CRPx0, a cybercrime crew that has rapidly evolved from a scam service to a ClickFix-delivered ransomware and crypto-theft business over the summer, claims its victim count jumped from fewer than 10 in June to 48 organizations on its clear-web leak site at the time of publication. Keep in mind: criminals aren’t always the most trustworthy bunch, so take their claims with a healthy dose of salt. Still, the ransomware biz’s expanding operations, unique payload, and white-label hacking service make it one to watch, and a few recent analyses provide tips for defenders to keep the crooks out of their IT environments. Rakesh Krishnan, a threat-intel analyst who writes about cybercrime investigations on TheRavenFile blog, was one of the first researchers to publish details about CRPx0 at the beginning of the month, including previously unreleased malware samples. The operators offer a hacking service, providing “complete database extraction” from victim organizations and “optional public leak coordination upon request.” This platform also advertises full network compromise, “from initial access, through lateral movement, to full domain compromise,” plus persistent access across the victim’s infrastructure. A second, white-label, ransomware-as-a-service platform makes it really easy for wannabe crooks to get into the data-theft and extortion biz. CRPx0 builds, deploys, and configures everything from command-and-control infrastructure to the negotiation panel and malware, allowing its criminal customers to bring their own brand identity to their operations - and originally offered these services for a $10,000 one-time fee. At first, the operators promised to allow affiliates to keep 100 percent of their profits - this is unheard of in ransomware-as-a-service operations. This has since shifted to a 70-30 model, with affiliates receiving 70 percent of the extortion payments (after a one-time $333 enrollment fee) and the remaining 30 percent going to the operators. CRPx0 rules prohibit affiliates from infecting Commonwealth of Independent States (CIS) member countries and organizations based in these countries. This is a pretty common rule among Russia-based ransomware operations, and in an earlier interview with The Register, Recorded Future threat intelligence analyst Allan Liska called it the “first rule of ransomware club: you don't attack organizations in the Commonwealth of Independent States.” The gang also prefers Monero (XMR) payments, rather than Bitcoin (BTC). ClickFix ransomware delivery Affiliates can also customize their own ClickFix payload delivery. The operators offer two lures, a fake Windows Update and a fake Google reCAPTCHA, to socially engineer victims into executing the initial command, according to a Ransom-ISAC research team analysis published on Thursday. The Windows lure tricks a victim into pasting a PowerShell command into the Run dialog. This drops a DLL stager chain and ultimately deploys Python-based ransomware. The macOS lure, however, uses a curl|bash command that downloads portable Python and the ransomware directly. The lures and the rest of CRPx0’s malware run on Windows and macOS, and according to the researchers, there are four payload formats: “the two HTML lures plus a standalone DLL and a standalone EXE, both of which discard the social engineering step entirely.” All four deliver the same ransomware: a 1,769-line Python script that steals high-value files before encrypting them with AES-128-CBC (Fernet). The malware moves laterally via WMI/schtasks, and delivers a ransom note that gives victims a 48-hour deadline to pay up - or see their files leaked. 'Complete, professional offensive control center' On August 23, the CRPx0 operators published a v3.0 update note on the group’s clearnet leak site, promising “a complete, professional offensive control center for managing compromised remote machines from a single web dashboard.” It provides crims with tools to steal valuable files, credentials, and wallet recovery phrases and keys, while “watching stolen cryptocurrency wallet addresses flow in.” This service also provides scripts to run remote commands, and the control panel sets up “automated attack reactions that fire on their own when something valuable happens on a target.” As the operators note: “Everything is built to be operated by a human with no technical background: point-and-click panels, plain-language rules, and clear status indicators. The underlying attack engine is hidden behind a clean, dark-themed interface.” CRPx0’s hacking and ransomware services, enabling everything from crypto theft to encryptors and full network compromise, “could be a strategic move to attract new recruits, or a scam targeting a range of affiliate hopefuls seeking cybercrime services,” according to an August 12 analysis from Jade Brown, a threat researcher at Bitdefender. What defenders should do Still, “other threat actors may attempt to adopt similar techniques,” she warns. “This is a reminder that organizations should balance detection capabilities in preparation for different types of compromises, configuring technologies to detect and block malicious behavior that aligns with both crypto theft and encryption processes.” The Ransomware-ISAC team says defenders should prioritize five actions, in this order. “The first three cost nothing and blunt the entire ClickFix class of attack, not just CRPx0,” they note. First: remove the Run dialog for standard users - this will entirely block the Windows path. For macOS users: restrict Terminal via MDM for non-technical staff. Next, the threat-intel analysts advise defenders to alert on RunMRU writes containing powershell, curl or long base64 strings. “Every ClickFix victim leaves a trace at HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU,” they wrote. “This is the highest-fidelity ClickFix detection available and it is trivial to deploy.” The team also lists adversary network indicators and suggests blocking those. Make sure to hunt for indicators and malicious behavior in the pre-encryption exfiltration window. “Data leaves before a single file is encrypted, so .crpx0 extensions and ransom notes are a post-mortem indicator, not a warning,” according to the Ransomware-ISAC. Finally, confirm backups are unreachable from the account that would be compromised, and treat anything reachable with the victim's credentials as destroyed. ®
A German digital-rights group has filed a criminal complaint against Meta, Ray-Ban parent EssilorLuxottica, and several retailers over Meta's AI smart glasses, arguing the devices can enable covert recording in violation of German privacy law. Prosecutors have begun a preliminary review, while Germany's network regulator says smart glasses are legal "as long as the recording function is clearly visible." Reuters reports: "There's no place to escape from smart glasses. You have to expect at any moment to be filmed and then exposed on the internet," said HateAid managing director Josephine Ballon. The organization reported the management of Meta, units of spectacles maker EssilorLuxottica including Ray-Ban, as well as retailers Fielmann, Apollo-Optik, Mister Spex and MediaMarkt to the Frankfurt-based digital crime prosecution unit ZIT. HateAid said its complaint was based on a federal digital data protection law that prohibits the sale of communication devices designed to film people without them noticing.
ZIT confirmed it received a complaint from HateAid invoking that law, saying it would routinely investigate on a preliminary basis whether there are grounds for a deeper probe. MediaMarktSaturn Retail Group said it was taking the complaint very seriously, adding that its suppliers had contractual obligations for all goods to be compliant with the law. Mister Spex said it had not been officially notified of a complaint and that it was taking protection of privacy very seriously.
Big companies describe being under constant threat but only half have a plan in place to respond to an attack
Nearly a third of British manufacturers have been hit by a cyber-attack on them or a company in their supply chain, according to a survey that highlighted the growing hacking risk to companies.
The findings come almost a year after Britain’s largest automotive employer, JLR, was hit by an attack that forced it to halt production for weeks.
In Georgia the Savannah Police Department "terminated four sworn officers and two civilian employees following an internal investigation into misuse of the department's Flock Safety License Plate Reader system," according to a local news report:
All six cases are also under independent criminal investigation by the Georgia Bureau of Investigation... Investigators found that employees were running searches on personal acquaintances and family members. One officer was found to have given someone from an outside law enforcement agency access to SPD's Flock Safety system, which they weren't authorized to do.
Elsewhere ABC News reports that a female North Carolina police officer was arrested Wednesday "for allegedly using Flock license plate readers to track her boyfriend's ex-wife, according to police..." The officer is accused of accessing the system for personal use 31 different times, including at least twice when she was off-duty, and listing most of the lookups as motor vehicle infractions. [Police chief Ron] Campurciani "added that the department is looking at 10 other potential misuse cases and said three 'look like they could be problematic.'"
And an Ohio news station reports a police officer who recently resigned "while under internal investigation repeatedly used the Flock license plate reader system to search a vehicle registered to someone investigators identified as his likely domestic partner."
Meanwhile, 404 Media reported this week that an Iowa county's usage police specifically tells police officers — in all capital letters — not to tell occupants of a vehicle that an automated license plate reader was used for a traffic stop. It also instructs officers to not even mention the use of the ALPR technology in their reports "unless absolutely necessary," according to information they'd obtained from a public records request," suggesting they instead they call the cameras "county resources":
It is not just local police in small communities who are creating policies designed to obfuscate Flock usage. Earlier this year, we reported that police in multiple states were being told to be "as vague as permissible" about why they were using Flock because their searches could be obtained using public records requests, and that warning was being shared by the FBI and Department of Justice...
In the [Iowa county] public records request, Sheriff Don Phillips said "there is no need" to tell people about the use of Flock... "because the information is verified by the deputy running the license plate. It is common practice for law enforcement to refrain from disclosing investigative methods and sources to prevent criminals from learning how to circumvent them."
Google recently changed how it refers and assigns names to hacking groups. TechCrunch spoke with one of the world’s foremost experts on tracking hackers to understand why companies give hackers codenames.
A Canadian hacker has admitted being part of a group responsible for several major cyberattacks. Connor Riley Moucka pleaded guilty to being part of a coterie of hackers that hit 165 organizations, resulting in the theft of customer records and the extortion of millions of dollars.
Moucka and other members of the group used stolen login credentials to compromise data belonging to at least 165 customers of a US-based software-as-a-service company. This unauthorized access was used to steal billions of sensitive customer records and download terabytes of information,
“Connor Moucka hacked over 150 companies and organizations, obtained extremely sensitive information, and extorted the victims for millions of dollars. Today’s guilty plea serves as a reminder to all cybercriminals, regardless of where they live, that they cannot hide behind a wall of anonymity. You will be found and brought to justice,” said assistant attorney general A. Tysen Duva of the Justice Department’s Criminal Division
The trial is the result of a coordinated worldwide action against the Snowflake group. The investigation was led by the FBI but benefited from contributions from the Royal Canadian Mounted Police, the Australian Federal Police, Spain’s Guardia Civil, the Security Service of Ukraine and the Turkish National Police.
Given the widespread enterprise adoption of passkeys to replace passwords, a Palo Alto Networks Unit 42 report disclosing ways attackers are getting around passkey protections is concerning, analysts say, but they stress that the demonstrated attacks can only happen after a successful intrusion.
They also pointed out that the issues are not strictly caused by holes in passkeys so much as by weaknesses in the procedures surrounding them.
“The researchers didn’t break the underlying cryptography. They exploited the seams around it: onboarding flows, recovery mechanisms and trust signals that weren’t being validated,” said Justin Greis, CEO of consulting firm Acceligence. “That distinction matters because it tells us where the actual risk lives.”
The Palo Alto report showed attacks that, it said, “demonstrate how malware on a compromised endpoint can misuse onboarding, recovery and device trust workflows to take over passkey-protected accounts,” as well as “how an attacker can authenticate without user interaction, bypass user verification requirements and extract all synced passkey private keys.”
Palo Alto described three categories of attack, collectively dubbed Pass-ta-key: Pass-ta-key, where an attacker takes over an account protected by a Google-synced passkey using malware running on the victim’s device, without requiring privilege escalation, device unlock or user interaction; Silver Pass-ta-key, which involves an attacker tricking Google Cloud Authenticator into believing the victim has unlocked the device with biometrics, leading to full account takeover without using the victim’s device during authentication; and Golden Pass-ta-key, which allows an attacker to extract all synced passkeys in a form that lets them be shared or sold on the credential black market.
Given the complexity of most global enterprise threat surfaces, some CISOs have struggled with adapting passwordless processes to environments with legacy and virtual environments. Passcodes have been recently embraced by enterprise CISOs as the first step in implementing a passwordless strategy.
Analysts and consultants in the main agreed that the flaw Palo Alto reports is significant, despite the fact that it assumes the attacker has already penetrated an environment and successfully installed malware. Sadly, given that such penetration only requires one privileged user anywhere to accidentally click on a poisoned link or attachment, the assumption of prior penetration is likely valid.
Implementation issues are the problem
What the report reveals is less about any flaws within passcodes directly, and more about the lack of attention paid to a wide range of mechanisms surrounding them.
Greis said CISOs now need to focus on what to do, and what to test, based on the assumption that user behavior is not always as expected.
In several cases cited in the report, he pointed out, issues occurred “not because the standard is flawed, but because implementations haven’t caught up to it. It mirrors what we’ve seen repeatedly in security: the specification is sound, but the ecosystem implementing it is uneven.”
Consultant Brian Levine, executive director of FormerGov, agreed.
“On any service where your organization is the relying party, require user verification and actually validate the user-verified flag in the authentication response,” he said. “The researchers found real-world services accepting logins without it, which quietly collapses a multi-factor login back into a single factor.”
Frank Dickson, group VP for security at IDC, added that he would stress to CISOs that this attack assumes a prior successful penetration.
“This isn’t passkeys getting hacked from across the internet. It’s what [an attacker] does once they’re already inside the house. So the real headline is that ‘phishing resistant’ stops being resistant the moment the endpoint stops being clean,” he said.
“Stop treating verification as optional,” he advised. “Flip it to required, check it server side every single time, and save your hardware bound keys, the YubiKeys of the world, for the accounts that matter most. A key that never leaves a physical device is a key no attacker can ever harvest in bulk.”
Or Finkelstein, head of marketing at Secret Double Octopus, agreed that CISOs have gotten complacent about the way in which systems support passkeys.
“CISOs should probably look at how user verification is enforced, how enrollment and recovery work, have a clear and enforced policy on whether credentials are synced or device-bound, and have some ITDR system to quickly mitigate suspicious endpoints and authenticators,” he said. “In most serious enterprise environments, EDR and device management reduce the likelihood of initial attacks, but do not close every post-compromise attack path.”
Poor support processes weaken passkeys
Some have argued that the lack of sufficiently robust support processes actually weakens passkey capabilities and undermines the whole point of such systems.
J. Wolfgang Goerlich, a member of the faculty of IANS and a longtime cybersecurity consultant, pointed out that the original FIDO2 spec eliminated credential theft by binding the private key to a physical authenticator. Synced passkeys reintroduced credential portability and therefore reintroduced the form of credential theft risk cited in the Palo Alto report.
“A passwordless system is exactly as strong as the flow that re-establishes it,” he said. “Both serious techniques here start by forcing a device to re-enroll. Many security teams have never modeled, never monitored and never rehearsed a response to this.”
Goerlich’s advice to CISOs is to require device-bound authenticators, such as hardware tokens or computers, for all privileged and sensitive access. They may consider allowing wallets for lower risk access, he said, “however, much like passwords in Web browsers have long been at risk, we must now consider passkeys in the browsers an unacceptable risk.”
American heiress Jamey Carney was found dead in her Killarney home in July, after her teenage daughter discovered her body. Her Jordanian asylum seeker boyfriend is now the prime suspect.
An “AI worm” can spread through Microsoft Word documents using Copilot as a vector, a prominent Norwegian AI researcher reported on Tuesday.
The report from Håkon Måløy, later confirmed by Microsoft, said that an attacker can conceal instructions in a document that is later used as source material for Copilot-generated or Copilot-edited Word documents, for example, as input to a financial report. Those malicious instructions could potentially alter figures in the document being created. They then copy themselves into the new document, causing it to become a carrier of the attack when used in another Copilot-assisted workflow.
Måløy noted: “To my knowledge, this is among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite.”
Microsoft on Thursday emailed a statement to CSOonline discussing the report’s revelations.
“We have addressed the findings reported by the researcher and thank them for working with us through coordinated vulnerability disclosure. To address this class of risk, we use a defense-in-depth strategy with safeguards that block malicious instructions at multiple points and help keep tasks aligned with users’ requests,” Microsoft said.
“We are continuously strengthening these safeguards as the technology and threat landscape evolve,” it added. “We encourage customers to install the latest updates, use multiple layers of security protection, treat content from unknown sources with caution, and review AI-generated content before using or sharing it.”
Sidesteps defenses
Aman Mahapatra, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, has reviewed the mechanisms used in this vulnerability and says that it is much worse than it might seem, because it will sidestep just about every defensive mechanism enterprises have in place today.
“This is a worm, a self-propagating malware pattern that uses Copilot as the transmission mechanism and legitimate corporate collaboration as the delivery channel. It bypasses every traditional email security control because the document is not malicious on delivery and it becomes malicious when Copilot processes it. That means that it bypasses DLP because the exfiltration happens through the user’s own authenticated Copilot session,” Mahapatra said. “It then bypasses endpoint protection because no code executes, only instructions get followed by an AI service the enterprise has explicitly authorized.”
He also noted that researchers have been warning about this class of attack for two years.
Microsoft’s involvement
Måløy said that he has been working with the Microsoft Security Response Center (MSRC) since March 3 and Microsoft subsequently implemented and distributed multiple small focused mitigations, but the core vulnerability has yet to be fixed.
He said he was hesitant to disclose an active vulnerability, but felt that it was now time to publish.
“My reasoning is that defenders cannot reduce exposure to a risk they are unaware of,” Måløy wrote, “and the propagation mechanism described here affects ordinary document workflows that many organizations already rely on.”
In an email interview, Måløy noted that the tweaks Microsoft has implemented were helpful, nonetheless.
“The coordinated disclosure process showed that mitigations can meaningfully reduce the demonstrated attack surface, making attacks less reliable and limiting their reach, even without completely eliminating the underlying problem,” he said.
Måløy also addressed the resolution that many analysts and consultants suggested, which is to change the nature of LLMs to fully isolate instructions from the data they operate on.
“Separating instructions from data may be part of the solution, but I think the distinction between data and instructions is not always clear in real-world workflows. For example, a user may ask an agent to arrange a business trip, requiring the agent to retrieve an email specifying the approved itinerary and a document containing the booking procedure,” Måløy said.
“My view is that the broader challenge is therefore not simply to prevent systems from interpreting external content as instructions, but to evaluate whether those instructions align with the user’s goals and the context in which the system is operating,” he added.
Problem hard to overstate
Mike Wilkes, enterprise CISO at Aikido Security, said it would be difficult to overstate the potential problems from this situation.
“This is a significant issue because it moves prompt injection from a single compromised interaction into a potentially self-propagating document integrity attack,” he said, noting that it is not a conventional worm that spreads automatically. A user or Copilot workflow must still bring an infected document into the model’s context. “But once that happens, the malicious instructions can reportedly alter business information, conceal themselves inside the resulting Word document and turn a legitimate internal file into the next carrier,” he said.
That, he pointed out, creates “a dangerous enterprise supply chain in which financial reports, contracts, policies and partner documents may inherit malicious behavior while retaining the trust associated with their legitimate authors and Microsoft 365 accounts.”
Not a new issue
The key issue behind this flaw is the fact that genAI tends to struggle with telling the difference between data that a user offers as input and the instructions the AI is to execute.
Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, observed that the same problem with mixed data and instructions occurred in databases decades ago, and turned into what we know as SQL injection attacks today. But, he noted, a few years later, parametrized binding for the database access layers was developed, which separates instructions, which are handled internally and safely, from data, which can come from untrusted sources. “The same needs to happen with LLMs and other AI,” he said.
Mike Leone, a VP/principal analyst at Moor Insights & Strategy, agreed.
“It’s hard not to chuckle a bit with this one. People have been asking whether data can give orders since SQL injections. We fixed that one by giving the database a way to tell an instruction from a value,” Leone said. “Thirty years later, we’ve built an entire category of software that can’t tell the difference at all.”
Tom Findling, CEO at Conifers.ai, also said he sees the data-vs-instructions issue as the biggest problem.
“Separating data from instructions is still unsolved at the model layer. The labs are making real progress, but not enough to be your only control,” he said, and stressed, “Microsoft doesn’t need to wait for that. It can slow propagation inside Copilot: stop hidden content from being written into new documents, surface hidden text before it’s used, preserve the trust level of what Copilot read and show all AI-generated changes.”
Fix needs industry agreement
However, Frank Dickson, group VP for security at IDC, argued that a fix needs industry agreement.
“A fundamental fix requires the industry to converge on the same architectural change, which isn’t happening anytime soon given the incentives and the fact that the major players are far from besties,” he said, pointing out that Instruction-data separation would need to be baked in at the model or platform level across every major vendor. “None of them are rewarding that work commercially right now, so treat that as a multi-year research problem, not something a CISO should wait on.”
Leone disagreed, arguing that a single vendor can do quite a bit, at least for its own customers.
“Microsoft has said publicly since last year that indirect prompt injection can’t be fully prevented, and I give them credit for saying it out loud rather than pretending otherwise,” Leone said, noting that the industry doesn’t have to move in lockstep. “This attack lives inside one product,” he said. “If Microsoft hardens the Copilot document path, Copilot customers get safer whether or not anyone else moves.”
Dickson added that another critical problem with this vulnerability is that the carrier documents are created by legitimate employees using legitimate tools, “so there’s no obvious point of origin once the payload starts moving; an organization could be laundering corrupted financial figures through its own workflow for weeks before anyone notices.”
Tactics that might help
That said, experts had some specific suggestions for CISOs trying to negate this problem.
IDC’s Dickson said, “the most useful lever right now sits outside the model entirely, in how much untrusted content Copilot is allowed to pull into a session without a human choosing it.” He noted that enterprises can turn Copilot’s auto-discovery behavior off or restrict it, and require humans to explicitly select the documents they feed it. “That alone closes off one of the two ways the attack gets a foothold,” he said.
IDC also suggested a visible diff or redline of anything Copilot changes in a financial or otherwise consequential document, and the requirement for a human to approve the changes. “That’s not a technical fix, it’s a workflow one, and it’s available today,” Dickson said.
He said that IT should also track where content came from and what was touched by an AI system, in metadata that travels with the document. “It doesn’t stop the injection, but it means when something does get through, an organization can actually trace how far it spread instead of discovering a corrupted number three reports later with no way to reconstruct the chain,” he said.
However, one expert, Tyler Reguly, Fortra’s associate director of security R&D, said that he didn’t see this vulnerability having a meaningful impact because it feels like what he called a “laboratory vulnerability.”
Normal enterprise workflows don’t encompass a number of the necessary steps for compromise, he said, pointing out that, if anything, people are trained not to download Word documents. Plus, he noted, looking at the blurred example in the report, the malicious document contained an additional apparently blank page which held the concealed prompts in white text.
“That page is going to send up warning signs for me if someone even managed to convince me to download an external Word document,” he said. So, overall, “this feels like it requires a perfect storm.”
Traveling enterprise employees beware: Think twice before you log onto that oh-so-convenient public Wi-Fi.
Since at least June, threat actors have been compromising “captive” Wi-Fi gateways and other portal appliances at hotels, conference centers, and similar shared venues to hijack users’ Microsoft 365 accounts, according to the ReliaQuest Threat Research team.
Once a threat actor controls a gateway, they can silently redirect a user’s traffic to their own infrastructure and steal their Microsoft 365 credentials without ever touching the user’s device, compromising endpoints, or sending phishing links or malicious attachments.
“The most dangerous element is that it operates at the network gateway, which sits beneath most of the trust assumptions users and devices make,” ReliaQuest told CSO Online. “It’s not necessarily an enterprise breach level event on its own, but it’s a very real risk to individual accounts.”
Exploiting a ‘fundamental trust’
Domain Name System (DNS) poisoning, in which false data is injected to redirect regular web traffic to fraudulent domains, has previously been observed on small office routers, but attackers are now expanding the technique to higher-level targets, the ReliaQuest researchers explained in a blog post.
Attackers likely gain access to the gateways through weak or reused admin credentials in combination with exposed interfaces like Secure Shell (SSH), Simple Network Management Protocol (SNMP), and other web consoles, they pointed out.
Admin access to the gateway is all that malicious actors need, because devices are designed to inherently trust DNS, which translates domain names like login.microsoftonline[.]com into IP addresses to route them. Therefore, a single gateway compromise gives the attacker the ability to redirect traffic for every guest logging into the network, providing IP addresses it controls in response to DNS requests, rather than the legitimate ones, without touching a single endpoint.
“Captive portal appliances sit at the network perimeter for every guest on that network,” the researchers wrote. “Detection is inherently difficult because the attack happens gateway-side, outside the endpoint’s visibility.”
In the campaign tracked by ReliaQuest, four attacker-registered domains, m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com, were used for Microsoft-impersonation lures.
The compromised Wi-Fi gateways were discovered across multiple US cities as well as in India and Saudi Arabia, and impacted users were from companies in professional and financial services, legal, retail, health care, and energy, indicating that the method isn’t sector-specific.
“We’ve seen enough SharePoint exfiltration cases to know that a single popped account can cascade into meaningful data loss,” ReliaQuest noted. Meanwhile, for the network operators, there’s a “reputational dimension”; user compromise is a “serious trust and brand problem, regardless of how sophisticated’ the underlying attack is.”
Safe services, DNSSEC not enough
Locking network configurations to a ‘safe’ DNS provider such as Google (8.8.8.8), Cloudflare (1.1.1.1), or the cloud-based OpenDNS isn’t a sufficient tactic, because it doesn’t change the path that queries actually travel over, ReliaQuest contended.
By default, devices send DNS queries as unencrypted protocol traffic, and those packets still have to traverse the hotel’s network to reach Google, Cloudflare, or OpenDNS, the company explained. Since the gateway sits directly in that path, it can inspect, block, or redirect the query before it ever reaches the chosen resolver.
“Specifying a trusted DNS server changes the intended destination, not who controls the road to get there,” ReliaQuest noted.
Further, Domain Name System Security Extensions (DNSSECs), which use digital signatures and public-key cryptography, only “partially” address the problem. DNSSEC provides authentication and integrity for signed domains, which means a validating resolver can detect and reject forged or tampered responses.
“What it does not do is provide confidentiality or availability,” the company said. “It does not encrypt DNS traffic or stop an attacker from intercepting, blocking, or redirecting requests.”
So while DNSSEC can defeat certain response-forgery attacks against signed zones, an on-path gateway can still see queries, drop them, or force fallback behavior. However, this protection layer only helps when domains are actually signed, and then only when the client or resolver performs validation, which “many stub resolvers do not,” according to ReliaQuest.
Full-tunnel VPNs required
To combat the problem, enterprises should require all corporate devices to use a full-tunnel VPN for network connection. Controls should prevent internet access until a tunnel is active, ReliaQuest advised.
This will route all of a device’s traffic, including DNS, through an encrypted connection to a trusted VPN server before it travels anywhere else, the company explained, thus preventing local networks like hotel gateways from seeing or modifying DNS and internet traffic.
“In effect, it takes the untrusted network out of the trust equation,” ReliaQuest noted.
However, full-tunnel configuration is not the default for VPNs, because it comes with “real trade-offs,” the researchers noted: It adds cost, latency, and bandwidth demands, since every packet has to travel through company infrastructure. Thus, forcing all traffic through the corporate backbone is “not always practical” for distributed or bandwidth-heavy workforces.
Enterprises should also enforce conditional access in Entra ID to block device-code authentication flow, which has few legitimate use cases for most users in most environments, ReliaQuest noted.
Additional precautions
The company also advised:
Restricting Proxy Auto-Configuration (PAC) file retrieval to approved internal hosts;
Disabling automatic Web Proxy Auto-Discovery (WPAD) via Group Policy to (this is often enabled by default in Windows);
Deploying encrypted DNS such as DoH or DoT in strict mode as a “complement or alternative” to full-tunnel VPN. This is particularly important for organizations where always-on VPN is not feasible.
Training employees to verify the URL and certificate of any page requesting credentials before entering them, particularly on public Wi-Fi networks.
Prevention is more important than detection here, ReliaQuest pointed out: while in tools like Microsoft Defender for Endpoint, ‘DnsConnectionInspected’ events showing queries to attacker-controlled domains are a primary endpoint-level signal, “by the time those events fire, the redirect has typically already occurred. In other words, endpoint telemetry confirms what happened more than it prevents it.”
This is exactly why methods like encrypted transport, Conditional Access, and WPAD and PAC hardening matter more than detection alone, the researchers emphasized.
For the last 22 years, one of the most bizarre true crime stories ever to grace the program Unsolved Mysteries has confounded amateur investigators and spawned hundreds of pages of online speculation. Who was behind the decade-long torment of Bill and Dorthy Wacker in the 80s and 90s, which included allegations of stalking, robberies, and even assaults?
While any internet true crime enthusiast knows Unsolved Mysteries frequently left out interesting details that can create a rabbit hole of alternative explanations, in this case, the show has been the sole source of information, with no other known period news coverage of the harassment.
That is, until recently, when this author acquired the original police records, spanning almost 100 pages of material, while researching for my podcast, Cease to Exist. The records reveal a wealth of new information, including potential leads on suspects, and answers to questions true crime fans have speculated about for years.
The Wackers claimed to be victims of a long-term harassment campaign. Credit: Film Rise/Unsolved Mysteries
Unsolved Mysteries
In the Unsolved Mysteries season 6 two-hour finale, airing in the spring of 1994, the public met Bill and Dorthy Wacker, an elderly couple from Massillon, Ohio, who claimed to be victims of a bizarre string of harassment stretching back years. Since then, their story has been the subject of considerable speculation, with some believing the whole affair was so unbelievable that the Wackers must have been making it up. On the other hand, Dorothy herself did seem to bear injuries consistent with the couple’s claims. Without any further information, true crime fans dissected every available scrap of evidence, including the accuracy of the reenactments, for possible clues.
“The Wackers are quiet, unassuming people who tend to mind their own business. Hardly the type to draw the wrath of an unseen enemy,” Unsolved Mysteries host Robert Stack said at the beginning of the segment.
The scene then opens with the couple returning to find their home ransacked on January 16, 1985. This was the third claimed incident, but according to the program, the first that was reported.
“After nearly 10 years, Dorothy and Bill Wacker still wonder who and why,” Stock intoned.
The Wacker’s Story
In interview footage with the couple, Bill speculates that someone may be attempting to force the couple to move, although why that would be was unclear, and refers to the perpetrator as “a kook,” which becomes a bit of a meme in online discourse about the case.
Six months after the previous break-in, Dorothy was home alone recovering from heart surgery when she heard a knock at the door. She found a young man who claimed his car had broken down and that he needed to use her telephone. Although she didn’t see a car anywhere, she let the polite stranger in. He made a call, thanked her, and appeared to leave.
Before she knew what had happened, Dorothy awoke tied up on her kitchen floor after having been struck in the head. A neighbor heard her cries through an open window and came to her aid. Although Dorothy’s injury was not serious, there were two strange elements to the crime. First was the graffiti “cheaper, but will do,” shown in the reenactment as having been left on the kitchen wall. Second was the variety of items stolen from the home, including a gun and radio receiver, which were later returned to the Wackers’ porch. Police were baffled by the return of a stolen gun and distributed fliers featuring a sketch of the suspect, but no identification was ever made.
Harassment continued with a series of threatening phone calls that persisted even after the family changed their number, according to Dorothy and her daughter Peggy Hoover. Additionally, nocturnal banging on the outside of the house began, which led the couple to install lights. The only result was a strange note on the front porch reading “your lights are a laugh,” and subsequent notes such as “you scum I’ll get even,” with a backside reading “this time ha ha.” The police never found any fingerprints on the notes and suggested they may have been made by someone using their opposite hand to disguise their handwriting.
The graffiti written on the Wackers’ wall in the Unsolved Mysteries Reenactment (Credit: Filme Rise/Unsolved Mysteries)
Second Attack and Stake Out
The most dramatic events yet occurred in the fall of 1993. Dorothy was walking her dog outside of their home on October 27th when she was attacked again. The segment claimed she suffered “skull lacerations” and was taken to the hospital, but there were no witnesses to the event.
Notably, Sheriff Bruce W Umpleby says that after interviewing neighbors, no one had any information that led them to believe there was a person there. He continued that most crimes have simple motives and there has never been one identified for the strange periodic flurries of activity around the Wackers.
Things reached a climax when the family conducted a stakeout, hoping to finally capture the stalker one November evening. Bill hid inside a trailer in the driveway, while Dorothy and their daughter Cathy stayed inside the home. Across the street, their sons-in-law Dan and Clay sat in a vehicle in a neighbor’s driveway. After almost four hours, they decided to end the stakeout around 10:30 p.m., when they heard a loud bump on the porch. Incredibly, the stalker had apparently evaded the surveillance and thrown a rock onto the Wackers’ front porch with a note reading “get the message.”
At the conclusion of the segment, Bill says he hopes whoever is responsible is caught soon because, if the Wackers were no longer the targets, he feared the individual would simply target someone else.
Unsolved Mysteries Online Speculation
Besides noting that the sheriff’s department had asked Dorothy after the second attack whether Bill could have been the attacker, the series plays the events fairly straight, without directly questioning the couple’s story. The eerie music and Stack’s gravelly voice convey a feeling of serious menace. True crime fans are more divided, with some arguing that the events were too implausible to be real, while others find it unlikely that an elderly couple would fabricate such a wild tale. Notably, another popular Unsolved Mysteries segment, involving the stalking of Cindy James, is also widely believed to have involved a hoax.
Unfortunately, Newspapers.com’s archive of the local paper, The Massillon Independent, has a large gap between the early 1970s and the 2020s. The only other known media appearance by Bill Wacker before his death was in an unrelated citizen-reaction piece about Connie Chung interviewing Newt Gingrich’s mother in the Akron Beacon Journal, although he is wearing an Unsolved Mysteries hat in the picture. The only other items recovered were obituaries stating that Bill had died in 1999 at age 79 and Dorothy in 2020 at age 83. This left armchair sleuths to rely primarily on what appeared in the episode itself, which does raise questions.
One notable detail is that, in the reenactment, Dorothy’s dog doesn’t bark to alert her to the intruder, which seemed uncharacteristic of a small dog. People debated whether this was merely a quirk of the reenactment or reflected how the event actually occurred, with some questioning whether this provided evidence that Bill was behind the assault. Additionally, some found it odd that the stakeout was called off at the relatively early hour of 10:30 p.m. and found the return of stolen items completely unbelievable. Another oddity was the wording of the letters, with phrases like “you scum” and “no junk,” which sounded to some like older adults attempting to mimic the speech of teenagers while using outdated phraseology.
Among those who believe the Wackers, suspicion has frequently fallen on the daughters, who would presumably inherit the home and were not mentioned as suspects in the episode. Particular suspicion has fallen on Peggy, who was not present for the stakeout. Some have also pointed to the phone calls continuing after the Wackers changed their number as possible evidence of an inside job.
One Redditor, sovietbabyy, claimed to be a relative of the Wackers who stumbled upon the case, although they were too young to have ever met Bill and Dorothy themselves. They claimed Bill and his siblings were all dead but asked other family members for more information and were told that the extended family believed the story and that Bill was usually secluded but would help anyone in need. Five years later, a poster using the screen name goawaycommies followed up, claiming to be the same person. In these new posts, the author claimed that Stark County was a high-crime area and that the police were known to be ineffective; therefore, it shouldn’t be surprising that no one was caught.
While it could be debated whether these two posters are actually the same person, the goawaycommies post provided one essential detail that led to a major breakthrough: the Wackers’ address.
Finding the Wackers
In late December, I wrote to the Massillon County Sheriff requesting any files they had on the Wackers. They granted my request in early January, providing 94 pages of documents. Follow-up requests to the North Lawrence Fire Department, who responded to the assaults, as well as inquiries to two of the responding officers and Ricky Lee Pegido, were fruitless. The Sheriff’s office maintains that these documents are all that were found in the file, despite some appearing to be missing, such as a cover sheet without a report and references to a “phone trap” that is not followed up on.
While the officers may not have wanted to talk about these events, what was contained inside was fascinating, providing the names of suspects, neighbors’ opinions on the Wackers, incidents that were not included in the Unsolved Mysteries segment, and another 90s-era “classic” addition: records involving consultation with a psychic about the crimes.
The Wacker home today. Credit: Google Street View
The Reports
Right from the beginning, the documents tell a slightly different story from the television segment. Instead of waiting until the third event, in January 1985, to call police, there was a report concerning the initial August 1984 break-in. This one was different from the others, with gold and diamond jewelry stolen that was not returned and police noting that a credit card may have been used to force the lock.
The police report for the January 1985 break-in contained two notable details: the method of entry and the first-named suspect. Despite having their locked home broken into previously, the Wackers had left a side door unlocked, allowing the burglar to gain entry. Additionally, the report lists a “Randy” as a possible suspect, a young man whose aunt had previously cared for Mrs. Wacker’s elderly mother in the home.
Next, the first assault report appears, which is similar to what was shown in the episode, except that “CHEAPER, BUT WILL DO” was written in a bathroom instead of the kitchen. Additionally, a basement window was cut, through which the perpetrator may have escaped. The man who came to her aid is named here as Jim Pedigo, who says he and his brother had been working in their backyard all morning without seeing or hearing a thing until Dorothy’s cries became evident. In this report, the name is given as “Pedigl,” and it switches back and forth between that and “Pedigo” in the reports (the name “Pedigo” appears in print as a family name in the area in obituaries). When Bill returned, he found items that appeared to have been staged to be taken later from the robbery around the perimeter of the house.
Following this, there is a series of minor reports of items being stolen and returned—oddly, with the Wackers still not locking their doors, despite the first report indicating that had been their former habit.
The Second Assault
The report of the second assault does closely match the program, even down to the controversial dog not barking when the assailant came after Dorothy. Although the Wackers claimed the dog normally ignored its surroundings as it relieved itself, the officer noted on a follow-up visit to the residence that the dog barked when he arrived, which he found suspicious. In the report, Dorothy claimed she had to crawl to the back door to get help from Bill after the attacker fled, which was supported by dirt and scratch marks on her forearms noted by the officer. The officer gave Bill some suggestions, such as installing a light on that side of the house and trimming some trees to remove hiding places.
A lengthy segment of the report regarding the Sheriff’s canvassing of the neighborhood provides some interesting insight into the Wackers’ relationship with their neighbors. This portion notes that:
The neighbors collectively agreed that none of them have had any type of problems. Nor, have they seen or heard any form of disturbance in the area. In fact, several of the neighbors stated that they don’t even lock their doors. Further stated by the neighboring community, most of the neighbors stay to themselves, however, ‘the Wackers bring most of their problems on themselves.’ Apparently the Wackers aren’t the most congenial of persons in the neighborhood, especially with the Shillings and Maddox’s.
The Maddox family is the same household as the Pedigo family, a notable change of relations since Jim Pedigo aided Dorothy. On the other hand, another couple in the neighborhood stated that they regularly played cards with the Wackers, providing a nuanced image of them as people who got along with some but not others.
Suspects Not Named on Unsolved Mysteries
Following this event, both of the daughters began continually contacting the Stark County Sheriff’s office, demanding more attention be paid to their parents’ harassment. One of the items introduced here, but oddly never followed up on, is a “phone trap” put on the Wackers’ phone by their telephone company, Ameritech, to monitor all incoming calls. Although the reports say this is activated, there is no information on whether any claims of harassing calls were ever compared against the phone trap.
There appears to be a missing report explaining where the tip originates from, but officers speak with the son residing at the Maddox/Pedigo residence, Ricky Lee Pedigo, about whether he is aware of an individual by the name of “Shriner” on his mother’s side of the family, which he was not. When they later return to speak with his mother, Barbara Maddox, she claims she is not related to anyone by that name and flippantly remarks that the composite of the suspect in the first attack on Dorothy looks like a young dick Van Dyke, but no one she’s ever seen before.
Next, officers follow up on a tip from daughter Peggy Hoover that a woman named Debbie Shriver’s (not Shriner) ex-husband may be the suspect. After tracing this woman through a former landlord and then her own father, Debbie, now going by Debbie Pedigo, agrees to speak with the Stark County Sheriff’s. She says the composite bears no resemblance to her ex-husband, James Shriver.
Peggy then returns with another tip that a psychic told her the suspect lives within a twelve-mile radius of the Wacker home.
Finally, Peggy provides one last suspect: Barbara Maddox’s stepson, Johnny Lee, whom she says may be because her parents didn’t pay enough attention to him as a boy. At this point, Barbara Maddox has had enough, saying that her stepson hasn’t been to visit in years, and she is going to put up a privacy fence to keep away from the Wackers.
The suspect sketch from the Dorothy Wacker assault. Credit: Film Rise /Unsolved Mysteries
Final Events
From this point on, the banging and rocks being thrown at the home continued. At one point, the Wackers claimed someone had tried to gain entrance to their locked home, but the police report casts suspicion on this. The appraisal was that it appeared as though someone was attempting to make it look like the house was being broken into without causing too much damage, and it was inconsistent with typical burglary techniques.
The final report is from October 1997, when Dorothy heard a loud banging on the house while seated in the living room. An officer responded but could find no damage.
All the reports are bizarre. The daughters appear to be very invested in the case, yet Peggy ultimately seems to be throwing around claims that don’t add up to anything. Was she letting her imagination run away with her, using the events as a cover to harass people she had personal grievances against, or was she really on to something? The “Shriner/Shriver” discrepancy speaks to a minor issue prevalent in the police’s investigations: not confirming the spelling of names, which also occurs with “Pedigl/Pedigo.” Does this indicate the sheriff’s department is generally performing sloppy work, as the Reddit poster implied? While there is room to speculate here, the constantly changing accusations may have undermined Peggy’s credibility with law enforcement.
One possible conclusion is that the very earliest break-in was real, since the stolen items were not returned and the report is consistent with a typical forced entry. Perhaps after that, the Wackers developed a taste for the excitement and attention and hoaxed the rest of it. This would explain the incongruities of items being returned, no one ever seeing anything, their continuing to leave their doors unlocked, and the strange attempt to create the appearance of a forced entry without damaging the home.
But then again, officers reported witnessing injuries to Dorothy after both assaults. Could she have been willing to take things that far? Could the couple have truly been victims? Could one of the children be behind it? Was Bill assaulting her?
None of these questions can clearly be answered from the available evidence; and so, decades after the strange story of the Wackers first came to public attention, the case rests—and another relic of the 1990s remains an unsolved mystery.
Ryan Whalen covers science and technology for The Debrief. He holds an MA in History and a Master of Library and Information Science with a certificate in Data Science. He can be contacted at ryan@thedebrief.org, and follow him on Twitter @mdntwvlf.
“Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs,” the company wrote in the report.
The takedown reduced activity across multiple phishing categories, forcing attackers to shift to newer delivery methods.
Riding this shift in were a few notable phishing campaigns, including an automated business email compromise (BEC) campaign that reached 42,000 organizations in under three hours, and a multi-stage phishing campaign that used nested email (EML) files, calendar invitations, and a Microsoft authentication redirect to deliver malware.
To counter phishing attacks, Microsoft recommends blocking emails containing known bad URLs/ subject fields, enabling password-less authentication methods, or moving to MFA for accounts that still require passwords.
Tycoon2FA disruption sent attackers exploring
The take-down of Tycoon2FA forced its operators to abandon portions of their infrastructure and rework hosting, domain registrations, and delivery mechanisms.
“After falling 15% in March and another 22% in April, Tycoon2FA-linked phishing volume dropped 74% in May to just 1.5 million messages, then fell another 20% in June to 1.2 million, by far the lowest monthly volumes observed in at least a year,” Microsoft said.
The decline extended to QR Code lures and fake CAPTCHA pages, two phishing techniques in which Tycoon2FA accounted for 12% and 14% of industry activity in June, respectively. This indicated that the platform’s customer base had not been able to migrate to a replacement infrastructure.
But cutting off one head of the hacker hydra only gave rise to new tactics elsewhere.
The adaptation came in the form of using Microsoft Teams as a social engineering channel. Attackers established conversations to build trust before attempting credential theft or delivering malicious payloads. “Teams-based phishing volume climbed steadily throughout Q2, with the average number of detected attacks rising 19% from March to April, holding roughly flat into May (+1%), then increasing another 10% into June,” Microsoft said.
Microsoft also observed a highly automated BEC campaign that reached over 67,000 users using scripted emails, Amazon Simple Email Service (SES), and engagement tracking, alongside a separate phishing campaign targeting 107,000 users that abused Microsoft’s authentication flow and trusted cloud services, including Teams archive recording and ICS calendar invite, to disguise malware delivery behind legitimate infrastructure.
Phishing changes but the defense doesn’t
While QR Code and Captcha-based phishing attacks dropped significantly in the second quarter, business email compromise (BEC) charted jumped 121% between March and April, before dropping down again in May.
QR Code phishing represented 8.3 million attacks in June 2026, down from a peak of 18.7 million in March. Similarly, Captcha-gated phishing fell from 12 million attacks in March to 2.2 million in June.
BEC attacks hit 9 million in March, falling to 3.9 million in June.
But even as these phishing classics lost momentum and newer techniques emerged, Microsoft’s defensive advice remained rooted in the basics. It noted organizations should complement email filtering with phishing-resistant authentication such as passkeys and phishing-resistant MFA to reduce the effectiveness of credential theft campaigns.
The company also recommended strengthening Exchange Online Protection and Microsoft Defender for Office 365 with capabilities such as Safe links and Zero-hour Auto Purge (ZAP), in which malicious emails already delivered to mailboxes are removed before they are read, alongside enforcing password-less authentication methods like Windows Hello, FIDO keys, and Microsoft Authenticator.
Microsoft concluded its report with a list of indicators of compromise (IoCs) from the threats observed in the quarter to support detection efforts.
Prosecutors accused 21-year-old student Zyaire Wilkins of publishing on Steam several fake video games that contained malware, infecting thousands of victims, and stealing crypto from some of them.
Thalha Jubair, 20, and Owen Flowers, 19, sentenced to five and a half years each for cyber-attack that cost Transport for London £39m
The data of millions of commuters was stolen, Londoners were left out of pocket and 27,000 Transport for London staff were forced to reset their passwords.
Over four days in 2024 a pair of teenage hackers had London’s transport network at their mercy. Thalha Jubair and Owen Flowers had burrowed into the heart of Transport for London’s IT systems and held the “keys to the kingdom”.
Com quase 17,7 mil milhões de contas comprometidas indexadas e mais de mil fugas de dados catalogadas, o Have I Been Pwned é a referência mundial para saber se o seu endereço de e-mail ou password já caíram nas mãos erradas. É totalmente gratuito.
International authorities and a raft of private technology companies say they have disrupted a cybercrime “assembly line” that allowed crooks to collect millions of login credentials and steal more than $47 million in ransom payments and by other fraudulent means.
The crux of the operation was the simultaneous targeting of two unrelated tools that are widely used in various online scams. The first is Amadey, a malware-as-a-service platform for compromising devices and delivering malicious payloads for ransomware and other scams. Amadey has been observed in the wild since at least 2018 and was seen last year abusing GitHub as it collected system information from infected devices and installed customized payloads. The second tool was StealC, an infostealer-as-a-service platform that collects credentials, authentication cookies, cryptocurrency wallets, browser extensions, and files whose names match customer-defined patterns.
Severing a critical link in the cybercrime chain
Amadey and StealC are separate tools that are run independently of each other. Given their widespread use, however, many customers use both in their individual cybercrime activities. The tools also, it turns out, relied on some of the same underlying infrastructure to run. Microsoft said it made this determination after analyzing the tools using AI. This insight allowed Microsoft attorneys to seek an order disrupting both at the same time.
Airbnb scams have surged 30x since 2023, including a sharp rise this year
Criminals hijack legitimate host accounts to to trick holidaymakers
Staying safe isn't so straightforward as threats evolve
Airbnb-related scam activity has increased 30x since the first half of 2023, according to new research from Saily and NordStellar, confirming that cybercriminals continue to go after holidaymakers seeking the best deals amid rising prices.
The report ultimately concludes that attackers are now targeting the trust built by larger platforms, saving them from having to build new identities from scratch.
And to top it all off, the nature of scams is also changing, as instead of using suspicious websites to obtain victim payments or information, criminals are now targeting legitimate Airbnb host accounts which have spent years amassing positive reviews and high ratings.
Exploiting legitimate accounts and hijacking trust
While the end goal remains high volumes of vulnerable consumers, scammers have added an extra layer of victim in their pipeline. Verified Airbnb hosts are now valuable assets for criminals because they already have identity verifications, positive reviews, booking histories, years of activity and established credibility.
Once the verified account is compromised, attackers can then go on to scam higher volumes of unsuspecting victims by posting – and charging for – fake property listings.
“Travelers are getting better at spotting obvious scams,” Saily Head of Product Matas Cenys said. “Criminals know this, so they are increasingly trying to steal trust instead of building fake trust from scratch.”
Where this type of attack differs from others, though, is that the victims never leave the platform. Rather than falling victim to phishing attacks and being redirected to malicious external sites, they interact fully with supposed legitimate hosts on the Airbnb platform.
While Airbnb attacks have seen a 30x increase in around three years and a sharp rise in the last year alone, they reflect a much broader trend of attackers compromising existing trusted accounts.
The recent ramp-up in attacks could also be tied to the summer season, with holidaymakers looking to book last-minute deals in the run-up to the summer season. Urgency and pressure to keep costs low also adds to criminals’ success.
“Everything looks normal until they arrive at their destination and discover the accommodation never existed," Cenys added.
How to protect yourself from booking scams
Saily is recommending that all communication stays within the booking platform and that customers avoid payment methods suggested outside of official channels. Unusually attractive listings in high-demand destinations could also be taken with a pinch of salt, and savvy shoppers may choose to reverse image search a property to double check its authenticity.
“As travel booking becomes increasingly digital, trust becomes one of the most valuable currencies in the travel ecosystem,” Cenys warned.
As for abusing victim trust, researchers also argue that AI has aided attacks by allowing criminals to produce better fake listings more quickly.
More generally, Airbnb revealed that two in five Americans have fallen victim for an online scam, with the average loss totalling nearly $2,000. The company has introduced measures to remind its users how to avoid scams, including introducing identity verification and reminders not to leave the platform, but account takeovers can still slip under the radar.
Airbnb also holds guest payments until 24 hours after check-in to ensure that everything is as described. Anti-fraud tech also prevented around 265,000 suspicious listings from appearing on the platform in 2025, the company boasted.
The company posted a comprehensive eight-step list of how to avoid scams on its platform online, calling out pressure tactics and unusual deals.
The media response to the Belfast beheading has once again focused on the 'racism' of the working class rather than on the horror of the crime itself and the dysfunctional immigration system behind it, says Andrew Devine.
Iranian-linked group Handala breached California Water Service, leaking 5GB of customer data and exposing critical GPS infrastructure across seven districts.
Login
