$10,000 phishing kit claims to plant rogue passkeys for persistent account hijacking
Security researchers have uncovered a phishing kit sold for $10,000 on the dark web that claims to plant fake passkeys, enabling persistent access to compromised accounts. The tool is designed to bypass multi-factor authentication and maintain control even after the victim changes their password, posing a significant threat to both individual users and organizations.
In other security developments, Microsoft released patches for on-premises SharePoint that failed to fix the underlying vulnerability, which is now being exploited in zero-day attacks. China has upgraded smartphone surveillance tools, and Ring has relaxed its anti-snooping stance, allowing more lenient policies regarding hidden cameras.
On the hardware front, Waymo has designed a 5 nm chip for robocars that delivers over 1,000 TOPS of machine learning performance with ultra-low latency, aiming to stay ahead of Tesla in autonomous driving technology. AMD announced that its latest systems are four times more energy-efficient than those from two years ago, inching closer to its goal of making AI less power-hungry. Google is pitting Marvell against Broadcom in the AI chip race, offering Marvell a $12.2 billion stake to sweeten the deal and secure advanced networking solutions. Cerebras introduced its CS-4 rack systems, which double per-chip performance while cramming three times as many chips into a single rack, maximizing AI compute density.
In software updates, Go 1.27 expands generics support to include methods, a move that may delight diehard gophers but could displease AI developers who rely on more specialized languages. At DEF CON, the Franklin project has enlisted hackers to research security vulnerabilities, aiming to crowdsource defense mechanisms against emerging threats. Meanwhile, Russian threat actors are posing as Signal support staff to launch phishing attacks, and the US has taken down Iranian propaganda websites. A marketing company has also faced scrutiny after asking users, "Why Do We Have Your Information?" highlighting ongoing privacy concerns.
