Security Newsletter | 3/5/26

If you take nothing else from this newsletter, just do these three things to protect yourself:

1. Lock your Apple Account with a security key. If you’re able to invest in one, a physical security key is the most secure option for locking your account, since physical access to the key is required when logging in.
2. Hide sensitive notifications from your Lock Screen. You can turn off notification previews so that others cannot read them when you’re out and about in public.
3. Protect the Notes app by setting a password. In the Settings app, you can set a unique password for your Notes app, preventing others from accessing your private notes.

GenAI tools are incredibly useful to scammers. The main way that scammers rely on GenAI is for translation. Focusing their scam efforts on targets who are geographically distant helps protect the scammer from legal repercussions, but that same geographic distance means that the scammer is likely to be less savvy to the language and customs of their victim. Enter Generative AI, which the scammer can use to generate natural-sounding, culturally relevant text in their victim’s language of choice.

There is another aspect to using commercial GenAI systems though: they are surveillance technologies. Every major commercial GenAI system polices the activity of its users. The result is that OpenAI, which makes ChatGPT, has practically unprecedented visibility into some scam operations. As scammers use their chat agent to create scam text, the company’s employees can see complete logs of the scammers’ activity and queries. OpenAI publishes a periodic report on scams they’ve detected and foiled, and it makes for good reading. The company breaks all the scam activity it sees down into three phases: the ping, which is the cold call; the zing, which is an effort to create a strong emotion that can be exploited; and the zing, which is the effort to extract money. Check out the OpenAI scam report; it’s a great breakdown of basic scam mechanics.

This month’s report also offers this gem of a sentence: “In isolated cases, individual users self-identified as scam workers in Cambodia, such as when asking the model for tax advice and stating their occupation as ‘scammer.’”

Incredible.

The Bottom Line: Scammers depend on emotionally manipulative language to create heightened emotions: fear, love, anger, etc, which can then be exploited. While most people will recognize this kind of manipulation most of the time, those suffering from loneliness, isolation, exhaustion, or other mental health challenges are much more vulnerable—and that means all of us, at least some of the time. Learning to identify the patterns of scammers by reading reports like this can help, as does using a password manager. When it comes to handing over money to someone online, always vet contacts with live video calls and get a second opinion from a disinterested third party before you send money to a contact made online.

AI-Powered Islamic State Propaganda Showing Up in Minecraft, Roblox & Social Media

Last year, Meta cut back on content moderation, leaving the door open to an increase in disinformation and propaganda on its platforms. Researchers at the Institute for Strategic Dialogue, a policy think tank devoted to studying disinformation and combating extremism, have a new report looking at the extremist propaganda of the Islamic State. The Islamic State no longer holds territory in West Asia, but related groups do hold territory in Africa, and there is still a propaganda operation highly active online on social media and in some video games. They’re apparently using AI to emulate the speech and writing of some of their deceased leaders in efforts to drive recruitment. Read more at 404 Media.

In a related story, researchers discovered a cluster of fully automated pro-China propaganda accounts on Meta’s Threads platform. Read more at NewsGuard’s Reality Check newsletter.

The Bottom Line: Every forum, online or in person, requires some form of moderation to police malicious actors, disinformation, and lies. It is much easier to lie than to refute a lie, and so moderation is always a difficult task. GenAI is magnifying this problem by making it even easier to generate disinformation. Because of the scale of modern social media, there will always be some element of propaganda circulating there. Preferring forums that employ fair and capable moderators can help, but the antidote to propaganda is literacy—the more educated you are, the easier it is to identify influence operations and make your own informed opinions. A healthy information diet, including diverse viewpoints and newsletters like this one, can help (we hope).

Researchers Discover Way to Snoop on Any Encrypted Wi-Fi

A recent paper published at the Network and Distributed System Security Symposium shows how researchers worked out a way to bypass the encryption system used to secure modern Wi-Fi. The exploit works on corporate Wi-Fi networks and home Wi-Fi routers and would potentially allow a hacker to attack computers on a Wi-Fi network just by being near enough to catch the radio signals. There is no known malicious exploitation of this vulnerability yet, and router makers have already begun patching the exploit. Read more at Ars Technica.

The Bottom Line: It’s important to keep your Wi-Fi router up to date with the latest patches. Many home Wi-Fi routers will update automatically, but not all, so make sure you know how to log in to your home Wi-Fi’s admin panel to check for updates.

iPhone and iPad Secure Enough to Handle NATO Classified Information

The NATO certification agency has decided that iPhones and iPads may be used out of the box (that is, without special hardware profiles or settings) to handle classified material up to the NATO restricted level, the 4th and least restrictive of the 4 NATO classification levels. Apple has a press release on this. No other mass consumer device has achieved this certification—usually, devices have to be carefully managed and upgraded to achieve certification. Read more at Security Week.

The Bottom Line: If you happen to serve in a job that requires NATO security clearance and the handling of NATO classified materials, your next work phone might be an iPhone. For the rest of us, this is just a verification of the hard work Apple has put into securing iPhones and iPads. 

GenAI Can Easily De-Anonymize Online Accounts

Researchers have compellingly demonstrated that custom GenAI models can be trained to quickly match the writings of an anonymous online account with the author’s real social media accounts using syntax and style matching. The technique is not perfectly accurate (nothing GenAI does is ever going to be perfectly accurate), but it does provide an avenue to help researchers decloak account authors—for good or ill. Read the paper here. 

The Bottom Line: True anonymity is almost as impossible as true security: no defense is perfect. Instead, defense is always a matter of increasing the costs of trying to impose on you. If this technology makes de-anonymizing social media accounts trivial, and the only way to avoid being unmasked by this kind of technique is to simply not post writing that can be analyzed, then that will have a chilling effect on online speech.

California Air Quality Agency Subjected to AI-Powered Astroturfing Campaign

Last year, in an effort to reduce air pollution, the Southern California Air Quality Management District (SCAQMD) sought to impose fees on the manufacturing, distribution, and installation of gas-powered appliances. The goal was to phase out gas appliances in favor of electric ones instead. That is, until tens of thousands of emails flooded the SCAQMD inbox opposing these new rules, leading to the agency halting its plans. However, a closer look at these emails has revealed that many of them originated from CiviClick, a company that uses artificial intelligence to run opposition campaigns. AI is infamously harmful to the environment due to the massive amount of energy required to power it, meaning the company effectively harmed the environment to oppose rules that would have helped the environment. Read more at Phys.org.

The Bottom Line: Artificial intelligence is making astroturfing campaigns much easier for the companies that run them. AI-powered bots are rampant on social media, making it easy for us to read information from seemingly ordinary, trustworthy people and take it as fact. Always double-check sources and verify anything you read online.

The correct answer is D: Passkeys. The worst answer is probably B: Email codes, but A: SMS Codes is also fairly weak. Of course, any multifactor authentication method is better than none, because any method will mean that guessing your password isn’t enough to break into the account. Email is weak because most email is fairly easy to intercept. The same is true for SMS codes. But even “fairly easy” is relative; it’s still not all that easy. C: Generated codes using an authenticator app is stronger than A or B, but can still be phished by modern phishing kits. Only Passkeys are phishing resistant, and they’re more convenient, too!

Interested in browsing the web privately? Check out:

• Keep Your Web Browsing Activity Private
• Can Private Browsing Be Traced?
• What Is a VPN & How Does It Work?