|
Welcome back to the TCE Strategy monthly newsletter! From a global scam industry powered by forced labor, to AI support bots giving away Instagram accounts, to a single line of code that nearly deleted one of the most valuable animated movies ever made, June has been another month where cybersecurity news sounds like a movie script. Unfortunately, it’s real. Let’s see how this month’s cybersecurity news can help us make better decisions about what is Secure Enough for us, the companies we work for, and our families.
Meta’s AI support chatbot gave attackers the keys to Instagram accounts
TechCrunch reported that hackers hijacked Instagram accounts by tricking Meta’s AI-powered support chatbot into adding a new email address to a victim’s account and then resetting the password. The attacker did not have to control the victim’s legitimate email account. They just had to convince the support process to trust the wrong person. (TechCrunch)
This is a fascinating and scary example of a broader problem. For years, attackers have tried to trick human help desk workers into resetting passwords, moving phone numbers, or bypassing MFA. Now companies are putting AI into those workflows. That can be fine if the AI is only summarizing tickets or helping a trained employee make a decision. It is much less fine if the AI can take account-control actions without strong guardrails.
Takeaway: Treat social media accounts like real assets. That is especially true for businesses, public figures, schools, government agencies, and anyone who uses social media to communicate with customers. Turn on MFA. Make sure the email account tied to the social media account has strong MFA. Store recovery codes somewhere safe. Remove old phone numbers and old email addresses from account recovery settings. If multiple employees manage an account, use a business manager tool instead of sharing a password. Shared passwords are not a team sport. They are a future incident report.
For companies deploying AI into support processes, the lesson is bigger: AI should not be allowed to change ownership of accounts, approve payment changes, disable MFA, or grant access to sensitive data unless the identity verification process is extremely strong and auditable. A chatbot that can be socially engineered is still a help desk worker. It is just a help desk worker that can make mistakes faster.
The UK wants social media blocked for children under 16
The United Kingdom announced that it plans to block social media platforms from offering services to children under 16, following the same general model that Australia started using. The UK plan would include platforms such as Snapchat, TikTok, YouTube, Instagram, Facebook and X, but not messaging apps such as WhatsApp and Signal. The UK proposal also goes beyond a simple ban by targeting features such as live streaming and communication with children by strangers. The government says it expects protections to come into force in Spring 2027. (UK government announcement)
Whether this works is a very open question. Kids are creative. Kids have friends with older siblings. Kids have VPNs. Kids also have an amazing ability to convince adults that “everyone else’s parents allow it.” However, the fact that governments are moving this aggressively should tell us something important: society is starting to admit that social media is not just “kids being kids.” It is an attention-extraction business that is exceptionally good at keeping people scrolling.
There is also a cybersecurity angle here that doesn’t get enough attention. Age verification requires data. Sometimes that data is a birthdate. Sometimes it is a scan of an ID. Sometimes it is facial estimation. Sometimes it is a parent’s information tied to a child’s account. Every one of those approaches creates data that someone has to protect. The more sensitive the verification process, the more attractive the data becomes to cybercriminals.
Takeaway: Parents should not wait for laws to decide what is acceptable in their homes. Companies should not wait for laws to decide what is acceptable in their systems. For families, treat social media like a real risk decision, not like a default childhood milestone. Use parental controls. Keep devices out of bedrooms overnight. Talk about scams, sextortion, impersonation, deepfakes, bullying, and the fact that the Internet never forgets. For companies building or buying age-verification technology, treat that data like regulated sensitive data from day one. If that system needs to prove a child is not 15, it should not accidentally create a giant database of children’s identities while doing so.
AI worms that “think” are no longer science fiction
Researchers at the CleverHans Lab published work on an AI-driven adaptive computer worm. This was a controlled research prototype, not malware being used in the wild, and the researchers intentionally withheld details that would make it easier to copy. Still, the concept matters. Traditional computer “worms” usually spread by exploiting one known weakness again and again to move laterally throughout a computer network. This research showed an agentic worm that can look at different machines, reason about what weakness might work on each one, and adapt as it moves through different computers. (CleverHans Lab)
In other words, the worm is not just a digital crowbar. It is a burglar that walks around the building trying different doors, windows, keypads, bad passwords, unpatched systems and forgotten devices until it finds the next way in. That is a much more sophisticated automated attacker than has ever been seen before.
The good news is that this was not released into the wild. The bad news is that the defensive recommendations are the same mundane controls we have been talking about for years: patch systems, remove unnecessary services, segment networks, require MFA, eliminate shared admin accounts, restrict local administrator rights, monitor unusual lateral movement, and stop pretending that the printer, camera, badge reader, phone system, HVAC controller, and forgotten Linux box in the corner are “not really computers.” They are computers, and computers are easily manipulated. Cybercriminals do not care what department bought them.
Takeaway: AI is going to make weak cybersecurity hygiene more expensive. It does not magically create a new universe where passwords, patching, backups and network segmentation no longer matter. It creates a universe where the time between “a flaw exists” and “a criminal can exploit it at scale” keeps shrinking. This is not a technology problem only. It is a leadership problem. Leadership needs to decide whether the company wants to pay for prevention on its own timeline or pay for emergency response work after the cybercriminal attacks.
Google’s AI answers may legally be Google’s answers
A German court ruled that Google can be liable for false claims made in its AI Overviews. The case involved Google’s AI wrongly linking two publishers to scams and shady business practices. The court treated the AI overview as Google’s own content, not merely a list of search results from third-party websites. Google says the decision is not final and is reviewing it. (The Decoder)
This matters far beyond Google. AI companies have spent a lot of time telling the world that AI is a tool and users need to verify the output. That is true, but it is not the whole story. If a company builds an AI system, puts it in front of millions of users, presents the answer confidently, and benefits from the answer being convenient, courts may decide that the company owns the answer. That is not a small shift.
Takeaway: Do not use AI as your final source of truth for anything that could hurt someone if it is wrong. That includes legal issues, medical advice, hiring decisions, terminations, public accusations, financial recommendations, cybersecurity incident response, and anything that could damage a person’s reputation. AI is a fantastic research assistant. It is not a magic truth machine.
For businesses, this is also a warning about customer-facing chatbots. If your AI chatbot tells customers something false about pricing, contracts, warranties, health benefits, safety, compliance, or someone else’s reputation, “the AI said it” may not be a viable defense. If the chatbot speaks for your company, your company needs to govern what it says.
Offline backups saved Pixar. They can save your company too.
The Wall Street Journal ran a terrific story about how Pixar nearly lost Toy Story 2 when a command accidentally deleted most of the film’s files from the central server. The team thought backups would save them, which is exactly what backups are supposed to do. Then they discovered the backups had not been working properly. The movie was ultimately saved because a supervising technical director had a copy on a computer at home, which was physically driven back to Pixar. The story is being retold during the Toy Story 5 press cycle, but the near-disaster was Toy Story 2. (Wall Street Journal)
This story is funny only because it ended well. It also happens to be one of the best backup lessons ever told. Pixar did not nearly lose the movie because of ransomware. They nearly lost it because of an accident. Backups are not only for cybercriminals. They are for bad commands, failed software updates, power events, broken sync tools, corrupted databases, angry employees, confused employees, and the occasional moment where someone does something dumb because humans are involved.
Takeaway: Offline backups are your friend. Immutable backups are your friend. Tested restores are your friend. A backup that has never been restored is not a backup. It is a theory. Every organization should know the answers to these questions: Can ransomware delete or encrypt our backups? Can a domain administrator delete our backups? Can our backup administrator delete all backup history without another person approving it? How long would it take to restore the systems that create invoices, ship product, run payroll, and communicate with customers? When did we last test that answer?
The ideal answer is not just “we have backups.” The ideal answer is “we have multiple generations of backups, at least one copy is offline or immutable, we monitor backup success and failure, we test restores, and we have written down the order in which systems must be recovered.” That is not glamorous cybersecurity. It is just the part that decides whether a bad day becomes an existential crisis.
OpenClaw, Codex, Claude Desktop and the new AI-agent trust problem
AI applications are moving from “answer my question” to “do things on my behalf.” OpenClaw, ChatGPT Codex, Claude Desktop, Claude Code and similar tools can read files, write files, run commands, connect to code repositories, use extensions, browse content, interact with calendars, and automate work. That is the point. It is also the risk.
OpenAI’s Codex documentation describes a coding agent that can read, change and run code, with sandboxing, approvals and network controls designed to limit what the agent can do without permission. Anthropic’s Claude Desktop supports local MCP servers and desktop extensions, which are designed to connect Claude to external tools and local workflows. Those controls matter, but they do not remove the need for company-specific governance. (OpenAI Codex CLI) (OpenAI sandboxing) (Anthropic MCP)
The CISA vulnerability bulletin for the week of June 15th included OpenClaw vulnerabilities, and security researchers have documented OpenClaw weaknesses involving sandbox escapes, command execution, filesystem access issues, and privilege problems. The details will change as these tools mature, but the theme will not: an AI agent with access to your files, your commands, your browser, your email, your calendar, your cloud drives, your code and your credentials is not “just a chatbot.” It is software with hands. (CISA bulletin) (Cloud Security Alliance research)
Takeaway: Treat AI agents like a brand-new class of privileged software. Do not install them broadly because a few employees want to try them. Do not let them run as local administrator. Do not give them access to production systems unless there is a documented business reason and a documented risk acceptance. Do not connect them to every file share, email box, SaaS application and code repository just because the demo looks amazing. Demos are supposed to look amazing.
My recommended baseline for AI desktop and coding agents is simple: use a dedicated test machine or virtual machine where possible, run as a non-admin user, keep the tool updated, limit what folders it can access, block or tightly restrict Internet access unless it is needed, require human approval for commands that write files or reach the network, keep secrets out of accessible files, use separate accounts with least privilege, log what the tool does, and have a process to remove the tool quickly if something goes sideways.
For companies, this should become part of cybersecurity governance in 2026. Approved AI tools. Approved use cases. Data classifications. Logging. Contract review. Vendor security review. Extension review. Prompt-injection training. A process for exceptions. This does not need to be a 90-page policy that no one reads. It does need to be clear enough that employees know the difference between “use AI to summarize public documentation” and “connect an experimental agent to the finance share and see what happens.” The second one is how newsletters like this get written.
“Scambodia” and the people forced to scam the rest of the world
NPR’s Up First ran a terrific two-part podcast in June on the cyberscam industry in Cambodia. I take no joy in using such a derogatory and offensive nickname for a sovereign nation, but the phrase “Scambodia” exists in mainstream news outlets for a reason: the scale of this criminal industry is staggering. The reporting looked at the industry from a point of view we rarely see: the people inside the compounds who are forced to scam victims around the world.
The workers are often recruited with fake job offers. They are promised legitimate employment, travel to Cambodia, and then discover that the job is to sit in front of phones and computers all day trying to defraud strangers. Some are beaten. Some are threatened. Some are sold from one compound to another. They are doing terrible things to innocent victims, but many of them are victims themselves.
The FBI’s 2025 Internet Crime Report said cyber-enabled crimes cost Americans nearly $21 billion, with cryptocurrency investment fraud alone accounting for more than $7 billion in reported losses. NPR’s reporting described more than 200,000 scam workers being released after Cambodian crackdowns, many of them stranded and unable to get home. (FBI IC3 report) (NPR reporting)
Takeaway: This is not one person in a basement trying to trick Grandpa out of $500. This is an industrial-scale business model. The people running it have scripts, managers, training, quotas, customer relationship management tools, translators, AI tools, fake websites, fake investment portals, and money-laundering pipelines. They are not guessing. They are running a business, and victims are the product. Recognizing how these scams work is the best way to avoid being a victim, and the NPR podcasts do a terrific job outlining how the scams work. I strongly recommend you give them a listen.
For individuals, the following advice is boring because it works. If a stranger starts a conversation with you by text message, social media, a dating app, WhatsApp, Telegram, or LinkedIn and then starts talking about money, crypto, gold, investments, taxes, a computer virus, a law enforcement problem, or a family emergency, STOP COMMUNICATING WITH THEM. Do not keep chatting to be polite. Do not move the conversation to a different app. Do not send a screenshot of your bank account. Do not invest “a little” to test the system. Cybercriminals know that if they can get you to take one small step, they have a much better chance of getting you to take a second one. This is pig butchering at a massive scale.
For businesses, assume the same scam industry is targeting your Finance team, your executives, your sales staff, and your customers. Protect your email accounts with MFA. Require out-of-band verification for bank-account changes. Require two people to approve wire transfers. Train your team that urgency is one of the most important weapons cybercriminals use. If someone says, “This has to happen right now,” that is exactly when your team should slow down.
Until next month, stay safe!
|
