Streamline security and IT collaboration and shorten the mean time to remediate with automation. It’s common enough that I was able to find the above example to photograph simply by looking in my deleted messages folder. Barclay has been writing about technology for a decade, starting out as a freelancer with ITProPortal covering everything from London’s start-up scene to comparisons of the best cloud storage services. After that, he spent some time as the managing editor of an online outlet focusing on cloud computing, furthering his interest in virtualization, Big Data, and the Internet of Things. Get full access to premium articles, exclusive features and a growing list of member rewards. In marketing, product launch plans, advertising budgets, and influencer contracts often contain sensitive financial and strategic information.

The main lesson from this episode is that we should treat our phone number like a password, not a trivial piece of information . True digital safety requires not just encryption, but also user awareness, platform transparency, and adaptive regulation. Security experts recommend all iPhone users immediately update to the latest iOS version, with high-risk individuals particularly advised to enable Apple’s Lockdown Mode for additional protection against sophisticated zero-click attacks.

It’s a good idea to review the privacy settings of each app to limit who can see your profile picture, description, last seen time, or public profile. The less information that’s publicly available, the harder it will be for an attacker to create a convincing scam or link your number to other leaked data. On an individual level, there are several guidelines anyone can follow to reduce their exposure when using messaging apps. The first is to treat phone numbers and codes received via SMS as sensitive credentials that should never be shared , even if the person requesting them appears to be a friend, a technician, or the app itself. Cellcrypt adopts a zero-knowledge architecture with end-to-end encryption and client-side key control . In recent months, there has also been an increase in attempts to hijack WhatsApp accounts using social engineering.

Hackedgpt: Novel Ai Vulnerabilities Open The Door For Private Data Leakage

The caller and recipient would also need to be Facebook “friends” for the attack to work, which limits its utility versus being able to call anyone out of the blue. Still, given that Facebook now has more than 2.7 billion active users, it’s possible to find a population of targets that meet almost any parameters. It’s been almost a decade since Facebook started offering researchers cash rewards for finding and disclosing vulnerabilities in the company’s platforms. Those same 10 years have proved both the social network’s popularity and serious pitfalls, as its privacy and misinformation-related failures have impacted geopolitics around the world.

The attack becomes particularly dangerous because modern IM clients automatically parse rich media content, making the exploitation completely transparent to victims. WeChat’s layered defenses, from URL validation to sandboxed browsers, demonstrate a proactive approach to security. How high-risk individuals can protect their accounts when using apps such as WhatsApp and Signal. Those working in government should follow government guidance on the use of non-corporate communications channels. The NCSC has previously reported on the targeting of government officials’ accounts by China state-affiliated APT31, Russian Federal Security Service (FSB) actor Star Blizzard and Iran’s Islamic Revolutionary Guard Corps (IRGC). SafeBreach reported these findings to Google’s Vulnerability Reward Program on August 17, 2025.

Even though all of the vulnerabilities have been patched by the app developers, hackers would still be able to exploit the loophole if the targeted devices are running an older version of the apps. It is also possible that further research would discover more security issues that may be currently in use by hackers. Making sure you have high-end antivirus software installed on all your connected devices and that you regularly update your apps and OS is a must should you want to avoid cyber criminals from having a way into your personal life.

Implications For Smart Home Devices

In principle, it could be used to compromise an iPhone, as Cyber Security News reports. Following the discovery of the FaceTime vulnerability, Project Zero found similar flaws affecting Signal, Google Duo, Facebook Messenger, JioChat, and Mocha. No issues were found in the Telegram or Viber apps after they were also investigated. If someone leaves a project, their access to group chats must be revoked immediately. Chainalysis’ latest crime report notes that over $2.17 billion has been stolen so far in 2025, a pace that would take crypto-related thefts to new highs.

Users are encouraged to stay informed about potential risks and participate in awareness programs like the upcoming webinar on OWASP API Top 10 and WAAP guidance. Attackers can control connected devices such as lighting and windows via Google Home. The techniques also allow for covert video streaming by remotely activating video conferencing software, posing significant privacy threats.

This means that unless copied, the response will look completely innocent to the user, despite containing the malicious context, which will be read by ChatGPT. Furthermore, user interaction is required for a successful attack, meaning a target would likely need to click a malicious link or open a specially crafted file. Signal is still one of the most secure messaging apps available, but it’s not foolproof. And as recent incidents have shown, even the best tools can be compromised if used carelessly. Communications leaders must stop thinking of security as someone else’s job and start treating it as a core part of their own.

News

Therefore, despite being susceptible to prompt injection in the Browsing Context, the user should, theoretically, be safe, as SearchGPT is doing the browsing. While this specific Teams RCE flaw requires a complex attack chain, past vulnerabilities in enterprise messaging apps have shown the potential for widespread impact. An attacker could exploit this flaw to overwrite critical data or execute malicious code within the context of the Teams application. From there, the hacker would start hearing audio from the victim’s end of the call, even if they didn’t answer, for however long it rang.

A recent NPR feature on vulnerabilities within Pentagon communications highlights just how fragile even highly secure systems can be when subjected to targeted attacks. These platforms handle critical activities including social interactions, financial transactions, and business communications for billions of users globally, making successful attacks particularly devastating. What makes this attack particularly dangerous is its exploitation of WeChat’s debugging URL mechanism and built-in browser features. The app includes debugging functionality triggered when users access URLs containing specific parameters, which attackers can abuse to execute high-risk actions like configuration changes without user awareness. The majority of the research was done on ChatGPT 4o, but OpenAI is constantly tuning and improving their platform, and has since launched ChatGPT 5.

• On an individual level, there are several guidelines anyone can follow to reduce their exposure when using messaging apps.
• Enter your email and never miss timely alerts and security guidance from the experts at Tenable.
• Hundreds of millions of users ask LLMs questions that require searching the web, and it seems that LLMs will eventually replace classic search engines.
• The famous phrase “I joined the wrong chat” went from a joke to a global example of the recklessness of discussing military secrets in an encrypted chat without formal controls.
• That includes draft statements, internal assessments, and real-time strategy adjustments.

SENTRIQS has worked with the Air Force and participated in Cyber Dawg, an exercise led by the state of Georgia designed to test cyber capabilities and train personnel against sophisticated threats. Signal has become widely used in government and political circles because of its end-to-end encryption and reputation for protecting private communications. The app drew even greater scrutiny after senior Trump administration officials used a Signal group chat to discuss military operations in Yemen earlier this year.

That code, which many apps (including banking, social media, and SMS-ID authentication systems) use as a second layer of security , is the master key. Sharing it, even “because a friend asked for it,” is tantamount to handing over control of the account on a silver platter. Once inside, the criminal can impersonate the victim to request money, access previous conversations, or extend the attack to other services linked to the same number.

That means that any website that is indexed on Bing has a bing.com URL that will redirect to it. Krebs on Security reports that a flood of E-ZPass and other toll road scam messages appear to has been generated by a Chinese phishing kit. Over the past couple of months, BleepingComputer has seen a surge in smishing attacks that attempt to trick users into replying to a text so that links are enabled again. According to Microsoft, a successful exploit could have a high impact on the confidentiality, integrity, and availability of a user’s data, granting the attacker privileges to read, write, and delete information. Microsoft disclosed a significant remote code execution (RCE) vulnerability in its Teams collaboration software as part of its August 2025 Patch Tuesday updates.

Recent research highlights critical weaknesses in these platforms, underscoring the delicate balance between functionality and security. The problem is that these tools, while offering better protection than SMS or unencrypted email , are not designed for the level of security required for high-value strategic communications. They tend to concentrate the infrastructure in a few of the provider’s data centers, creating single points of failure and prime targets for attackers and legal pressure from foreign governments.

Leveraging personal data collected from previous breaches or social media, the attacker impersonates an acquaintance, technical support, or a trusted entity, convincing the victim to provide the verification code received via SMS. This means attackers will continue to exploit SMS vulnerabilities well into the 5G era. As long as interconnects link SS7, Diameter, and IMS networks, SMS-based attacks are not going away.

The imagent process has been a frequent target for sophisticated attackers, having been exploited in previous high-profile campaigns including FORCEDENTRY and BLASTPASS operations. The NICKNAME vulnerability exploits a race condition in the “imagent” process, which handles all iMessage traffic on iOS devices. When users update their contact profiles, including nickname, photo, or wallpaper, the system generates “Nickname Updates” that are processed by recipients’ devices. A previously unknown zero-click vulnerability in Apple’s iMessage appears to have been exploited by sophisticated threat actors targeting high-profile individuals across the United States and the European Union. Fortune also cautioned that no communications platform can credibly promise absolute security. Instead, he said agencies should evaluate the entire security architecture behind a product, including identity management, device security, infrastructure and administrative controls.

The NCSC and international partners have seen growing malicious activity from Russia-based actors using messaging apps to target high-risk individuals. Alongside international partners, the NCSC has issued actions for individuals at risk of targeted attacks against messaging apps. In organizations like the Balearic Islands Health Service , instant messaging has become an essential tool for rapid communication between professionals, but that doesn’t mean you can use just any app you have on your personal phone. The choice of tool directly impacts patient data confidentiality and legal compliance. A typical example is an email that appears to be from WhatsApp and invites you to “back up your messages and call history” via a link.

By November 14, 2025, Google confirmed the deployment of content classifier updates that effectively countered the described attack methods. Additionally, there are alarming tactics like covert video streaming, where an attacker can force Zoom to launch and stream the victim’s camera live through a 301 HTTP redirect from a Safe Browsing-approved domain. It’s not just a matter of technology, but of demonstrating, with documentation and evidence, that the most demanding standards are met. The conversation included names like Vice President JD Vance, Secretary of Defense Pete Hegseth, Director of National Intelligence Tulsi Gabbard, Secretary of State Marco Rubio, and CIA Director John Ratcliffe, among others. The famous phrase “I joined the wrong chat” went from a joke to a global example of the recklessness of discussing military secrets in an encrypted chat without formal controls. As security expert Luis Corrons pointed out, a careful attacker would perform the scan slowly and across many IP addresses , blending in with normal traffic and evading detection.

In addition to its long-term memory feature, ChatGPT considers the current conversation and context when responding. To avoid confusion, we will refer to this type of memory as Conversational Context. If the user asks it to remember something, or if there is some information that the engine deems important even without an explicit request, it can be remembered using memories. As is seen in the System Prompt, theamoredate.com the memories are invoked internally using the bio tool and sent as a static context along with it.