© Getty Images/Unya-MT
Bitcoin Magazine
President Trump to Highlight Crackdown on Overseas Crypto Scams
President Donald Trump will use a White House event on Wednesday to spotlight his administration’s push against foreign criminal networks that lure Americans into fake crypto investments, a White House official told Reuters.
The remarks are part of a broader event on cyber crime prevention. Trump and members of his cabinet plan to point to the government’s seizure of fraudulent crypto investment websites and its work to shut down online impersonation scams, the official reportedly said.
Homeland Security Secretary Markwayne Mullin, FBI Director Kash Patel, Defense Secretary Pete Hegseth and Attorney General Todd Blanche are expected to attend.
The event follows a March executive order in which Trump directed the Justice Department to prioritize the identification and prosecution of online scammers. He followed that with a memo directing the Department of Homeland Security to work with private companies to surveil foreign criminal hacking groups.
The numbers behind the crackdown are grim. Americans filed more than one million complaints with the FBI about internet scams in 2025, a 17% increase from 2024, and reported record losses.
Crypto fraud accounted for more than half of that damage. The FBI’s Internet Crime Complaint Center logged 181,565 crypto-related complaints and $11.366 billion in losses for 2025, making digital assets the single most loss-heavy category in the report. Crypto investment scams drained $7.2 billion of that total.
The FBI traced much of the activity to organized criminal enterprises in Southeast Asia — in Cambodia, Laos and Burma — that use victims of human trafficking as forced labor inside scam compounds. Criminals make contact through text messages, social media, dating apps and digital ads before steering victims to fake platforms that display fabricated profits. When victims try to withdraw, scammers demand taxes and fees and vanish.
Americans aged 60 and older bore the heaviest burden, with $4.43 billion in crypto-related losses. Crypto ATM scams produced $389 million in losses, a 58% jump from 2024, and recovery scams that target prior victims generated another $1.4 billion.
The global picture is worse. Chainalysis data from January showed illicit crypto addresses received at least $154 billion in 2025, a 162% increase from 2024. North Korea-linked hackers stole $2 billion over the year, including the $1.5 billion Bybit exploit, the largest crypto heist on record.
Enforcement has produced some solid results. The FBI’s Operation Level Up notified 3,780 victims of active crypto investment fraud in 2025 and saved an estimated $225.8 million. A Scam Center Strike Force that combines the DOJ, FBI, Secret Service, State Department and Treasury’s OFAC targets the Southeast Asian compounds.
According to Reuters, Trump and his sons have added at least $2.3 billion to the family fortune from their main crypto ventures, while the investors they courted have absorbed a $2.3 billion hit.
In October 2025, Trump pardoned Changpeng Zhao, the Binance founder convicted after the exchange pleaded guilty to failing to maintain an effective anti-money laundering program.
Democrats in Congress have accused the Trump family of using the presidency to enrich itself through its crypto ventures, a charge the White House rejects.
White House spokeswoman Anna Kelly said that “all actions by President Trump and his administration are taken in the best interest of the American people.”
This post President Trump to Highlight Crackdown on Overseas Crypto Scams first appeared on Bitcoin Magazine and is written by Micah Zimmerman.
It took OpenAI two days to notice that a recording device was hidden in a restricted executive conference room where leadership met to discuss highly confidential information, including technical progress, government engagements, and commercial partnerships.
Only those with special clearance are supposed to access that room. But the FBI believes the recording device was planted by Abdulrahman Alfozan, a 35-year-old engineer from Saudi Arabia, who became a permanent US legal resident in 2020. In a press release Tuesday announcing his arrest, the FBI alleged that chatbot logs and CCTV footage suggested that Alfozan—who worked as an OpenAI engineer for more than a year—sought to use the device to spy on OpenAI and risked leaking trade secrets in a way that threatened national security.
To conceal the USB device, Alfozan allegedly wrapped it in toilet paper, then plugged it into the back of a conference room television. The device was likely planted on September 28, and OpenAI found it on September 30 and quickly determined that its contents were encrypted, the FBI said. Days later, on October 5, OpenAI installed a camera in that conference room, and the CCTV footage allegedly showed Alfozan attempting to retrieve the recording device that same day.
© U.S. v. Abdulrahman Alfozan | Aurich Lawson
The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the United States for a conference.
The post Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe appeared first on SecurityWeek.
Just-in-time, or JIT, compilation could be considered a fundamental backbone of modern computing. JIT compilation turns scripting languages like JavaScript or intermediary binary forms like Web Assembly into native code on the fly, giving web apps, and things that are web apps under the covers like Electron-based tools, near native speed. A new paper explores leveraging JIT systems to revive Spectre-v2 attacks against processors.
Most modern processors gain performance by using a trick called “speculative execution”. The processor guesses the likely result of a compare, and begins executing some of the next instructions before the results are actually known. If the processor guessed right, things continue and there is a speed gain because it can jump ahead, but if the processor guessed wrong, any instructions that were run and any side effects of running them are discarded and execution resumes on the actual path. In theory, anyhow.
In practice, the Spectre class of attacks targets branch prediction. It was discovered that when the wrong branch was chosen, not all of the results were truly hidden; Patterns of failures in guessing branches can be used to leak behavior processing encryption keys and other activities. The attacks evolved with the research dubbed Spectre-V2, which showed that non-privileged contexts, like non-root users and virtual machines, could poison the instruction prediction and use it to read arbitrary memory. Fixes to the Linux kernel and other platforms were required to mitigate the worst of the effects.
The paper shows that by using self-modifying code in the JIT, the processor can be tricked into loading cached versions of the instructions. The fixes to the kernel to prevent Spectre attacks include identifying malicious code patterns that attack the branch prediction, and stopping or changing them: By causing the CPU to execute the cached copy of instructions instead of the live copy, the attack ignores the fixed instructions entirely and can attack the branch prediction algorithm.
To prove the attack is feasible in the real world, the researchers targeted several JIT compilers, including the SpiderMonkey JavaScript engine used by Firefox, the eBPF JIT found in the Linux kernel, and GraalVM, the JIT used in Python. They found success with each, demonstrating that the attack is at least plausible.
Research like this is unlikely to be an instant world-melter, and will help find possible mitigations in the future to prevent these sorts of attacks. Operating systems that support a high-security “lock-down” mode, like macOS and iOS, often disable JIT entirely, out of concern about these sorts of attacks. There’s probably no need to start disabling JIT on every system, but attacks like these have a tendency to evolve.
Updated Linux kernels are available for most distributions, with a truly intimidating list of patched security issues. As this Debian post states, “Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.” Several, in this case, is a load-bearing word, and you should go check out the CVE list. I’ll wait.
This, apparently, is what the AI Vulnpocalypse looks like today. After Windows patched over a thousand vulnerabilities in a single Patch Tuesday, we probably had a pretty good idea what would be coming. With over 1,200 vulnerability report IDs listed in the patch, manually understanding the security impact is extremely daunting if not entirely impossible. A random sampling shows vulnerabilities in compression handling, denial of service attacks from local users, and memory corruption that may or may not be exploitable, but with a list this huge that’s hardly exhaustive.
For normal admins and users, there isn’t much else to do besides apply the patches and hope they don’t cause new problems. Linux overall has a better track record with patches not breaking they entire system, but it’s not unheard of, and with this much churn, the chances of something going wrong of course increases. Patching is almost always a better option than not patching and hoping you don’t get owned, though!
“Stop hitting yourself” comes to mind. Google has stopped the Google Open Source Vulnerability Rewards Program, the bounty program offering rewards for finding bugs in the companies open source releases.
Surprising nobody, the bounty program has been flooded with “low effort” and “low quality” AI generated reports. Google says maintainers were overwhelmed with false reports containing AI hallucinations, and that the program would be re-evaluated in 2027. While AI-assisted, or even directed, security research is our new normal, if the results aren’t checked by someone able to confirm they’re legitimate, submitting them helps nobody.
Can’t help but feel some schadenfreude that a company shoving AI into every aspect of our lives is then impacted by AI being shoved everywhere, but in the end swamping developers with bogus reports keeps them from fixing the real bugs and benefits nobody, so it’s hard to find a positive takeaway on this one.
Customers of the Asos online clothing store who installed the Asos app got first-hand evidence that the platform was hacked by a ransomware crew. The attackers used the Asos app push notifications to send an alert to all customers: “Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.”
Snowflake is a cloud-scale database company, and has been implicated in several other attacks over the past few years, including a large hack in 2024 by the ShinyHunters group that led to compromises of Ticketmaster, AT&T, Lending Tree, and others. It’s unclear how the Asos Snowflake instance was compromised.
Direct-to-consumer ransomware demands aren’t new, and apply pressure to the impacted company. The message itself is a well-phrased piece of propaganda, casting the hacked company as the villain who isn’t protecting the customers by engaging in the extortion demands. Asos so far indicates that “basic customer information” like name and contact information, but possibly not payment details.
The FBI has removed a contractor from the multinational tech company Accenture, after determining that the breach of the Oracle PeopleSoft instance that then led to the breach of the information of the entire FBI agent and employee system, was avoidable.
Details remain scarce, but this would imply that the vulnerability used by ShinyHunters wasn’t a zero-day after all. One of the most dangerous phases of the vulnerability lifecycle is when both the bug and patch are known, because researchers can often quickly deduce the vulnerability from the patch and write an exploit. This seems to be what happened here.
Rarely are specific individuals held directly responsible for patch cycles. Patching production services of large organizations is usually determined at an institutional level. Reading between the lines, the individual may have been directly tasked with doing the work of installing the patches and didn’t.
Last week, the ShinyHunters group made public statements that it did not plan to leak the stolen information, and was simply using it as a means to get press coverage of their grievances against the FBI. The promise not to leak the addresses of the families of agents is probably appreciated by the agents themselves, but unlikely to do much to slow the pursuit.
Ars Technica reports that three domain registrars were hacked and the access used to obtain certificates for Google domains.
By hacking the registrars and changing the assignment of country-level Google domains for the “gh” (Ghana), “sl” (Sierra Leone), and “as” (American Samoa) top-level domains, the attackers were able to pass automated domain ownership checks required for obtaining SSL certificates.
To be usable, an attacker would have to be able to intercept and redirect the traffic between a user and the compromised domain, and the user would have to be attempting to connect to the Google domains in that country TLD in the first place. The attack may have been targeted against those specific countries, or may have simply been an opportunistic attempt to harvest credentials. Conceivably, the certificates could be used on malicious WiFi networks to try to capture user sessions from other Google domains and services.
Google has already implemented filtering for the specific certificates in Chrome, but these fixes do not help other browsers or services, and Google says it may not have identified all the compromised domains. Google also cautions that the domains of other companies were also compromised, and that those companies must take independent action to protect their users, but the impacted companies were not provided.
Researchers found a series of vulnerabilities in the Mammotion robot lawnmower platform. After spending “a few days on Mammotion’s cloud”, they demonstrated an admin account takeover and a full dump of all 337,000 customers, and for the cherry on top, unauthenticated access to first-person mode on mower. In case you wanted to help tidy up someones lawn or just go for a drive around the neighborhood.
After finding previous security issues in Mammotion products which were not, to put it delicately, fixed according the current norms of security patching in the industry, the company was on the radar. In addition to discovering that there was no rate limiting on brute-forcing account recovery and changing any users password, the team also found that factory systems lacked any authentication at all, hard-coded authentication tokens were baked into the firmware, and it may be possible to add any customer’s mower to any account.
After repeated attempts by the team to get the company to set up security contacts and respond to the vulnerability reports, it appears that the issues whith are remotely testable have been resolved, but for a fun read be sure to check the article and the email threads as an example of how, probably, you shouldn’t handle security reports as a company.
The FBI has removed an Accenture contractor over a data breach that exposed personal information of thousands of bureau employees.
The post FBI Blames Contractor’s Missed Patch for ShinyHunters Breach appeared first on SecurityWeek.
Known as Rey, the suspect is reportedly helping the FBI identify and locate other members of the extortion group.
The post Alleged ShinyHunters Leader Arrested in Jordan appeared first on SecurityWeek.
Cybercriminals used to hacking home routers and security cameras have found another Internet-connected device to add to their botnets: your car, according to research published by Kaspersky Lab.
The post Malware Takes the Wheel: Kaspersky Finds First Car Head Unit-Specific Attack appeared first on The Security Ledger with Paul F. Roberts.
Why Every Cybersecurity Professional Should Read the Original Records By Gary S. Miliefsky Publisher, Cyber Defense Magazine For more than a decade, cybersecurity professionals have watched researchers at DEF CON’s...
The post Hacking US Elections: The First Tranche of Declassified Election Integrity Documents appeared first on Cyber Defense Magazine.
Login