Pete Recommends – Weekly highlights on cyber security issues, May 31, 2025

Subject: Most AI chatbots devour your user data – these are the worst offenders
Source: ZDNET
https://www.zdnet.com/article/most-ai-chatbots-devour-your-user-data-these-are-the-worst-offenders/

Like many people today, you may turn to AI to answer questions, generate content, and gather information. But as they say, there’s always a price to pay. In the case of AI, that means user data. In a new report, VPN and security service Surfshark analyzed what types of data various AIs collect from you and which ones scoop up the greatest amount.For its report, Surfshark looked at 10 popular AI chatbots — ChatGPT, Claude AI, DeepSeek, Google Gemini, Grok, Jasper, Meta AI, Microsoft Copilot, Perplexity, Pi, and Poe. The analysis checked the privacy details for each app on Apple’s App Store as well as the privacy policies for DeepSeek and ChatGPT. The goal was to determine how many types of data each app collects, whether it gathers data linked to you, and whether the app uses third-party advertising.

Also: The best AI chatbots: ChatGPT, Copilot, and notable alternatives

Surfshark focused on 35 different data types, including contact info, health and fitness, financial info, location, sensitive info, contacts, user content, history, identifiers, diagnostics, usage data, and purchases. As one example, sensitive info includes racial or ethnic data, sexual orientation, pregnancy or childbirth information, disability, religious or philosophical beliefs, trade union membership, political opinion, genetic information, or biometric data.

All 10 AI apps collect some type of user data. The average number of data types amassed was 13 out of 35. Some 45% of the apps gather your location. Almost 30% track user data, which means that the information collected from the app is linked with third-party data to deliver targeted ads or share with a data broker.
So, who are the worst offenders?
[…]
ChatGPT and other AI apps and services do provide ways for you to prevent or at least limit the collection of your data. Your best bet is to investigate the privacy policies and settings for any AI you use to see how you can take charge of your own data.


Subject: The US Is Building a One-Stop Shop for Buying Your Data [plus A mysterious hacking group’s secret client is exposed, Signal takes a swipe at Microsoft Recall, Russian hackers target security cameras to spy on aid to Ukraine, and more.]
Source: WIRED
https://www.wired.com/story/us-spies-one-stop-shop-private-data/

Plus: A mysterious hacking group’s secret client is exposed, Signal takes a swipe at Microsoft Recall, Russian hackers target security cameras to spy on aid to Ukraine, and more.

This week, WIRED launched our Rogues issue—which included going a bit rough ourselves. WIRED senior correspondent Andy Greenberg flew to Louisiana to see how easy it would be to recreate the 3D-printed gun authorities say they found on Luigi Mangione when they arrested him for the murder of UnitedHealthcare’s CEO. The result? It was both easy and legal.

On Wednesday, US, European, and Japanese authorities announced the disruption of one of the world’s most widely used infostealer malware. Known as Lumma, the malware was used to steal sensitive information from victims around the world, including passwords, banking information, and cryptocurrency wallets details, according to authorities. Microsoft’s Digital Crime Unit aided in the operation, taking down some 2,300 URLs that served as the Lumma infrastructure.

A mysterious database containing more than 184 million records was taken down this week following its discovery by security researcher Jeremiah Fowler. The database contained 47 GB of data, which included information related to Amazon, Apple, Discord, Facebook, Google, Instagram, Microsoft, Netflix, Nintendo, PayPal, Snapchat, Spotify, Twitter, WordPress, Yahoo, and more.

In other news, the US charged 16 Russian nationals for allegedly operating the DanaBot malware, which authorities say was used in a wide variety of attacks, from ransomware to espionage. And a recent webinar revealed how a major venture capitalist helped get Starlink satellite internet activated for Israel following the October 7, 2023 attack by Hamas.
But that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

[…]


Subject: A Starter Guide to Protecting Your Data From Hackers and Corporations
Source: WIRED
https://www.wired.com/story/guide-protect-data-from-hackers-corporations/

Thinking about where to start when it comes to protecting your online privacy can be overwhelming. Here’s a simple guide for you—and anyone who claims they have nothing to hide.With President Donald Trump’s return to the White House and the US government’s digital surveillance machine more powerful than ever, digital privacy should be top of mind. But the digital security world can be confusing—and there’s the larger question of why. You may think, if I’m just a regular person, why is my digital privacy important?
Then there are the practical questions. What’s the best password manager? How can you keep your digital life under wraps at the border? And what kind of VPN should you be using? Is AI scraping my data?
WIRED senior writer and security expert Matt Burgess spoke with readers in a Reddit AMA this month about the basics of keeping your digital footprint locked down. Here’s what to know and why it’s important.

Filed: https://www.wired.com/category/security/


Subject: Western Mass. diners fooled by fake DoorDash account posing as real restaurant
Source: masslive.com
https://www.masslive.com/westernmass/2025/05/western-mass-diners-fooled-by-fake-doordash-account-posing-as-real-restaurant.html

Western Massachusetts residents placed orders for a local restaurant but when DoorDash drivers arrived, there was no food waiting.The restaurant’s account was a scam.

The Wilbraham Italian restaurant said DoorDash drivers had been showing up to pick up food for the “past couple of nights” looking for orders placed on DoorDash. But those orders don’t exist in the restaurant’s internal ordering system because they don’t work with DoorDash or any other third party delivery services.
“Apparently, some nefarious character decided to create a DoorDash ‘merchant account’ in Cima’s name (using a fictitious email address, no less) and the company never bothered to confirm the validity of said account,” the restaurant wrote on Facebook.


Subject: U.S. Spy Agencies Are Getting a One-Stop Shop to Buy Your Most Sensitive Personal Data
Source: The Intercept
https://www.bespacific.com/us-spy-agencies-are-getting-one-stop-shop-to-buy-your-most-sensitive-personal-data/

The Intercept: “The ever-growing market for personal data has been a boon for American spy agencies. The U.S. intelligence community is now buying up vast volumes of sensitive information that would have previously required a court order, essentially bypassing the Fourth Amendment. But the surveillance state has encountered a problem: There’s simply too much data on sale from too many corporations and brokers. So the government has a plan for a one-stop shop. The Office of the Director of National Intelligence is working on a system to centralize and “streamline” the use of commercially available information, or CAI, like location data derived from mobile ads, by American spy agencies, according to contract documents reviewed by The Intercept.[…]

Filed: https://theintercept.com/technology/

[see also:] IRS, Department of Homeland Security Contracted Firm That Sells Location Data Harvested From Dating Apps – https://theintercept.com/2022/02/18/location-data-tracking-irs-dhs-digital-envoy/


Subject: Verizon Study: Data Breaches Involving Third Parties On The Rise
Source: tech.co
https://tech.co/news/third-party-data-breaches-increasing

30% of data breaches that occurred last year involved a third party, new research shows. According to the Verizon 2025 Data Breach Investigations Report, during the year ended October 31, 2024, there were 15% more third-party data breaches than the previous year (15%).Third parties include suppliers, vendors, hosting partners, and IT support providers. These are a mainstay in most businesses, and as the study demonstrates, a growing source of concern from a cybersecurity standpoint.

The report sheds light on the evolving nature of attack vectors, as hackers deploy increasingly sophisticated methods to seize confidential information. With breaches on the rise in general, and businesses failing in their duties to prevent them, the cybersecurity landscape is in a perilous position.


Subject: X Funds for Content Creators Went to a Click Farm
Source: Newser + AI
https://www.newser.com/story/369377/x-funds-for-content-creators-went-to-a-click-farm.html

In a case that exposes the vulnerabilities of online revenue programs, a Vietnamese click farm is accused of siphoning funds from Elon Musk’s X by using fake accounts and stolen identities to generate bogus engagement—and hefty payouts. Now, X is fighting back in court, alleging a sweeping scheme that could reshape how social platforms police their payouts. X accuses the click farm of exploiting its Creator Revenue Sharing Program, according to a federal lawsuit filed in Texas, per the Independent. The eight defendants, based in Hanoi, allegedly used stolen identities to set up hundreds of fake profiles, then used software to automatically generate posts and artificially boost engagement through likes and reposts.

Subject: Fannie Mae joins Palantir to launch AI-run mortgage fraud unit
Source: UPI.com
https://www.upi.com/Top_News/US/2025/05/28/Fannie-Mae-Palantir-AI-fraud-crime-unit/5801748463848/

May 28 (UPI) Financial giant Fannie Mae said Wednesday it will launch its AI-powered unit to detect and prevent mortgage fraud in a partnership with AI software company Palantir.

“By integrating this leading AI technology, we will look across millions of datasets to detect patterns that were previously undetectable,” said Fannie Mae’s president and chief executive officer Priscilla Almodovar.

According to Fannie officials, it will not only detect suspicious activity but ultimately will “trigger investigative action.”


Subject: Cybercriminals exploit AI hype to spread ransomware, malware
Source: Bleeping Computer
https://www.bleepingcomputer.com/news/security/cybercriminals-exploit-ai-hype-to-spread-ransomware-malware/

Threat actors linked to lesser-known ransomware and malware projects now use AI tools as lures to infect unsuspecting victims with malicious payloads. This development follows a trend that has been growing since last year, starting with advanced threat actors using deepfake content generators to infect victims with malware.
These lures have become widely adopted by info-stealer malware operators and ransomware operations attempting to breach corporate networks.
Cisco Talos researchers have discovered that the same technique is now followed by smaller ransomware teams known as CyberLock, Lucky_Gh0$t, and a new malware named Numero.
The malicious payloads are promoted via SEO poisoning and malvertising to rank them high in search engine results for specific terms.

Tagged:

Filed: https://www.bleepingcomputer.com/news/security/


Subject: U.S. Sanctions Cloud Provider ‘Funnull’ as Top Source of ‘Pig Butchering’ Scams
Source: Krebs on Security
https://krebsonsecurity.com/2025/05/u-s-sanctions-cloud-provider-funnull-as-top-source-of-pig-butchering-scams/

The U.S. government today imposed economic sanctions on Funnull Technology Inc., a Philippines-based company that provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams known as “pig butchering.” In January 2025, KrebsOnSecurity detailed how Funnull was being used as a content delivery network that catered to cybercriminals seeking to route their traffic through U.S.-based cloud providers.“Americans lose billions of dollars annually to these cyber scams, with revenues generated from these crimes rising to record levels in 2024,” reads a statement from the U.S. Department of the Treasury, which sanctioned Funnull and its 40-year-old Chinese administrator Liu Lizhi. “Funnull has directly facilitated several of these schemes, resulting in over $200 million in U.S. victim-reported losses.”

Pig butchering is a rampant form of fraud wherein people are lured by flirtatious strangers online into investing in fraudulent cryptocurrency trading platforms. Victims are coached to invest more and more money into what appears to be an extremely profitable trading platform, only to find their money is gone when they wish to cash out.

Amazon said its Amazon Web Services (AWS) hosting platform actively counters abuse attempts.

[…]


Subject: Digital Corruption Takes Over DC
Source: Paul Krugman SubStack
https://paulkrugman.substack.com/p/digital-corruption-takes-over-dc

So why do ordinary people keep buying crypto? Part of the answer is intense marketing; as I mentioned in a recent post, my Venmo app (which is actually useful) is constantly trying to sell me crypto. But the most compelling explanation why people buy crypto is that there is a clear affinity between the psychology of buying crypto and the psychology of gambling. Retail crypto looks, in particular, a lot like the “numbers racket,” which siphoned millions of dollars from generations of working-class Americans until it was largely supplanted by state lotteries.
The numbers racket was illegal, but flourished anyway because the criminal organizations paid off police and politicians.
But they were pikers by today’s standards. According to Public Citizen, crypto companies accounted for almost half of all corporate spending during the 2024 election. Donald Trump and his family have made billions off the $Trump and $Melania “meme coins,” but I wouldn’t be surprised to learn that other politicians have also been the beneficiaries of crypto largesse.

What is a stablecoin? It’s a digital token like Bitcoin — that is, an asset that “belongs” to whoever has the secret numerical key that unlocks it. But unlike Bitcoin, whose value in dollars fluctuates wildly day to day, a stablecoin is supposed to retain a fixed value in dollars. The stablecoin issuer maintains that stability by standing ready to buy its tokens back, holding reserves of conventional assets like Treasury bills for that purpose.

One way to think about this is that stablecoin issuers are like banks back in the days before the Civil War, when gold and silver coins were the only official forms of money. Many banks issued paper currency, which they promised to redeem for gold and silver coins on demand. Similarly, stablecoin firms issue tokens that they promise to redeem for dollars.

Today, however, the federal government is deeply involved in banking, for very good reasons. After the devastating bank runs of the 1930s, in particular, officials realized that they needed to guarantee the value of deposits via the FDIC, while at the same time requiring banks to limit the kinds of risks they take. The goal was to limit the risk of financial crisis. While we did have a nasty crisis in 2008, that mostly involved “shadow banks” that evaded precautionary regulation. And stablecoins are, among other things, a new kind of shadow bank.

The fundamental point is that the growth and legitimation of stablecoins poses new risks to overall financial stability — all in the name of making it easier for criminals to do their business.

Posted in: AI, Civil Liberties, Cryptocurrency, Cybercrime, Cybersecurity, Economy, Financial System, Legal Research, Privacy