but rather a malicious actor posing as an MSP that created this account and then used it for nefarious purposes." - A Syncro spokesperson Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Windows 10 has reached end of support (EOS) today, October 14, 2025, but the operating system is still running on hundreds of millions of devices. With Windows 10 reaching EOS, Microsoft will no longer provide free software updates, technical support, or security patches. PCs running Windows 10 will continue to work, but they will become increasingly vulnerable to malware and other cyberattacks as new threats emerge and no patches are released. For users who cannot immediately upgrade to Windows 11, Microsoft has launched the Extended Security Updates (ESU) program. In order to enroll into the ESU program and get important security updates until October 13, 2026, consumers will be charged $30, while commercial organizations will have to pay $61 per device. The price will double each year for organizations that want ESU for up to three years. Individuals can also get extended security updates free of charge by using Windows Backup to sync their settings to the cloud, or by redeeming 1,000 Microsoft rewards points, which users earn for engaging with Microsoft products and services, such as Bing, Xbox and Microsoft Store. In addition, Microsoft announced recently that ESU will be free for users in the European Economic Area (EEA). It’s unclear how many users will opt for ESU, but a large number of devices will likely become increasingly vulnerable to attacks in the next months as Windows 10 still appears to have a market share of at least 40%, as reported recently by several third-party companies. Statcounter data for September 2025 showed that while Windows 11 had been running on nearly half of desktop machines, Windows 10 was also still installed on just over 40% of devices. An analysis conducted by remote access and support giant TeamViewer showed that more than 40% of global endpoints that recently received support via its software had been running Windows 10. TeamViewer’s analysis — based on 250 million remote support connections — showed that Windows 11 had been running on 47% of devices. Cybersecurity firm Kaspersky has also analyzed data collected from its customers and found that only 33% have upgraded to Windows 11 and 53% are still using Windows 10. Moreover, in the case of corporate users, Windows 10 is still present on nearly 60% of systems. Data shared by Microsoft in recent years puts the number of Windows users at well over one billion, which means hundreds of millions of computers are still running Windows 10. On the other hand, many organizations may be in the process of upgrading their devices. IDC reported last week that PC shipments during the third quarter of 2025 increased 9.4% compared to the prior year (global volumes reached 75.8 million units), and the surge is at least partly fueled by the transition to Windows 11. “Updating or decommissioning every endpoint is a major task, especially for larger enterprises,” said Jon Abbott, CEO and co-founder of ThreatAware. “Upgrading raises concerns about system reliability, prompting some organisations to delay migration until they are confident that critical systems will run smoothly.” Abbott pointed out that while ESU is a viable temporary solution, “In the long term, organisations must ensure that every Windows 10 device within their IT estate is either updated or decommissioned.” “Effective discovery requires consolidating data from sources such as Active Directory, SCCM, Intune and help desk logs, as well as identifying unmanaged BYOD and home-office PCs through agentless scanning. Only with comprehensive, up-to-date visibility can IT teams correctly prioritise assets and avoid unpleasant surprises mid-migration,” Abbott explained. He added, “Once the full scope of the challenge is understood, the next step is to set priorities. Not all endpoints merit equal urgency. Teams with Windows 10 devices handling sensitive data under GDPR, SOX or PCI-DSS should move to the front of the queue.” Related: Senator Urges FTC Probe of Microsoft Over Security Failures

A significant proportion of individual users and organizations still run the Windows 10 operating system, just days before it reaches its end-of-life date, raising cybersecurity concerns. On October 14, Windows 10 systems are will no longer receive security or feature updates, meaning that any new vulnerabilities will be left unpatched. Remote desktop provider TeamViewer has revealed that over 40% of global endpoints that recently received support via a TeamViewer session still run Windows 10. Additionally, a survey by UK consumer champion website Which? found that 26% of UK Windows 10 users do not plan to upgrade their operating system once support ends. A further 11% of respondents said they were unsure of their plans moving forward. Windows 10 Deadline a Security Cliff Edge Microsoft has urged all Windows 10 customers to upgrade to Windows 11 ahead of the deadline. Similarly, the UK’s National Cyber Security Centre (NCSC) has urged Microsoft customers to upgrade before October 11. The agency highlighted past cases where cybercriminals exploited unpatched versions of the legacy Windows XP system. This includes the WannaCry ransomware attack in 2017, which severely impacted NHS services in the UK. Dr Yvonne Bernard, CTO at Hornetsecurity, warned that the switch off for Windows 10 support is a cybersecurity and compliance “cliff edge” for many businesses that continue to use these products. “Companies that fail to act and continue using outdated Office packages could face the following consequences: the loss of Microsoft technical support, increased vulnerability to malware, higher maintenance costs and even denied cyber insurance claims,” she commented. Meanwhile, experts believe that attackers will ramp up their targeting of Windows 10 flaws once the end-of-life date passes. “Sticking with Windows 10 beyond October is like leaving your front door wide open in a bad neighborhood. There will be no more updates, patches, bug fixes or technical support; you are on your own. Any newly uncovered vulnerabilities will now be left open, zero days will be undefendable – it’s open season for attackers,” warned Charaka Goonatilake, CTO at Panaseer. Microsoft has said that the developments in Windows 11 will help ensure that users always have access to the latest security features and innovations. How to Start the Upgrade Process Today For individual Windows 10 customers that have not yet upgraded, the first step is to check to see whether devices are able to meet Windows 11 requirements. To do so, click the Start button, then go to Settings > Update & Security > Windows Update or use the PC Health Check app to see if your device meets the Windows 11 system requirements. Current Windows 10 users will need certain hardware requirements to upgrade. These include Trusted Platform Module (TPM) 2.0, Unified Extensible Firmware Interface (UEFI) and support for Secure Boot. For individual consumers who are unable or unwilling to upgrade by the deadline, Microsoft is offering an Extended Security Update (ESU) program for a one-time fee, providing a way of receiving critical security updates for Windows 10. ESU support for personal devices and will run from October 15, 2025, to October 13, 2026. At the enterprise level, organizations must firstly map out how and where Windows 10 is currently in use, by who and for what purpose. The next stage is prioritization, ensuring teams focus on upgrading the highest risk systems first, while also identifying where compensatory controls need to be applied. “Taking this pragmatic, data-driven risk-based approach helps security leaders to make the business case for investments. Organizations can then make informed decisions on what must be upgraded now, what can be protected in the short term, and what level of risk the business is actually willing to accept,” Goonatilake noted. Image credit: Hadrian / Shutterstock.com

In recent months, headlines have been dominated by the cybercrime collective known as Scattered Spider, also referred to as UNC3944, Scattered Swine, Octo Tempest, Storm-0875, and Muddled Libra. This loosely but highly organized group has launched a wave of attacks targeting retailers, insurers, and, most recently, airlines across multiple countries. Although British authorities arrested four suspects in July 2025, which led to a noticeable slowdown in activity, this may only be temporary. Scattered Spider is not a monolithic, state-sponsored operation. Rather, it is a decentralized collective, often composed of teenagers and young men emerging from online communities. The group first made headlines in 2023 with high-profile attacks on casino giants like MGM Resorts. Despite the consistency and visibility of their tactics, many organizations have failed to adequately strengthen their defenses. This raises the question: why have so few taken decisive actions to counter these persistent threats? Inside the Scattered Spider Playbook Scattered Spider engages in data extortion and a variety of other criminal activities. Its threat actors are known to deploy multiple ransomware variants in their attacks, most recently including DragonForce ransomware. While the group frequently adapts its tactics, techniques, and procedures (TTPs) to remain undetected, several methods remain consistent. Common TTPs include the following: Initial Access: The group extensively uses social engineering tactics such as phishing, push bombing (spamming multi-factor authentication prompts), and SIM swap attacks to steal credentials, install remote access tools, and bypass multi-factor authentication (MFA). Attack Execution: Leveraging living-off-the-land techniques, the attackers use native Windows tools such as PowerShell, Rundll32, WMIC, and Task Scheduler. This helps them avoid detection by traditional antivirus and endpoint detection and response (EDR) systems. Persistence: Scattered Spider abuses identity providers such as Okta, Microsoft Entra, and Active Directory to create backdoor administrative accounts, modify authentication workflows, and inject custom SAML tokens. They frequently use remote access tools like AnyDesk™, TeamViewer®, ScreenConnect™, and Splashtop® to blend in with legitimate IT activity. Privilege Escalation: The attackers enumerate internal accounts and groups, using built-in commands. They also exploit cloud privileges, such as roles in AWS or GCP, to escalate access and expand their footprint. Internal Reconnaissance: As with many advanced adversaries, the group maps out network topology to identify high-value systems such as domain controllers, file shares, and backup servers. They also extract sensitive data and credentials from platforms like Confluence, Jira, Slack, and SharePoint. Impact and Extortion: Scattered Spider often partners with ransomware groups such as ALPHV/BlackCat or RansomHub to encrypt data and issue ransom demands, typically requesting cryptocurrency. The group follows the broader trend of double or triple extortion, threatening to leak stolen data, contact regulators or customers, or launch follow-up attacks if demands are not met. The Help Desk Blind Spot One of Scattered Spider’s most effective and recognizable tactics involves impersonating IT help desk personnel via phone calls or text messages to obtain credentials or persuade employees to install remote access software. More recently, the group has reversed roles, now posing as employees to deceive IT or help desk staff into revealing sensitive information, resetting passwords, and transferring MFA tokens to attacker-controlled devices. In doing so, the attackers are exploiting a significant security oversight: IT help desks are often viewed as internal and inherently trustworthy, and as a result, are frequently excluded from multi-layered cybersecurity strategies. This is a critical blind spot that organizations must address immediately. How to Minimize Risk Exposure To reduce risks associated with Scattered Spider’s tactics, organizations should implement the following measures: Implement application controls, including white-listing for remote access tools Require phishing-resistant MFA such as FIDO2 or PKI-based authentication Restrict the use of Remote Desktop Protocol (RDP) and other remote access tools Develop and evaluate a robust business continuity plan, and maintain offline backups Enforce NIST-compliant password policies across all accounts Regularly patch and update all operating systems, applications, and firmware Restrict administrative privileges and use just-in-time access where possible To address the specific help desk vulnerability, organizations should introduce multi-step identity verification for all password resets and access recovery requests. Identity proofing and continuous verification are now essential components of any modern cybersecurity framework. They protect against identity-based threats, support compliance efforts, improve user experience, and strengthen organizational trust. Conclusion Scattered Spider and similar cybercriminal groups continue to represent a persistent and evolving threat. To stay ahead, organizations must implement holistic security strategies that cover all areas of their operations, including IT help desks. These often-overlooked teams have become prime targets. In a threat landscape increasingly shaped by social engineering and ransomware, proactive defense, layered protection, and closing internal security gaps are not optional; they are essential.

EXCLUSIVE Microsoft Recall, the AI app that takes screenshots of what you do on your PC so you can search for it later, has a filter that's supposed to prevent it from screenshotting sensitive info like credit card numbers. But a The Register test shows that it still fails in many cases, creating a potential treasure trove for thieves. Recall was introduced in 2024 as an exclusive app on Copilot+ PCs, which are laptops that come with a dedicated Neural Processing Unit (NPU) to help with AI-related tasks. Initially, researchers found serious security issues with it, and Redmond pulled it in the spring before re-introducing an ostensibly more secure version in fall 2024. These days, a screen encouraging you to enable it is part of the Windows setup experience on many new PCs. Although Microsoft claims that Recall is safe and private, the software could be a goldmine of personal information if a miscreant manages to break into your system. The app has a "Filter sensitive information" setting enabled by default that's supposed to exempt personal data such as credit card numbers and passwords from capture. However, according to our tests, that filter frequently fails. And there's no way it would know to avoid potentially damaging entries in your web history that you'd rather keep private (such as things related to your medical history or personal life). Just as bad, the screenshots Recall takes are available to anyone who has your PIN number, even via remote access. REG AD Sensitive information filtering: good, but not good enough REG AD To find out just how well the sensitive information filter works, I took a Lenovo Yoga Slim 7x Copilot+ PC with Recall enabled and tried entering many types of personal data that no one would want getting into the wrong hands. To give credit where it's due, the tool correctly identified and excluded a lot of financial data, some passwords, and most instances of Social Security numbers. When I logged into my bank account, Recall snagged both my bank's home page and several screens where my balance and a list of deposits appeared. On the bright side, it correctly excluded the screen with my account and ABA routing numbers on it. So an attacker would know which bank I use and how much money I have, both details that could help them, but not my credentials or account number. Recall did a pretty good job with shopping forms. When I went to the Microsoft site and added a credit card to my account, it took a screenshot with the card number, CVC and date fields blank. And when I created my own fake web page with a credit card entry form (with the letters CC: in front of the number field), the software filtered it out. However, when I removed text such as "checkout page" and "Enter payment info" from the form, leaving the credit card number, expiration date, and CVC, Recall captured it. Maybe it's unfair to expect the software to identify a credit card number without words like "credit card" or "pay" near it, but not all shopping forms look the same. The password blocking was mixed. When I opened up Google Chrome's password manager, Recall correctly filtered it out. The tool gets extra credit for not screenshotting this sensitive info, even when I took a screenshot of it in the Snipping Tool and displayed that on-screen. It also worked when I created a text file in Notepad with the words username and password in it. However, when I just listed usernames and passwords in a text file without those identifiers, it captured the screen. Perhaps we shouldn't expect Recall to know that a text file is full of passwords – and, no, you shouldn't keep your passwords in a text file – but many people probably have lists of their passwords without the word "password" printed next to them. There are so many ways that people store and refer to personal data that it's impossible to imagine Recall or any software catching them all. For example, when I entered a Social Security number in a Word document with the prefix "My SS#:" before it, the tool only captured an image with the first three digits in it. However, when I made the prefix "Soc:," it captured all the digits. When I logged into my PayPal account, Recall captured the login screen showing my username, but not my password. It correctly avoided screenshotting the account page, which showed my transactions, but if a bad actor had my username, that's some of the information they would need to get in. REG AD In another instance, I had a photo of my passport visible on the screen and Recall correctly avoided it. However, when that photo was partially covered by another window, Recall took the screenshot. A work in progress When contacted about our findings, Microsoft declined to comment. To be fair, though, Microsoft doesn't claim that Recall's sensitive data filter is perfect. In a blog post from November, when it officially started giving Windows Insiders access to the feature, Principal Product Managers Amanda Langowski and Brandon LeBlanc wrote that "we'll continue to improve this functionality, and if you find sensitive information that should be filtered out, for your context, language, or geography, please let us know through Feedback Hub." Users also have the option to block specific apps or websites from being screenshotted. To do so, you have to add them to a blacklist in Windows settings->Privacy & Security->Recall & snapshots. However, you'd have to anticipate in advance what you want to block. And, if you're really being diligent, you'd block your browser apps, which effectively makes Recall useless. Redmond also labels Recall as a "preview" app. However, if you're pushing the app during the Windows OOBE process on new laptops, it's hard to argue that it's in beta and therefore immune from criticism. Just how secure is Recall? Microsoft has also made a lot of noise about Recall's security. In June 2024, after security researcher and former Microsoft employee Kevin Beaumont detailed serious problems, including the fact that Recall's database was stored in plain text, the company pulled the product out of previews for several months and made some changes. In a September blog post from VP of Enterprise and OS Security David Weston, Microsoft detailed a number of security improvements. Most importantly, the snapshots and database are now encrypted and stored in a Virtualization-based Security Enclave (VBS). It also requires Windows Hello logins for you to view or search Recall snapshots. REG AD "Recall snapshots are available only after you authenticate using Windows Hello credentials," Weston wrote. "Specifically, Windows Hello Enhanced Sign-in Security biometric credentials protect your privacy and actively authenticate you to query your semantic indices and view associated snapshots." However, Weston didn't note that Windows Hello also supports using a PIN code for access, in addition to faces or fingerprints. So, if you have someone's PIN code or can guess it, you can access all of their Recall screenshots. Lack of physical access to the PC with the Recall data is not a blocker either. I installed free TeamViewer remote desktop software on the Copilot+ laptop and was able to view my entire Recall history from a second computer. When it asked for my face, I just gave it my PIN instead. It's also possible that the VBS enclave and encryption are not infallible. "Attackers have prior exploited side‑channel flaws in VBS and Hyper‑V to infer secrets from enclaves unless hyper-threading is disabled or fully patched," Huntress Security Senior SOC Manager Dray Agha told The Register. "So, administrators must apply all mitigations promptly and patch as Recall will inevitably become vulnerable to attacks over the years, which - as we know from multiple exploited vulnerabilities over the years - many folks simply do not do. Recall is an unnecessary security and privacy risk for not that much usability gain." Privacy risks: even worse for vulnerable users Privacy advocates are also concerned about the consequences of the wrong people gaining access to users' personal information. In July, the makers of Brave browser announced that it would be blocking Recall by designating every tab as "private," something which Microsoft's software respects. Peter Snyder, principal privacy researcher at Brave Software, told El Reg that the company is concerned about vulnerable users, such as domestic violence victims, being harmed by Recall screenshots. An abusive partner would be able to see that they were visiting websites that offer support, medical help, or a way to escape. "Many users need to hide certain bits of Web browsing from people who have access to their computer or phone," Snyder said. "Recall makes it extra-difficult for Brave to provide these kinds of protections because Recall isn’t designed to give software control over what is included in Recall’s snapshots." Snyder explained that Brave has a feature called "Off-the-Record," which helps users hide their browsing behavior, even from someone who has physical access to their PC. It has another feature called "Forgetful Browsing" that clears cookies and other storage from a site as soon as you leave it. Recall's screenshotting makes both of these features useless. Whether you're the type of person who blocks cookies or just someone who doesn't want your identity stolen, there are lots of reasons to be concerned about Recall. "I don't dispute that Microsoft has the best intentions at heart, along with doing as much as they can to ensure the security of this feature," said Sean Wright, Director of Application Security at Featurespace. "However, there are so many caveats, that I personally don't see how one would be able to have all these areas covered from a privacy and security concern." ®

Article written by cybersecurity expert Yuriy Tsibere. Gone are the days when cybersecurity meant stopping annoying viruses like the Love Bug. Today, it’s about battling a massive, financially motivated cybercrime industry. Attacks are smarter, faster, and more damaging—and that changes everything for product teams. For product managers (PMs), this means understanding that attackers are constantly exploiting the same weak spots: stolen admin credentials, missing multi-factor authentication (MFA) on VPNs, remote encryption, and clever “living off the land” (LOTL) tricks like using Office to launch PowerShell. Even something as simple as an unpatched firewall or a rogue USB drive can open the door to a breach. New vulnerabilities and zero-days are popping up all the time, and product teams have to stay on their toes. A few examples: WannaCry (2017): Used the EternalBlue flaw in SMBv1 to spread ransomware fast. It forced companies to disable SMBv1 altogether. Some Exchange Server bugs: Let attackers run malicious scripts, sometimes leading to ransomware. Log4j vulnerability: A vulnerability in a popular Java logging framework that enables arbitrary code execution. Still showing up in outdated firewalls and VPNs. Follina (MSDT): Let Office apps launch PowerShell without any user interaction. Timely patching helps, but it’s not enough. There’s always a gap between discovering a flaw and fixing it. That’s why teams need layered defenses and a mindset that’s ready to respond to incidents as they happen. How breach reports drive real-time product shifts The 100 days to secure your environment webinar series from ThreatLocker is a great example of incident-driven development. It helps security leaders focus on what matters most in their first few months. Real-world breaches often directly lead to new product features or policy changes. Here’s how: Unlocked machines: a threat actor once accessed a hospital computer that was left open and ran PowerShell. Now, password-protected screen savers are a must. USB data theft: USB drives are still a go-to for stealing data. Products now offer fine-grained USB controls—blocking unencrypted drives, limiting file types, or capping how many files can be copied. Lateral movement: Ransomware often spreads using old admin accounts. Tools now detect and remove these after review. LOTL attacks: Follina showed how legit tools can be misused. Ringfencing™ helps stop apps from launching things they shouldn’t. Outbound traffic abuse: Attacks like SolarWinds used outbound connections. Now, default-deny policies for server traffic are becoming standard. Stolen credentials: MFA is non-negotiable for cloud accounts, remote access, and domain controllers. Vulnerable VPNs: Unpatched VPNs are a big risk. Features now include IP-based access controls or even disabling unused VPNs. The PM's response: From advisory to actionable feature For cybersecurity PMs, reacting to threats means more than just writing advisories. It’s about building smarter, safer products. Here’s how: Get full visibility Start by understanding what’s running in your environment. Use monitoring agents to track file activity, privilege changes, app launches, and network traffic. Prioritize risks With a complete picture, PMs can focus on high-risk tools and behaviors: - Remote access tools like TeamViewer or AnyDesk - Software with too many permissions (e.g., 7-Zip, Nmap) - Risky browser extensions - Software from high-risk regions Drive adaptive policy creation Security policies should evolve with the threat landscape: - Test first: Use monitor-only mode and test groups before enforcing new rules. - Be precise: Go beyond on/off switches—use dynamic ACLs, Ringfencing, and app-specific admin rights. - Encourage adoption by minimizing disruption - Offer a store of pre-approved apps - Make it easy to request new software - Explain why restrictions exist—it builds trust - Continuous improvement and monitoring: - Use health reports to spot misconfigurations - Block USB file copies if thresholds are exceeded - Clean up old policies and unused apps regularly Embrace patch management Make sure everything—from operating systems to portable applications like PuTTY—is up to date. Use tools to find missing patches and test them with pilot users before rolling out. Protect backups Backups must be shielded from compromise. This includes limiting which apps can access them and requiring MFA for backup services. PMs should also test the backups regularly to validate recovery readiness. Cybersecurity PMs are on the front lines of using real-world protections against real-world threats. By staying informed, collecting the right data, and building with users in mind, you can reduce risk without making life harder for your team. Sponsored and written by ThreatLocker.