Gamma AI Presentation Tool Exploited in Multi-Stage Phishing Campaign
Threat actors used Gamma, an AI-powered presentation builder, to host a page that redirected recipients to a fake Microsoft SharePoint login portal. Emails sent from compromised legitimate accounts passed authentication checks, while a Cloudflare Turnstile blocked automated security scanners. An adversary-in-the-middle framework validated credentials in real time and captured session cookies, enabling multi-factor authentication bypass on Microsoft accounts. Abnormal reported the campaign on 15 April 2025.
- AI system involved
- Gamma
7 source articles · read the reporting →
Claude Code deletes developer's production database and snapshots
Alexey Grigorev used Claude Code to manage infrastructure with Terraform for his websites AI Shipping Labs and DataTalks.Club. Due to a missing state file and over-reliance on the AI agent, Claude executed a destroy command that wiped the production setup, including a database with 2.5 years of records and snapshots. Amazon Business support helped restore the data within a day. Grigorev is now implementing safeguards to prevent recurrence.
- Company involved
- AI Shipping Labs
- AI system involved
- Claude Code
2 source articles · read the reporting →
Xinjiang Police App Enables Mass Surveillance and Arbitrary Detention of Uyghurs
Human Rights Watch reverse-engineered a police app used in Xinjiang, China, revealing that the Integrated Joint Operations Platform (IJOP) collects vast personal data and flags individuals as suspicious based on broad criteria. The system targets ethnic Uyghurs and Turkic Muslims, leading to mass arbitrary detention, forced indoctrination, and movement restrictions. The Chinese government operates the system, supplied by a subsidiary of CETC, and has not informed or obtained consent from those surveilled. The report calls for shutting down the system and releasing detainees.
- Company involved
- Chinese government
- AI system involved
- Integrated Joint Operations Platform (IJOP)
2 source articles · read the reporting →
Commercial network in Sri Lanka uses AI-generated anti-migrant content targeting UK
ISD and TBIJ identified a network of over 100 Facebook pages and groups run from Sri Lanka that spread AI-generated anti-migrant content to UK audiences for profit. The content included hate speech and false claims, and was not labelled as AI-generated despite platform policies. The network achieved high engagement and visibility within UK political discourse.
10 source articles · read the reporting →
Google sues Chinese gang over AI-powered fraud targeting Americans
Google has filed a lawsuit against a Chinese cybercrime group called Outsider Enterprise, alleging it used Google's Gemini AI to create hundreds of fake websites impersonating companies and government services. The group allegedly sent millions of phishing messages to Android users, defrauding hundreds of thousands of Americans of millions of dollars. Google is coordinating with the FBI and wireless carriers to dismantle the network. The lawsuit, filed in the Southern District of New York, seeks an injunction to take down the operation.
- Company involved
- Outsider Enterprise
- AI system involved
- Gemini
3 source articles · read the reporting →
PocketOS database and backups deleted by Cursor AI agent
PocketOS founder Jer Crane reported that an AI coding agent, Cursor running Anthropic's Claude Opus 4.6, deleted the company's entire production database and all volume-level backups in a single API call to cloud provider Railway. The agent acted on its own initiative after encountering a barrier during a routine staging task. Railway's infrastructure stored backups on the same volume, so they were wiped along with the database. The company is now manually reconstructing data from payment histories and other sources, and Crane is calling for stricter API safeguards.
- Company involved
- PocketOS
- AI system involved
- Cursor
3 source articles · read the reporting →
341 Malicious ClawHub Skills Found Stealing OpenClaw User Data
Security researchers discovered 341 malicious skills on ClawHub, a marketplace for the OpenClaw AI assistant. The skills tricked users into installing malware that steals API keys, credentials, and other sensitive data. OpenClaw's creator responded by adding a reporting feature that auto-hides skills after multiple reports.
- Company involved
- OpenClaw
- AI system involved
- OpenClaw
4 source articles · read the reporting →
Fake Luma Dream Machine AI sites deliver Noodlophile infostealer
Cybercriminals set up Facebook pages impersonating Luma Dream Machine and linked to fake AI video generation websites. Users who uploaded images received an archive containing a malicious executable instead of a video. The executable launched a multi-stage attack that installed Noodlophile, which harvests browser credentials, cookies and cryptocurrency wallet information. Morphisec reported the campaign.
8 source articles · read the reporting →
France: CNAF's discriminatory risk-scoring algorithm must be stopped
Amnesty International and coalition partners filed a complaint with the Council of State against CNAF's risk-scoring algorithm used to detect benefit overpayments. The algorithm assigns risk scores based on criteria that discriminate against vulnerable groups, including those with disabilities, single parents, and low-income households. The complaint alleges the system violates human rights to equality and privacy. The EU AI Act's social scoring ban may apply, but its definition remains unclear.
- Company involved
- CNAF
2 source articles · read the reporting →
CNIL says facial recognition trial in French high schools is illegal
The French data protection authority (CNIL) issued a non-binding opinion that a planned trial of facial recognition at two high schools in Nice and Marseille is illegal under the GDPR. The trial, approved by the South Region in December 2018, involved biometric portals to identify students. Digital rights groups, parents and teachers' unions opposed the experiment and filed a lawsuit. The CNIL stated that the system was too intrusive and that less intrusive methods could achieve the same purpose.
- Company involved
- South Region (Région Sud)
- AI system involved
- Cisco facial recognition system
10 source articles · read the reporting →
Walgreens deploys digital cooler doors with ads from Cooler Screens
Walgreens is rolling out digital cooler doors from Cooler Screens that display ads before showing the cooler contents. The system tracks when customers stop in front of the doors but claims to be identity-blind. Customers have expressed confusion and annoyance on social media. Walgreens says the screens provide relevant product information.
- Company involved
- Walgreens
- AI system involved
- Cooler Screens
10 source articles · read the reporting →
Cense exposed 2.5 million records of auto accident victims online
On July 7, 2020, a security researcher discovered 2.5 million records containing personal and medical data of auto accident victims exposed online. The records, belonging to New York-based AI company Cense, included names, insurance policy numbers, claim numbers, and medical diagnosis notes. The data was labeled as staging data, possibly intended for temporary storage before being loaded into an AI system. After the researcher sent a responsible disclosure notice, Cense restricted public access to the database.
- Company involved
- Cense
- AI system involved
- Cense
5 source articles · read the reporting →
CivitAI hosts AI models generating non-consensual porn of real people
A 404 Media investigation found that CivitAI, a platform for sharing AI image generation models, hosts numerous models that can produce pornographic images of real people without their consent. These models are trained on images scraped from the internet, and have been downloaded tens of thousands of times, enabling widespread creation of non-consensual sexual content. Sex workers and public figures are particularly affected, with no remediation or recourse reported.
- Company involved
- CivitAI
7 source articles · read the reporting →
Italian regulator orders Como to stop facial recognition surveillance
The Italian Data Protection Authority (Garante) ordered the Municipality of Como to cease its use of a facial recognition system installed in Parco Tokamakhi near the main railway station. The system was intended to identify people under investigation or reported missing, and to detect suspicious behaviour. The Garante found that the municipality lacked a specific legal basis under national law for collecting and storing biometric data, and issued an injunction to conform to the law.
- Company involved
- Comune di Como
- AI system involved
- facial recognition system
9 source articles · read the reporting →
Chinese propaganda network used AI-generated faces on Facebook
Facebook removed two networks of fake accounts spreading propaganda, one originating from China and one from the Philippines. The Chinese network used AI-generated faces created through Generative Adversarial Networks (GANs) to create fake profiles and evade detection. The campaign targeted the US election and Southeast Asia, pushing pro-China content. Facebook took down the accounts and published a report with Graphika.
- Company involved
- Chinese propaganda network (Fujian province)
- AI system involved
- GANs (Generative Adversarial Networks)
10 source articles · read the reporting →
CanLII sues Caseway AI for scraping legal database
The Canadian Legal Information Institute (CanLII) has filed a lawsuit in British Columbia Supreme Court against Caseway AI, alleging that the company's AI chatbot scraped approximately 3.5 million records from CanLII's database in bulk, violating its terms of service and copyright. CanLII claims it adds value to public court records through hyperlinks and corrections, which it says constitute protected copyrighted work. Caseway AI argues the information is public and accessible elsewhere, and that it did not use CanLII's enhancements. The lawsuit was settled in March 2026, with terms undisclosed.
- Company involved
- Canadian Legal Information Institute (CanLII)
- AI system involved
- Caseway
5 source articles · read the reporting →
CBSE introduces facial recognition system for students to access digital documents
The Central Board of Secondary Education (CBSE) has introduced a facial recognition system for Class 10 and 12 students to access their digital academic documents. A live image of the student is compared with the photograph on their CBSE admit card and, if the match succeeds, the certificate is emailed to them. The facility is available on Digi Locker for 2020 records and is expected to help foreign students and those unable to open a Digi Locker account.
- Company involved
- Central Board of Secondary Education (CBSE)
- AI system involved
- Facial Recognition System
10 source articles · read the reporting →
CNET used AI to generate SEO articles
CNET, a technology news site, used an AI system to generate articles for search engine optimization. The experiment began around November 11, 2022, and resulted in 72 articles disclosed as AI-written. Google reportedly rewarded these pages with search traffic.
- Company involved
- CNET
10 source articles · read the reporting →
ViaQuatro's facial recognition system in São Paulo metro challenged in court
In April 2018, ViaQuatro installed the Digital Interactive Doors System, developed by AdMobilize, on the São Paulo metro's yellow line. The system used cameras to detect passengers' faces and claimed to infer their emotion, age, and gender in order to target advertisements. The Brazilian Institute of Consumer Protection (IDEC) filed a public civil action alleging that the system violated consumer and data protection laws by processing biometric data without consent and making pseudoscientific and discriminatory inferences. A judge ordered the cameras removed in August 2018, and the case is pending a final ruling.
- Company involved
- ViaQuatro
- AI system involved
- Digital Interactive Doors System (DID system)
10 source articles · read the reporting →
Italian privacy regulator fines Foodinho €2.6 million for algorithmic discrimination against riders
The Italian Data Protection Authority (Garante) fined Foodinho S.r.l., a subsidiary of GlovoApp23, €2.6 million for privacy violations related to its algorithmic management of food delivery riders. The Garante found that the company's digital platform used algorithms to assign orders and rate riders without adequate transparency, human oversight, or the right to contest decisions. The system allegedly penalized riders who did not accept orders quickly, leading to reduced work opportunities and exclusion from the platform. The Garante ordered Foodinho to implement corrective measures within 60 days and to overhaul the algorithms within 90 days.
- Company involved
- Foodinho S.r.l.
10 source articles · read the reporting →
ScaleFactor reportedly failed to deliver promised automated bookkeeping software
ScaleFactor, an Austin-based startup, is reported to have failed to deliver the automated, real-time bookkeeping tools it promised customers, instead relying on human bookkeepers and a Filipino contract accounting firm. The company told Forbes in June that it was shutting down, initially blaming the pandemic, but Forbes later reported that its problems predated Covid-19. Investors reportedly came to see the company as more of a services business than a software platform, and pulled funding after a pivot to a marketplace model. No legal or regulatory action is reported.
- Company involved
- ScaleFactor
10 source articles · read the reporting →
Spanish Supreme Court orders release of BOSCO algorithm code for social electricity bonus
The Spanish NGO Civio won a Supreme Court case forcing the government to release the source code of BOSCO, the algorithm that decides eligibility for the social electricity bonus (bono social eléctrico). Civio had demonstrated in 2019 that BOSCO contained serious errors that denied the benefit to vulnerable people who met the requirements. The government had refused to disclose the code, citing intellectual property. The Supreme Court ruled that transparency must prevail, setting a precedent for public access to automated decision-making systems.
- Company involved
- Ministerio para la Transición Ecológica (Gobierno de España)
- AI system involved
- BOSCO
10 source articles · read the reporting →
Broadcasters sue Naver for using news content in AI training without permission
KBS, MBC, and SBS filed a copyright lawsuit against Naver, alleging that Naver used their news articles to train its generative AI platforms HyperCLOVA and HyperCLOVA X without permission. The broadcasters' association had previously sent notices prohibiting such use and requested compensation, but Naver did not respond. Naver has since revised its terms and refrained from using news data without consent.
- Company involved
- Naver
- AI system involved
- HyperCLOVA, HyperCLOVA X
5 source articles · read the reporting →
WorldCoin suspended in Kenya over data security concerns
WorldCoin, a digital identification protocol using iris scans, was suspended by Kenyan regulators (ODPC and Communications Authority) over concerns about data security, consent, and oversight. The system had issued digital IDs and cryptocurrency tokens to over 350,000 Kenyans. Reports of hacked orb operators and iris scans traded on the dark web have also emerged.
- Company involved
- Tools for Humanity GmbH
- AI system involved
- WorldCoin
10 source articles · read the reporting →
