❌

Normal view

The Wackers’ Decades-Long Harassment Was One of Unsolved Mysteries’ Strangest Cases—New Information Has Finally Come to Light

25 July 2026 at 13:01

For the last 22 years, one of the most bizarre true crime stories ever to grace the program Unsolved Mysteries has confounded amateur investigators and spawned hundreds of pages of online speculation. Who was behind the decade-long torment of Bill and Dorthy Wacker in the 80s and 90s, which included allegations of stalking, robberies, and even assaults?

While any internet true crime enthusiast knows Unsolved Mysteries frequently left out interesting details that can create a rabbit hole of alternative explanations, in this case, the show has been the sole source of information, with no other known period news coverage of the harassment.

That is, until recently, when this author acquired the original police records, spanning almost 100 pages of material, while researching for my podcast, Cease to Exist. The records reveal a wealth of new information, including potential leads on suspects, and answers to questions true crime fans have speculated about for years.

Wackers
The Wackers claimed to be victims of a long-term harassment campaign. Credit: Film Rise/Unsolved Mysteries

Unsolved Mysteries

In the Unsolved Mysteries season 6 two-hour finale, airing in the spring of 1994, the public met Bill and Dorthy Wacker, an elderly couple from Massillon, Ohio, who claimed to be victims of a bizarre string of harassment stretching back years. Since then, their story has been the subject of considerable speculation, with some believing the whole affair was so unbelievable that the Wackers must have been making it up. On the other hand, Dorothy herself did seem to bear injuries consistent with the couple’s claims. Without any further information, true crime fans dissected every available scrap of evidence, including the accuracy of the reenactments, for possible clues.

“The Wackers are quiet, unassuming people who tend to mind their own business. Hardly the type to draw the wrath of an unseen enemy,” Unsolved Mysteries host Robert Stack said at the beginning of the segment.

The scene then opens with the couple returning to find their home ransacked on January 16, 1985. This was the third claimed incident, but according to the program, the first that was reported.

“After nearly 10 years, Dorothy and Bill Wacker still wonder who and why,” Stock intoned.

The Wacker’s Story

In interview footage with the couple, Bill speculates that someone may be attempting to force the couple to move, although why that would be was unclear, and refers to the perpetrator as “a kook,” which becomes a bit of a meme in online discourse about the case.

Six months after the previous break-in, Dorothy was home alone recovering from heart surgery when she heard a knock at the door. She found a young man who claimed his car had broken down and that he needed to use her telephone. Although she didn’t see a car anywhere, she let the polite stranger in. He made a call, thanked her, and appeared to leave.

Before she knew what had happened, Dorothy awoke tied up on her kitchen floor after having been struck in the head. A neighbor heard her cries through an open window and came to her aid. Although Dorothy’s injury was not serious, there were two strange elements to the crime. First was the graffiti “cheaper, but will do,” shown in the reenactment as having been left on the kitchen wall. Second was the variety of items stolen from the home, including a gun and radio receiver, which were later returned to the Wackers’ porch. Police were baffled by the return of a stolen gun and distributed fliers featuring a sketch of the suspect, but no identification was ever made.

Harassment continued with a series of threatening phone calls that persisted even after the family changed their number, according to Dorothy and her daughter Peggy Hoover. Additionally, nocturnal banging on the outside of the house began, which led the couple to install lights. The only result was a strange note on the front porch reading “your lights are a laugh,” and subsequent notes such as “you scum I’ll get even,” with a backside reading “this time ha ha.” The police never found any fingerprints on the notes and suggested they may have been made by someone using their opposite hand to disguise their handwriting.

Unsolved Mysteries Segment Wackers
The graffiti written on the Wackers’ wall in the Unsolved Mysteries Reenactment (Credit: Filme Rise/Unsolved Mysteries)

Second Attack and Stake Out

The most dramatic events yet occurred in the fall of 1993. Dorothy was walking her dog outside of their home on October 27th when she was attacked again. The segment claimed she suffered “skull lacerations” and was taken to the hospital, but there were no witnesses to the event. 

Notably, Sheriff Bruce W Umpleby says that after interviewing neighbors, no one had any information that led them to believe there was a person there. He continued that most crimes have simple motives and there has never been one identified for the strange periodic flurries of activity around the Wackers.

Things reached a climax when the family conducted a stakeout, hoping to finally capture the stalker one November evening. Bill hid inside a trailer in the driveway, while Dorothy and their daughter Cathy stayed inside the home. Across the street, their sons-in-law Dan and Clay sat in a vehicle in a neighbor’s driveway. After almost four hours, they decided to end the stakeout around 10:30 p.m., when they heard a loud bump on the porch. Incredibly, the stalker had apparently evaded the surveillance and thrown a rock onto the Wackers’ front porch with a note reading “get the message.”

At the conclusion of the segment, Bill says he hopes whoever is responsible is caught soon because, if the Wackers were no longer the targets, he feared the individual would simply target someone else.

Unsolved Mysteries Online Speculation

Besides noting that the sheriff’s department had asked Dorothy after the second attack whether Bill could have been the attacker, the series plays the events fairly straight, without directly questioning the couple’s story. The eerie music and Stack’s gravelly voice convey a feeling of serious menace. True crime fans are more divided, with some arguing that the events were too implausible to be real, while others find it unlikely that an elderly couple would fabricate such a wild tale. Notably, another popular Unsolved Mysteries segment, involving the stalking of Cindy James, is also widely believed to have involved a hoax.

Unfortunately, Newspapers.com’s archive of the local paper, The Massillon Independent, has a large gap between the early 1970s and the 2020s. The only other known media appearance by Bill Wacker before his death was in an unrelated citizen-reaction piece about Connie Chung interviewing Newt Gingrich’s mother in the Akron Beacon Journal, although he is wearing an Unsolved Mysteries hat in the picture. The only other items recovered were obituaries stating that Bill had died in 1999 at age 79 and Dorothy in 2020 at age 83. This left armchair sleuths to rely primarily on what appeared in the episode itself, which does raise questions.

One notable detail is that, in the reenactment, Dorothy’s dog doesn’t bark to alert her to the intruder, which seemed uncharacteristic of a small dog. People debated whether this was merely a quirk of the reenactment or reflected how the event actually occurred, with some questioning whether this provided evidence that Bill was behind the assault. Additionally, some found it odd that the stakeout was called off at the relatively early hour of 10:30 p.m. and found the return of stolen items completely unbelievable. Another oddity was the wording of the letters, with phrases like “you scum” and “no junk,” which sounded to some like older adults attempting to mimic the speech of teenagers while using outdated phraseology.

Among those who believe the Wackers, suspicion has frequently fallen on the daughters, who would presumably inherit the home and were not mentioned as suspects in the episode. Particular suspicion has fallen on Peggy, who was not present for the stakeout. Some have also pointed to the phone calls continuing after the Wackers changed their number as possible evidence of an inside job.

One Redditor, sovietbabyy, claimed to be a relative of the Wackers who stumbled upon the case, although they were too young to have ever met Bill and Dorothy themselves. They claimed Bill and his siblings were all dead but asked other family members for more information and were told that the extended family believed the story and that Bill was usually secluded but would help anyone in need. Five years later, a poster using the screen name goawaycommies followed up, claiming to be the same person. In these new posts, the author claimed that Stark County was a high-crime area and that the police were known to be ineffective; therefore, it shouldn’t be surprising that no one was caught.

While it could be debated whether these two posters are actually the same person, the goawaycommies post provided one essential detail that led to a major breakthrough: the Wackers’ address.

Finding the Wackers

In late December, I wrote to the Massillon County Sheriff requesting any files they had on the Wackers. They granted my request in early January, providing 94 pages of documents. Follow-up requests to the North Lawrence Fire Department, who responded to the assaults, as well as inquiries to two of the responding officers and Ricky Lee Pegido, were fruitless. The Sheriff’s office maintains that these documents are all that were found in the file, despite some appearing to be missing, such as a cover sheet without a report and references to a “phone trap” that is not followed up on.

While the officers may not have wanted to talk about these events, what was contained inside was fascinating, providing the names of suspects, neighbors’ opinions on the Wackers, incidents that were not included in the Unsolved Mysteries segment, and another 90s-era “classic” addition: records involving consultation with a psychic about the crimes.

The Wacker Home
The Wacker home today. Credit: Google Street View

The Reports

Right from the beginning, the documents tell a slightly different story from the television segment. Instead of waiting until the third event, in January 1985, to call police, there was a report concerning the initial August 1984 break-in. This one was different from the others, with gold and diamond jewelry stolen that was not returned and police noting that a credit card may have been used to force the lock.

The police report for the January 1985 break-in contained two notable details: the method of entry and the first-named suspect. Despite having their locked home broken into previously, the Wackers had left a side door unlocked, allowing the burglar to gain entry. Additionally, the report lists a “Randy” as a possible suspect, a young man whose aunt had previously cared for Mrs. Wacker’s elderly mother in the home.

Next, the first assault report appears, which is similar to what was shown in the episode, except that “CHEAPER, BUT WILL DO” was written in a bathroom instead of the kitchen. Additionally, a basement window was cut, through which the perpetrator may have escaped. The man who came to her aid is named here as Jim Pedigo, who says he and his brother had been working in their backyard all morning without seeing or hearing a thing until Dorothy’s cries became evident. In this report, the name is given as “Pedigl,” and it switches back and forth between that and “Pedigo” in the reports (the name “Pedigo” appears in print as a family name in the area in obituaries). When Bill returned, he found items that appeared to have been staged to be taken later from the robbery around the perimeter of the house.

Following this, there is a series of minor reports of items being stolen and returned—oddly, with the Wackers still not locking their doors, despite the first report indicating that had been their former habit.

The Second Assault

The report of the second assault does closely match the program, even down to the controversial dog not barking when the assailant came after Dorothy. Although the Wackers claimed the dog normally ignored its surroundings as it relieved itself, the officer noted on a follow-up visit to the residence that the dog barked when he arrived, which he found suspicious. In the report, Dorothy claimed she had to crawl to the back door to get help from Bill after the attacker fled, which was supported by dirt and scratch marks on her forearms noted by the officer. The officer gave Bill some suggestions, such as installing a light on that side of the house and trimming some trees to remove hiding places.

A lengthy segment of the report regarding the Sheriff’s canvassing of the neighborhood provides some interesting insight into the Wackers’ relationship with their neighbors. This portion notes that:

The neighbors collectively agreed that none of them have had any type of problems. Nor, have they seen or heard any form of disturbance in the area. In fact, several of the neighbors stated that they don’t even lock their doors. Further stated by the neighboring community, most of the neighbors stay to themselves, however, ‘the Wackers bring most of their problems on themselves.’ Apparently the Wackers aren’t the most congenial of persons in the neighborhood, especially with the Shillings and Maddox’s.

The Maddox family is the same household as the Pedigo family, a notable change of relations since Jim Pedigo aided Dorothy. On the other hand, another couple in the neighborhood stated that they regularly played cards with the Wackers, providing a nuanced image of them as people who got along with some but not others.

Suspects Not Named on Unsolved Mysteries

Following this event, both of the daughters began continually contacting the Stark County Sheriff’s office, demanding more attention be paid to their parents’ harassment. One of the items introduced here, but oddly never followed up on, is a “phone trap” put on the Wackers’ phone by their telephone company, Ameritech, to monitor all incoming calls. Although the reports say this is activated, there is no information on whether any claims of harassing calls were ever compared against the phone trap.

There appears to be a missing report explaining where the tip originates from, but officers speak with the son residing at the Maddox/Pedigo residence, Ricky Lee Pedigo, about whether he is aware of an individual by the name of “Shriner” on his mother’s side of the family, which he was not. When they later return to speak with his mother, Barbara Maddox, she claims she is not related to anyone by that name and flippantly remarks that the composite of the suspect in the first attack on Dorothy looks like a young dick Van Dyke, but no one she’s ever seen before.

Next, officers follow up on a tip from daughter Peggy Hoover that a woman named Debbie Shriver’s (not Shriner) ex-husband may be the suspect. After tracing this woman through a former landlord and then her own father, Debbie, now going by Debbie Pedigo, agrees to speak with the Stark County Sheriff’s. She says the composite bears no resemblance to her ex-husband, James Shriver.

Peggy then returns with another tip that a psychic told her the suspect lives within a twelve-mile radius of the Wacker home.

Finally, Peggy provides one last suspect: Barbara Maddox’s stepson, Johnny Lee, whom she says may be because her parents didn’t pay enough attention to him as a boy. At this point, Barbara Maddox has had enough, saying that her stepson hasn’t been to visit in years, and she is going to put up a privacy fence to keep away from the Wackers.

Suspect Sketch Dorothy Wacker Assault
The suspect sketch from the Dorothy Wacker assault. Credit: Film Rise /Unsolved Mysteries

Final Events

From this point on, the banging and rocks being thrown at the home continued. At one point, the Wackers claimed someone had tried to gain entrance to their locked home, but the police report casts suspicion on this. The appraisal was that it appeared as though someone was attempting to make it look like the house was being broken into without causing too much damage, and it was inconsistent with typical burglary techniques.

The final report is from October 1997, when Dorothy heard a loud banging on the house while seated in the living room. An officer responded but could find no damage.

All the reports are bizarre. The daughters appear to be very invested in the case, yet Peggy ultimately seems to be throwing around claims that don’t add up to anything. Was she letting her imagination run away with her, using the events as a cover to harass people she had personal grievances against, or was she really on to something? The “Shriner/Shriver” discrepancy speaks to a minor issue prevalent in the police’s investigations: not confirming the spelling of names, which also occurs with “Pedigl/Pedigo.” Does this indicate the sheriff’s department is generally performing sloppy work, as the Reddit poster implied? While there is room to speculate here, the constantly changing accusations may have undermined Peggy’s credibility with law enforcement.

One possible conclusion is that the very earliest break-in was real, since the stolen items were not returned and the report is consistent with a typical forced entry. Perhaps after that, the Wackers developed a taste for the excitement and attention and hoaxed the rest of it. This would explain the incongruities of items being returned, no one ever seeing anything, their continuing to leave their doors unlocked, and the strange attempt to create the appearance of a forced entry without damaging the home.

But then again, officers reported witnessing injuries to Dorothy after both assaults. Could she have been willing to take things that far? Could the couple have truly been victims? Could one of the children be behind it? Was Bill assaulting her?

None of these questions can clearly be answered from the available evidence; and so, decades after the strange story of the Wackers first came to public attention, the case rests—and another relic of the 1990s remains an unsolved mystery.

Ryan Whalen covers science and technology for The Debrief. He holds an MA in History and a Master of Library and Information Science with a certificate in Data Science. He can be contacted at ryan@thedebrief.org, and follow him on Twitter @mdntwvlf.

Email threats changed after the Tycoon2FA take-down

24 July 2026 at 11:29

Traditional phishing techniques are in decline as a result of the disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.

“Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs,” the company wrote in the report.

The takedown reduced activity across multiple phishing categories, forcing attackers to shift to newer delivery methods.

Riding this shift in were a few notable phishing campaigns, including an automated business email compromise (BEC) campaign that reached 42,000 organizations in under three hours, and a multi-stage phishing campaign that used nested email (EML) files, calendar invitations, and a Microsoft authentication redirect to deliver malware.

To counter phishing attacks, Microsoft recommends blocking emails containing known bad URLs/ subject fields, enabling password-less authentication methods, or moving to MFA for accounts that still require passwords.

Tycoon2FA disruption sent attackers exploring

The take-down of Tycoon2FA forced its operators to abandon portions of their infrastructure and rework hosting, domain registrations, and delivery mechanisms.

“After falling 15% in March and another 22% in April, Tycoon2FA-linked phishing volume dropped 74% in May to just 1.5 million messages, then fell another 20% in June to 1.2 million, by far the lowest monthly volumes observed in at least a year,” Microsoft said.

The decline extended to QR Code lures and fake CAPTCHA pages, two phishing techniques in which Tycoon2FA accounted for 12% and 14% of industry activity in June, respectively. This indicated that the platform’s customer base had not been able to migrate to a replacement infrastructure.

But cutting off one head of the hacker hydra only gave rise to new tactics elsewhere.

The adaptation came in the form of using Microsoft Teams as a social engineering channel. Attackers established conversations to build trust before attempting credential theft or delivering malicious payloads. “Teams-based phishing volume climbed steadily throughout Q2, with the average number of detected attacks rising 19% from March to April, holding roughly flat into May (+1%), then increasing another 10% into June,” Microsoft said.

Microsoft also observed a highly automated BEC campaign that reached over 67,000 users using scripted emails, Amazon Simple Email Service (SES), and engagement tracking, alongside a separate phishing campaign targeting 107,000 users that abused Microsoft’s authentication flow and trusted cloud services, including Teams archive recording and ICS calendar invite, to disguise malware delivery behind legitimate infrastructure.

Phishing changes but the defense doesn’t

While QR Code and Captcha-based phishing attacks dropped significantly in the second quarter, business email compromise (BEC) charted jumped 121% between March and April, before dropping down again in May.

QR Code phishing represented 8.3 million attacks in June 2026, down from a peak of 18.7 million in March. Similarly, Captcha-gated phishing fell from 12 million attacks in March to 2.2 million in June.

BEC attacks hit 9 million in March, falling to 3.9 million in June.

But even as these phishing classics lost momentum and newer techniques emerged, Microsoft’s defensive advice remained rooted in the basics. It noted organizations should complement email filtering with phishing-resistant authentication such as passkeys and phishing-resistant MFA to reduce the effectiveness of credential theft campaigns.

The company also recommended strengthening Exchange Online Protection and Microsoft Defender for Office 365 with capabilities such as Safe links and Zero-hour Auto Purge (ZAP), in which malicious emails already delivered to mailboxes are removed before they are read, alongside enforcing password-less authentication methods like Windows Hello, FIDO keys, and Microsoft Authenticator.

Microsoft concluded its report with a list of indicators of compromise (IoCs) from the threats observed in the quarter to support detection efforts.

This article first appeared on CSO.

FBI arrests man accused of using Steam games to drain victims’ crypto wallets

17 July 2026 at 17:18
Prosecutors accused 21-year-old student Zyaire Wilkins of publishing on Steam several fake video games that contained malware, infecting thousands of victims, and stealing crypto from some of them.

‘Keys to the kingdom’: hackers who gained access to heart of London transport network jailed

Thalha Jubair, 20, and Owen Flowers, 19, sentenced to five and a half years each for cyber-attack that cost Transport for London £39m

The data of millions of commuters was stolen, Londoners were left out of pocket and 27,000 Transport for London staff were forced to reset their passwords.

Over four days in 2024 a pair of teenage hackers had London’s transport network at their mercy. Thalha Jubair and Owen Flowers had burrowed into the heart of Transport for London’s IT systems and held the “keys to the kingdom”.

Continue reading...

© Photograph: William Barton/Alamy

© Photograph: William Barton/Alamy

© Photograph: William Barton/Alamy

Have I Been Pwned: o site que lhe diz em segundos se os seus dados já foram roubados

16 July 2026 at 08:16

Com quase 17,7 mil milhões de contas comprometidas indexadas e mais de mil fugas de dados catalogadas, o Have I Been Pwned é a referência mundial para saber se o seu endereço de e-mail ou password já caíram nas mãos erradas. É totalmente gratuito.

The post Have I Been Pwned: o site que lhe diz em segundos se os seus dados já foram roubados appeared first on Tek Notícias.

One-two punch delivered in global operation disrupts cybercrime "assembly line"

24 June 2026 at 22:03

International authorities and a raft of private technology companies say they have disrupted a cybercrime “assembly line” that allowed crooks to collect millions of login credentials and steal more than $47 million in ransom payments and by other fraudulent means.

The crux of the operation was the simultaneous targeting of two unrelated tools that are widely used in various online scams. The first is Amadey, a malware-as-a-service platform for compromising devices and delivering malicious payloads for ransomware and other scams. Amadey has been observed in the wild since at least 2018 and was seen last year abusing GitHub as it collected system information from infected devices and installed customized payloads. The second tool was StealC, an infostealer-as-a-service platform that collects credentials, authentication cookies, cryptocurrency wallets, browser extensions, and files whose names match customer-defined patterns.

Severing a critical link in the cybercrime chain

Amadey and StealC are separate tools that are run independently of each other. Given their widespread use, however, many customers use both in their individual cybercrime activities. The tools also, it turns out, relied on some of the same underlying infrastructure to run. Microsoft said it made this determination after analyzing the tools using AI. This insight allowed Microsoft attorneys to seek an order disrupting both at the same time.

Read full article

Comments

© Alex Schmidt / Getty Images

‘Travelers are getting better at spotting obvious scams' — but experts warn Airbnb scams are on the rise as summer arrives

24 June 2026 at 01:05
  • Airbnb scams have surged 30x since 2023, including a sharp rise this year
  • Criminals hijack legitimate host accounts to to trick holidaymakers
  • Staying safe isn't so straightforward as threats evolve

Airbnb-related scam activity has increased 30x since the first half of 2023, according to new research from Saily and NordStellar, confirming that cybercriminals continue to go after holidaymakers seeking the best deals amid rising prices.

The report ultimately concludes that attackers are now targeting the trust built by larger platforms, saving them from having to build new identities from scratch.

And to top it all off, the nature of scams is also changing, as instead of using suspicious websites to obtain victim payments or information, criminals are now targeting legitimate Airbnb host accounts which have spent years amassing positive reviews and high ratings.

Exploiting legitimate accounts and hijacking trust

While the end goal remains high volumes of vulnerable consumers, scammers have added an extra layer of victim in their pipeline. Verified Airbnb hosts are now valuable assets for criminals because they already have identity verifications, positive reviews, booking histories, years of activity and established credibility.

Once the verified account is compromised, attackers can then go on to scam higher volumes of unsuspecting victims by posting – and charging for – fake property listings.

“Travelers are getting better at spotting obvious scams,” Saily Head of Product Matas Cenys said. “Criminals know this, so they are increasingly trying to steal trust instead of building fake trust from scratch.”

Where this type of attack differs from others, though, is that the victims never leave the platform. Rather than falling victim to phishing attacks and being redirected to malicious external sites, they interact fully with supposed legitimate hosts on the Airbnb platform.

While Airbnb attacks have seen a 30x increase in around three years and a sharp rise in the last year alone, they reflect a much broader trend of attackers compromising existing trusted accounts.

The recent ramp-up in attacks could also be tied to the summer season, with holidaymakers looking to book last-minute deals in the run-up to the summer season. Urgency and pressure to keep costs low also adds to criminals’ success.

“Everything looks normal until they arrive at their destination and discover the accommodation never existed," Cenys added.

How to protect yourself from booking scams

Saily is recommending that all communication stays within the booking platform and that customers avoid payment methods suggested outside of official channels. Unusually attractive listings in high-demand destinations could also be taken with a pinch of salt, and savvy shoppers may choose to reverse image search a property to double check its authenticity.

“As travel booking becomes increasingly digital, trust becomes one of the most valuable currencies in the travel ecosystem,” Cenys warned.

As for abusing victim trust, researchers also argue that AI has aided attacks by allowing criminals to produce better fake listings more quickly.

More generally, Airbnb revealed that two in five Americans have fallen victim for an online scam, with the average loss totalling nearly $2,000. The company has introduced measures to remind its users how to avoid scams, including introducing identity verification and reminders not to leave the platform, but account takeovers can still slip under the radar.

Airbnb also holds guest payments until 24 hours after check-in to ensure that everything is as described. Anti-fraud tech also prevented around 265,000 suspicious listings from appearing on the platform in 2025, the company boasted.

The company posted a comprehensive eight-step list of how to avoid scams on its platform online, calling out pressure tactics and unusual deals.

Google logo on a black background next to text reading 'Click to follow TechRadar'

Chinese cybercrime operation that used AI to scam ‘hundreds of thousands of victims’ sued by Google

12 June 2026 at 21:38
The tech giant said a group called "Outsider Enterprise" used AI to scam hundreds of thousands of victims, sending 2.5 million text messages over a span of two weeks.

French government’s secure messaging system breached

12 June 2026 at 16:51

An intruder has breached the French government’s encrypted messaging service, Tchap, showing once again that human error is a weak spot in any security system.

Tchap was developed in France as an example of national sovereignty and was designed to be a more secure option than WhatsApp for communication between government employees.

In this case, it wasn’t the technology that was at fault, but a user: The intruder gained access to the system by taking over their account, according to DINUM, the French government’s interministerial digital directorate.

DINUM said it has blocked the affected user’s access and is investigating how much information has been revealed. While the system’s encryption was not broken, the intruder would have been able to view unencrypted public chat rooms accessible to the account taken over, potentially affecting 73,467 of the system’s 825,000 users, DINUM said.

That matches at least part of a post on X (formerly Twitter) reporting the intruder’s claim to have accessed the account of a Tchap user in the education sector through social engineering, exposing 73,467 user accounts, 643,459 messages, 876 chat rooms with message history, and 59,386 media files totalling 13.51 GB, including references to documents marked “Diffusion Restreinte” (restricted distribution).

DINUM said that it had reminded all Tchap users that public chat rooms are accessible to any user and are not encrypted, so all participants should refrain from any sensitive or confidential information.

This article first appeared on CSO.

Poland To Jail Online Streamers of Violent Crime For Up To 5 Years

By: BeauHD
11 June 2026 at 23:00
Polish lawmakers have voted to criminalize "trash streaming," with up to five years in prison for online broadcasts of serious crimes such as rape or murder, animal cruelty, humiliating violence, gambling promotion, or even simulated depictions of those acts. Reuters reports: The move is part of a broader push by Poland to tighten regulation of online content. Recent measures include banning the use of mobile phones by children under 16 in schools and introducing stricter age verification rules to access pornography. Under the new provisions, broadcasting crimes punishable by more than five years in prison, including murder or rape, will itself be classed as a separate offence punishable by up to five years behind bars. The law also covers content showing cruelty to animals, violence aimed at humiliating others, and the promotion of gambling. The same penalties will apply to individuals who simulate or falsely portray the commission of such crimes while streaming, lawmakers said.

Read more of this story at Slashdot.

Oracle warns of security bug that hackers abused to breach 100+ companies

11 June 2026 at 21:27
The tech giant warned of a security flaw that a cybercrime gang said it's exploiting as part of a mass-hacking campaign. Google said it notified more than 100 organizations that had potentially vulnerable servers.

ACLU Sues After Facial Recognition Falsely Identifies Florida Man As a Child Abductor

By: BeauHD
11 June 2026 at 20:00
fjo3 shares a report from Reason: Police arrested a man in Florida for attempted child abduction in a town he had never visited, and the only evidence linking him to the crime was an AI facial recognition hit. Represented by the American Civil Liberties Union (ACLU), he is now suing the officers and agencies who put him through it. [...] According to a police report, facial recognition software concluded with 93 percent confidence that the suspect was Robert Dillon. [...] The ACLU is now suing the city of Jacksonville Beach, as well as the individual police officers and officials involved in the case. According to the lawsuit (PDF), the responding officer viewed security camera footage of the suspect but didn't take a copy; instead, he took pictures of the screen with his cell phone. "In the photos, the suspect image is low resolution, and the suspect's face is partially shadowed and off-axis," the lawsuit claims. When an investigator queried the facial recognition system, it was with the officer's grainy secondhand cell phone photos. [...] But as the ACLU notes, facial recognition's accuracy "depends significantly on the quality of the probe image. Lower-quality images contain less interpretable facial data, degrading the system's ability to produce a reliable template." At the very least, it requires a much better source image. Besides, no such investigative tool should form the sole basis for an arrest warrant. "If you came to me with a facial recognition hit and that was your probable cause, I would probably kick you out of my office because that's not how it works," Jacksonville Sheriff T.K. Waters told local news. (Waters is among those being sued in the ACLU lawsuit, because it was an investigator from the Jacksonville Sheriff's Office who ran the grainy photo through facial recognition and advised O'Connell it was a "93% match" to Dillon.)

Read more of this story at Slashdot.

Sudanese Man Arrested After Attempted “Beheading” in Belfast

9 June 2026 at 13:14

A Sudanese man has been arrested after an attempted "beheading" in Belfast last night that left a man in his 40s with serious injuries in a "critical" condition.

The post Sudanese Man Arrested After Attempted “Beheading” in Belfast appeared first on The Daily Sceptic.

Meet Hades: The malware that lies to AI security agents

9 June 2026 at 06:05

Threat actors are continuing their onslaught against software supply chains, now with malware named after death itself.

The newly-discovered Hades Campaign is a “highly sophisticated” supply chain compromise that targets Python developer environments and runs as soon as infected packages are imported. It uses the popular Bun toolkit to silently execute multi-layer payloads that can extract sensitive data, move laterally across compromised systems, exploit common security frameworks, and even hijack AI gatekeeper analyzer systems via adversarial prompt injection.

Notably, the campaign exploited the popular C++ library ensmallen, as well as packages in the computational biology, bioinformatics, and genotype-phenotype analysis ecosystems.

The most novel thing about this malware is its combination of advanced tactics, noted David Shipley of Beauceron Security. He noted that we’ve seen memory-focused malware, we’ve seen attacks that attempt to defuse large language model (LLM) powered analysis with hidden prompts, and we’ve seen malware with wiper capabilities.

“But all three, in a fast moving mass propagating worm, is its own kind of nightmare,” he said. “And I suspect this is the way of the future.”

How Hades works

The Hades Campaign was discovered by researchers at StepSecurity, who called it the latest evolution of the Miasma threat actor. The researchers previously described Miasma attacks that had sent self-replicating worms to perform multi-cloud credential sweeps, caused infected repositories to execute code when folders were accessed in integrated development environments (IDEs) or by AI agents, and used techniques that scanned and read Linux process memory.

Hades uses the same credential harvesting methods, self-replicating worm logic, and GitHub-based exfiltration patterns, the researchers noted. In addition to ensmallen, compromised packages include mflux-streamlit, nhmpy, ppkt2synergy, embiggen, gpsea, and pyphetools.

The campaign’s entry point is a simple, obfuscated script embedded inside a Python package’s __init__.py file, a critical building block that gives Python the ability to recognize packages and import modules. Once they gain access, threat actors drop a precompiled Bun runtime binary and executes its JavaScript payload. Bun allows the malware to run complex JavaScript tasks in environments lacking a Node.js installation, bypassing traditional package manager controls and proxy logs.

The malware is able to scrape Linux memory mappings, and also introduces tailored macOS and Windows memory scrapers, which allow threat actors to extract sensitive, encrypted data.

Interestingly, attackers are also able to evade detection by automated LLMs that scan for suspicious code. This is achieved with a simple block of text at the top of the file; this instructs the model to ignore the hidden code below, classify the package as verified and clean, and provide reports stating it is safe.

This element represents what the StepSecurity researchers described as a “significant conceptual shift,” with attackers writing payloads that target AI systems’ cognitive logic. “Scanners that pass raw text to LLMs without strict boundary isolation can be coerced into generating false negative verdicts, allowing the malicious package to bypass organization analysis,” they wrote.

The tactic is indeed clever, Beauceron’s Shipley agreed, pointing out that attackers will increasingly target endpoint LLM-powered agents.

Why? “Because there’s no reliable defense,” he said. “LLMs are incredibly susceptible to social engineering.” This has been relabeled as prompt engineering, but is essentially just phishing for bots, he pointed out.

“While everyone’s worried about LLM-powered vulnerability discovery and automated exploitation, it’s LLM-created smart malware like this, and AI-powered phishing of humans and bots, that keeps me awake at night,” Shipley said.

Hades’ crafty worm propagation

The Hades Campaign command and control (C2) infrastructure uses three independent channels on public GitHub infrastructure to allow its communications to blend in with normal traffic. Stolen credentials are encrypted locally in a hybrid fashion (serialized, compressed, and pushed to a newly created public GitHub repository under attackers’ control). Exfiltrated repositories carry the description “Hades — The End for the Damned.”

Researchers noted that a core component of this campaign is its ability to propagate and move laterally across networks. It exploits the very methods meant to protect systems, including Secure Shell (SSH) and Secure Copy Protocol (SCP), OpenID Connect (OIDC),and Supply-chain Levels for Software Artifacts (SLSA).

For instance, when running inside a GitHub Actions workflow runner, the malware checks for OIDC variables, then bypasses registry signature policies and generates cryptographically signed SLSA provenance bundles via Sigstore. It can then fetch target libraries and inject the obfuscated script and JavaScript payload. From there, it can publish compromised versions to the Python Package Index (PyPI) repository and node package manager (npm) using the target’s credentials and the generated Sigstore bundle.

“This ensures that the published package appears to have valid, cryptographically verified build provenance from the organization’s official GitHub Actions build environment,” the researchers explained.

Further, if a harvested GitHub token has write permissions, the malware will target repositories to extract secrets using GitHub Actions runners. This occurs “directly from the runner’s address space without ever writing them to disk or making a suspicious network connection,” the researchers noted.

The malware also targets rule files and configuration directories for 14 different AI agents and systems, planting custom prompt instructions or executing hooks that trigger a bun run bootstrap command when the victim loads or consults the workspace with their AI assistant. Finally, it establishes persistence on the workstation and monitors for the presence of the stolen token; if that token is revoked, it executes a wiper process to erase the user’s files.

❌