Gain valuable insights from industry leaders as they provide their perspectives on navigating the evolving digital landscape, addressing emerging cyber threats and trending topics that affect us all.

Chief AI & Innovation Officer

Leadership Perspectives

<p>Since taking office on January 20, 2025, President Donald Trump’s administration has taken significant steps to strengthen U.S. leadership in AI. Efforts have been focused on accelerating AI innovation while curbing the flow of advanced technologies to geopolitical rivals. To foster growth, regulatory barriers are being eased, and Project Stargate is set to transform the nation’s AI infrastructure.&nbsp;</p><p>As AI rapidly evolves, policymakers must strike a balance between driving innovation and addressing risks related to misinformation, security, safety, and ethics. Gen has outlined key recommendations for responsible AI development, aligning with its ongoing policy efforts in the EU and core principles of Integrity, Accountability, Data Protection, Human Involvement, and Transparency.&nbsp;</p><p>The following is an overview of the recommendations, and you can take a deeper dive into them in our <a href="https://www.gendigital.com/media/m5jitl4s/us-ai-policy-recommendations-from-gen_final.pdf" target="_blank" rel="noreferrer noopener">U.S. AI Policy Recommendations</a>.&nbsp;</p><h2><strong>Recommendations for U.S. Policymakers</strong>&nbsp;</h2><p>As the U.S. enters this new era of emerging technology, shaping its AI strategy requires a framework that promotes responsible innovation while addressing its complex challenges. To achieve this, targeted policy measures must enhance accountability, consumer protection, transparency, security, safety, and public awareness.&nbsp;&nbsp;</p><p>The following recommendations from Gen outline key actions for U.S. policymakers to ensure AI’s safe and ethical development while strengthening America’s tech leadership. These build upon our commitment to five core policy principles: Integrity, Accountability, Data Protection, Human Involvement, and Transparency.&nbsp;&nbsp;</p><p>Our recommendations include:&nbsp;</p><ol><li><strong>Support and enact a nationwide AI law</strong> to regulate AI’s development, use, security, and safety in a balanced way</li><li><strong>Strengthen consumer protection policies at the state level</strong> to safeguard individuals from fraudulent, dangerous, or defective AI technologies.</li><li><strong>Regulate AI development and use</strong> by organizations to ensure responsible and ethical technologies.</li><li><strong>Raise public awareness on AI risks </strong>through national education campaigns to inform Americans about content authenticity and the risks of sharing personal data online.</li><li><strong>Establish clear guidelines</strong> on the ownership, rights, and ethical use of AI-generated data, including data used for training AI models, the recycling of AI-generated content, and the responsible deployment of digital avatars and personas.</li><li><strong>Combat deepfakes and misinformation</strong> through legal frameworks that address and work toward eliminating them to secure public trust.</li><li><strong>Mandate AI transparency</strong> by requiring AI companies to disclose information about their systems and provide clarity in how their models operate and make decisions.</li><li><strong>Ensure regulatory certainty of AI standards</strong> to prevent regulatory ambiguity and foster innovation by giving companies confidence in compliance requirements.&nbsp;</li></ol><p>While these recommendations lay a strong foundation for responsible AI governance, policymakers must also take a proactive role in areas where long-term technological progress is critical, but incentives are lacking. Key priorities include: &nbsp;</p><ol><li><strong>Investing in Fundamental Scientific Research:</strong> AI has the potential to drive groundbreaking discoveries in physics, chemistry, and other foundational sciences. Government funding for this research will be critical to unlocking the transformative advancements of AI in the coming decades, even if it may not yield immediate profits. &nbsp;</li><li><strong>Preparing for Workforce Transition: </strong>AI-driven automation will reshape entire job sectors, affecting workers from rideshare drivers to software developers. Proactive workforce transition programs, including reskilling initiatives and adult education, can help guarantee<strong> </strong>that the benefits of AI are broadly shared and do not deepen economic divides. &nbsp;</li><li><p><strong>Advancing Next-Generation Computing Materials:</strong> Silicon has powered the digital era, but new materials may offer superior speed, efficiency, and scalability. However, these alternatives face adoption challenges. Rather than focusing solely on AI model development, the U.S. government should spearhead research and infrastructure efforts to advance these cutting-edge materials and lay the groundwork for the next wave of computing innovation. &nbsp;</p><h2><strong>A Call for Responsible Growth</strong>&nbsp;</h2></li></ol><p>The U.S. stands at a pivotal moment in the AI revolution. While innovation drives progress, responsible governance must ensure that AI benefits society as a whole. By investing in foundational scientific research, preparing the American workforce for AI-driven changes, and promoting next-generation computing materials, the U.S. can secure its leadership in the global AI race while fostering long-term economic stability and technological progress.&nbsp;</p><p>Finally, balancing innovation with accountability requires collaboration between governments, industry, and global partners.&nbsp; For more insights on Gen’s policy approach, read our full <a href="https://www.gendigital.com/media/m5jitl4s/us-ai-policy-recommendations-from-gen_final.pdf" target="_blank" rel="noreferrer noopener">U.S. AI Policy Recommendations</a> and <a href="https://www.gendigital.com/media/5abd44mv/digital-freedom-in-the-eu.pdf" target="_blank" rel="noreferrer noopener">Digital Freedom in the EU</a>.&nbsp;</p>

A framework for responsible U.S. leadership in the age of AI

AI in 2025: Gen's Policy Recommendations for U.S. Leadership 

Security Evangelist at Gen

<p>Cybercriminals often operate unseen in the digital shadows, exploiting unknown vulnerabilities (“zero-days”) to breach systems before patches are available. In Netflix’s new political thriller <em>“Zero Day,”</em> a catastrophic cyberattack strikes the United States, taking down power grids, transportation networks, communications, and even hospital life-support systems <a href="https://www.informationweek.com/cyber-resilience/what-netflix-s-zero-day-got-right-and-wrong-about-cyberattacks#:~:text=power%2C%20transit%2C%20air%20traffic%20control,bottom%20of%20this%20massive%20cyberattack" target="_blank" rel="noreferrer noopener">all at once</a>. This fictional crisis is orchestrated through <strong>zero-day vulnerabilities</strong> – unknown software flaws that hackers exploit to infiltrate critical infrastructure. The show’s creators have said they want to <em>“bring light to real cybersecurity threats”</em> and warn that <a href="https://www.netflix.com/tudum/articles/zero-day-ending-explained" target="_blank" rel="noreferrer noopener"><em>“we’ve got to do something to protect ourselves before a real zero-day event occurs”</em></a>. In other words, the high-stakes drama on screen highlights a very real concern off screen: zero-day attacks can and do happen, and everyone – from large enterprises to everyday people – needs to understand this threat.&nbsp;</p><h2>What is a Zero-Day Vulnerability?&nbsp;</h2><p>In simple terms, a <a href="https://us.norton.com/blog/emerging-threats/zero-day-exploit" target="_blank" rel="noreferrer noopener"><strong>zero-day vulnerability</strong></a> is a security hole in software or hardware that the vendor or developer doesn’t yet know about. Because it’s unknown, there’s no official fix or patch available at the time it’s discovered by attackers. Hackers treasure these flaws since they can exploit them freely until the software maker finds out and rushes to plug the hole. The name “zero-day” itself comes from the idea that developers have had <strong>zero days</strong> to fix the problem – the attack happens before anyone even knows the vulnerability exists. Once a patch is released, the vulnerability ceases to be “zero-day,” but until then it’s an open door for cybercriminals. In short, a zero-day is an unpatched, unknown weakness – and that’s what makes it so dangerous.&nbsp;</p><p>A <strong>zero-day exploit</strong>, on the other hand, is the method or code hackers use to leverage such a vulnerability. When attackers launch a <strong>zero-day attack</strong>, they are taking advantage of a flaw that no one realizes is there, giving them a stealthy head start. Software makers often only learn of the issue <em>after</em> it’s been used in an attack, at which point they scramble to investigate and release a security update. This window of exposure – from the first malicious use until the patch – is when users are most vulnerable, since traditional <a href="https://www.avast.com/free-antivirus-download" target="_blank" rel="noreferrer noopener">antivirus</a> or defenses might not recognize the new threat. It’s a race against time for defenders to close the gap once a zero-day comes to light.&nbsp;</p><h2>Real-World Cases of Zero-Day Exploits&nbsp;</h2><p>Real incidents over the years show just how impactful zero-day exploits can be. One of the most famous examples is <strong>Stuxnet (2010)</strong> – a sophisticated computer worm that was first discovered in 2010 (but had been active for years prior). Stuxnet targeted Iran’s nuclear facilities and managed to disrupt industrial machines by exploiting multiple zero-day flaws in Siemens industrial control software. It was essentially a cyber weapon, using at least four previously unknown vulnerabilities to spread and sabotage systems. Once Stuxnet was uncovered, those vulnerabilities were urgently patched, but the case became a textbook example of a zero-day attack in action – so much so that it even inspired a documentary called <em>“Zero Days.”</em>&nbsp;</p><p>Another notorious case was the <a href="https://blog.avast.com/wannacry-update-the-worst-ransomware-outbreak-in-history" target="_blank" rel="noreferrer noopener"><strong>WannaCry ransomware outbreak (2017)</strong></a>, which showed how zero-day exploits could wreak havoc on ordinary computer systems worldwide. WannaCry spread rapidly across hundreds of thousands of Windows PCs in May 2017, encrypting files and demanding ransom. It propagated using an exploit called <strong>EternalBlue</strong>, a tool originally developed (and kept secret) by the U.S. National Security Agency. EternalBlue took advantage of a Windows vulnerability that, at the time of its theft and leak, had no available patch – making it a zero-day in the attackers’ hands. In fact, Microsoft released a security update in March 2017 once they learned of the flaw, but many organizations had not applied it by May. The result: WannaCry tore through unpatched systems, from <a href="https://blog.avast.com/ransomware-that-infected-telefonica-and-nhs-hospitals-is-spreading-aggressively-with-over-50000-attacks-so-far-today" target="_blank" rel="noreferrer noopener">hospitals in the UK</a> to small businesses worldwide. This attack was eventually halted and the vulnerability patched on all supported systems, but not before it caused an estimated billions in damage. WannaCry was a wake-up call that even when fixes exist, delay in applying them can turn a known bug into a personal disaster.&nbsp;</p><p>Zero-day exploits aren’t just tools of nation-states or large criminal gangs – they have also been used against consumer devices in highly targeted ways. For instance, Apple has repeatedly had to issue emergency iPhone updates to stop <strong>“zero-click” spyware attacks</strong>. In one campaign uncovered in 2023, attackers used a pair of zero-day vulnerabilities (one in Apple’s image processing and one in iMessage) to silently install the notorious <a href="https://www.avast.com/c-pegasus-spyware" target="_blank" rel="noreferrer noopener"><strong>Pegasus</strong></a> spyware on iPhones. This attack, dubbed “BLASTPASS,” didn’t even require the victim to click a link – a malicious image file sent via iMessage could compromise a fully up-to-date phone. Upon discovery, Apple rushed out patches for iOS, macOS, and watchOS to close the holes and protect users. Similarly, a zero-day bug in the popular WebP image format (used by web browsers) was identified in 2023 after being exploited in the wild. The flaw (CVE-2023-4863) allowed attackers to hack devices just by tricking users into loading a booby-trapped image, prompting Google, Microsoft, Apple, and Mozilla to all issue out-of-band updates to their browsers. These cases show that zero-days can hit <em>anyone</em> – whether you’re an activist with a smartphone or a casual web surfer – if you happen to be in the blast radius before the fix arrives.&nbsp;</p><p>Small and medium businesses have also been victims of zero-day exploits. A dramatic example was the <strong>Kaseya VSA supply-chain attack (2021)</strong>. REvil, a ransomware gang, discovered unknown vulnerabilities in Kaseya’s IT management software (widely used by managed service providers to support many SMB clients). On July 2, 2021 – before Kaseya <a href="https://www.bleepingcomputer.com/news/security/kaseya-patches-vsa-vulnerabilities-used-in-revil-ransomware-attack/#:~:text=utilized%20these%20vulnerabilities%20to%20launch,servers%20and%201%2C500%20business%20customers" target="_blank" rel="noreferrer noopener">could patch the issues</a> – the attackers used those zero-days to breach about 60 MSPs and encrypt data on up to 1,500 customer networks downstream. This one attack effectively held hundreds of small businesses hostage, from local shops to schools, by exploiting a hidden flaw in software they all trusted. Kaseya worked quickly with researchers and law enforcement to develop a patch and help affected companies, but the incident underscored how a zero-day in a single service can cascade into a massive event.&nbsp;</p><p>These examples are not outliers. Zero-day exploits have become increasingly common in cyberattacks. In fact, in 2023, <a href="https://www.informationweek.com/cyber-resilience/what-netflix-s-zero-day-got-right-and-wrong-about-cyberattacks#:~:text=Zero%20days%2C%20the%20namesake%20of,the%20Cybersecurity%20and%20Infrastructure%20Security" target="_blank" rel="noreferrer noopener"><strong>11 of the top 15 most exploited software vulnerabilities were initially abused as zero-days</strong></a>&nbsp; – meaning attackers got the first strike before developers had any chance to fix those flaws. From industrial sabotage to global malware outbreaks, zero-day vulnerabilities have repeatedly been at the center of real-world security crises. Each time, the pattern is similar: a flaw nobody knew existed gets used for harm, and only then does a fix race out to contain the damage.&nbsp;</p><h2>How Zero-Days Impact Individuals and SMBs&nbsp;</h2><p>It’s easy to assume that zero-day attacks only matter for governments or big corporations, but that’s a dangerous misconception. While high-profile targets grab headlines, <strong>everyday individuals and small businesses</strong> are also at risk from zero-day exploits. Many zero-day attacks aren’t <em>specifically</em> aimed at a single high-value victim – instead, attackers may deploy them broadly, hoping to compromise as many devices as possible before the vulnerability is patched. In these cases, regular users can become collateral damage. For example, a zero-day embedded in a malicious website or email attachment doesn’t discriminate between a Fortune 500 company employee or a home user – anyone who visits that site or opens that booby-trapped file could be infected. This kind of tactic can ensnare <em>individual consumers</em>, leading to financial theft and privacy breaches, all from a hidden flaw that users had no way to know about or defend against at the time.&nbsp;</p><p>For <strong>small and medium-sized businesses (SMBs)</strong>, zero-days are equally perilous. SMBs often rely on off-the-shelf software and devices (operating systems, routers, content management systems, etc.) that can contain unknown vulnerabilities just like those used by larger enterprises. The difference is that smaller organizations typically have fewer IT resources and less sophisticated security measures in place. That makes them attractive targets for cybercriminals, who may use zero-day exploits as a foot in the door. An attacker might unleash a ransomware worm built on a zero-day that tears through any network it can reach – hitting not only big companies but also small businesses that lack advanced defenses. We’ve seen cases where <strong>non-targeted zero-day attacks</strong> (like self-spreading malware) ended up infecting thousands of computers globally, many of them personal PCs and small business servers that just happened to be vulnerable. Even targeted attacks can spill over; for instance, a zero-day used to attack a software supplier (as in the Kaseya example) can indirectly affect dozens or hundreds of client businesses down the supply chain. The bottom line is that zero-days erase the notion of “too small to be noticed.” If you use technology – whether at home or at work – an unpatched unknown flaw in that technology could be exploited without warning. The impact might be stolen data, locked-up systems, or devices conscripted into a botnet. For an individual, that could mean identity theft or drained bank accounts; for an SMB, it could mean costly downtime, loss of customer trust, or worse. In short, zero-day vulnerabilities are everyone’s problem, not just an issue for tech giants or governments.&nbsp;</p><h2>Best Practices to Stay Protected&nbsp;</h2><p>The idea of invisible software flaws might sound scary, but there are many practical steps you can take to <strong>reduce your risk</strong> from zero-day threats. Cybersecurity is about managing risk and limiting exposure, and even against unknown exploits, the following best practices make a big difference:&nbsp;</p><ul><li><strong>Keep your devices and software updated.</strong> When vendors release security patches (often in routine updates), install them promptly. Many zero-day attacks only succeed until a fix is available – once patched, the threat is neutralized. Enabling automatic updates on your operating system, applications, and phone ensures you get these critical patches as soon as they come down. Regular updates close the holes that attackers might otherwise use. As the WannaCry example showed, delaying patches can leave you vulnerable to an exploit that’s already been solved.&nbsp;</li><li><strong>Use reputable security software.</strong> A good security solution can sometimes detect suspicious behavior even from new, unknown threats. Modern security software doesn’t rely solely on known virus signatures; it also looks at what programs are doing (heuristics and behavior analysis). While it may not catch every zero-day, it adds an extra layer of defense that could stop or contain an attack. Make sure your security software stays up to date so it can recognize the latest threats. Additionally, consider using a firewall (many operating systems include one by default) to block unauthorized connections, which can help limit the damage if some malware does get in.&nbsp;</li><li><strong>Practice good cybersecurity hygiene.</strong> Many zero-day exploits still require some action to reach you – for instance, convincing you to open a file, click a link, or plug in an infected device. By staying vigilant with your online habits, you can avoid falling into those traps. This means: Don’t download attachments or software from untrusted or unknown sources. Be wary of unexpected emails or messages, especially those urging you to run macros or enable content in documents. Use strong, unique passwords (and a password manager) so that if one account is compromised it doesn’t unlock everything. And always enable 2 Factor Authentication (2FA) whenever is possible. Good habits act like a safety net, catching a lot of threats before they can ever execute, whether zero-day or not.&nbsp;</li><li><strong>Beware of phishing – think before you click.</strong> <a href="https://www.avast.com/c-phishing" target="_blank" rel="noreferrer noopener">Phishing</a> is one of the most common ways attackers deliver exploits. A convincing scam email might lure you to a malicious website that quietly uses a zero-day to infect your computer, or get you to install a “document” that is actually <a href="https://us.norton.com/blog/emerging-threats/malware" target="_blank" rel="noreferrer noopener">malware</a>. Always examine emails and texts critically: check the sender’s address, look for signs of hoaxes or urgency, and verify via other means if you get an odd request (like a supplier asking you to install an update or a “bank” emailing for login info). When in doubt, don’t click the link. This caution helps because even if a zero-day is involved, it often needs that initial hook to get to you.&nbsp;</li><li><strong>Enable strong security settings and isolate where possible.</strong> For businesses, network segmentation (keeping critical systems separate) and least-privilege access (limiting user rights) can contain the blast radius of a zero-day attack. For individuals at home, simply enabling built-in security features can help – for example, make sure your web browser’s security settings are on default or high, use an ad-blocker or script blocker if you’re tech-savvy (to reduce the chance of encountering malicious scripts), and turn off any software features you don’t need that could introduce risk. If you own IoT devices (smart cameras, etc.), keep their firmware updated and avoid exposing them directly to the internet. Essentially, remove unnecessary targets and entry points from your environment.&nbsp;</li><li><strong>Backup your data regularly.</strong> This won’t prevent an attack, but it can save you if the worst happens. If a zero-day powered <a href="https://www.avg.com/en/signal/what-is-ransomware" target="_blank" rel="noreferrer noopener">ransomware</a> or wiper malware strikes, having recent backups of your important files (and storing them offline or in a secure cloud service) means you can restore your system without paying ransom or losing everything. Test your backups occasionally to ensure they work. It’s a last-resort measure, but an essential part of resilience.&nbsp;</li></ul><p>By following these practices, individuals and SMBs can significantly strengthen their defenses. You’re essentially making yourself a harder target and mitigating the fallout if something does slip by. No single tip is foolproof, especially against a brand-new exploit, but together these steps build a layered security posture. Think of it like home security: you lock the doors, install an alarm, and stay alert for suspicious activity – those precautions still matter even if the burglar has a new kind of lockpick. The same principle applies in cybersecurity.&nbsp;</p><h2>Conclusion&nbsp;</h2><p>Zero-day vulnerabilities might sound like the stuff of thrillers – and indeed, <em>“Zero Day”</em> on Netflix dramatizes an extreme scenario – but the core threat is very real. In the real world, we won’t (hopefully) see an entire nation knocked offline in an instant, but we <strong>do</strong> see stealthy hacks, data breaches, and malware outbreaks powered by unknown flaws. The key lesson is that <strong>awareness and preparedness make a difference</strong>. You may not be able to prevent a determined attacker from discovering the next zero-day, but you can control how ready you are to respond. Keeping systems up to date, practicing smart online behavior, and maintaining good security basics will tilt the odds in your favor. For businesses, investing in proactive security monitoring and employee training can catch anomalies that hint at zero-day activity, buying valuable time to react. For individuals, staying informed (like knowing when there’s a critical update to install) and using the tools at your disposal will greatly reduce the chances of being caught off-guard.&nbsp;</p><p>In the end, zero-days remind us that no software is perfectly secure – there may always be a hidden crack. But by staying vigilant and proactive, we can shrink the window of opportunity for attackers. The fictional crisis in <em>“Zero Day”</em> makes for gripping entertainment; our job in reality is to ensure such disasters remain fiction. By applying the best practices and encouraging a culture of cybersecurity awareness, we can each do our part to protect ourselves and our businesses from the unseen threats lurking out there. <strong>Be aware, be prepared, and stay updated</strong> – that’s the real-world playbook to defend against zero-day vulnerabilities. Your future self (and your data) will thank you for it.&nbsp;</p>

Netflix’s 'Zero Day' may be fiction, but the threat is real — here’s what you need to know about zero-day vulnerabilities and how to protect yourself before a real-world cyber crisis strikes.

Zero-Day Vulnerabilities: The Real Threat Behind Netflix’s “Zero Day” 

Cyber Safety Chief Technology Officer

<p>Today, technology is deeply woven into our daily lives and is advancing at an extraordinary pace. All of the progress in tech, however, comes with an equal measure of risk. In 2024, large-scale data breaches dominated headlines, while AI pushed the boundaries of reality, reshaping how we work, create and interact with technology.&nbsp;</p><p>With all of this, 2025 is set to be a year of profound transformation in the cybersecurity landscape.</p><p>At Gen, we don’t wait to respond to change; we anticipate it. Our experts are looking ahead to the trends that will redefine the industry while harnessing AI for good to ensure safety and trust remain at the forefront. <strong>Here’s what we see on the horizon.</strong><br>&nbsp;</p><h2>AI Will Blur the Line Between Reality and Fiction</h2><p>Artificial intelligence isn’t just a powerful tool — it’s becoming a force that reshapes how we perceive the world. But, as it becomes better, smarter, more realistic and accessible, AI will increasingly blur truth and deception, making it more difficult than ever to decipher what’s real.</p><h3>Hyper-Personalized Realities</h3><p>AI-powered Large Language Models (think ChatGPT, Gemini, etc.) are advancing at an incredibly fast pace, offering hyper-personalized interactions that could alter perceptions and decision-making.&nbsp;</p><p>Imagine a world where AI doesn’t just answer your questions but anticipates your&nbsp;needs.</p><p>But here’s the trade-off: to unlock this seamless, personal assistant experience, people are handing over everything to AI, including calendars, messages and apps. Hyper-personalization comes with a cost: the erosion of privacy and autonomy. Are you willing to lose privacy for convenience?&nbsp;</p><p>This raises critical ethical questions: Who controls the narratives AI presents? How do we safeguard independent thought in a world increasingly influenced by machine intelligence?</p><p>We believe that AI-driven solutions should ensure transparency and accountability, giving individuals tools to navigate these hyper-realities without losing sight of two key things: truth and trust.</p><h3>AI in Sensitive Roles</h3><p>We suspect that AI will also infiltrate areas once considered uniquely human, such as parenting and education. Imagine an AI tool stepping in to mentor a child, help with homework, or even act as a digital babysitter. While it offers unlimited time and patience, it challenges the boundaries of what roles and responsibilities should be left to humans.</p><p>The implications are profound:</p><ul><li><strong>Redefining Relationships:</strong>&nbsp;AI is poised to transform the family, from parenting and pets to companionship, by taking over routine tasks like homework help and schedule management or even emotional connections. Bonding moments – like bedtime stories or daily conversations – slip away. With robotics bringing AI into the physical world, the stakes grow higher: robotic pets replacing real ones, AI nannies soothing children and robot companions filling emotional gaps.&nbsp;</li><li><strong>Shaping Young Minds:&nbsp;</strong>As AI becomes more engaging, children may form stronger bonds with machines than caregivers, shifting family dynamics. While AI offers personalized guidance and companionship, overdependence could limit kids’ social and emotional growth, making real relationships harder to navigate. Families must balance the benefits of AI with the need for genuine human connection.</li></ul><p>The broader societal question is this: how much influence will we allow AI to have in shaping the next generation?<br>&nbsp;</p><h2>The Deepfake Revolution</h2><p>Deepfakes — AI-generated media designed to mimic real people — are becoming so sophisticated that even experts may struggle to distinguish truth from fabrication. In 2025 we expect increases in:</p><ul><li><strong>Personal Attacks:&nbsp;</strong>Scorned individuals could use deepfakes to harass or extort others, not just by targeting the individual directly but by creating convincing fake media of family members or friends. These fabricated videos or audio clips could be used to manipulate victims emotionally, spread false rumors, or even strain personal relationships, amplifying the psychological toll of such attacks.</li><li><strong>Political Manipulation:</strong> Governments and bad actors may leverage deepfakes to divide, spread disinformation and destabilize societies. Imagine a fake speech from a world leader announcing false policies — such content could ignite panic, erode trust in institutions and manipulate public opinion. Deepfakes could also target journalists or political opponents, fabricating damaging scandals or discrediting reliable sources, undermining public confidence in the media. This highlights the need for a system where authenticity is non-negotiable -- where digital signatures could become the standard to restore trust.&nbsp;</li><li><strong>Financial Fraud:</strong> Deepfake videos or audio clips of executives could be used to impersonate authority figures, convince employees to transfer funds, reveal sensitive company information or approve unauthorized transactions. For instance, a Business Communication Compromise (BCC) can happen when a convincing video of a CEO instructing a financial officer to expedite a payment bypasses typical safeguards, due to its perceived authenticity and established trust. The threat doesn’t end with internal fraud; deepfakes could also target investors or clients, undermining trust in corporate communications and causing long-term reputational damage. These attacks could ripple through supply chains and financial systems, creating chaos on an unprecedented scale.&nbsp;</li></ul><h2>Data Theft: The Multi-Faceted Threat to Identity</h2><p>The digital world runs on data and cybercriminals are mastering the art of leveraging it as a multifaceted threat to target individuals, organizations and societies alike.</p><h3>Comprehensive Profiles for Targeted Scams</h3><p>Large-scale breaches and public data sources provide criminals with the raw materials to build highly detailed profiles of their victims. &nbsp;This goes beyond just a first and last name or email address – criminals piece together “who” their targets really are. They know where you work, what you do for a living, your hobbies and habits. With this intimate understanding and detailed information, they can:</p><ul><li>Craft hyper-personalized phishing attempts</li><li>Launch convincing extortion schemes</li><li>Impersonate trusted services to exploit victims’ trust</li></ul><p>For example, attackers using images of victims’ homes during sextortion attempts demonstrate how cybercriminals are evolving their psychological manipulation tactics.</p><h3>Forgotten Logins, Fresh Targets: How Old Accounts Open New Doors for Hackers</h3><p>The average individual has hundreds of online accounts. Besides the active ones, there’s also a plethora of aged accounts that are long gone, such as old email addresses from Hotmail or social accounts like MySpace. These accounts can be forgotten or abandoned. Combined with the low adoption of multi-factor authentication (MFA) and the widespread practice of password reuse, these neglected accounts become gateways for attackers. Cybercriminals can pivot from one breached account to another, collecting more personal information with each step and enabling even more precise and damaging attacks.</p><h2>Scams Enter the Era of Hyper-Personalization</h2><p>2025 marks the dawn of hyper-personalized scams. Cybercriminals no longer rely on broad attacks and wait for someone to take the bait. Instead, they use meticulously crafted profiles built from breached data, public records or dark web scraps to tailor their attacks. They’re not random. They’re designed to feel personal, disarming and hard to resist because they rely on your specific data – your own identity.&nbsp;</p><p>These scams won’t feel like scams. They’ll feel real. Here are some examples:</p><ul><li><strong>Tailored Manipulation</strong>: Imagine receiving a message referencing a conversation you had last week or mimicking a friend’s tone perfectly. Attackers will use personal details to craft scams so convincing they disarm even the most vigilant.</li><li><strong>Psychological Exploits</strong>: Cognitive biases like urgency, trust, and fear will be turned against us. Emotional triggers — like a fabricated crisis involving a loved one — will make hesitation feel impossible.</li><li><strong>Platform Integration</strong>: Social media and messaging apps will become prime battlegrounds, with scams that look indistinguishable from legitimate interactions.</li></ul><p>This is the reality of where scams are heading. The lines between genuine and fraudulent will blur, forcing us to rethink how we defend against threats. Technology together with awareness, education, and proactive resilience will be critical to protecting ourselves and our communities in this new era of deception.</p><h2>Financial Theft: The New Frontier of Exploitation</h2><p>The war on financial security is escalating, with attackers blurring the boundaries between digital fraud and physical coercion. 2025 will see financial theft reach unprecedented levels, fueled by innovation in both technology and tactics.</p><h3>A New Breed of Digital Fraud</h3><p>Cybercriminals are wielding sophisticated tools to undermine trust and exploit vulnerabilities:</p><ul><li><strong>Deepfake Scams</strong>: Picture a video of a trusted leader or celebrity endorsing a high-return investment. These convincing forgeries will draw in victims by the thousands, fueling a new wave of financial deception.</li><li><strong>Voice-Cloned Lies</strong>: Fraudsters will impersonate government officials, announcing fake income distributions or policy updates, driving victims to malicious platforms.</li><li><strong>Crypto Scams on Steroids</strong>: From fake giveaways to fabricated trading platforms, cryptocurrency will remain a prime target for attackers hungry for unregulated, high-reward opportunities.</li></ul><h3>Where Cybercrime Gets Personal&nbsp;</h3><p>Financial theft is no longer confined to just the digital world. Now, it feels more and more personal. Spyware and malware will silently monitor devices, giving attackers backdoor access to banking apps and bypassing traditional security measures.</p><p>This evolving threat challenges us to rethink financial security. It’s not just about protecting devices; it’s about protecting the people behind them. The only way forward is bold innovation, collective vigilance, and an unwavering commitment to staying ahead of those who prey on trust.</p><h2>Our Vision for the Future</h2><p>The challenges of 2025 demand bold action, innovative thinking and a commitment to protecting what matters most: trust. And while threats are undoubtedly getting more complex, the future is bright, and technology will play a pivotal role in making the world safer, smarter and more secure. At Gen, we’re not just observing these challenges; we’re staying ahead of them. With products like Norton Genie for scam detection, Norton 360 Deluxe and Avast One for all-in-one protection, and LifeLock to restore what’s lost, we’re safeguarding your digital world and Powering Digital Freedom.</p><p>While technology like AI holds the promise of a more secure and innovative future, uncertainty often stands in the way of progress. This is where we see opportunity: to educate, empower and lead. By helping others understand and embrace AI responsibly, we can ensure it becomes a force for good — strengthening our defenses while driving innovation.</p><p>Make no mistake — new technology breeds new risks. However, it also serves as a powerful catalyst for positive change, paving the way to a safer and brighter future.</p><p>With every new tool, every evolving threat, and every transformative idea, we’re shaping a future where innovation and security go hand in hand.</p>

Exploring Tomorrow’s Threats, Today’s Solutions: Predictions for the Cybersecurity Landscape in 2025

Predictions 2025: Navigating the Future of Cybersecurity

<p>As technology evolves, so does our digital landscape. Many of us have witnessed this transformation firsthand; we can still remember the sound of dial-up internet and are also part of today's "always-on" culture. Most of the world is constantly connected, even expecting instant responses via text, DM or Microsoft Teams. However, increased connectivity comes with its own challenges. Scams, once confined to traditional, more obvious methods, have adapted to leverage some of the latest technology for more sophisticated and clever schemes unlike ever before.&nbsp;</p><p>When it comes to election security, the first thought often centers around the risk of hacking voting systems or machines. Artificial intelligence (AI) technology makes it easier than ever to manipulate public opinion without needing to breach highly secure systems. As AI continues to advance, its potential to affect nearly every facet of our daily lives—including news, careers, trends, social media and elections—cannot be underestimated.</p><p><strong>A Global Outlook&nbsp;</strong>&nbsp;</p><p>2024 has deemed itself the ultimate election year with 64 countries plus the European Union all headed to the polls this year. That means there’s even more at stake for the vast majority of people who can and will participate in free and fair elections in their country.&nbsp;</p><p>We’ve already seen an&nbsp;<a href="https://www.ic3.gov/Media/News/2024/240709.pdf">FBI report</a> on state-sponsored media leveraging software to manipulate public opinion through social networks.&nbsp;</p>

<h2><strong>The Influence of AI </strong> &nbsp;</h2><p>AI seems to touch every aspect of our digital existence today and is spreading through personalized advertising algorithms and even for our personal content curation. (Admit, you can hardly scroll on LinkedIn without an ad or a tip on how to use AI.)  &nbsp;</p><p>One <a href="https://vm.tiktok.com/ZGeVGdeLc/">deepfake video</a> features a journalist alongside candidates from six different Spanish political parties. Although this video is intended for fun, as indicated by its hashtags, it highlights both the potential and believability of AI technology.&nbsp;&nbsp;</p>

<p>However, AI's impact extends beyond convenience and efficiency; it also poses significant risks. For instance, AI algorithms are already being utilized to manipulate elections by spreading misinformation and propaganda; be it through automated bots, curated images or deepfake videos. We see it on social media constantly. And the real problem is determining real versus fake. With such convincing technology, AI has the potential to erode public trust and undermine democratic processes. &nbsp;</p><h2><strong>Proactive Measures to Combat Misinformation</strong>&nbsp;</h2><p>As we approach another election year, the issue of <a href="https://www.gendigital.com/blog/news/innovation/ai-disinformation">AI misinformation</a>, particularly deepfakes, has become a pressing concern. Although the U.S. federal government has yet to take action against deepfakes, there are states that are taking measures into their own hands. One U.S. state, Colorado, has proactively implemented measures to combat the spread of these deceptive technologies. The state now mandates that campaign ads featuring audio, video, and other AI-generated content include prominent disclosures.&nbsp;</p><p>The law treats deepfakes — fake videos or images created by AI showing people doing or saying things they didn't actually do — as if the people were being forced to act against their will. It highlights the risk of candidates’ reputations being "irreparably tainted" by fabricated messages and requires "clear and conspicuous" disclosures when AI-generated content is used to portray candidates within 60 days of a primary election or 90 days of a general election.&nbsp;</p><p>The new law empowers individuals to file administrative complaints with the Secretary of State’s Office for election law violations and gives candidates the ability to sue over the dissemination of deepfakes. Colorado’s proactive stance sets a precedent for safeguarding the integrity of the electoral process and protecting voters from being misled by manipulated content, ensuring a fair and transparent election.&nbsp;</p><h2><strong>Elections Under Siege</strong> &nbsp;</h2><p>How would AI impact our elections? Well, consider this: elections have already faced cyberattacks in the past through digital channels. &nbsp;</p><p>Historical data, including analyses of past election years and telemetry from significant events, show the severity of the issue and emphasize the need for proactive measures to safeguard electoral integrity. &nbsp;</p><p>We don’t have to look too far to find evidence. Case in point: the Polish Parliamentary Elections of 2023. Just two days before the elections, Polish media outlets released a video depicting a police intervention at one of the three polling stations in Poland. The intervention was prompted by an anonymous bomb threat received before the scheduled voting day. However, accounts associated with the Russian FIMI infosphere quickly seized upon this video, reframing its context to suggest that explosions had already taken place at the polling station. The incident exemplifies a calculated effort to stoke fear surrounding the purported bomb threats directed at polling stations, potentially discouraging voter turnout. &nbsp;</p><p>Recently, an AI-generated version of Indian Prime Minister Narendra Modi was spread on WhatsApp.  &nbsp;</p><p>In the United Kingdom, the state of British healthcare and the National Health Service was a hot topic during the pre-election period. The urgency of this issue has been exploited by cybercriminals, leading to a 208% increase in URL-based election attacks in 2024 compared to 2023. These attackers have primarily targeted healthcare topics to deceive and manipulate voters.&nbsp;</p><p>Similarly, in Germany, we have observed an alarming increase in blocked attacks on URLs with politically controversial content. These attacks occurred in two significant waves: the first at the turn of the year and the second from April up to the election week. From the beginning of the pre-election period in December 2023 to the end of May 2024, the monthly number of blocked attacks surged by 233%. When comparing the entire pre-election period of the last six months to the same months of the previous year, there is an astounding year-on-year increase of nearly 5000% in blocked attacks. These attacks, originating from politically charged websites, include malicious malvertising, phishing, and push notifications designed to install malware or steal sensitive personal data.&nbsp;</p><p>The 2024 European elections have seen a dramatic rise in politically based cyberattacks on German users, with an increase of almost 5000%. Cybercriminals have employed various tactics, including fake ads, phishing, and dangerous push notifications, to exploit politically charged content. Keywords and names were frequently used as clickbait to lure victims. This significant surge in political-based attacks underscores the need for robust cybersecurity measures to protect the integrity of the electoral process and ensure a safe digital environment for voters.&nbsp;&nbsp;</p><p>Below are a few examples of elections that have faced some form of cyberattack: &nbsp;</p>

<h3><strong>Types of Election Scams</strong> &nbsp;</h3><p>A myriad of election scams exists, ranging from seemingly innocuous political donation solicitations to sophisticated phishing attempts targeting voter registration databases. AI-driven scams exacerbate the threat landscape, as malicious actors leverage advanced algorithms to create videos, text and even email scams designed to sway public opinion and manipulate electoral outcomes. But AI isn’t the only threat to elections.&nbsp;</p><p>Potential threats to elections: &nbsp;</p><ul><li>Tampering with registrations, votes &nbsp;</li><li>Committing voter registration fraud&nbsp;</li><li>Hacking candidate laptops, email, social accounts &nbsp;</li><li>Hacking of campaign websites &nbsp;</li><li>Leaking of confidential info &nbsp;</li><li>Hacking government servers, comms networks,  &nbsp;</li><li>Spreading misinformation on the election process, parties, candidates or results &nbsp;</li><li>Altering results &nbsp;</li><li>Hacking internal systems used by media or press  &nbsp;</li></ul><p>Here's what scams could look like to voters: &nbsp;</p><ul><li>Political donation scams &nbsp;</li><li>Fake survey or polls &nbsp;</li><li>Voter registration phishing  &nbsp;</li><li>Scam texts &nbsp;</li><li>Social media posts&nbsp;</li><li>Fake data leaks&nbsp;</li><li>Misinformation campaigns&nbsp;</li></ul><h3><strong>Spotting the Scams&nbsp;</strong>&nbsp;</h3><p>As scams become increasingly sophisticated, it is important to equip individuals with the necessary tools and knowledge to identify and mitigate any possible threat.  &nbsp;</p>

<h2><strong>Looking Towards the Future</strong> &nbsp;</h2><p>Emerging technologies, such as deepfakes, present both opportunities and risks. (Like all technology, it’s good when put in responsible hands.) Though these tools can be exploited maliciously, they also hold the potential for positive applications.    &nbsp;</p><p>Here, we delineate both the benefits and risks stemming from AI involvement in the electoral process. &nbsp;</p><p>Benefits of AI include: &nbsp;</p><ul><li>Enhanced security: AI presents an opportunity to reinforce cybersecurity measures. &nbsp;</li><li>Voter engagement: Leveraging AI-driven chatbots and virtual assistants can foster enhanced voter engagement by facilitating communication, ensuring broader accessibility. &nbsp;</li><li>Data analysis: AI algorithms offer the capability to sift through vast datasets, uncovering valuable insights into voter trends, preferences, and potential irregularities.  &nbsp;</li></ul><p> Technological risks associated with AI include: &nbsp;</p><ul><li>Security vulnerabilities: AI systems, datasets, and models are not immune to cyberattacks.  &nbsp;</li><li>Bias and Equity Concerns: AI systems have the potential to inherit biases from their training data, potentially leading to unfair or discriminatory outcomes in voter registration, candidate selection, or data analysis processes. &nbsp;</li><li>AI-driven cyberattacks: AI-powered data mining allows for targeted and sophisticated social engineering attacks, enabling threat actors to identify potential targets and vulnerabilities more effectively.  &nbsp;</li><li>Manipulation of AI-generated Content: Synthetic media, such as AI-generated images, videos, and text, can be weaponized to spread disinformation or manipulate public opinion.  &nbsp;</li></ul>

<p>AI has become so widespread and accessible, that it is certainly a power that must be kept in the rightful hands and with a watchful eye.   &nbsp;</p><h3><strong>Our Commitment</strong> &nbsp;</h3><p>Our commitment to the ethical use of technology and our mission of powering digital freedom has led us to sign <a href="https://www.aielectionsaccord.com/">the tech accord</a> "AI for Good." By aligning ourselves with this initiative, we emphasize our dedication to leveraging AI for positive impact and ethical practices. We recognize the transformative potential of AI in addressing societal challenges, including combating scams and safeguarding online communities.  &nbsp;</p><p>We’ve already started using AI for good, with products like Norton Genie – an AI-powered tool used to detect scams via text, email and social media. We’ll continue to learn and leverage the power and potential of AI responsibly to promote a safer and more inclusive digital environment for all.&nbsp;</p>

During a Worldwide Election Year, Understand and Navigate the Power and Possibilities of AI  

Seeing Isn’t Believing – Tackling AI, Misinformation and Its Impact on an Election Year 

<p><strong>The new frontier of cyberthreats: how nation-state groups are targeting consumers</strong> &nbsp;</p><p>In recent cybersecurity trends, we've observed a troubling shift: sophisticated attacks once aimed solely at governments and enterprises are now targeting everyday consumers. Nation-state groups, traditionally known for espionage and cyber warfare, are not just targeting governments and large enterprises anymore; they're also setting their sights on everyday consumers like you, increasingly using scams to infiltrate personal devices. &nbsp;</p><p> &nbsp;</p><p><strong>The rise of nation state scams on consumers</strong> &nbsp;</p><p>Typically, we think of nation-state attacks as sophisticated, covert operations aimed at siphoning secrets from rival governments or multinational corporations. However, these powerful adversaries have begun exploiting the same advanced tactics to deploy scams against ordinary people. The distinction between advanced persistent threats (APTs) and consumer-targeting scams is blurring. These threats now coexist, leveraging sophisticated techniques to breach consumer defenses. &nbsp;</p><p> &nbsp;</p><p><strong>Advanced threats in your inbox</strong> &nbsp;</p><p>Imagine receiving an email that looks like a job offer from a reputable company. It's actually a sophisticated scam, utilizing methods that were once the hallmark of attacks against governments. These scams can bypass standard antivirus software, tricking you into compromising your personal security without even realizing it. And this is already happening.  &nbsp;</p><p>The Lazarus Group, also known as Hidden Cobra, is a notorious cybercriminal organization believed to be backed by North Korea. It has been active since at least 2009 and is known for its highly sophisticated and destructive cyberattacks, primarily aimed at espionage, sabotage, and financial gain. The group has been linked to a variety of high-profile incidents globally, indicating the scale and global reach of its operations. &nbsp;</p><p>We recently uncovered (<a href="https://decoded.avast.io/luiginocamastra/from-byovd-to-a-0-day-unveiling-advanced-exploits-in-cyber-recruiting-scams/">read here our detailed technical analysis of the attack</a>) an attack carried out by Lazarus targeting specific individuals. The victims are unlike previous attacks from this group, such as the Sony Pictures Hack in 2014 or the Bangladesh Bank heist in 2016. &nbsp;</p>

<p><strong>Tomorrow's threats, today's concerns</strong> &nbsp;</p><p>It's a sobering thought: the elite cyber threats of today are the consumer scams of tomorrow. Techniques developed for espionage are trickling down to the consumer level, bringing with them risks that were once thought to be faced only by the most secure facilities in the world. &nbsp;</p><p>The cybersecurity landscape is continually evolving. What was once an isolated incident of advanced malware in a corporate system can now turn into widespread consumer scams. These threats evolve, learning from each interaction, which makes them increasingly difficult to detect and defend against. &nbsp;</p><p> &nbsp;</p><p><strong>Conclusion</strong> &nbsp;</p><p>Understanding this shift in target from the high towers of government to the personal devices in our pockets is crucial. As consumers, staying informed about the latest threats and adopting robust cybersecurity measures are our best defense. Remember, in the digital age, anyone can be a target. Invest in comprehensive security solutions that keep pace with these evolving threats. Regularly update your software, be skeptical of unsolicited communications, and consider consulting with cybersecurity experts to ensure your digital life is secure. &nbsp;</p>

The Evolution of Cyberthreats From Global Espionage to Personal Intrusion

The new frontier of cyberthreats: how nation-state groups are targeting consumers  

<p>"Scamverse." This concept, much like the multifaceted realms of the "Spiderverse" in the world of comic books, represents the complex and interconnected web of scams that dominate today's digital threats. As a cybersecurity expert with 25 years of experience, I have witnessed the evolution of these threats, from the early days of viruses and Trojans to the sophisticated scam-centric dangers we face today.&nbsp;</p><h2><strong>The Evolution of Cyberthreats</strong>&nbsp;</h2><p>Historically, the digital world was plagued primarily by viruses and Trojans. These were malicious programs designed to disrupt, damage, or gain unauthorized access to computer systems. With the popularization of the internet, a new breed of threats emerged, notably worms. These self-replicating programs could spread across networks without human intervention, marking a significant shift in the nature of cyberthreats.&nbsp;</p><p>However, as technology advanced and the internet became increasingly integral to daily life, cybercriminals adapted and evolved. The emergence of phishing scams, botnets, and ransomware signaled a shift from mere disruption to focused, profit-driven criminal activity. Phishing scams, in particular, demonstrated the opportunity to deceive or trick individuals into divulging sensitive information. We call it social engineering.&nbsp;</p><h2><strong>The Rise of the Scamverse</strong>&nbsp;</h2><p>The term "Scamverse" describes the current era, where the majority of cyberthreats involve some form of scam. This doesn't imply that all threats originate as scams, but it highlights the reality that most people are more likely to encounter a scam than any other type of cyberthreat. Scams in the digital age are diverse and sophisticated, ranging from email phishing and fake websites to social media scams and fraudulent online marketplaces.&nbsp;</p><p>In this scam-centric landscape, the primary weapon of cybercriminals is deception. Unlike traditional malware, which relies on exploiting technical vulnerabilities, scams exploit human vulnerabilities — trust, ignorance and fear. This makes them particularly insidious and difficult to combat, as they hinge on manipulating human psychology rather than breaching digital defenses.&nbsp;</p><h3><strong>Characteristics of the Scamverse</strong>&nbsp;</h3><ol><li><strong>Social Engineering:</strong> The cornerstone of most scams is social engineering, the art of manipulating people into performing actions or divulging confidential information. Phishing emails, for instance, often masquerade as legitimate communications from trusted entities to trick individuals into clicking on malicious links or sharing sensitive data.&nbsp;</li><li><strong>Financial Motivation:</strong> The primary objective of scams is financial gain. Whether through ransomware demands, the theft of financial information or fraudulent transactions, the end goal is invariably monetary.&nbsp;</li><li><strong>Targeted Attacks:</strong> Scams are increasingly personalized and targeted. Cybercriminals often gather information about their victims to craft more convincing and effective scams, increasing the likelihood of success.&nbsp;</li><li><strong>Exploitation of Current Events:</strong> Scammers are adept at exploiting current events, such as global pandemics or political upheavals, to create timely and relevant scam campaigns that prey on people's fears and uncertainties.&nbsp;</li></ol><h3><strong>Navigating the Scamverse</strong>&nbsp;</h3><p>Staying protected in the Scamverse requires vigilance and education. Traditional cybersecurity measures like antivirus software and firewalls remain essential, but they must be supplemented with awareness and skepticism. People should educate themselves about common scam tactics and question the legitimacy of unsolicited communications. Organizations should invest in regular training to keep employees informed about the latest scam techniques.&nbsp;</p><p>Additionally, solutions like email filtering, web reputation services and behavioral analytics can help identify and block scam-related activities. Collaborative efforts between cybersecurity firms, law enforcement and regulatory bodies are also crucial in dismantling large-scale scam operations.&nbsp;</p><h2><strong>The Dual Role of AI in the Scamverse</strong>&nbsp;</h2><p>Artificial Intelligence (AI) plays a paradoxical role in the Scamverse, acting as both a facilitator for cybercriminals and a powerful tool in the cybersecurity arsenal. This dual nature of AI in the realm of cyber threats underscores the ongoing arms race between attackers and defenders.&nbsp;</p><h3><strong>AI as a Tool for Cybercriminals</strong>&nbsp;</h3><p lang="EN-US">AI, as a tool for cybercriminals, significantly enhances the sophistication, reach, and effectiveness of scams. By leveraging natural language processing and machine learning, AI can craft highly convincing phishing emails and even use deepfake techniques in video and audio, making these scams increasingly challenging to distinguish from legitimate communications. Furthermore, AI facilitates automated social engineering, enabling bots to conduct personalized and persuasive interactions with potential victims on social media or via email. Additionally, AI algorithms are adept at harvesting and analyzing vast amounts of data to identify potential targets, tailoring scams to individuals' online behavior and striking at the most opportune moments, thereby increasing the success rate of these malicious attacks.&nbsp;</p><ol><li>As a tool for cybercriminals, AI significantly enhances the sophistication, reach and effectiveness of scams. By leveraging natural language processing and machine learning, AI can craft highly convincing phishing emails and even use deepfake techniques in video and audio, making these scams increasingly challenging to distinguish from legitimate communications. Furthermore, AI facilitates automated social engineering, enabling bots to conduct personalized and persuasive interactions with potential victims on social media or via email. Additionally, AI algorithms are adept at harvesting and analyzing vast amounts of data to identify potential targets, tailoring scams to individuals' online behavior and striking at the most opportune moments, thereby increasing the success rate of these malicious attacks.&nbsp;</li></ol><h3><strong>AI as a Defense Mechanism</strong>&nbsp;</h3><p>Conversely, AI is a formidable tool in combating the Scamverse, offering several advantages in detecting and preventing scams.&nbsp;</p><ol><li><strong>Continuous Adaptation:</strong> Perhaps the most significant advantage of AI in cybersecurity is its ability to continuously learn and adapt. For example, with <a href="https://us.norton.com/products/genie-scam-detector">Norton Genie</a>, as new types of scams emerge, the AI can be trained with the latest data points to recognize them. It analyzes messages, websites, social media posts and more, alerting you if it’s a potential scam and then giving you advice on the best next steps. &nbsp;</li><li><p lang="EN-US"><strong>Anomaly Detection:</strong> AI systems can analyze patterns in data to identify anomalies that may indicate scam activities. These systems can detect unusual patterns in network traffic, email communications or online transactions that human analysts might miss.&nbsp;</p></li><li><strong>Phishing Detection:</strong> AI can be trained to recognize the subtle signs of phishing attempts, such as slight deviations in email formatting, sender information or the language used. This can help in filtering out phishing emails before they reach the intended recipient.&nbsp;</li><li><strong>Behavioral Analysis:</strong> AI can monitor user behavior to detect signs of compromise or scam interactions. For example, sudden changes in the way a user interacts with a system or unusual financial transactions can trigger alerts.&nbsp;</li></ol><h2><strong>The Future Intersection of AI and Scamverse</strong>&nbsp;</h2><p>Looking forward, the intersection of AI and the Scamverse is poised to become increasingly complex. As AI technologies become more advanced, we can expect both the sophistication of scams and the effectiveness of our defenses to escalate. This dynamic landscape will require constant vigilance, innovation and collaboration, among cybersecurity professionals, technology developers and policymakers.&nbsp;</p><p><a href="https://www.gendigital.com/blog/news/innovation/ai-based-cyberthreats">AI's role</a> in the Scamverse is a double-edged sword. While it empowers cybercriminals with advanced tools to execute scams, it also equips cybersecurity experts with potent mechanisms to thwart these threats. The future of cybersecurity in the Scamverse will undoubtedly be shaped by the ongoing development and deployment of AI technologies, emphasizing the need for cutting-edge research and ethical AI practices in the field.&nbsp;</p><p><strong>Conclusion</strong>&nbsp;</p><p>The Scamverse represents the current and perhaps most challenging era in the evolution of cyberthreats. Its reliance on social engineering makes it uniquely dangerous, as it exploits human nature itself. Navigating this landscape requires a combination of technological solutions, education, and a healthy dose of skepticism. As we continue to adapt to these challenges, one thing is clear: the battle against the Scamverse will be as much about changing human behavior as it is about advancing technological defenses.&nbsp;</p>

In the ever-evolving landscape of cyberthreats, a new term has emerged to encapsulate the current era's predominant danger: "Scamverse."

The Scamverse: Navigating the New Frontiers of Cyberthreats

Global Privacy Compliance Program Manager

<h2><strong>What is Data Privacy Week?</strong> &nbsp;</h2><p>Data Protection Day originated in Europe to commemorate the first legally binding international treaty dealing with privacy and data protection. Now, the celebration has expanded to an entire week and is recognized worldwide. The mission of <a href="https://staysafeonline.org/programs/data-privacy-week/">Data Privacy Week</a>, observed January 21-27 this year, is to <em>inspire dialogue and empower individuals and companies to respect privacy, safeguard data and enable trust</em>.&nbsp;&nbsp;</p><p>Data Privacy Week, which encourages people everywhere to take control of their digital footprints, is run by the <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fstaysafeonline.org%2Fprograms%2Fdata-privacy-week%2F&amp;data=05%7C02%7CAlisha.Robinson%40gendigital.com%7C6a003a179aef40725ccf08dc16b91ab6%7C94986b1d466f4fc0ab4b5c725603deab%7C0%7C0%7C638410231503836756%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp;sdata=E3%2BMt372PJpwhWRw5v6FwZ1nCsxBCaH2fv6H1u0BOu4%3D&amp;reserved=0%22%20\o%20%22Original%20URL:%20https://staysafeonline.org/programs/data-privacy-week/%20%20Click%20to%20follow%20link.%22%20\t%20%22_blank">National Cybersecurity Alliance</a> (NCA). NCA advocates for the safe use of technology and helps governments and corporations work together to foster digital good.&nbsp;</p><p>Everything you do online generates data. Every time you shop, click, scroll, like, message, play and more, you are generating data. This personal information has tremendous value to businesses. The landscape of privacy and data protection laws and regulations continues to grow more complex. Companies with global operations that wish to advance the privacy rights of individuals and enable innovative products and services must comply with these laws and deliver meaningful data security to their customers; this can be challenging for many companies and difficult for people when trying to figure out if the apps and companies that hold their data are keeping it safe.  &nbsp;</p>

<h2><strong>How We Help People Protect Their Digital Lives</strong> &nbsp;</h2><p>For Gen, empowering people to take control of their digital lives is in our DNA. Security, transparency, and accountability are built into everything we do, and products like <a href="https://us.norton.com/products/norton-secure-vpn%22%20/t%20%22_blank">Norton Secure VPN</a> protect a person’s online privacy by hiding the computer’s address from websites visited from any device. Norton, a part of Gen, also offers <a href="https://us.norton.com/products/norton-360-deluxe%22%20/t%20%22_blank">Norton 360 Deluxe</a>, which can prevent activity or location tracking, as well as information theft, installation of malicious programs and uninvited changes to devices. We recently <a href="https://www.gendigital.com/blog/impact/community/product-donations-domestic-violence">launched a product donation pilot program</a>, donating up to 5,000 of these free product licenses to survivors of domestic violence to help them recover from financial or technological abuse. These products are also donated or discounted to nonprofits through our partnership with <a href="https://www.techsoup.org/search/products/norton/%22%20/t%20%22_blank">TechSoup</a>. &nbsp;</p><p>In addition to product donations, we work regularly with nonprofits like <a href="https://www.gendigital.com/blog/impact/community/my-digital-life%22%20/t%20%22_blank">Discovery Education</a> and the <a href="https://www.gendigital.com/blog/impact/community/the-smart-talk-2023%22%20/t%20%22_blank">National PTA</a> to help children and families learn about keeping their information private.  &nbsp;</p><h2><strong>Five Ways We Help Keep Customer Data Safe</strong>&nbsp;</h2><p>We focus on five essential elements to help keep customer data safe. Check for these key practices: &nbsp;</p><ol><li><strong>Accountability.</strong> At Gen, we hold ourselves accountable by defining our principles, conducting internal and external audits, empowering employees at all levels of the company to proactively consider privacy and data protection, engaging in continuous improvement processes, and constantly scanning for new risks and opportunities. For more details on Gen’s Privacy Operating Model, see page 34 of our <a href="https://s201.q4cdn.com/771113172/files/doc_downloads/2023/07/gen-2023-social-impact-report.pdf">2023 ESG Report</a>. &nbsp;</li><li><strong>Security.</strong> We secure personal data using appropriate technical and organizational measures to protect integrity, confidentiality, and availability. Our security monitoring alerts us to suspicious activity, and we have a robust incident response program. &nbsp;</li><li><strong>Essential rights. </strong>We take a principles-based approach, going beyond regional data protection laws to provide essential rights to our customers, such as access and deletion, regardless of whether there is a law requiring it. &nbsp;</li><li><strong>Transparency.</strong> Privacy policies are often difficult to read and understand. We work to make our policies as clear and detailed as possible. We provide additional support articles and easy access to contact information to make it easy for customers to exercise their privacy rights and get their questions answered. &nbsp;</li><li><strong>Customer-First Privacy by Design. </strong>In everything we do, we strive to anticipate, identify, and prevent invasive events before they happen. Privacy measures should not be add-ons, but fully integrated components of the system. We only collect personal data for specified, clear and legitimate purposes. And, we only collect as much personal data as we need to achieve those purposes.&nbsp;&nbsp;</li></ol><p>This Data Privacy Week, we encourage you to do a quick review of the companies and apps that have your information. Do they have systems and policies in place to keep your data secure? Will they let you delete your data? Are they explaining what personal data is collected and why? Do they respect your rights to control how your data is used? Remember, it’s your data and it has value. Be selective about who you choose to do business with and thoughtful about what information you are providing. And, no matter where you are in your data security journey, we hope Data Privacy Week serves as an important reminder to exercise your rights to safety and privacy.  </p>

This Data Privacy Week, learn what to expect from businesses that have your personal information

Helping to Keep Personal Data Safe

Chief Technology Officer

<p>As we stand on the brink of 2024, the nature of cyber threats is undergoing a profound transformation: We are now expecting the threat landscape to be filled with frequent, highly individualized attacks in 2024. The advancement of artificial intelligence (AI) will notably enable the development of sophisticated tools. Criminals will use these tools for targeted messaging in victims' languages, enhancing manipulation.</p><p>Next year, we anticipate ransomware and scams that are designed to manipulate individuals emotionally. As we navigate this changing landscape, our predictions for the next year offer insights into the challenges ahead, as well as the measures we can adopt to fortify our digital defenses.</p>

<h2>Future advancements in AI and related risks</h2><p>The coming year will be a pivotal moment in the evolution of artificial intelligence, marking a period of significant transformation and emerging challenges. This era features rapid AI advancements, changing how these tools integrate into our lives. As AI becomes more embedded in our daily routines, its impact extends beyond mere technological innovation, influencing societal norms, privacy considerations and ethical boundaries.</p><h3>AI will undergo multiple evolutions</h3><p>We suspect a significant evolution in AI, especially in Large Language Models (LLMs) in 2024. Historically, LLMs have been cloud-based, relying on extensive server resources to produce text resembling human writing. The upcoming year, however, marks a pivotal shift towards more compact LLMs that function directly on user devices. This change transcends a simple relocation; it signifies a profound transformation in the integration of AI into our everyday activities and workflows.</p><p>Several key factors drive the move towards device-based LLMs. Firstly, privacy demands are rising and data stored on devices are more private than data stored in the cloud. Local data processing on devices also enhances security, reducing cloud storage risks. Secondly, this shift promises enhanced speed and efficiency. Local processing eliminates latency issues often encountered with cloud-based solutions, leading to a more seamless and responsive user experience.</p><p>Additionally, 2024 will be significant for generative AI, particularly in multi-type conversions. The evolving LLMs are not just limited to text generation; they are branching into more dynamic forms of media conversion.</p><p>The text-to-video feature, allowing synthesized video from text, is a notable advancement. This capability will open up new vistas for content creators, educators and marketers, offering a tool to rapidly produce visually engaging material that resonates with their audience. However, it will also be misused for the creation and spread of scams and disinformation, as it will be progressively harder to recognize a truly recorded video from an AI-generated one.</p><p>The development of text-to-voice AI is equally transformative. This technology goes beyond traditional text-to-speech systems, offering more nuanced and human-like voice generation. It holds immense potential, from creating more interactive and personalized customer service experiences to aiding those with visual impairments or reading difficulties.</p><p>Evolving AI technologies raise questions about ethics, regulation and balancing innovation with user welfare. For businesses and individuals alike, the upcoming year promises to be a journey of discovery and adaptation, as these lightweight, multi-faceted generative AI solutions redefine our interaction with technology and information in profound ways.</p><h3>New tools bring new security challenges as generative AI is broadly adopted</h3><p>The increasing popularity of generative AI in business will bring new risks and challenges. One significant concern is the phenomenon of "Bring Your Own AI" (BYOAI), where employees use personal AI tools in the workplace, which we predict will become exponentially more popular.</p><p>This practice poses a considerable risk of unintentional leakage of sensitive company secrets. Employees using personal AI for work may accidentally expose confidential data to third parties. On the flip side, corporate AI solutions will offer an increasing number of privacy-preserving features, which are frequently not available at the personal level.</p><h3>Social media will become a major attack vector for AI-related scams and disinformation</h3><p>We predict that the vast troves of personal information collected by social media companies over the past decade and a half will be utilized to target AI-generated ads and scams in the form of videos and static posts. Cybercriminals will use these platforms' reach to spread sophisticated scams and disinformation. Leveraging AI, they will be able to create and distribute highly customized and convincing content that blends seamlessly into users' feeds, targeting individuals based on their online behaviors, preferences and social networks.</p><p>Scams may appear as fake news, deceptive ads, deepfakes or misleading direct messages. Social media's interactivity will facilitate quick and broad spread. This will make cybercrimes more efficient and challenging for users and platforms to counter.</p><h3>Business Email Compromise (BEC) attacks will utilize AI to create more sophisticated Business Communication Compromise (BCC) attacks</h3><p>In 2024, we will witness a significant evolution in&nbsp;Business Communication Compromise (BCC) attacks (formerly referred to as Business Email Compromise or BEC attacks), as cybercriminals increasingly adopt AI and deepfake technologies to execute more sophisticated and convincing scams.</p><p>Cybercriminals will create deepfakes mimicking executives or partners. This will challenge employees in distinguishing legitimate from fraudulent requests, particularly when quick decisions are needed.</p><p>These enhanced BEC/BCC attacks will lead to financial losses and erode trust within organizations. Companies could encounter reduced effectiveness in communication and internal mistrust, as employees grow increasingly wary and doubtful of digital interactions.</p><p>A two-factor authentication-like solution is expected in response to these threats. These changes will mandate the verification of requests through a separate, independent channel, like a person-to-person interaction or secured phone call.</p><h3>The dark side of ChatGPT's fame: Malware on the rise</h3><p>The increasing popularity of AI tools like ChatGPT has attracted the attention of cybercriminals. We expect increased attempts by attackers to exploit AI solution-seekers. This includes deceptive “GPT” apps or plugins used for data theft or malware distribution. Users might think these malicious tools are legitimate AI solutions, downloading them only to compromise their systems and data.&nbsp;</p><p>We also anticipate attempts by malicious entities to "hack" LLMs with the aim of accessing valuable information, such as training data, model configurations, internal algorithms or other sensitive internal details. Furthermore, the threat actors might backdoor public LLMs, potentially stealing user inputs, IP and PII details.</p><p>Finally, we foresee the development of new malicious LLMs like "<a href="https://decoded.avast.io/threatintel/insights-into-the-ai-based-cyber-threat-landscape/">WormGPT</a>." In contrast to commercial models—which include built-in safeguards—these malicious models are designed to support the generation of malicious content.</p>

<h2>Digital blackmail will evolve and become more targeted</h2><p>Digital blackmail is rapidly evolving and becoming more targeted. <a>This change is not limited to ransomware attacks, it encompasses a variety of tactics aimed at high-value targets.&nbsp;</a>Notably, sophisticated data exfiltration shows the shifting nature and severity of these threats. As we move forward, this trend signifies a move towards more intricate and damaging forms of digital extortion.</p><h3>Ransomware will become more complex and damaging</h3><p>Cybercriminals mainly use encrypted or stolen data to demand ransoms or sell it, but we foresee a rise in more harmful data abuse tactics. This may involve data brokers exploiting information for identity theft, targeting both employees and customers, or to steal a company’s assets. This shift points to a more complex and harmful ransomware impact on businesses.</p><h3>Evolving attack methods: exploiting VPN and cloud infrastructure</h3><p>Expect evolving ransomware delivery methods, including more sophisticated VPN infrastructure exploitation. This tactic presents a formidable challenge for organizations relying on VPNs for remote work and secure communications.&nbsp;</p><p>Recent security incidents are troubling for companies that believe being in a cloud resolves all security concerns. Many of them recently <a href="https://www.schneier.com/blog/archives/2023/08/microsoft-signing-key-stolen-by-chinese.html">learned a hard lesson</a> that attacks such as <a href="https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/">cloud authentication token theft are</a> real and impactful. We should expect a significant increase in cloud infrastructure attacks, leading to more extortion.</p><h3>Diversification of extortion methods beyond encryption</h3><p>In addition to the above threats, we predict a rise in extortion emails like sextortion and business threats. These emails, typically disseminated through botnets, use intense scare tactics but are often repetitive. In 2024, expect a surge in creative email extortion. This could include the generation of falsified images or the introduction of new subjects for extortion, further complicating the cybersecurity landscape.</p>

<h2>Threat delivery will become more sophisticated on mobile</h2><p>Mobile cyberthreats are rapidly evolving in sophistication. We anticipate an increase in unethical practices such as instant loan apps resulting in data theft and extortion, the rise of trojanized chat apps filled with spyware and crypto wallet thieves, and a shift in malware distribution methods, favoring web-based threats through social media, messaging, or email, rather than attacks through apps.</p><h3>Instant loans as a lure into blackmail and extortion</h3><p>There is a growing concern about the rise in malicious practices within the instant loan app industry as the financial industry continues to advance. With the rise of these apps, some lenders use unethical tactics for repayments. More instant loan apps are stealing data from delinquent borrowers and rogue apps misuse user data to pressure repayments and add high late fees. This practice is increasingly common and is expected to intensify in 2024.&nbsp;</p><h3>Trojanized chat apps with spyware and stealing modules</h3><p>There could be a rise in fake chat apps with hidden crypto-stealing features or spyware. These fraudulent apps may abuse the trust users have in communication platforms, penetrating devices to extract confidential information or cryptocurrency keys. These attacks could include advanced social engineering methods, persuading users to give extensive permissions under the pretense of adding chat features that are not present in standard chat clients.</p><h3>Shifts in the delivery techniques of mobile threats</h3><p>Distributing web-based threats like phishing is much easier than it would be on native applications (and often with a higher return on investment). This is a key reason for the steep rise in such attack types on mobile devices, where they account for more than <a href="https://decoded.avast.io/threatresearch/avast-q3-2023-threat-report/">80% of all attacks</a>. We predict that this trend will persist, with more malicious actors using web-delivery attack methods rather than using native mobile applications.</p>

<h2>Rising threats in the cryptocurrency sphere</h2><p>The evolving cryptocurrency landscape introduces significant cybersecurity risks. The decentralized nature of these platforms offers anonymity but lacks the traditional safeguards of financial institutions. This absence of oversight and the inability to reverse transactions or monitor for fraudulent activities amplify the risks associated with these digital assets.&nbsp;</p><h3>An increased focus on crypto wallets by cybercriminals</h3><p>Cybercriminals are quickly adapting to the growing interest in cryptocurrencies. We're observing a marked increase in attacks targeting crypto wallets. Attackers are increasingly targeting crypto wallets with refined and sophisticated methods. This trend is likely to intensify, posing a significant threat to individual and institutional investors in the cryptocurrency space.</p><h3>Malware as a service will continue to evolve</h3><p>Services like <a href="https://decoded.avast.io/threatresearch/avast-q3-2023-threat-report/">Lumma</a>&nbsp;— a Malware-as-a-Service (MaaS) product targeting cryptocurrency wallets — are evolving with new features and better anti-detection capabilities. These MaaS companies act similarly to corporations, with malware advancements funded by profits from their malicious activities.</p><p>A new technique is the renewal of stolen cookies. This method enables attackers to retain access to hacked online accounts, even when passwords are updated. The consequences for online account security are significant; and we anticipate this will profoundly affect the coming year, requiring innovative strategies in digital security and account management.</p><h3>Vulnerabilities in crypto exchanges and cross-currency transactions</h3><p>Crypto exchanges are facing more attacks, leading to significant financial losses. A unique risk lies in the vulnerability of protocols allowing currency exchange. These exchange protocols can be manipulated to issue funds or alter balances, challenging users and experts. Given the potential for significant financial damage and the complex nature of these attacks, there is an urgent need for stronger security measures and greater vigilance in the cryptocurrency exchange sector.</p><p>Using accessible formal verification systems and SAT solvers, attackers analyze crypto system source codes for vulnerabilities and exploit them to steal cryptocurrency. As a result, we anticipate more high-volume frauds next year.</p><h2>Conclusion</h2><p>The cybersecurity predictions for 2024 underscore a landscape in flux, dominated by the dual forces of AI's promise and peril. While AI tools can be leveraged for protection, their misuse by cybercriminals presents a significant challenge.&nbsp;</p><p>As we look to the future, it’s clear that a proactive and educated stance on cybersecurity is not just advisable — it is imperative. Our strategies must evolve in tandem with the threats we face, ensuring that we remain one step ahead in the ever-escalating cyber arms race.</p>

Navigating the evolving threat landscape

Cybersecurity predictions for 2024 

Threat Research Team

<p>Large language models (LLMs) and generative AI are significantly increasing their abilities and global utilization. While these tools offer undeniable utility to the general public, they also present potential risks of misuse. Furthermore, bad actors are also actively investigating tools like OpenAI's ChatGPT.&nbsp;</p><p>This document describes the following aspects of an AI-based cyber threat landscape:&nbsp;</p><ul><li>How ChatGPT brand is misused for lures, scams, or other social engineering-related threats&nbsp;</li><li>How generative AI can be used to generate malware&nbsp;</li><li>The potential pitfalls and changes it brings for security researchers and attackers&nbsp;</li><li>How ChatGPT and generative AI can help security researchers in their daily struggles, providing insights, and bringing AI-based assistants to their toolset&nbsp;</li></ul><p>Generative AI and other forms of AI are going to play a key role in the cyber threat landscape. We expect that highly believable and multilingual texts misused for phishing and scams will be leveraged at scale, providing better opportunities for more advanced social engineering.&nbsp;</p><p>On the other hand, we believe that generative AI as it stands now is unlikely to drastically alter the landscape of malware generation. Although many proofs of the concept exist—mainly from security firms and nefarious actors testing the technology—it's still a complex approach, especially when compared to existing, simpler methods.&nbsp;</p><p>Despite the risks, it is important to recognize the value that generative AI brings to the table when used for legitimate purposes. We already see security and AI-based assistant tools with various levels of maturity and specialization emerging on the market.&nbsp;&nbsp;</p><p>Given the rapid development of these tools and the widespread availability of open-source versions, we can reasonably anticipate a substantial improvement in their capabilities in the near future.&nbsp;</p>

<h3><a href="https://cmsb.nortonlifelock.com/sites/default/files/2023-09/LLM%20malware%20090523.pdf">Read the full whitepaper here.</a></h3>

With the rapid development of AI and the widespread availability of open-source versions, we can anticipate improvements in their capabilities.

Insights Into the AI-Based Cyberthreat Landscape 

<p>Join us at the end of October for a conference about new advances in machine learning. You will see how AI can help protect people against the bad guys on the Internet – a goal we trully believe in. We have teamed up with Czech Technical University to bring together the best minds in tech and academia. Experts from many universities world wide as well as a few of our own will share their vision for what the future holds and debate the possibilities of tomorrow’s digital landscape.</p><h2><strong>Speakers’s spotlight:</strong></h2><ul><li>Doug Tygar – UC Berkeley</li><li>Alex Halderman – University of Michigan</li><li>Matthias Grossglauser – EPFL Switzerland</li><li>Rachel Greenstadt – New York University</li><li>Christopher Kiekintveld – University of Texas</li></ul><p>You’ll have a chance to meet our new CTO Michal Pechoucek. He is a seasoned security specialist and a father of AI at CTU. Michal will give the opening talk.</p><h2><strong>Call for posters</strong></h2><p>If you’re a PhD student there is also a poster session where you’ve be able to present your research and achievements. The deadline is August 18th 2019.</p><h2><strong>More Info</strong></h2><ul><li>When: October 25th 2019</li><li>Where: Prague, Czech Republic</li><li>Details: <a href="https://www.cybersecprague.ai/">https://www.cybersecprague.ai/</a></li></ul>

Have you ever wondered how AI is used in cybersecurity?

CyberSec & AI Prague 2019

<p>Cryptojacking stole the limelight away from&nbsp;<a href="https://www.avast.com/c-ransomware">ransomware</a>&nbsp;at the end of 2017, becoming a major cyberthreat that continued into 2018. On March 8, 2019 Coinhive, the service that enables websites around the world to use browser CPUs to mine Monero, will shut down. Will Coinhive’s end also end browser-based cryptomining and jacking?</p><h2><strong>The rise of web-based cryptomining</strong></h2><p>Crypto coins are generated by solving a complex mathematical problem that meets certain criteria. The result confirms a set of transactions. If such a result is found, the first one to publish it receives a reward and the transaction fees from the given set. Various crypto coins use different algorithms, but most of them have been implemented in miner applications for CPU and GPU. JavaScript is a programming language used to implement the miner application and — as it’s supported by most browsers, meaning no special software is required to mine— makes it an attractive mining option. Most JavaScript miners mine Monero (XMR), because the mining algorithm is suitable for computations on a CPU, whereas mining Bitcoin (BTC), for example, on a CPU wouldn’t make much sense due to the algorithm and mining difficulty.</p><p>Mining cryptocurrency is a legit business, but to do this on a large scale, strong computing power is required. There are miners who run huge server farms to earn money with Bitcoin mining or mining of other cryptocurrencies. Running these server farms requires a high financial investment both for the infrastructure and electricity. For this reason, web-based cryptomining became popular; it doesn’t require the miner to install extra software and can be injected into websites.</p><h2><strong>Going from mining their own business to jacking around</strong></h2><p>Like most lucrative online activities, cryptomining became an attractive business model for cybercriminals. Cybercriminals began using other people’s computers and browsers to mine cryptocurrencies, without their permission, known as cryptojacking.</p><p>When it comes to cryptojacking, cybercriminals can either install software onto victims’ computers to mine or use websites to mine by implementing mining scripts into a website’s code. When a user visits an infected website, the script starts mining crypto coins using the visitor’s computing power. Installing software onto PCs requires skill, time and effort. Additionally, the chances of people noticing their computer is mining are higher when their computer’s GPU is being used to mine, slowing down their devices. Browser-based cryptojacking therefore became very popular; cybercriminals hijack websites to inject Coinhive’s JavaScript to mine using site visitors’ browsers, profiting from the time spent on the infected websites.</p><h2><strong>Cryptojacking in the gray zone</strong></h2><p>In terms of cybersecurity, cryptojacking landed in a bit of a gray zone. While the effects of cryptojacking, especially browser-based cryptojacking which mainly includes slowing down the browser, are bothersome, they aren’t devastating and often users are unaware their browser is mining. Not all browser-based cryptomining is malicious. There is a legitimate use of the cryptocurrency miners where websites give users the option to mine, to in return avoid seeing ads, or in the case of UNICEF to raise money for a charitable cause. We at Avast reached a point, however, where we needed to decide whether or not we should block all browser-based miners to protect our user base from cryptojacking.</p><p>We decided to create a set of strict rules, and miners that adhere to the rules and request to be whitelisted are not blocked, but those that do not are blocked by our antivirus. We consider mining on webpages to be ethical when users are explicitly asked permission, before the mining begins, and are educated on the process.</p><h2><strong>The decline in jacking</strong></h2><p>Security companies blocking web-based cryptojacking might be one of many reasons why cryptojacking is on a decline. In their blog post about discontinuing Coinhive, the Coinhive team mentioned the drop in the hash rate after the Monero fork and the crash of the cryptocurrency market, along with the upcoming fork and algorithm update of Monero, which will cause the hashrate to drop.</p><p>The number of browser cryptojacking attempts we blocked during Monero’s peak followed the trends in the value of Monero, as can be seen in the charts below. Bitcoin and the cryptocurrency market as a whole had a similar trend line. Coinhive’s decision to discontinue their service may not come as a surprise, given the drop in the value of cryptocurrencies and the fact that the service was often used by bad actors for cryptojacking without asking the users’ permission, resulting in the cryptominer being blocked by security companies.</p><h2><strong>The End of an Era</strong></h2><p>It’s difficult to predict whether or not browser-based cryptojacking will ever rise again after Coinhive discontinues its service or if another mining service will fill Coinhive’s void. According to&nbsp;<a href="https://twitter.com/bad_packets/status/1030201187381927936?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1030201187381927936&amp;ref_url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcoinhive-cryptojacking-service-to-shut-down-in-march-2019%2F">Bad Packets Report</a>, Coinhive had a 62% share of website miners in August 2018. Even if another service decides to fill the gap Coinhive will leave, it may not be as successful as Coinhive once was, if it doesn’t allow cybercriminals to mine for their own financial gain.</p><p>The steady drop in Monero’s and other crypto currencies’ value might also be forcing cybercriminals to focus their attention on other, more profitable, activities. A possible rise in Monero’s value could cause cybercriminals to mine more again, but they would likely do this using PCs, if they care to make the extra effort.&nbsp;&nbsp;</p><p>Ultimately, Coinhive going out of business is a good thing for security, privacy, and transparency. Their business model relied upon taking 30% of all the coins mined on their service, and reportedly 100% of the money from coin that was mined on accounts that had been shut down for abuse. Its flaws were clear. With the value of Monero dropping significantly over the course of 2018, the hard forks and AV on their tail, it was impossible for Coinhive to maintain profit. Pushed by the AV companies, Coinhive has launched a service with explicit opt-in, so that will show us the true size of the legitimate market and if cryptomining can indeed be an alternative to advertising.</p>

Will Coinhive’s end lead to the end of browser-based cryptomining and cryptojacking?

The End of Coinhive; The end of cryptojacking?

<p>A chain is only as strong as its weakest link. This is also true in the world of security. This year, we tracked a growing threat trend — that when just one device in a home or small business (usually the router) is compromised, then the rest of the devices on the network become easy to compromise. With connected devices — known as the internet of things — growing faster than any device category in history, it’s increasingly difficult to buy appliances and home goods that do not have a connection to the internet.</p><p>From connected lights to coffee makers and smart speakers to door locks, IoT devices will continue to drive a class of attacks aimed at exploiting their weaknesses in configuration, security flaws, and consumers’ low interaction with their settings. Therefore, the main theme of our predictions is based on how infiltrating an IoT device could easily lead to breaking into the perimeter where IoT devices with compromised modems reside.</p><p>As we begin the new year, we are publishing a&nbsp;<strong>3-part series on 2019 predictions</strong>. We will cover&nbsp;<strong>IoT</strong>,&nbsp;<strong>mobile threats</strong>, and<strong>&nbsp;AI&nbsp;</strong>in these posts, all developed from insights and analysis by the Avast Threat Intelligence Team. In this first post, we are focusing on our top IoT threat predictions for 2019, including those from 2018 that continue to present challenges.</p>

<h2><strong>The internet of (vulnerable) things</strong></h2><p>The category of IoT is rapidly expanding, and for good reason — while a person typically has one laptop and mobile phone, they may have a multitude of connected devices in their home from doorbell, to entertainment, to home security. According to Juniper Research, the number of connected devices is expected to top 38.5 billion by 2020.</p><p>Here’s a peek at the brands and services that a smart home like that could encompass:</p>

<p>The trend toward smart devices will be so pronounced in the coming years that it will become difficult to buy appliances or home electronics that are&nbsp;<em>not&nbsp;</em>connected to the internet.&nbsp; &nbsp;</p><p>As much of our&nbsp;<a href="https://blog.avast.com/mqtt-vulnerabilities-hacking-smart-homes">research has shown</a>, security is unfortunately quite often an afterthought in the manufacturing of these devices. While many of the biggest brand-name smart devices do come with reasonable security embedded, some developers skimp on security to keep costs low for consumers, a mistake considering a smart home is only as safe as its weakest link.&nbsp;History tends to repeats itself, and just as PC and mobile&nbsp;<a href="https://www.avast.com/c-malware">malware</a>&nbsp;evolved, we expect to see IoT malware become more sophisticated and dangerous.</p><h2><strong>Router attacks</strong></h2><p>Anyone whose home is connected to the internet has a router to which they connect their computers, phones, and IoT devices. Routers are ubiquitous and important, but rarely maintained with the latest security standards. In fact, once an internet service provider installs the router, most people never give it a second thought, unless they experience internet disruptions.</p><p>Avast research shows that 60% of users worldwide have either never logged in to their router or have never updated their router’s firmware, leaving them potentially vulnerable to fairly simple attacks. The major problem here is that when an attacker uses a known vulnerability or weak authentication credentials to access a router, they gain access not just to the router, but to all devices connected to its network as well.</p><p>Routers have proven to be simple and fertile targets for a growing wave of attacks. While many attacks against routers use&nbsp;<a href="https://blog.avast.com/hacker-creates-seven-new-variants-of-the-mirai-botnet">variants based on the Mirai</a>&nbsp;codebase (which was released by the creator shortly after the successful attacks of September 2016), many are far more complex and point to a murky future for home network security.</p><p>Not only have we seen an increase in router-based malware in 2018, but also changes in the characteristics of those attacks. Where router-based malware has traditionally taken over a device for the purposes of carrying out a&nbsp;<a href="https://www.avast.com/c-ddos">DDoS</a>&nbsp;attack, such as the Mirai attacks, today’s attacks use malware to infect a device and open up a line of communication to a C&amp;C (command and control server), without taking any immediate action.</p><p>We saw this with VPNFilter and Torii; once the router is infected, these malware strains listen to the network traffic, fingerprint the network and the devices on it, and allow for the C&amp;C to send new payloads or instructions to the device. In this, the malware acts more like a platform and less like a&nbsp;<a href="https://www.avast.com/c-computer-virus">virus</a>. This “platform-ification” of malware opens up many possibilities such as pay-per-install as well as DDoS-for-hire or even good old-fashioned&nbsp;<a href="https://www.theregister.co.uk/2018/11/08/upnp_spam_botnet_broadcom/">spam</a>.</p><h2><strong>Downstream effects of router vulnerabilities</strong></h2><p>Routers will continue to be targeted, not just to run malicious scripts or spy on users, but also to be used as an intermediate link in chain attacks. In the case of the Mikrotik campaigns, a simple re-configuring of the router ended up affecting the entire internal network. The malware served JavaScript miners to all the browsers behind the router.</p><p>This attack also showed a potentially more worrisome trend, as these routers are not just in our homes, but also used by many smaller internet service providers. There is potential for an infected router to infect many hundreds or thousands of downstream devices. Further, it would be very difficult to figure out where the infection is coming from.</p><h2><strong>More modular IoT malware</strong></h2><p>Just as PC malware was very simple in its infancy, most IoT malware has been built for a very narrow purpose, such as to gather botnets for a DDoS attack. But like PC malware, IoT malware will learn and adjust its modus operandi from “one-trick” malware to multipurpose malware platforms capable of supporting organized pay-per-install campaigns.</p><p>There are benefits to infecting and then keeping a low profile, rather than immediately monetizing the network. After getting a large volume of IoT devices under control, malware authors can repurpose their bots to do whatever they see fit (or whatever would be most profitable).</p><h2><strong>More sophisticated spreading techniques</strong></h2><p>We expect to see more and more malware that will infect IoT devices from the browser. Browser-based attacks on personal computers and mobile phones, called Cross Site Request Forgery, are found in the wild, but are not yet very common. In this scenario, a user visits a page with malicious Javascript, which will scan the user’s local network, find a vulnerable device, and infect it. It could be a valuable way to infect a device that is not visible from the internet, for example a device behind a NAT (Network Address Translation).</p><h2><strong>IoT malware as proxy</strong></h2><p>Right now, IoT malware authors typically monetize their deeds through cryptomining or DDoS-for-hire attacks, but this is not the most profitable approach. We think more and more IoT malware authors will begin infecting more powerful and interesting devices, like mobile phones, tablets and PCs.</p><p>An example would be infecting the router to inject JavaScript or any other malicious payload into the traffic delivered to the user. It could also be used as a proxy to connect and carry out attacks on other internet users or devices. By using a chain of infected devices that barely have any logging capabilities, attackers can disguise their original location, similar to how anonymization proxies work.</p><h2><strong>IoT malware will drop support for x86 architecture</strong></h2><p><a href="https://en.wikipedia.org/wiki/X86">x86</a>&nbsp;is one of the most common backward-compatible instruction set architectures and has been in use since Intel introduced it in the late 1970s. However, as more devices operating on alternate frameworks become available, it is logical that malware authors will stop including the x86 step to make reverse engineering harder for security vendors. There are many sandboxes for PEs (portable executables) and x86 ELFs (Executable and Linkable Formats), but the majority of them struggle to support other architectures.</p><p>Despite the warnings inherent in these predictions, we believe the burgeoning IoT-verse marks a thrilling moment in our techno-evolution. Just make sure you stay smart and security-conscious with each new device you allow into your life. To be better prepared for the technological landscape ahead,&nbsp;<a href="https://cdn2.hubspot.net/hubfs/486579/Avast%20Threat%20Landscape%20Report%202019.pdf">download and read the full&nbsp;<strong>2019 Avast Predictions</strong>&nbsp;report</a>.</p>

Leadership Perspectives

AI in 2025: Gen's Policy Recommendations for U.S. Leadership

Zero-Day Vulnerabilities: The Real Threat Behind Netflix’s “Zero Day”

Predictions 2025: Navigating the Future of Cybersecurity

Seeing Isn’t Believing – Tackling AI, Misinformation and Its Impact on an Election Year

The new frontier of cyberthreats: how nation-state groups are targeting consumers

The Scamverse: Navigating the New Frontiers of Cyberthreats

Helping to Keep Personal Data Safe

Cybersecurity predictions for 2024

Insights Into the AI-Based Cyberthreat Landscape

CyberSec & AI Prague 2019

The End of Coinhive; The end of cryptojacking?

2019 predictions: The internet of (vulnerable) things

The new frontier of cyberthreats: how nation-state groups are targeting consumers 