Security Newsletter | 10/1/26

If you take nothing else from this newsletter, just do these three things to protect yourself:

1. Employ a privacy-preserving web browser such as Safari or DuckDuckGo. Ditch Chrome.
2. Don't use web browser extensions except for your ad-blocker, password manager, and possibly a VPN.
3. Keep your devices up to date. Learn how to update to the latest OS.

DraftKings is one of the largest sports betting platforms, according to Motley Fool, and a major driver of the sports betting industry. From the New York Times, it appears that DraftKings has been employing AI trained on customer usage data to target ads to the bettors most likely to place losing bets. Not just customers most likely to click an ad or place a bet, but customers most likely to lose. Engineers raised alarms when they began to suspect the AI was singling out those with destructive gambling habits. If this sounds familiar, you may be remembering the 2017 revelation that Facebook's algorithm could identify when teens were feeling depressed and reveal that to advertisers, so the vulnerable teens could be targeted, for example, with makeup ads, as later attested by a Facebook employee.

These are both forms of behavioral advertising: studying the specific behaviors of individual buyers to identify who is most likely to click an ad, and even when they're most likely to click. Highly targeted ads that seem to know everything about you may merely feel creepy, but ad-tech and behavioral advertising data has made its way outside of the advertising world and into decisions about who can be targeted for law enforcement and even military action. Such data can be collected and resold to private detectives, police, military, and also stalkers. That Ad-tech data is interesting to militaries is shown by the US Military disabling advertising identifiers out of concern they might reveal soldiers' locations. US Immigration and Customs Enforcement uses ad-tech data, and one data source for potential predictive policing. Commercial ad-tech data has been used by private Ukraine-linked firms to track Russian soldiers and locate strategic targets. We have not yet seen reporting of ad-tech data directly utilized to select military targets—we know it could be used, but we don't know yet wheter it actually has. Still, given the growing reliance on data-hungry algorithmic target priority systems, it seems only a matter of time.

The Bottom Line: It is possible to reduce how much ad-tech surveillance can learn about you personally by employing tools such as a privacy-preserving web browser (like Safari, Brave, or DuckDuckGo), iCloud Private Relay, email masking services such as Hide My Email, DNS cloaking such as NextDNS, and sometimes a consumer VPN. Each tool you employ reduces how much advertisers can surveil you in different ways, and collectively they reduce your exposure to this kind of targeted advertising and profiling. 

However, it must be said that the internet does not need to be built so that merely browsing it gives up your privacy. To maintain the usefulness of the internet as a tool for the public good, reasonable restraints must be placed on how much personal profiling data companies can capture and retain for advertising or other purposes. Creating reasonable safeguards is the job of lawmakers. In some jurisdictions, your opinions may affect the decisions of your lawmakers, so consider reaching out to them with your concerns.

This Phishing Campaign Can Hack iPhones

Cybersecurity firm D3Lab reports discovering a new iOS phishing campaign targeting Italians. The hackers impersonate pagoPA, an Italian government service that lets users pay their taxes and other government fees. Impersonating a government alert message is just the start; once the user clicks the message, the malware silently tries to bypass the iPhone's defenses and steal the owner's identity and credit card information. This exploit appears to target phones running iOS 17.2.1 and older but does not work on newer operating systems. Read more from D3Lab.

The Bottom Line: Exploits targeting iPhones are on the rise, but the vast majority of them cannot target the latest operating systems. That's why it's important to keep your device up to date.

AI Dangers: Superintelligent or Super Unreliable?

In mid-September, a US intelligence report suggested that a specific Chinese ship traveling in the Middle East was carrying components of a nuclear weapon, according to CNN. The US military made plans to intercept and board the ship—an action which some US military sources feared would be viewed by China as an act of war. At the last minute it came out that the report was completely fictional—it was generated by an AI chatbot, and the detail about nuclear weapons parts was a hallucination. The US attack was called off. The Guardian has written a thoughtful breakdown of why the threat posed by this technology may have less to do with its much-hyped "super-intelligence," and more to do with people believing the marketing hype and using it for jobs for which it is dangerously unsuited. Read more at The Guardian.

The Bottom Line: Work produced by generative AI must be fact-checked. It works best in cases where the fact-checking is automatic, such as when generating an itinerary for a trip: You'll have to make the actual reservations, so you'll automatically end up fact-checking the list. It must never be used to help decide matters of critical importance.

New macOS Infostealer: MacSync Steals Your Crypto and Info

Cybersecurity company Kaspersky discovered a new evolution of infostealer malware targeting Macs. This malware, called MacSync by its creators, is rented to criminals as a malware-as-a-service. It may reach you through compromised versions of free or open-source programs, or in a clickfix-type attack that prompts you to run code in your own terminal (don’t do that). Once installed, it bypasses macOS protections and seeks to steal keychain information, as well as crypto wallet contents and other materials. Read more at Securelist. 

The Bottom Line: Beware of free software. While there are many great free apps, make sure to download them from their official source, never a third party. Be wary of prompts asking for your Mac’s admin password—this should only happen when you initiate an action. Finally, you can run a reputable malware scanner for additional protection, such as Malwarebytes.

• The most recent iOS and iPadOS is 27
• The most recent macOS is 27
• The most recent tvOS is 27
• The most recent watchOS is 27
• The most recent visionOS is 27

Read about the latest updates from Apple.

There is far too much security and privacy news for us to cover it all. When building this newsletter, we look for scams, hacks, trouble, and news to illustrate the kinds of problems Apple enthusiasts may encounter in our private lives, and the self-defense we can practice to keep our devices, accounts, and lives secure. Our commentary focuses on practical advice for everyday people. This newsletter was written by Cullen Thomas and edited by August Garry.