BRK EXCL: The crypto investment scam celebrity deepfake ads are still spreading across X, now impersonating BBC broadcaster Laura Kuenssberg @bbclaurak and Jim Ratcliffe (one of UK's richest people and owns 28% of Manchester United). I detected these ads in the last hour. Total views: 62,000+ The threat actors are using an Amazon affiliate A/B redirect switch to cloak their intended destination of bogus concocted news articles that drive users to initially invest £250+ in scam crypto products and fake investment platforms. You will lose your money. You will not get your stake back from them. The news cycle may be tired of these stories, but I won't stop reporting on the fraud.

An Epi Special Investigation on the scam political ads plaguing X users in the UK. Over four days, we detected 425 unique malicious ads, generating over 2.3 million impressions. From 1 to 4 July, I observed 425 distinct malicious ads that exploited the studio brand of the BBC Radio 4 Today programme and the likeness of Emily Maitlis. 1 July: 82 ads with 816,950 views 2 July: 95 ads with 433,808 views 3 July: 169 ads with 781,802 views 4 July: 79 ads with 319,412 views Total 1–4 July: 2,351,972 views (avg: 5,534 views/ad) Some individual ads reported over 70,000 impressions. The vast majority of the 425 ads matched one-to-one with individual X accounts; ie. around 400 separate X accounts were used for 425 ads. Interestingly, a large proportion of the accounts were created between 2009 and 2014, with a peak in 2011, and many of their initial tweets posted are scams and malicious links. This tells me that these Twitter accounts have not been recently created or hijacked, but are persistent scam accounts controlled and traded by organised criminals over long periods — decades, in fact. Ads were published by X accounts originating from 89 countries, most of which X indicates are using VPNs, which obscure their true geographic location. The ad origins include exotic and unusual countries such as: Afghanistan, Belarus, Mongolia, Palestine, Pakistan, Russia, Somalia, South Sudan, Ukraine, Uzbekistan and Venezuela. Some important questions that need answers: Why is X allowing ads from a such an exotic variety of countries to reach British users with UK political inspired ads? Why does X let ads be published from accounts hiding behind VPNs, particularly when they acknowledge their use? What are the banks and jurisdictions of the credit cards used to pay for the ads? Why is X permitting ads from regions in active conflict zones, and most concerningly, from countries under comprehensive and targeted US and UK sanctions — including: Afghanistan, Belarus, Russia, Somalia, South Sudan and Venezuela. Since this investigation, I have observed malicious ads exploiting the likeness of Nick Robinson on the Today programme. Funnily enough, I will be on the Today programme on BBC Radio 4 on Wednesday morning at 06:50 to discuss my findings. I hope you join me as one of six million listening! On your radio, on BBC Sounds, or on catchup. UK: Wed 6:50am US Eastern: Wed 1:50am US Pacific: Tue 10:50pm Sydney: Wed 3:50pm @epiapp @episecurity

I've been tracking these campaigns extensively for weeks. This is not an isolated incident. The posts are directing users to crypto investment scams on Discord and Telegram xitter.cf/ajrgd/status/207670776…

Movie piracy isn't the story. The free full-length movies are merely the vehicle for crypto investment scams.

Talked to @ConnorSephton on @RoxomTV about the Nigel Farage and Andrew Bailey scam adverts flooding X in the past few weeks, with fresh waves seen in recent days. 00:19. Is this a new issue? 00:51. Who is behind this? 01:40. What happens if I click on one of these ads? 03:05. Are people losing money? 04:08. Why have X appeared slow to take down the ads? 08:54. What about deepfakes and the effect of AI on scams? 10:01. What Alex does to tackle deepfakes and avoid scams overall 11:18. Alex's main advice on phishing and scams. Why people can't read URLs and why you need a good link checker

BREAKING & EXCL: Malicious Farage and Andrew Bailey scam ads are continuing today. Threat actors are now pixelating the faces of Farage and Bailey to evade automated detection. This confirms what I suspected: X is using AI image models and face recognition to detect the scam ads. X needs to check the URLs of ads and posts to defeat the scams. I stand ready to work together, as always, in service of the public.

The X account of BBC 5 Live Sport @5liveSport looks to be compromised, with scam affiliates listed under the account

BREAKING: Something really bad has just happened with the BBC 5 Live Sport account on here. Looks to be compromised. Two scam accounts are now affiliated with BBC 5 Live Sport: [@]FNSNVencicne [@]MngmntTrade [@]FNSNVencicne is NOT Venice AI but purports to be [@]MngmntTrade is a crypto and investment scam vehicle @bbc @bbc5live @5liveSport please remediate and investigate immediately Meanwhile, do not click any links from the 5 Live Sport account as it may be compromised. Investment scams may soon appear from the account and the affiliates.

16:55 UK time. Ad still live. Now 1.7 million impressions for this phishing campaign

PUBLIC ADVISORY: The X account for Alcatel USA [@]alcatelmobileus (21.8k followers) has been compromised and is currently pushing scam ads. This is the biggest account I've seen taken over so far — a major brand with 21.8k followers. The account last posted in 2019. Don't trust this account or the links it posts at this time. Please share widely and tag the people to remediate this across X Trust and Safety @Safety There is a broader issue. Scam ads on X are rife and getting worse. Epi and I stand ready, as always, to help all that we can with our internet intel and services, which block these sites by default. No opportunism; just public service.

PUBLIC ADVISORY for Instagram users from @epiapp: We have responsibly disclosed a critical security vulnerability to Meta about Instagram. We are not detailing the vulnerability here, but it impacts the Instagram in-app web browser. We are issuing this redacted public advisory in the public interest. We advise Instagram users to be especially cautious and vigilant when using the Instagram browser, and to refrain from using the in-app browser to log in to third-party sites and services at this time. It is in the public interest for users to be aware and act accordingly, because the vulnerability is one of web trust as much as an exploitable technical failure. It affects all Instagram users worldwide right now, and we are concerned of active exploitation. Don't log in to sites in the Instagram web browser at this time. We stand ready to work closely with Meta on fixing this vulnerability and improving the security of the in-app browser.

Made a script to check our org and help others detect if they're affected by the Axios NPM library compromise. Axios is a hugely popular HTTP request library, installed over 100 million times every week, and is used in hundreds of thousands of software projects. This script checks a batch of Node repos in one go. Run it on your dev machines, CI and environments. gist.github.com/alexgreenlan…

Want to stop getting phished? Use a good link checker! The Epi link checker cares about your privacy and security. It doesn't log or record input URLs, doesn't track you, uses no third-party scripts, is free and requires no login. It resolves all redirects for you in its sandbox, so you get the right trust verdict — for the final destination. No star ratings. No subjective scores. We simply tell you whether a site is trusted, legitimate, malicious or unsafe. epihq.com

This is really bad @Bitly. A targeted scam ad hosted on your security check redirect page. The new bit•ly redirect interstitial is ostensibly about keeping users safe with site scanning and transparency. You ask the user to "use the site preview above to make sure the link takes you where you expect", but there's a big scammy ad taking up the most of the page at the top, asking the user to "click to verify", which will mislead a good many people. The bad actor has crafted this ad placement especially for Bitly, to fool as many as they can to inadvertently click through. It's also not obvious it's an ad; there is no labelling. The "security check" interstitial achieves the exact opposite and makes users less safe. It reminds me of the days of popup spam, and deceptive and intrusive advertising which plagued major sites in the 2000s and 2010s. People will be defrauded with these ads. Ideally, you wouldn't run ads, but you certainly mustn't host bad ads, placing all the safety responsibility with the end user. Don't rely on Google or the ad network; approve all ads you're hosting on security-critical pages like this.

Big news: Apple just quietly published (1 Jan) a webpage describing the training data used for their gen AI This legal document is for compliance with the California Generative Artificial Intelligence Training Data Transparency Act. 🍿 Fascinating insights. Highlights: "Apple trains generative AI models using a mixture of data that includes publicly available data, including publicly available information crawled by Apple’s web crawler Applebot, data licensed or purchased from third parties, open-sourced data, data obtained through user studies, and synthetic data." "Applebot does not crawl data from websites that require login credentials or that are protected by a paywall. Applebot respects standard robots.txt directives" "Data sets for model training include both data from the public domain and data subject to intellectual property rights. For example, data used to train generative AI models includes data that has been directly licensed to Apple and data made available pursuant to licenses, such as common open-source licenses, that permit use of the data in the development of generative AI systems." "Apple does not use our users’ private personal data or user interactions when training our foundation models. Additionally, for content publicly available on the internet that has been crawled by Applebot, Apple takes steps to apply filters to remove certain categories of personally identifiable information, such as social security and credit card numbers, from training data." "Apple filters web-crawled data and publicly available datasets both at the time the data is crawled or imported and also as a part of post-acquisition processing prior to training. The data is managed both to limit the use of low-quality data and to remove content that is undesirable or unsafe. For example, Apple performs quality filtering and plain-text extraction on data crawled by Applebot, including safety, profanity, inappropriate content, spam, financial data, and quality filtering using heuristics and model-based classifiers, global fuzzy de-duplication using locality-sensitive n-gram hashing, decontamination against common pre-training benchmarks, and filtering against benchmark datasets. Different techniques are used to filter datasets, including manual and algorithmic ranking of content, use of heuristics, and use of machine learning models." "Apple has been collecting textual data for training since 2018 and image data for training since 2020. Data collection remains ongoing." "Apple uses generated text, images, audio, and other content to supplement datasets containing real-world data. This category of data is used to enhance the other corpora, including synthetic image caption data, question-answer pairs, and language data. Apple also uses synthetic data generation for post-training, including supervised fine-tuning." I wonder what happens with respect to the Google-trained Apple LLM model. This document was discovered by Epi Internet Intelligence (@epiapp).

Why Trusted Publishing and OIDC is dangerous for CI, your deployments and source code, and GitHub overall. My recommendation to machine-to-machine OIDC flow developers: always require a secret to be supplied as well.

Here to help devs with reviews, audits and pentests for RSC, servers and client apps. In the wake of the significant and widespread attacks on NPM libraries and React2Shell exploits, security must no longer be an afterthought or bolt-on. I've been building secure apps and servers for 15 years, and running a cybersec startup for 6 years. Security works when it is at the foundation, with secure code practices followed religiously by devs, and platform safeguards built in. Reach out if you want me to look at your source and apps. Happy to take a deep dive into your repos, and if you like my work, establish a working relationship.

Shai-Hulud Wave 2 Breaking: just updated our check tool, adding 190 new compromised npm deps since yesterday, including libs from Browserbase and Oku UI. Go get checked: gist.github.com/alexgreenlan…