American heiress Jamey Carney was found dead in her Killarney home in July, after her teenage daughter discovered her body. Her Jordanian asylum seeker boyfriend is now the prime suspect.
The post American Heiress ‘Murdered by Asylum Seeker Boyfriend’ Who Fled Ireland on One-Way Ticket appeared first on The Daily Sceptic.
An “AI worm” can spread through Microsoft Word documents using Copilot as a vector, a prominent Norwegian AI researcher reported on Tuesday.
The report from Håkon Måløy, later confirmed by Microsoft, said that an attacker can conceal instructions in a document that is later used as source material for Copilot-generated or Copilot-edited Word documents, for example, as input to a financial report. Those malicious instructions could potentially alter figures in the document being created. They then copy themselves into the new document, causing it to become a carrier of the attack when used in another Copilot-assisted workflow.
Måløy noted: “To my knowledge, this is among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite.”
Microsoft on Thursday emailed a statement to CSOonline discussing the report’s revelations.
“We have addressed the findings reported by the researcher and thank them for working with us through coordinated vulnerability disclosure. To address this class of risk, we use a defense-in-depth strategy with safeguards that block malicious instructions at multiple points and help keep tasks aligned with users’ requests,” Microsoft said.
“We are continuously strengthening these safeguards as the technology and threat landscape evolve,” it added. “We encourage customers to install the latest updates, use multiple layers of security protection, treat content from unknown sources with caution, and review AI-generated content before using or sharing it.”
Aman Mahapatra, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, has reviewed the mechanisms used in this vulnerability and says that it is much worse than it might seem, because it will sidestep just about every defensive mechanism enterprises have in place today.
“This is a worm, a self-propagating malware pattern that uses Copilot as the transmission mechanism and legitimate corporate collaboration as the delivery channel. It bypasses every traditional email security control because the document is not malicious on delivery and it becomes malicious when Copilot processes it. That means that it bypasses DLP because the exfiltration happens through the user’s own authenticated Copilot session,” Mahapatra said. “It then bypasses endpoint protection because no code executes, only instructions get followed by an AI service the enterprise has explicitly authorized.”
He also noted that researchers have been warning about this class of attack for two years.
Måløy said that he has been working with the Microsoft Security Response Center (MSRC) since March 3 and Microsoft subsequently implemented and distributed multiple small focused mitigations, but the core vulnerability has yet to be fixed.
He said he was hesitant to disclose an active vulnerability, but felt that it was now time to publish.
“My reasoning is that defenders cannot reduce exposure to a risk they are unaware of,” Måløy wrote, “and the propagation mechanism described here affects ordinary document workflows that many organizations already rely on.”
In an email interview, Måløy noted that the tweaks Microsoft has implemented were helpful, nonetheless.
“The coordinated disclosure process showed that mitigations can meaningfully reduce the demonstrated attack surface, making attacks less reliable and limiting their reach, even without completely eliminating the underlying problem,” he said.
Måløy also addressed the resolution that many analysts and consultants suggested, which is to change the nature of LLMs to fully isolate instructions from the data they operate on.
“Separating instructions from data may be part of the solution, but I think the distinction between data and instructions is not always clear in real-world workflows. For example, a user may ask an agent to arrange a business trip, requiring the agent to retrieve an email specifying the approved itinerary and a document containing the booking procedure,” Måløy said.
“My view is that the broader challenge is therefore not simply to prevent systems from interpreting external content as instructions, but to evaluate whether those instructions align with the user’s goals and the context in which the system is operating,” he added.
Mike Wilkes, enterprise CISO at Aikido Security, said it would be difficult to overstate the potential problems from this situation.
“This is a significant issue because it moves prompt injection from a single compromised interaction into a potentially self-propagating document integrity attack,” he said, noting that it is not a conventional worm that spreads automatically. A user or Copilot workflow must still bring an infected document into the model’s context. “But once that happens, the malicious instructions can reportedly alter business information, conceal themselves inside the resulting Word document and turn a legitimate internal file into the next carrier,” he said.
That, he pointed out, creates “a dangerous enterprise supply chain in which financial reports, contracts, policies and partner documents may inherit malicious behavior while retaining the trust associated with their legitimate authors and Microsoft 365 accounts.”
The key issue behind this flaw is the fact that genAI tends to struggle with telling the difference between data that a user offers as input and the instructions the AI is to execute.
Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, observed that the same problem with mixed data and instructions occurred in databases decades ago, and turned into what we know as SQL injection attacks today. But, he noted, a few years later, parametrized binding for the database access layers was developed, which separates instructions, which are handled internally and safely, from data, which can come from untrusted sources. “The same needs to happen with LLMs and other AI,” he said.
Mike Leone, a VP/principal analyst at Moor Insights & Strategy, agreed.
“It’s hard not to chuckle a bit with this one. People have been asking whether data can give orders since SQL injections. We fixed that one by giving the database a way to tell an instruction from a value,” Leone said. “Thirty years later, we’ve built an entire category of software that can’t tell the difference at all.”
Tom Findling, CEO at Conifers.ai, also said he sees the data-vs-instructions issue as the biggest problem.
“Separating data from instructions is still unsolved at the model layer. The labs are making real progress, but not enough to be your only control,” he said, and stressed, “Microsoft doesn’t need to wait for that. It can slow propagation inside Copilot: stop hidden content from being written into new documents, surface hidden text before it’s used, preserve the trust level of what Copilot read and show all AI-generated changes.”
However, Frank Dickson, group VP for security at IDC, argued that a fix needs industry agreement.
“A fundamental fix requires the industry to converge on the same architectural change, which isn’t happening anytime soon given the incentives and the fact that the major players are far from besties,” he said, pointing out that Instruction-data separation would need to be baked in at the model or platform level across every major vendor. “None of them are rewarding that work commercially right now, so treat that as a multi-year research problem, not something a CISO should wait on.”
Leone disagreed, arguing that a single vendor can do quite a bit, at least for its own customers.
“Microsoft has said publicly since last year that indirect prompt injection can’t be fully prevented, and I give them credit for saying it out loud rather than pretending otherwise,” Leone said, noting that the industry doesn’t have to move in lockstep. “This attack lives inside one product,” he said. “If Microsoft hardens the Copilot document path, Copilot customers get safer whether or not anyone else moves.”
Dickson added that another critical problem with this vulnerability is that the carrier documents are created by legitimate employees using legitimate tools, “so there’s no obvious point of origin once the payload starts moving; an organization could be laundering corrupted financial figures through its own workflow for weeks before anyone notices.”
That said, experts had some specific suggestions for CISOs trying to negate this problem.
IDC’s Dickson said, “the most useful lever right now sits outside the model entirely, in how much untrusted content Copilot is allowed to pull into a session without a human choosing it.” He noted that enterprises can turn Copilot’s auto-discovery behavior off or restrict it, and require humans to explicitly select the documents they feed it. “That alone closes off one of the two ways the attack gets a foothold,” he said.
IDC also suggested a visible diff or redline of anything Copilot changes in a financial or otherwise consequential document, and the requirement for a human to approve the changes. “That’s not a technical fix, it’s a workflow one, and it’s available today,” Dickson said.
He said that IT should also track where content came from and what was touched by an AI system, in metadata that travels with the document. “It doesn’t stop the injection, but it means when something does get through, an organization can actually trace how far it spread instead of discovering a corrupted number three reports later with no way to reconstruct the chain,” he said.
However, one expert, Tyler Reguly, Fortra’s associate director of security R&D, said that he didn’t see this vulnerability having a meaningful impact because it feels like what he called a “laboratory vulnerability.”
Normal enterprise workflows don’t encompass a number of the necessary steps for compromise, he said, pointing out that, if anything, people are trained not to download Word documents. Plus, he noted, looking at the blurred example in the report, the malicious document contained an additional apparently blank page which held the concealed prompts in white text.
“That page is going to send up warning signs for me if someone even managed to convince me to download an external Word document,” he said. So, overall, “this feels like it requires a perfect storm.”
This article originally appeared on CSOonline.
Traveling enterprise employees beware: Think twice before you log onto that oh-so-convenient public Wi-Fi.
Since at least June, threat actors have been compromising “captive” Wi-Fi gateways and other portal appliances at hotels, conference centers, and similar shared venues to hijack users’ Microsoft 365 accounts, according to the ReliaQuest Threat Research team.
Once a threat actor controls a gateway, they can silently redirect a user’s traffic to their own infrastructure and steal their Microsoft 365 credentials without ever touching the user’s device, compromising endpoints, or sending phishing links or malicious attachments.
“The most dangerous element is that it operates at the network gateway, which sits beneath most of the trust assumptions users and devices make,” ReliaQuest told CSO Online. “It’s not necessarily an enterprise breach level event on its own, but it’s a very real risk to individual accounts.”
Domain Name System (DNS) poisoning, in which false data is injected to redirect regular web traffic to fraudulent domains, has previously been observed on small office routers, but attackers are now expanding the technique to higher-level targets, the ReliaQuest researchers explained in a blog post.
Attackers likely gain access to the gateways through weak or reused admin credentials in combination with exposed interfaces like Secure Shell (SSH), Simple Network Management Protocol (SNMP), and other web consoles, they pointed out.
Admin access to the gateway is all that malicious actors need, because devices are designed to inherently trust DNS, which translates domain names like login.microsoftonline[.]com into IP addresses to route them. Therefore, a single gateway compromise gives the attacker the ability to redirect traffic for every guest logging into the network, providing IP addresses it controls in response to DNS requests, rather than the legitimate ones, without touching a single endpoint.
“Captive portal appliances sit at the network perimeter for every guest on that network,” the researchers wrote. “Detection is inherently difficult because the attack happens gateway-side, outside the endpoint’s visibility.”
In the campaign tracked by ReliaQuest, four attacker-registered domains, m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com, were used for Microsoft-impersonation lures.
The compromised Wi-Fi gateways were discovered across multiple US cities as well as in India and Saudi Arabia, and impacted users were from companies in professional and financial services, legal, retail, health care, and energy, indicating that the method isn’t sector-specific.
“We’ve seen enough SharePoint exfiltration cases to know that a single popped account can cascade into meaningful data loss,” ReliaQuest noted. Meanwhile, for the network operators, there’s a “reputational dimension”; user compromise is a “serious trust and brand problem, regardless of how sophisticated’ the underlying attack is.”
Locking network configurations to a ‘safe’ DNS provider such as Google (8.8.8.8), Cloudflare (1.1.1.1), or the cloud-based OpenDNS isn’t a sufficient tactic, because it doesn’t change the path that queries actually travel over, ReliaQuest contended.
By default, devices send DNS queries as unencrypted protocol traffic, and those packets still have to traverse the hotel’s network to reach Google, Cloudflare, or OpenDNS, the company explained. Since the gateway sits directly in that path, it can inspect, block, or redirect the query before it ever reaches the chosen resolver.
“Specifying a trusted DNS server changes the intended destination, not who controls the road to get there,” ReliaQuest noted.
Further, Domain Name System Security Extensions (DNSSECs), which use digital signatures and public-key cryptography, only “partially” address the problem. DNSSEC provides authentication and integrity for signed domains, which means a validating resolver can detect and reject forged or tampered responses.
“What it does not do is provide confidentiality or availability,” the company said. “It does not encrypt DNS traffic or stop an attacker from intercepting, blocking, or redirecting requests.”
So while DNSSEC can defeat certain response-forgery attacks against signed zones, an on-path gateway can still see queries, drop them, or force fallback behavior. However, this protection layer only helps when domains are actually signed, and then only when the client or resolver performs validation, which “many stub resolvers do not,” according to ReliaQuest.
To combat the problem, enterprises should require all corporate devices to use a full-tunnel VPN for network connection. Controls should prevent internet access until a tunnel is active, ReliaQuest advised.
This will route all of a device’s traffic, including DNS, through an encrypted connection to a trusted VPN server before it travels anywhere else, the company explained, thus preventing local networks like hotel gateways from seeing or modifying DNS and internet traffic.
“In effect, it takes the untrusted network out of the trust equation,” ReliaQuest noted.
However, full-tunnel configuration is not the default for VPNs, because it comes with “real trade-offs,” the researchers noted: It adds cost, latency, and bandwidth demands, since every packet has to travel through company infrastructure. Thus, forcing all traffic through the corporate backbone is “not always practical” for distributed or bandwidth-heavy workforces.
Enterprises should also enforce conditional access in Entra ID to block device-code authentication flow, which has few legitimate use cases for most users in most environments, ReliaQuest noted.
The company also advised:
Prevention is more important than detection here, ReliaQuest pointed out: while in tools like Microsoft Defender for Endpoint, ‘DnsConnectionInspected’ events showing queries to attacker-controlled domains are a primary endpoint-level signal, “by the time those events fire, the redirect has typically already occurred. In other words, endpoint telemetry confirms what happened more than it prevents it.”
This is exactly why methods like encrypted transport, Conditional Access, and WPAD and PAC hardening matter more than detection alone, the researchers emphasized.
This article originally appeared on CSOonline.
For the last 22 years, one of the most bizarre true crime stories ever to grace the program Unsolved Mysteries has confounded amateur investigators and spawned hundreds of pages of online speculation. Who was behind the decade-long torment of Bill and Dorthy Wacker in the 80s and 90s, which included allegations of stalking, robberies, and even assaults?
While any internet true crime enthusiast knows Unsolved Mysteries frequently left out interesting details that can create a rabbit hole of alternative explanations, in this case, the show has been the sole source of information, with no other known period news coverage of the harassment.
That is, until recently, when this author acquired the original police records, spanning almost 100 pages of material, while researching for my podcast, Cease to Exist. The records reveal a wealth of new information, including potential leads on suspects, and answers to questions true crime fans have speculated about for years.
In the Unsolved Mysteries season 6 two-hour finale, airing in the spring of 1994, the public met Bill and Dorthy Wacker, an elderly couple from Massillon, Ohio, who claimed to be victims of a bizarre string of harassment stretching back years. Since then, their story has been the subject of considerable speculation, with some believing the whole affair was so unbelievable that the Wackers must have been making it up. On the other hand, Dorothy herself did seem to bear injuries consistent with the couple’s claims. Without any further information, true crime fans dissected every available scrap of evidence, including the accuracy of the reenactments, for possible clues.
“The Wackers are quiet, unassuming people who tend to mind their own business. Hardly the type to draw the wrath of an unseen enemy,” Unsolved Mysteries host Robert Stack said at the beginning of the segment.
The scene then opens with the couple returning to find their home ransacked on January 16, 1985. This was the third claimed incident, but according to the program, the first that was reported.
“After nearly 10 years, Dorothy and Bill Wacker still wonder who and why,” Stock intoned.
In interview footage with the couple, Bill speculates that someone may be attempting to force the couple to move, although why that would be was unclear, and refers to the perpetrator as “a kook,” which becomes a bit of a meme in online discourse about the case.
Six months after the previous break-in, Dorothy was home alone recovering from heart surgery when she heard a knock at the door. She found a young man who claimed his car had broken down and that he needed to use her telephone. Although she didn’t see a car anywhere, she let the polite stranger in. He made a call, thanked her, and appeared to leave.
Before she knew what had happened, Dorothy awoke tied up on her kitchen floor after having been struck in the head. A neighbor heard her cries through an open window and came to her aid. Although Dorothy’s injury was not serious, there were two strange elements to the crime. First was the graffiti “cheaper, but will do,” shown in the reenactment as having been left on the kitchen wall. Second was the variety of items stolen from the home, including a gun and radio receiver, which were later returned to the Wackers’ porch. Police were baffled by the return of a stolen gun and distributed fliers featuring a sketch of the suspect, but no identification was ever made.
Harassment continued with a series of threatening phone calls that persisted even after the family changed their number, according to Dorothy and her daughter Peggy Hoover. Additionally, nocturnal banging on the outside of the house began, which led the couple to install lights. The only result was a strange note on the front porch reading “your lights are a laugh,” and subsequent notes such as “you scum I’ll get even,” with a backside reading “this time ha ha.” The police never found any fingerprints on the notes and suggested they may have been made by someone using their opposite hand to disguise their handwriting.
The most dramatic events yet occurred in the fall of 1993. Dorothy was walking her dog outside of their home on October 27th when she was attacked again. The segment claimed she suffered “skull lacerations” and was taken to the hospital, but there were no witnesses to the event.
Notably, Sheriff Bruce W Umpleby says that after interviewing neighbors, no one had any information that led them to believe there was a person there. He continued that most crimes have simple motives and there has never been one identified for the strange periodic flurries of activity around the Wackers.
Things reached a climax when the family conducted a stakeout, hoping to finally capture the stalker one November evening. Bill hid inside a trailer in the driveway, while Dorothy and their daughter Cathy stayed inside the home. Across the street, their sons-in-law Dan and Clay sat in a vehicle in a neighbor’s driveway. After almost four hours, they decided to end the stakeout around 10:30 p.m., when they heard a loud bump on the porch. Incredibly, the stalker had apparently evaded the surveillance and thrown a rock onto the Wackers’ front porch with a note reading “get the message.”
At the conclusion of the segment, Bill says he hopes whoever is responsible is caught soon because, if the Wackers were no longer the targets, he feared the individual would simply target someone else.
Besides noting that the sheriff’s department had asked Dorothy after the second attack whether Bill could have been the attacker, the series plays the events fairly straight, without directly questioning the couple’s story. The eerie music and Stack’s gravelly voice convey a feeling of serious menace. True crime fans are more divided, with some arguing that the events were too implausible to be real, while others find it unlikely that an elderly couple would fabricate such a wild tale. Notably, another popular Unsolved Mysteries segment, involving the stalking of Cindy James, is also widely believed to have involved a hoax.
Unfortunately, Newspapers.com’s archive of the local paper, The Massillon Independent, has a large gap between the early 1970s and the 2020s. The only other known media appearance by Bill Wacker before his death was in an unrelated citizen-reaction piece about Connie Chung interviewing Newt Gingrich’s mother in the Akron Beacon Journal, although he is wearing an Unsolved Mysteries hat in the picture. The only other items recovered were obituaries stating that Bill had died in 1999 at age 79 and Dorothy in 2020 at age 83. This left armchair sleuths to rely primarily on what appeared in the episode itself, which does raise questions.
One notable detail is that, in the reenactment, Dorothy’s dog doesn’t bark to alert her to the intruder, which seemed uncharacteristic of a small dog. People debated whether this was merely a quirk of the reenactment or reflected how the event actually occurred, with some questioning whether this provided evidence that Bill was behind the assault. Additionally, some found it odd that the stakeout was called off at the relatively early hour of 10:30 p.m. and found the return of stolen items completely unbelievable. Another oddity was the wording of the letters, with phrases like “you scum” and “no junk,” which sounded to some like older adults attempting to mimic the speech of teenagers while using outdated phraseology.
Among those who believe the Wackers, suspicion has frequently fallen on the daughters, who would presumably inherit the home and were not mentioned as suspects in the episode. Particular suspicion has fallen on Peggy, who was not present for the stakeout. Some have also pointed to the phone calls continuing after the Wackers changed their number as possible evidence of an inside job.
One Redditor, sovietbabyy, claimed to be a relative of the Wackers who stumbled upon the case, although they were too young to have ever met Bill and Dorothy themselves. They claimed Bill and his siblings were all dead but asked other family members for more information and were told that the extended family believed the story and that Bill was usually secluded but would help anyone in need. Five years later, a poster using the screen name goawaycommies followed up, claiming to be the same person. In these new posts, the author claimed that Stark County was a high-crime area and that the police were known to be ineffective; therefore, it shouldn’t be surprising that no one was caught.
While it could be debated whether these two posters are actually the same person, the goawaycommies post provided one essential detail that led to a major breakthrough: the Wackers’ address.
In late December, I wrote to the Massillon County Sheriff requesting any files they had on the Wackers. They granted my request in early January, providing 94 pages of documents. Follow-up requests to the North Lawrence Fire Department, who responded to the assaults, as well as inquiries to two of the responding officers and Ricky Lee Pegido, were fruitless. The Sheriff’s office maintains that these documents are all that were found in the file, despite some appearing to be missing, such as a cover sheet without a report and references to a “phone trap” that is not followed up on.
While the officers may not have wanted to talk about these events, what was contained inside was fascinating, providing the names of suspects, neighbors’ opinions on the Wackers, incidents that were not included in the Unsolved Mysteries segment, and another 90s-era “classic” addition: records involving consultation with a psychic about the crimes.
Right from the beginning, the documents tell a slightly different story from the television segment. Instead of waiting until the third event, in January 1985, to call police, there was a report concerning the initial August 1984 break-in. This one was different from the others, with gold and diamond jewelry stolen that was not returned and police noting that a credit card may have been used to force the lock.
The police report for the January 1985 break-in contained two notable details: the method of entry and the first-named suspect. Despite having their locked home broken into previously, the Wackers had left a side door unlocked, allowing the burglar to gain entry. Additionally, the report lists a “Randy” as a possible suspect, a young man whose aunt had previously cared for Mrs. Wacker’s elderly mother in the home.
Next, the first assault report appears, which is similar to what was shown in the episode, except that “CHEAPER, BUT WILL DO” was written in a bathroom instead of the kitchen. Additionally, a basement window was cut, through which the perpetrator may have escaped. The man who came to her aid is named here as Jim Pedigo, who says he and his brother had been working in their backyard all morning without seeing or hearing a thing until Dorothy’s cries became evident. In this report, the name is given as “Pedigl,” and it switches back and forth between that and “Pedigo” in the reports (the name “Pedigo” appears in print as a family name in the area in obituaries). When Bill returned, he found items that appeared to have been staged to be taken later from the robbery around the perimeter of the house.
Following this, there is a series of minor reports of items being stolen and returned—oddly, with the Wackers still not locking their doors, despite the first report indicating that had been their former habit.
The report of the second assault does closely match the program, even down to the controversial dog not barking when the assailant came after Dorothy. Although the Wackers claimed the dog normally ignored its surroundings as it relieved itself, the officer noted on a follow-up visit to the residence that the dog barked when he arrived, which he found suspicious. In the report, Dorothy claimed she had to crawl to the back door to get help from Bill after the attacker fled, which was supported by dirt and scratch marks on her forearms noted by the officer. The officer gave Bill some suggestions, such as installing a light on that side of the house and trimming some trees to remove hiding places.
A lengthy segment of the report regarding the Sheriff’s canvassing of the neighborhood provides some interesting insight into the Wackers’ relationship with their neighbors. This portion notes that:
The neighbors collectively agreed that none of them have had any type of problems. Nor, have they seen or heard any form of disturbance in the area. In fact, several of the neighbors stated that they don’t even lock their doors. Further stated by the neighboring community, most of the neighbors stay to themselves, however, ‘the Wackers bring most of their problems on themselves.’ Apparently the Wackers aren’t the most congenial of persons in the neighborhood, especially with the Shillings and Maddox’s.
The Maddox family is the same household as the Pedigo family, a notable change of relations since Jim Pedigo aided Dorothy. On the other hand, another couple in the neighborhood stated that they regularly played cards with the Wackers, providing a nuanced image of them as people who got along with some but not others.
Following this event, both of the daughters began continually contacting the Stark County Sheriff’s office, demanding more attention be paid to their parents’ harassment. One of the items introduced here, but oddly never followed up on, is a “phone trap” put on the Wackers’ phone by their telephone company, Ameritech, to monitor all incoming calls. Although the reports say this is activated, there is no information on whether any claims of harassing calls were ever compared against the phone trap.
There appears to be a missing report explaining where the tip originates from, but officers speak with the son residing at the Maddox/Pedigo residence, Ricky Lee Pedigo, about whether he is aware of an individual by the name of “Shriner” on his mother’s side of the family, which he was not. When they later return to speak with his mother, Barbara Maddox, she claims she is not related to anyone by that name and flippantly remarks that the composite of the suspect in the first attack on Dorothy looks like a young dick Van Dyke, but no one she’s ever seen before.
Next, officers follow up on a tip from daughter Peggy Hoover that a woman named Debbie Shriver’s (not Shriner) ex-husband may be the suspect. After tracing this woman through a former landlord and then her own father, Debbie, now going by Debbie Pedigo, agrees to speak with the Stark County Sheriff’s. She says the composite bears no resemblance to her ex-husband, James Shriver.
Peggy then returns with another tip that a psychic told her the suspect lives within a twelve-mile radius of the Wacker home.
Finally, Peggy provides one last suspect: Barbara Maddox’s stepson, Johnny Lee, whom she says may be because her parents didn’t pay enough attention to him as a boy. At this point, Barbara Maddox has had enough, saying that her stepson hasn’t been to visit in years, and she is going to put up a privacy fence to keep away from the Wackers.
From this point on, the banging and rocks being thrown at the home continued. At one point, the Wackers claimed someone had tried to gain entrance to their locked home, but the police report casts suspicion on this. The appraisal was that it appeared as though someone was attempting to make it look like the house was being broken into without causing too much damage, and it was inconsistent with typical burglary techniques.
The final report is from October 1997, when Dorothy heard a loud banging on the house while seated in the living room. An officer responded but could find no damage.
All the reports are bizarre. The daughters appear to be very invested in the case, yet Peggy ultimately seems to be throwing around claims that don’t add up to anything. Was she letting her imagination run away with her, using the events as a cover to harass people she had personal grievances against, or was she really on to something? The “Shriner/Shriver” discrepancy speaks to a minor issue prevalent in the police’s investigations: not confirming the spelling of names, which also occurs with “Pedigl/Pedigo.” Does this indicate the sheriff’s department is generally performing sloppy work, as the Reddit poster implied? While there is room to speculate here, the constantly changing accusations may have undermined Peggy’s credibility with law enforcement.
One possible conclusion is that the very earliest break-in was real, since the stolen items were not returned and the report is consistent with a typical forced entry. Perhaps after that, the Wackers developed a taste for the excitement and attention and hoaxed the rest of it. This would explain the incongruities of items being returned, no one ever seeing anything, their continuing to leave their doors unlocked, and the strange attempt to create the appearance of a forced entry without damaging the home.
But then again, officers reported witnessing injuries to Dorothy after both assaults. Could she have been willing to take things that far? Could the couple have truly been victims? Could one of the children be behind it? Was Bill assaulting her?
None of these questions can clearly be answered from the available evidence; and so, decades after the strange story of the Wackers first came to public attention, the case rests—and another relic of the 1990s remains an unsolved mystery.
Ryan Whalen covers science and technology for The Debrief. He holds an MA in History and a Master of Library and Information Science with a certificate in Data Science. He can be contacted at ryan@thedebrief.org, and follow him on Twitter @mdntwvlf.
Traditional phishing techniques are in decline as a result of the disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.
“Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs,” the company wrote in the report.
The takedown reduced activity across multiple phishing categories, forcing attackers to shift to newer delivery methods.
Riding this shift in were a few notable phishing campaigns, including an automated business email compromise (BEC) campaign that reached 42,000 organizations in under three hours, and a multi-stage phishing campaign that used nested email (EML) files, calendar invitations, and a Microsoft authentication redirect to deliver malware.
To counter phishing attacks, Microsoft recommends blocking emails containing known bad URLs/ subject fields, enabling password-less authentication methods, or moving to MFA for accounts that still require passwords.
The take-down of Tycoon2FA forced its operators to abandon portions of their infrastructure and rework hosting, domain registrations, and delivery mechanisms.
“After falling 15% in March and another 22% in April, Tycoon2FA-linked phishing volume dropped 74% in May to just 1.5 million messages, then fell another 20% in June to 1.2 million, by far the lowest monthly volumes observed in at least a year,” Microsoft said.
The decline extended to QR Code lures and fake CAPTCHA pages, two phishing techniques in which Tycoon2FA accounted for 12% and 14% of industry activity in June, respectively. This indicated that the platform’s customer base had not been able to migrate to a replacement infrastructure.
But cutting off one head of the hacker hydra only gave rise to new tactics elsewhere.
The adaptation came in the form of using Microsoft Teams as a social engineering channel. Attackers established conversations to build trust before attempting credential theft or delivering malicious payloads. “Teams-based phishing volume climbed steadily throughout Q2, with the average number of detected attacks rising 19% from March to April, holding roughly flat into May (+1%), then increasing another 10% into June,” Microsoft said.
Microsoft also observed a highly automated BEC campaign that reached over 67,000 users using scripted emails, Amazon Simple Email Service (SES), and engagement tracking, alongside a separate phishing campaign targeting 107,000 users that abused Microsoft’s authentication flow and trusted cloud services, including Teams archive recording and ICS calendar invite, to disguise malware delivery behind legitimate infrastructure.
While QR Code and Captcha-based phishing attacks dropped significantly in the second quarter, business email compromise (BEC) charted jumped 121% between March and April, before dropping down again in May.
QR Code phishing represented 8.3 million attacks in June 2026, down from a peak of 18.7 million in March. Similarly, Captcha-gated phishing fell from 12 million attacks in March to 2.2 million in June.
BEC attacks hit 9 million in March, falling to 3.9 million in June.
But even as these phishing classics lost momentum and newer techniques emerged, Microsoft’s defensive advice remained rooted in the basics. It noted organizations should complement email filtering with phishing-resistant authentication such as passkeys and phishing-resistant MFA to reduce the effectiveness of credential theft campaigns.
The company also recommended strengthening Exchange Online Protection and Microsoft Defender for Office 365 with capabilities such as Safe links and Zero-hour Auto Purge (ZAP), in which malicious emails already delivered to mailboxes are removed before they are read, alongside enforcing password-less authentication methods like Windows Hello, FIDO keys, and Microsoft Authenticator.
Microsoft concluded its report with a list of indicators of compromise (IoCs) from the threats observed in the quarter to support detection efforts.
This article first appeared on CSO.
Thalha Jubair, 20, and Owen Flowers, 19, sentenced to five and a half years each for cyber-attack that cost Transport for London £39m
The data of millions of commuters was stolen, Londoners were left out of pocket and 27,000 Transport for London staff were forced to reset their passwords.
Over four days in 2024 a pair of teenage hackers had London’s transport network at their mercy. Thalha Jubair and Owen Flowers had burrowed into the heart of Transport for London’s IT systems and held the “keys to the kingdom”.
Continue reading...
© Photograph: William Barton/Alamy
© Photograph: William Barton/Alamy
© Photograph: William Barton/Alamy
Com quase 17,7 mil milhões de contas comprometidas indexadas e mais de mil fugas de dados catalogadas, o Have I Been Pwned é a referência mundial para saber se o seu endereço de e-mail ou password já caíram nas mãos erradas. É totalmente gratuito.
The post Have I Been Pwned: o site que lhe diz em segundos se os seus dados já foram roubados appeared first on Tek Notícias.
International authorities and a raft of private technology companies say they have disrupted a cybercrime “assembly line” that allowed crooks to collect millions of login credentials and steal more than $47 million in ransom payments and by other fraudulent means.
The crux of the operation was the simultaneous targeting of two unrelated tools that are widely used in various online scams. The first is Amadey, a malware-as-a-service platform for compromising devices and delivering malicious payloads for ransomware and other scams. Amadey has been observed in the wild since at least 2018 and was seen last year abusing GitHub as it collected system information from infected devices and installed customized payloads. The second tool was StealC, an infostealer-as-a-service platform that collects credentials, authentication cookies, cryptocurrency wallets, browser extensions, and files whose names match customer-defined patterns.
Amadey and StealC are separate tools that are run independently of each other. Given their widespread use, however, many customers use both in their individual cybercrime activities. The tools also, it turns out, relied on some of the same underlying infrastructure to run. Microsoft said it made this determination after analyzing the tools using AI. This insight allowed Microsoft attorneys to seek an order disrupting both at the same time.
© Alex Schmidt / Getty Images
Airbnb-related scam activity has increased 30x since the first half of 2023, according to new research from Saily and NordStellar, confirming that cybercriminals continue to go after holidaymakers seeking the best deals amid rising prices.
The report ultimately concludes that attackers are now targeting the trust built by larger platforms, saving them from having to build new identities from scratch.
And to top it all off, the nature of scams is also changing, as instead of using suspicious websites to obtain victim payments or information, criminals are now targeting legitimate Airbnb host accounts which have spent years amassing positive reviews and high ratings.
While the end goal remains high volumes of vulnerable consumers, scammers have added an extra layer of victim in their pipeline. Verified Airbnb hosts are now valuable assets for criminals because they already have identity verifications, positive reviews, booking histories, years of activity and established credibility.
Once the verified account is compromised, attackers can then go on to scam higher volumes of unsuspecting victims by posting – and charging for – fake property listings.
“Travelers are getting better at spotting obvious scams,” Saily Head of Product Matas Cenys said. “Criminals know this, so they are increasingly trying to steal trust instead of building fake trust from scratch.”
Where this type of attack differs from others, though, is that the victims never leave the platform. Rather than falling victim to phishing attacks and being redirected to malicious external sites, they interact fully with supposed legitimate hosts on the Airbnb platform.
While Airbnb attacks have seen a 30x increase in around three years and a sharp rise in the last year alone, they reflect a much broader trend of attackers compromising existing trusted accounts.
The recent ramp-up in attacks could also be tied to the summer season, with holidaymakers looking to book last-minute deals in the run-up to the summer season. Urgency and pressure to keep costs low also adds to criminals’ success.
“Everything looks normal until they arrive at their destination and discover the accommodation never existed," Cenys added.
Saily is recommending that all communication stays within the booking platform and that customers avoid payment methods suggested outside of official channels. Unusually attractive listings in high-demand destinations could also be taken with a pinch of salt, and savvy shoppers may choose to reverse image search a property to double check its authenticity.
“As travel booking becomes increasingly digital, trust becomes one of the most valuable currencies in the travel ecosystem,” Cenys warned.
As for abusing victim trust, researchers also argue that AI has aided attacks by allowing criminals to produce better fake listings more quickly.
More generally, Airbnb revealed that two in five Americans have fallen victim for an online scam, with the average loss totalling nearly $2,000. The company has introduced measures to remind its users how to avoid scams, including introducing identity verification and reminders not to leave the platform, but account takeovers can still slip under the radar.
Airbnb also holds guest payments until 24 hours after check-in to ensure that everything is as described. Anti-fraud tech also prevented around 265,000 suspicious listings from appearing on the platform in 2025, the company boasted.
The company posted a comprehensive eight-step list of how to avoid scams on its platform online, calling out pressure tactics and unusual deals.
The media response to the Belfast beheading has once again focused on the 'racism' of the working class rather than on the horror of the crime itself and the dysfunctional immigration system behind it, says Andrew Devine.
The post The Belfast Riots Are a Symptom of a Dysfunctional Immigration System That the Media Ignore appeared first on The Daily Sceptic.
An intruder has breached the French government’s encrypted messaging service, Tchap, showing once again that human error is a weak spot in any security system.
Tchap was developed in France as an example of national sovereignty and was designed to be a more secure option than WhatsApp for communication between government employees.
In this case, it wasn’t the technology that was at fault, but a user: The intruder gained access to the system by taking over their account, according to DINUM, the French government’s interministerial digital directorate.
DINUM said it has blocked the affected user’s access and is investigating how much information has been revealed. While the system’s encryption was not broken, the intruder would have been able to view unencrypted public chat rooms accessible to the account taken over, potentially affecting 73,467 of the system’s 825,000 users, DINUM said.
That matches at least part of a post on X (formerly Twitter) reporting the intruder’s claim to have accessed the account of a Tchap user in the education sector through social engineering, exposing 73,467 user accounts, 643,459 messages, 876 chat rooms with message history, and 59,386 media files totalling 13.51 GB, including references to documents marked “Diffusion Restreinte” (restricted distribution).
DINUM said that it had reminded all Tchap users that public chat rooms are accessible to any user and are not encrypted, so all participants should refrain from any sensitive or confidential information.
This article first appeared on CSO.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Login