Pete Recommends – Weekly highlights on cyber security issues, January 10, 2026

Subject: DoorDash bans driver over alleged AI delivery scam
Source: The Hill
https://thehill.com/business/5669719-doordash-ban-driver-ai-scam/

DoorDash bans driver over alleged AI delivery scam: ‘Zero tolerance for fraud’ https://thehill.com/business/5669719-doordash-ban-driver-ai-scam/

(NEXSTAR) – A delivery driver for DoorDash has been ousted from the platform after allegedly attempting to trick a customer into thinking their order had been delivered to their door with an image generated by artificial intelligence.

Hobart later explained that he didn’t think the DoorDash driver was ever physically present at his home but instead used a number of tactics to make it appear to him, and to the powers that be at the company, that it was a legitimate delivery. The user also theorized that the “Dasher” may have been a scammer who simply hacked a legitimate driver’s account, changed the payout information, and attempted to get paid for “a bunch of fake deliveries” before anyone found out.

Tags


Subject: How to Protect Your iPhone or Android Device From Spyware
Source: WIRED
https://www.wired.com/story/how-to-protect-your-iphone-or-android-device-from-spyware/

Being targeted by sophisticated spyware is relatively rare, but experts say that everyone needs to stay vigilant as this dangerous malware continues to proliferate worldwide.

In December, hundreds of iPhone and Android users received a threat notification, warning them their device had been targeted by spyware. Days later, Apple and Google patched security holes that experts think were used to plant the stealthy malware on a select group of devices.

Spyware is so dangerous because the adversary is able to see and hear everything you do on your smartphone, including via encrypted messaging apps such as WhatsApp and Signal. But it tends to be extremely targeted against dissidents, journalists, politicians, and business leaders operating in certain sectors.

In early December, as Google issued its threat notification, the tech firm’s researchers detailed how an exploit chain was used to install Predator spyware surreptitiously onto a device.

It came after an alert issued by the US Cybersecurity and Infrastructure Security Agency (CISA), warning users that adversaries are “actively leveraging” commercial spyware to target mobile messaging applications.

As the risk increases, what can you do to protect your Android device or Apple iPhone?

[…]
Signs You’ve Been Hit
[…]
How to Prevent and Mitigate Spyware
[…]
Google offers spyware protection for Android called Advanced Protection, which has been enhanced in Android 16 with intrusion logging, USB protection and the option to disable auto-reconnect to insecure networks. It can be enabled via your Settings > Security & Privacy > Other Settings > Advanced Protection.

In addition to using anti-spyware features, all users should be mindful of clicking links from strangers, says White. “Pay attention to changes in devices’ functioning. Using a reputable VPN can help prevent some forms of surveillance and censorship,” she says. “Evaluate any new requests for social media followers before accepting. Visit Amnesty’s secure onion website, privately and anonymously, using the Tor network’s browser.”

More generally, exercise “strict control” over what gets installed on your device, adds Arntz.


Subject: Punkt Updates its Privacy-Focused Smartphone
Source: Phone Scoop
https://www.phonescoop.com/articles/article.php?a=23654

Swiss phone maker Punkt has announced a new version of its privacy-centered 5G smartphone. The Punkt MC03 is an update to the Punkt MC02, with updated specs like a 120 MHz AMOLED (full-color) display, MediaTek Dimensity 7300 processor, 8 GB of RAM, and an IP68 rating for dust and water. Like the MC02, it runs AphyOS (based on Android Open Source) and offers both a curated set of privacy-first apps (now referred to as “Vault”), plus the ability to run third-party Android apps with extra privacy options (now appearing in a separate section called “Wild Web”). New with the MC03, core apps like email, calendar, and cloud storage are provided by Proton. AphyOS continues to require a $10/month subscription for full functionality, which Punkt explains as replacing the money that other phone OSes make from selling your data. A one-year subscription is included. Discounts are available for purchasing several years in advance. The Punkt MC03 will be available in North America this spring for $699.


Subject: Trump admin lifts sanctions on Predator-linked spyware execs
Source: The Register
https://www.theregister.com/2026/01/04/trump_admin_lifts_sanctions_predator_spyware_execs/

infosec in brief. The Trump administration has cleared a trio of individuals sanctioned by the Biden administration for involvement with the Intellexa spyware consortium behind the Predator surveillance tool, removing restrictions that had barred them from doing business with the US.

It’s the latest indicator that the Trump administration is a-okay with commercial spyware used by authoritarian countries to spy on dissidents, journalists, and political opponents, following a move in September that saw Team MAGA lift restrictions on Immigration and Customs Enforcement (ICE) purchasing software from commercial spyware maker Paragon Solutions.

Predator has all the usual features of a commercial spyware product. It allows users to perform espionage-related activities on infected devices, including device tracking, surveillance, data theft, and the like.

Predator has remained available through the Intellexa spyware consortium despite US sanctions imposed in 2024 on Intellexa-linked entities and executives. In its first round of sanctions in March 2024, the Biden-era Treasury Department described Intellexa as a “significant threat to … national security.”

Filed: https://www.theregister.com/security/


Subject: 8 WhatsApp Features to Boost Your Security and Privacy
Source: WIRED
https://www.wired.com/story/5-features-that-boost-security-and-privacy-on-whatsapp/

Meta’s end-to-end encrypted messaging app is used by billions of people. Here’s how to make sure you’re one of the most locked-down ones out there.

WhatsApp is protected by end-to-end encryption, the gold standard of security that, when implemented properly, means only you and the person you’re chatting with can read your messages. Behind the scenes, WhatsApp has also launched passkey-encrypted backups and privacy-enhanced AI technology.

But there are a bunch of features you can use to boost your own privacy and security in the Meta-owned app. Here are eight of the best.

Topics


Subject: Instagram CEO says in the age of AI, you can’t assume what you see online is real
Source: TechSpot
https://www.bespacific.com/instagram-you-cant-trust-what-you-see-anymore-html/

TechSpot: ‘At the close of 2025, Instagram head Adam Mosseri used his personal account to post a 20-page presentation examining what he called the “new era of infinite synthetic content.” The slideshow, which reads like a digital memo to the future of photography, argues that technology has permanently blurred the distinction between authentic and artificial imagery – and that Instagram, once defined by its personal photo diaries, has already moved beyond that stage. Mosseri said the traditional, more intimate feed was “dead” years ago. What replaces it now, he suggested, is a world in which users must adapt to a new default assumption: that not everything they see is real. “For most of my life I could safely assume photographs or videos were largely accurate captures of moments that happened. This is clearly no longer the case and it’s going to take us years to adapt,” he wrote. He described a shift from trust to verification as the foundation of visual culture online. “We’re going to move from assuming what we see is real by default, to starting with skepticism. Paying attention to who is sharing something and why. This will be uncomfortable – we’re genetically predisposed to believing our eyes.”[more]


Abstracted from beSpacific
Copyright © 2025 beSpacific, All rights reserved.


Subject: AI-powered browsers can be tricked into stealing your data
Source: Quartz
https://www.bespacific.com/ai-powered-browsers-can-be-tricked-into-stealing-your-data/

Quartz – The companies building them have decided that’s a risk worth taking: “In October, OpenAI launched Atlas, its ChatGPT-powered browser designed to go head-to-head with Google Chrome. Perplexity has Comet. Opera (remember them?) unveiled Neon. Mozilla, which built its entire brand on being the browser you can trust, just announced an “AI Window” for Firefox. Google keeps weaving Gemini deeper into Chrome. The message from Silicon Valley is unmistakable. All these companies are promising browsers that don’t just load web pages but actually understand them….

The pitch is compelling. The security situation is not. The security team for the Brave browser (which is also introducing AI features) published a series this fall showing just how vulnerable AI browsers are to prompt injection, a type of attack where hidden instructions manipulate an AI into doing things the user never asked for.

OpenAI’s chief information security officer acknowledged on X that prompt injection remains “a frontier, unsolved security problem.” The company launched Atlas anyway…”

Abstracted from beSpacific
Copyright © 2025 beSpacific, All rights reserved.


Subject: Fact-Checking and Misinformation: Evidence from the Market Leader
Source: SSRN
https://www.bespacific.com/fact-checking-and-misinformation-evidence-from-the-market-leader/

Cage, Julia and Gallo, Nathan and Hengel, Moritz and Henry, Emeric and Huang, Yuchen, Fact-Checking and Misinformation: Evidence from the Market Leader. [61 pages] (December 05, 2025). Available at SSRN: https://ssrn.com/abstract=5868423 or http://dx.doi.org/10.2139/ssrn.5868423

What are the dynamic effects of fact-checking on the behavior of those who circulate misinformation and on the spread of false news? In this paper, we provide causal evidence on these questions, building on a unique partnership with the Agence France Presse (AFP), the world’s largest fact-checking organization and a partner of Facebook’s Third-Party Fact-Checking Program. Over an 18-month period (December 2021-June 2023), we collected information on the stories proposed by fact-checkers during the daily editorial meetings, some of which were ultimately fact-checked while others, despite being ex ante “similar”, were left aside. Using two complementary Difference-inDifferences approaches, …

Abstracted from beSpacific
Copyright © 2025 beSpacific, All rights reserved.


Subject: Worried about surveillance, states enact privacy laws and restrict license plate readers
Source: Stateline
https://stateline.org/2026/01/08/worried-about-surveillance-states-enact-privacy-laws-and-restrict-license-plate-readers/

A growing number of conservative lawmakers also want to curb the use of surveillance technologies.As part of its deportation efforts, the Trump administration has ordered states to hand over personal data from voter rolls, driver’s license records and programs such as Medicaid and food stamps.

At the same time, the administration is trying to consolidate the bits of personal data held across federal agencies, creating a single trove of information on people who live in the United States.

Many left-leaning states and cities are trying to protect their residents’ personal information amid the immigration crackdown. But a growing number of conservative lawmakers also want to curb the use of surveillance technologies, such as automated license plate readers, that can be used to identify and track people.

Conservative-led states such as Arkansas, Idaho and Montana enacted laws last year designed to protect the personal data collected through license plate readers and other means. They joined at least five left-leaning states — Illinois, Massachusetts, Minnesota, New York and Washington — that specifically blocked U.S. Immigration and Customs Enforcement from accessing their driver’s license records.

[…]

Categories:


Subject: Security Experts Dire Warning on AI Agents in 2026
Source: tech.co
https://tech.co/news/hackers-target-ai-agents-2026

Key Takeaways

  • According to cybersecurity researchers, AI agents will become a main attack vector for hackers in 2026.
  • The cybersecurity skills gap will lead to companies deploying different AI tools en masse, which will encourage attackers to switch their focus from human operators to AI agents.
  • To combat this, companies should invest in technological safeguards, as well as upskill their existing emp
Posted in: AI, Cybercrime, Cybersecurity, Privacy, Social Media