Do Son Privacy expert Alexander Hanff warns that Claude Desktop installs a "native messaging bridge" without consent, potentially bypassing browser security sandboxes.
surveillance
Hunt.io discovers Canis C2, an AI-assisted surveillance framework targeting all major OSs. An exposed API revealed payloads and source code. Read more here.
Acronis uncovers CRESCENTHARVEST, a new spyware targeting Iranian dissidents. Attackers use protest lures & Google DLL sideloading to steal data.
LayerX exposes 30+ malicious AI extensions spying on 260,000 users. These "privileged proxies" steal Gmail data & page content. Uninstall now.
ZeroDayRAT mobile spyware is sold on Telegram. It offers full remote control of Android & iOS devices, including camera streaming & crypto theft.
"RedKitten" spies on Iranian protesters using AI-written malware. Attackers use fake death lists to deploy SloppyMIO surveillance tools.
Microsoft confirms it surrenders BitLocker keys to the FBI in Jan 2026. Discover why your Windows 11 cloud-stored key is a major privacy liability.
RSF uncovers ResidentBat, a Belarusian KGB spyware physically installed during interrogations to hijack encrypted messages and monitor journalists.
NexusRoute is a sophisticated Android RAT campaign impersonating Indian E-Challan/mParivahan via GitHub phishing. It steals UPI PINs and conducts surveillance using a native-backed and professionally maintained malware framework.
India reversed its mandate to pre-install the Sanchar Saathi app, claiming "voluntary adoption" but following strong resistance from Apple, Samsung, and political opposition.
LayerX exposed a 6-year, 9M-install campaign: Fake VPN/ad-blocking Chrome extensions hijack all user traffic via remote PAC proxy scripts, enabling surveillance and data exfiltration.
The US-sanctioned NSO Group, maker of Pegasus spyware, was acquired by an American investment firm for "tens of millions." The deal will keep operations in Israel but may lift sanctions.
Microsoft disabled certain Azure and AI services used by a unit of Israel’s Ministry of Defense after finding evidence of mass civilian surveillance in Gaza and the West Bank.Export to Sheets
A new report from Sekoia.io reveals how the global commercial spyware industry is thriving despite sanctions, selling sophisticated zero-click surveillance tools to governments.
A new report reveals a mobile malware campaign in Indonesia impersonating the state pension fund TASPEN to steal financial and personal data from civil servants.
A new investigation reveals that Israel's Unit 8200 used Microsoft Azure to store millions of phone calls, prompting a new inquiry by the company.
Four open-source packages on npm and PyPI (56k+ downloads) are secretly deploying sophisticated spyware, performing webcam surveillance, keylogging, and credential theft.
Italian researchers developed "WhoFi," an AI-powered system using Wi-Fi signal reflections from the human body to identify individuals with 95.5% accuracy, even without devices.
The UK government is reportedly reconsidering its secret demand for an iCloud backdoor after US criticism and Apple's decision to disable Advanced Data Protection for UK users.
Lookout Threat Lab reveals Massistant, a powerful new mobile forensics app from China's Meiya Pico, used by law enforcement to extract vast user data from seized phones.
A critical flaw (CVE-2025-7503, CVSS 10.0) in Shenzhen Liandian IP cameras allows root access via an undocumented, default-enabled Telnet service with hardcoded credentials. No patch available.
Hunt.io researchers uncovered dozens of malicious Android apps disguised as popular programs on open servers, which are fronts for SpyNote spyware, harvesting sensitive user data.