Cyber, in brief

Thieves after wallet recovery words

A hidden chip in some Ledger wallets is said to copy the secret recovery words shown at setup. [1] A new version of the DarkSword kit for iPhones copies crypto wallet apps. [2] One DarkSword server held the recovery words of 11 victims. [2]

Hacking tools sold ready-made

DarkSword's operators rent it out through agents and resellers, Censys found. [2] ARTEX, the tool used on Korean banks, was free for anyone to download from GitHub this year. [6] Copies of it are still available after its maker closed it. [7]

AI working for both sides

An attacker used AI models with the ARTEX tool to break into South Korean banks. [7] Apate, an Australian company, runs about 350,000 AI bots that keep scammers busy. [4] King Charles III warned that hostile actors now use automated tools. [8]

Bait in places people trust

Fake meeting invites now appear in people's calendars beside real appointments. [3] Japan's cyber office warned that some attackers pose as people offering protection. [5] The Ledger wallets in question came from a reseller, not from Ledger. [1]

One pressure seen across the day runs through Cyber too.

• AI used by scammers, and against themBuilding ↑ · seen in 2 beats→

1. 1Ledger finds a hidden chip in a crypto wallet sold by a reseller, as reports say thieves took more than $86m from hundreds of wallets
2. 2A hacking kit for older iPhones now takes crypto
3. 3Fake meetings land straight in calendars
4. 4AI bots keep phone scammers talking
5. 5Japan tells ministries and firms to tighten up

Ledger, a company that makes small devices for keeping crypto coins safe, has confirmed that one customer's device held a hidden chip it did not put there. [1]

Watch whether Ledger says how many wallets passed through CryptoBillis and how the chips got inside them, which would show whether this is one reseller's stock or something wider. [1]

iVerify, a US phone-security company, reported on Thursday a new version of DarkSword, a hacking kit for iPhones, which it calls P7. [2]

DarkSword was first described in March by Google, iVerify and Lookout. [2]

It attacks iPhones running iOS 18.4 to 18.7 through booby-trapped web pages, and it leaked soon after it was made public. [2]

P7 copies saved passwords, notes, photos and crypto wallet apps, and asks its operator for new orders every 15 seconds. [2]

Censys, a company that scans the internet, found a copy of one operator's server holding the recovery words of 11 victims. [2]

The kit is aimed at iPhones still on older systems, though one operator's server shows work on attacks for iOS 26, the newest. [2]

When a maker stops selling or sharing something, the copies people already hold keep working until each one is found.

A phone that installs updates can be fixed from far away, which is why the DarkSword kit is aimed at iPhones still on older systems.

Most of us own a few things like that, such as an old phone or an app that stopped getting updates.

Scammers are sending fake meeting invitations that appear in people's online calendars, such as Google Calendar, the Guardian reports. [3]

Sublime Security, an email-security company, says the scam is still new but growing fast. [3]

Calendar apps can add an invitation on their own, so the entry appears even if the email went to spam. [3]

The entry holds a link to a fake login page, or a number to ring to cancel a charge that never happened. [3]

Some scammers send the invites through real services such as Zoom, so blocking them would also block real meetings, says Max Gannon of Cofense, a security firm. [3]

Luke Wescott of Sublime Security advises setting calendars to accept invites only from known senders. [3]

He also advises deleting a suspicious invite rather than declining it, because declining tells the sender the address is in use. [3]

Apate, an Australian company, runs about 350,000 AI bots that answer scam calls and messages while pretending to be possible victims, Wired reports. [4]

The bots never fall for the scam, but give the caller enough hope to stay on the line, sometimes for more than two hours. [4]

Banks use the system and phone companies support it. [4]

Apate says it has gathered more than 250,000 details about fraudsters, such as scam web addresses and the bank accounts used to move stolen money. [4]

A minute a scammer spends on a bot is a minute not spent on a real person, says Apate's founder, Dali Kaafar. [4]

Researchers at ETH Zurich, a Swiss university, found that AI-run decoy computers also keep attacking AI programs busy for longer than simpler decoys. [4]

Japan's National Cybersecurity Office, set up last year, warned on Friday that attacks on computer systems are rising in number and growing more advanced, AP reports. [5]

Its instructions go to ministries, which pass them to local governments and companies. [5] They cover basics such as updating software, using strong passwords and checking suppliers. [5]

A study by the Yomiuri newspaper and Trend Micro, a Tokyo security firm, counts more than 500 attacks so far this year, against 473 last year and 503 in 2024. [5]

Customers of the Lawson shop chain, the Daiwa Securities brokerage and the BookOff second-hand chain have all had data leaked, and last month a break-in at Times Car reached 6.6 million accounts. [5]

AP says this year is almost certain to set a record. [5] The office also warned that some attackers pretend to be people offering protection against attacks. [5]

The Chinese developer of ARTEX, a free AI program built to test a company's defences, said on GitHub on Thursday that it will stop updating it and close its code to the public. [6]

CrowdStrike, a US security company, says ARTEX was used with AI models, including Anthropic's Claude, in recent break-ins at South Korean banks. [7]

At least nine Korean banks have reported attacks since late September. [6] The developer, who uses the name Autumn-27, said they oppose illegal use and bear no responsibility for it. [6]

Copies made before the change remain, including English and Korean versions built from its code, BleepingComputer reports. [7] So the tool is still available in the form the attacker used. [7]

Also seen in Finance.

King Charles III wrote to Britain's National Cyber Security Centre to mark its tenth year, in a letter the centre published on Saturday, the BBC reports. [8]

The centre was set up in 2016 as part of GCHQ, the UK's signals intelligence agency, to defend the country against online attacks. [8]

The King wrote that hostile actors keep changing their methods and now use automated tools. [8]

The BBC also understands the centre offered help this week to ASOS, the online clothes shop whose app was used to send customers a hackers' message. [8]

The ASOS offer is one example of the centre stepping in when a big British company is hit. [8]

The King noted that much of the centre's work cannot be praised in public. [8]

Dubai Police has warned that AI is making fake videos and fake voices harder to tell from real ones, The National, a UAE newspaper, reported on Saturday. [9]

The warning comes from a study by the force's Future Foresight Centre. [9]

It says these fakes, known as deepfakes, could help criminals pretend to be real people, steal identities and fool the public. [9]

Its key finding goes further: people may start to doubt photos, videos and recordings that are real. [9]

Police use recordings as evidence in their investigations, so a fake nobody can spot makes that evidence harder to trust, the study says. [9]

It says technology alone will not fix this. [9]

It asks for wider public awareness, skills to check where a picture or clip came from, and security agencies that look for new criminal tricks before they spread. [9]