‼️ BREAKING: Trezor’s email provider has been breached. Customers are receiving a non-spoofed email, it’s real, just not sent by the real company.
This follows shortly after the breach of their logistics provider, which left 80k+ customers’ data exposed.
This follows shortly after the breach of their logistics provider, which left 80k+ customers’ data exposed.
😢9😁3😭2🔥1
‼️ BREAKING: OpenAI might have stolen another mathematician's work, as he suspects one of OpenAI's flagship proofs was helped along by his own unpublished work. This one published the email exchange.
Last month OpenAI said its Astra model had settled a question in group theory that had been open for 27 years. The proof's key step came from work Andreas Thom published with Gábor Kun. For months before the announcement, Thom had been working through that same mathematics with ChatGPT.
So he emailed OpenAI researchers Mark Sellke and Sébastien Bubeck with two questions: had those conversations entered the training data, and were they available to the model while it worked on the problem?
Sellke's complete reply, Thom says, was "Regarding your conversations with ChatGPT: that did not happen."
Weeks later, in the separate Navier-Stokes dispute, OpenAI said no specific user data was accessed, but could not rule out that de-identified data from customers' use of its products had improved its models. Thom got no such caveat.
Last month OpenAI said its Astra model had settled a question in group theory that had been open for 27 years. The proof's key step came from work Andreas Thom published with Gábor Kun. For months before the announcement, Thom had been working through that same mathematics with ChatGPT.
So he emailed OpenAI researchers Mark Sellke and Sébastien Bubeck with two questions: had those conversations entered the training data, and were they available to the model while it worked on the problem?
Sellke's complete reply, Thom says, was "Regarding your conversations with ChatGPT: that did not happen."
Weeks later, in the separate Navier-Stokes dispute, OpenAI said no specific user data was accessed, but could not rule out that de-identified data from customers' use of its products had improved its models. Thom got no such caveat.
🤯13🥴4❤3🤪2
This media is not supported in your browser
VIEW IN TELEGRAM
Security researchers at Calif used a wormable zero-click RCE vulnerability to take over WeChat accounts just by calling them. The victim didn't have to pick up, and anyone who answered heard only silence while the exploit ran.
The hijacked account then called its own contacts and took them over the same way. Calif's demo worm jumped from an Android phone to an iPhone to another Android phone, gaining full control of each account: reading and sending messages and making calls as the victim.
Calif says it found the flaw in WeChat's calling feature with AI and had a working exploit in about two days.
Tencent has mitigated it for all users since Calif reported it in July.
Calif's write-up:
https://calif.io/research/weworm
The hijacked account then called its own contacts and took them over the same way. Calif's demo worm jumped from an Android phone to an iPhone to another Android phone, gaining full control of each account: reading and sending messages and making calls as the victim.
Calif says it found the flaw in WeChat's calling feature with AI and had a working exploit in about two days.
Tencent has mitigated it for all users since Calif reported it in July.
Calif's write-up:
https://calif.io/research/weworm
😍10👍7🔥6😱1
Dutch bank bunq took a security expert to court after he gave journalists his professional opinion on scams hitting its customers
In 2024, Dutch journalists investigated bunq customers who lost up to €200,000 to phishing texts and callers posing as bank staff. Fraud expert Shairesh Algoe told them the attacks weren't new, and that while fraud can't be prevented 100%, he believed banks generally detect it. Bunq read that as a comment on its own systems. Algoe says it was a general remark, since he doesn't know bunq's systems from the inside.
Soon after, bunq CEO Ali Niknam, whom Algoe has known since their student days, called him and asked whether an expert could talk to him about his quotes. Algoe agreed. The call came from Niknam's media lawyer instead.
A year later, a bailiff arrived at his home with a request to question him under oath. Bunq offered to drop it if he signed an account of his contacts with the journalists. The notary refused to record it after Algoe said he'd been pressured, so bunq sued to force his signature.
On Monday, the judge brokered a deal: bunq withdraws the case and pays his court costs. The statement both sides signed confirms the account is accurate, but says it was produced under pressure and intimidation Algoe experienced from bunq's lawyer.
It isn't the first time. Bunq has tried at least three times to make people testify under oath about their contacts with Dutch journalists. A judge refused, finding in part that the bank was fishing for the newspaper's sources. NRC pointed to the EU's anti-SLAPP directive, which targets lawsuits meant to silence journalists and their sources.
In 2024, Dutch journalists investigated bunq customers who lost up to €200,000 to phishing texts and callers posing as bank staff. Fraud expert Shairesh Algoe told them the attacks weren't new, and that while fraud can't be prevented 100%, he believed banks generally detect it. Bunq read that as a comment on its own systems. Algoe says it was a general remark, since he doesn't know bunq's systems from the inside.
Soon after, bunq CEO Ali Niknam, whom Algoe has known since their student days, called him and asked whether an expert could talk to him about his quotes. Algoe agreed. The call came from Niknam's media lawyer instead.
A year later, a bailiff arrived at his home with a request to question him under oath. Bunq offered to drop it if he signed an account of his contacts with the journalists. The notary refused to record it after Algoe said he'd been pressured, so bunq sued to force his signature.
On Monday, the judge brokered a deal: bunq withdraws the case and pays his court costs. The statement both sides signed confirms the account is accurate, but says it was produced under pressure and intimidation Algoe experienced from bunq's lawyer.
It isn't the first time. Bunq has tried at least three times to make people testify under oath about their contacts with Dutch journalists. A judge refused, finding in part that the bank was fishing for the newspaper's sources. NRC pointed to the EU's anti-SLAPP directive, which targets lawsuits meant to silence journalists and their sources.
💩19
‼️ Meet the man charged in the UK under the National Security Act with assisting Russian intelligence, who, it turns out, also works as an escort available to hire 24/7 from £30 for 15 minutes.
🤣17😁16🥴4😱2
‼️ BREAKING: Chinese labs DeepSeek and Moonshot were quietly relaying customer prompts to Claude through fraudulent accounts. Users thought they were using Chinese AI, but were actually getting answers from Claude.
Their customers' sensitive data now is in Anthropic's hands. One user, who is tied to China's military, asked Kimi whether a person tracked across hundreds of CCTV cameras in Chengdu was behaving abnormally. DeepSeek passed along live credentials for a Russian government database, shared by an IT operator handling data from a Defense Ministry-linked agency.
The two Chinese labs relayed customer prompts to Claude through fraudulent accounts and saved the exchanges to train their own models. Moonshot forwarded almost 300,000 customer requests in a single ten-day stretch. DeepSeek flagged users running its models inside coding tools like Claude Code and OpenCode, then routed some of them to Opus.
Anthropic's report names seven China-based labs it says ran campaigns to copy Claude's capabilities, which Anthropic calls illicit distillation. The largest, attributed to Alibaba, topped 151 million exchanges between May and July
Source: Anthropic
https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf
Their customers' sensitive data now is in Anthropic's hands. One user, who is tied to China's military, asked Kimi whether a person tracked across hundreds of CCTV cameras in Chengdu was behaving abnormally. DeepSeek passed along live credentials for a Russian government database, shared by an IT operator handling data from a Defense Ministry-linked agency.
The two Chinese labs relayed customer prompts to Claude through fraudulent accounts and saved the exchanges to train their own models. Moonshot forwarded almost 300,000 customer requests in a single ten-day stretch. DeepSeek flagged users running its models inside coding tools like Claude Code and OpenCode, then routed some of them to Opus.
Anthropic's report names seven China-based labs it says ran campaigns to copy Claude's capabilities, which Anthropic calls illicit distillation. The largest, attributed to Alibaba, topped 151 million exchanges between May and July
Source: Anthropic
https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf
🤣34🤯8❤2💩1
‼️ BREAKING: OpenAI is pausing the resource-intensive $200 Pro plan. Member of technical staff Tibo said he "shouldn’t have underestimated Astra" after many people pointed out that he’d claimed last month there was enough compute.
🤣23
‼️ BREAKING: Kash Patel wanted FBI staff to run an influence campaign on X by replying to Epstein tweets with bureau stats.
He then asked his spokesman to reply to IfindRetards' post, saying it had gotten 277k responses.
His spokesman corrected him: it had 277k views and just 400 replies. He also warned that engaging "would look bad on you."
https://vault.fbi.gov/records-regarding-the-review-of-the-investigative-holdings-related-to-jeffrey-epstein/records-regarding-the-review-of-the-investigative-holdings-related-to-jeffrey-epstein-part-11/view
He then asked his spokesman to reply to IfindRetards' post, saying it had gotten 277k responses.
His spokesman corrected him: it had 277k views and just 400 replies. He also warned that engaging "would look bad on you."
https://vault.fbi.gov/records-regarding-the-review-of-the-investigative-holdings-related-to-jeffrey-epstein/records-regarding-the-review-of-the-investigative-holdings-related-to-jeffrey-epstein-part-11/view
🤣9💩5❤3🤔1
‼️ BREAKING: Extortion group FulcrumSec says it is behind the Dustin breach and that it received an email from Dustin's negotiator saying they "saw Novo Nordisk in the news" and "have no intention of becoming a headline."
Yet, according to FulcrumSec, Dustin refused to pay, so the group has partially released the stolen data.
FulcrumSec's leak page lists the source code behind Dustin's webshops and records for more than a million customer portal users.
Customers it names, with the number of active accounts in the data:
- Ericsson (1,445)
- NAV, Norway's welfare agency (1,041)
- Statnett, Norwegian grid operator (180)
- SEB (78)
- City of Copenhagen (43)
- Dutch National Police (9)
- Enexis (9)
- UWV, Dutch benefits agency (5)
- Dutch Ministry of Defence (4)
- ABN AMRO (3)
- Gasunie (3)
- Radboud UMC (3)
- Rabobank (2)
- City of Rotterdam (2)
- UMCG (2)
Dustin, which is still investigating, has told customers that personal data in the portal may have been accessed, but describes it as non-sensitive business information. The group says the leak goes further, with support tickets containing 92 Swedish personal identity numbers.
Yet, according to FulcrumSec, Dustin refused to pay, so the group has partially released the stolen data.
FulcrumSec's leak page lists the source code behind Dustin's webshops and records for more than a million customer portal users.
Customers it names, with the number of active accounts in the data:
- Ericsson (1,445)
- NAV, Norway's welfare agency (1,041)
- Statnett, Norwegian grid operator (180)
- SEB (78)
- City of Copenhagen (43)
- Dutch National Police (9)
- Enexis (9)
- UWV, Dutch benefits agency (5)
- Dutch Ministry of Defence (4)
- ABN AMRO (3)
- Gasunie (3)
- Radboud UMC (3)
- Rabobank (2)
- City of Rotterdam (2)
- UMCG (2)
Dustin, which is still investigating, has told customers that personal data in the portal may have been accessed, but describes it as non-sensitive business information. The group says the leak goes further, with support tickets containing 92 Swedish personal identity numbers.
😁4❤2😭2