Privacy
-
Researchers describe “Pixnapping” Android side‑channel that can steal 2FA codes
A team of academic researchers disclosed “Pixnapping,” a side‑channel pixel‑stealing technique that can recover on‑screen data including two‑factor codes on Android by exploiting rendering APIs and graphical operations, and Google has issued patches under CVE‑2025‑48561 while some issues remain unpatched.
-
Council of Europe authorises EU to sign UN cybercrime convention
The Council of Europe authorised the European Commission and member states to sign the UN Convention against Cybercrime, a treaty adopted by the UN General Assembly in December 2024 that sets common rules for criminalising cyber offences and exchanging electronic evidence, with safeguards to protect human rights.
-
SimonMed says 1.2 million patients impacted in January data breach
SimonMed Imaging said more than 1.2 million people were affected by a data breach that gave attackers access to its network from Jan. 21 to Feb. 5; Medusa ransomware claimed the theft and the company said it found no evidence of misuse as of Oct. 10.
-
Smishing texts impersonate New York tax agency to steal inflation refund details
Smishing texts impersonating the New York Department of Taxation and Finance are urging recipients to submit payment and personal details to claim “Inflation Refunds,” BleepingComputer reported; state officials said the refunds are automatic and advised people not to provide information and to report suspected scams.
-
DraftKings warns accounts breached in credential stuffing attacks
DraftKings said an undisclosed number of customer accounts were accessed in credential stuffing attacks that exposed a limited set of account details; the company is requiring password resets, urging multifactor authentication and advising customers to monitor financial and credit accounts.
-
UC Irvine researchers say high-precision mice can be used to eavesdrop on conversations
Researchers at the University of California, Irvine say high-precision optical mice can pick up tiny desk vibrations from speech and, using signal processing and machine learning, be converted into audible reconstructions; the team published details on a Google research site and an arXiv paper.
-
ESET: Fake Signal and ToTok Android Apps used to deploy spyware in UAE
ESET researchers warned that two spyware campaigns in the UAE use fake Signal and ToTok Android apps disguised as plugins or add‑ons to collect contacts, messages, backups and files; the spyware has been traced to mid‑2022 and is blocked by Google Play Protect for devices with Google Play Services.
-
Misconfigured Rainwalk Pet database left 158 GB of owner and pet records exposed
A misconfigured Rainwalk Pet database exposed about 158 GB of customer and pet records, including names, contact details, partial credit card numbers, veterinary bills and microchip numbers, the article said; the data remained publicly accessible for almost a month before being secured.
-
Discord says support vendor breach exposed customer data
Discord said a compromised third-party customer support vendor exposed support tickets and personal details, including billing data and ID images, and that it cut the vendor’s access, launched an investigation and notified law enforcement.
-
Signal adds post‑quantum SPQR ratchet to its protocol
Signal announced the Sparse Post Quantum Ratchet (SPQR), to be combined with its Double Ratchet into a Triple Ratchet that Signal says will add post‑quantum protections while preserving forward secrecy and post‑compromise security, and will be rolled out gradually with formal verification and academic review.
