Team News

Researchers at Cleafy have discovered a new Android banking trojan called “DroidBot” that steals login information for more than 77 cryptocurrency exchanges and banking apps.

DroidBot has been active since June 2024 as a malware-as-a-service (MaaS) platform. Criminals who want to use DroidBot pay a monthly subscription fee of $3,000.

So far, 17 groups have been identified that used malware for attacks with the help of malware creators. Malware infections have been detected across the UK, Italy, France, Turkey and Germany, but Cleafy warns that there are indications of attempts to spread the malware to new regions.

The developers of DroidBot are most likely Turkish, who provide collaborators with all the necessary tools to carry out attacks. This includes the malware itself, command and control (C2) servers, and a central administrative panel from which they can control their operations, retrieve stolen data, and issue commands.

Malware can record the victim’s keystrokes, display fake login pages through banking application interfaces, intercept SMS messages, especially those containing one-time passwords (OTPs) for banking applications, allow attackers to remotely view and control infected device, execute commands and dim the screen to hide the malicious activity.

DroidBot uses Android access services to track what the victim is doing on the device and simulates swiping and tapping movements.

Among the 77 apps that DroidBot is trying to steal passwords for are Binance, KuCoin, BBVA, Unicredit, Santander, Metamask, BNP Paribas, Credit Agricole, Kraken and Garanti BBVA.

Android users are advised to download apps only from Google Play, review permission requests after installation and check if Play Protect is active on their devices.

iPhone users are being warned about a new identity theft scam that can permanently lock your Apple ID account.

Cybercriminals are sending fake emails to billions of iPhone users, pretending the emails are from Apple.

These emails appear to have been sent by Apple Support, stating that the victim’s account has been suspended and calling for a “prompt response” to the victim.

However, it redirects users to a fake page that can steal their login details and two-factor authentication codes.

The fake emails tell users to click on a link to verify their account, redirecting them to another page that steals their information such as username and password, as well as 2F authentication information.

Once hackers get the credentials, they can immediately access user accounts and digital wallets, and worst of all, the urgency mentioned in the email will trick users into quickly clicking the link without thinking.

The email states that the user has only 24 hours to verify their Apple ID “or it will be blocked forever”.

“Apple will never ask you to sign in to any website or select ‘Accept’ in a 2F authentication dialog. You won’t even have to enter your password, device passcode, or 2F code anywhere,” Apple said.To appear credible, hackers often mention your personal information such as your name or phone number.

Social media company Meta (Facebook, Instagram) has accused the Australian government of rushing to ban social media for under-16s without properly considering the evidence and voices of young people.

Australian politicians who backed the world’s first law say it is necessary to ensure another generation of teenagers do not experience “such harmful content” in the years to come.

The ban, passed by Australia’s parliament on Thursday, just days after a day-long inquiry was held to review 15,000 submissions, has already been described as a test case for what other governments are planning to do.

Despite the bill’s passage, politicians did not unanimously support it, with one independent lawmaker calling it “a 1970s solution to a 2024 problem”. Human rights groups and mental health advocates have also warned it could marginalize young Australians.

So far, most social media companies have said they will comply with the ban, failure to do so would result in fines of up to $50 million. But they expressed uncertainty about how it would be implemented and concerns about its potential impact.

“We are concerned about a process that rushed through the legislation without properly considering the evidence the industry is already doing to ensure age-appropriate experiences and young voices,” said a spokesperson for Meta.

Elon Musk, the owner of X, has already criticized the ban and suggested it was “a backdoor way of controlling internet access for all Australians”.

On Friday, Australian government minister Murray Watt said social media companies should take the ban seriously and realize they have an “interest in maintaining their reputation and their social licence”.

“Between those fines and social pressure, we’ll see how the social networks perform – and if they don’t, we have the opportunity to go after them,” he said.

The ban was supported by Australia’s main opposition party. Shadow communications minister David Coleman said its benefits far outweighed the risks.

“What other generation in history has grown up exposed to content as harmful as this? We can turn our eyes away from it and not talk about it, or we can look it in the face and accept it and do something about it,” Coleman said.

Otherwise, the Human Rights Commission warned that the law could infringe on the rights of young people and reduce their ability to participate in society.

As part of the Digital Markets Act (DMA) regulation, Apple is making some changes to the operating system, and with iOS 18.2, iPhone and iPad users in the European Union will be able to delete the App Store, Safari and other built-in for iOS.

It’s already possible to hide some of Apple’s native apps, such as Calculator, Calendar, Music and Notes, and the beta version of iOS 18.2 that reached developers shows that Apple is expanding the list of apps that will be able to be hidden.

Interestingly, this option is currently only available to users located in European Union countries.

The current iOS 18.2 beta software version allows users in the EU to delete the App Store, Camera, Safari, Messages and Photos. With this change, Apple wants to comply with the requirements of the Digital Markets Act, which requires technology companies to make it easy for users to uninstall any app.

In addition to this change, iOS 18.2 adds a new menu for easier setting of default apps, and Image Playground integration, Genmoji, ChatGPT, and Visual Search have also been added for iPhone 16 models.

At the moment, iOS 18.2 beta is only available on devices that are compatible with the Apple Intelligence feature, namely iPhone 15 Pro and later phones or M1 iPad or later tablets.

Imagine some people driving up to a pub in a top-of-the-range sports car – say a £1.5m [€1.8m] Koenigsegg Regera – parking it and slowly getting out of the vehicle. They walk into the pub where you’re drinking and start walking around the patrons, reaching into your pockets in front of everyone, and smiling as they pull out your wallet and empty it of cash and cards.

The not-so-subtle crime stops if you yell and ask what the hell they’re doing. “Sorry for the trouble,” says the pickpocket. “Friend, you have the opportunity to refuse.”

It sounds absurd. However, this seems to be the approach the government is taking to satisfy artificial intelligence (AI) companies. According to the Financial Times, a consultation will soon open that will allow AI companies to collect content from individuals and organizations, unless the latter explicitly refuse the use of their data.

The AI ​​revolution has been as sweeping as it has been rapid. Even if you’re not one of the 200 million people who log into ChatGPT every week, or if you use its generative AI competitors like Claude and Gemini, you’ve undoubtedly interacted with an AI system – whether you know it or not. But AI momentum needs two sources of continuous supply in order to survive and not fizzle out. One is energy – which is why AI companies are getting into the business of buying nuclear power plants. And, the other is data.

Data is essential to AI systems because it helps evolve the ways we interact. If the AI ​​has any “knowledge” – and this is highly debatable, considering that it is really just a pattern-matching machine – then it comes from the data it is trained on.

One study predicts that large language models like ChatGPT will run out of training data by 2026 due to its voracious appetite. However, without that data, the AI ​​revolution may stall. Tech companies know this, which is why they’re signing blanket content licensing deals all over the place. But this creates obstacles, and a sector whose unofficial motto during the last decade has been “act fast and don’t think”, does not like obstacles.

For this reason, they are already trying to push us into a copyright waiver approach where everything we write, post and share is destined to become training data for AI in advance, unless we say no when companies must seek our permission to use our data. We can already see how companies are preparing us for this reality: this week, X began notifying users of a change to its terms and conditions of use that would allow all posts to be used to train Grok, the model Elon Musk’s AI, designed to compete with ChatGPT. Meanwhile, Meta, the company that owns Facebook and Instagram, has made a similar change — resulting in the viral urban legend “Goodbye Meta AI” that supposedly overturns legal agreements.

The reason AI companies want automatic opt-in is clear: if you ask most people if they want anything from the books they write, the music they produce, or the posts and photos they share on social media to be used to train AI, they’ll say no. And then the AI ​​revolution fails. Why governments want to enable such a change in the concept of copyright, which has existed for more than 300 years and been enshrined in law for more than 100 years, is less clear. But, like many things, it seems to be about money.

The government has faced lobbying from big tech companies suggesting this is a requirement to rate their countries as places to invest and share the benefits of AI innovation. A lobbying document written by Google suggested that its support for the automatic inclusion of the entire copyright regime, with the option of opt-out by certain individuals, would “ensure that the UK can be a competitive place to develop and training future AI models”. The government’s proposed framework for the matter, which already establishes opt-out access, is a major win for big tech lobbyists.

Considering the amount of money circulating in the technology sector and the level of investment thrown into AI projects, it’s no surprise that Keir Starmer doesn’t want to miss out on the potential for potential profits. The Government would be remiss if it did not consider how to delight companies as they develop world-changing technology, and make the UK a powerhouse in AI.

But, that is not the answer. Let’s be clear: the proposed UK copyright scheme would effectively allow companies to steal our data – every post we make, every book we write, every song we create – without any consequence. It would require us to sign up to each separate service and tell them no, we don’t want them processing our data and giving us a poor image. Potentially hundreds of them, from large technology companies to small research labs.

Lest we forget, OpenAI – a company now valued at more than $150 billion – is planning to abandon its non-profit founding principles to become a for-profit company. It has more than enough money to pay for the training data, rather than relying on the generosity of the general public. Such companies can certainly afford to put their hands in their pockets, not ours. Therefore, hands off.