A malware campaign was recently detected in Brazil, distributing a malicious LNK file using WhatsApp. It targets mainly Brazilians and uses Portuguese-named URLs. To evade detection, the command-and-control (C2) server verifies each download to ensure it originates from the malware itself.
The whole infection chain is complex and fully fileless, and by the end, it will deliver a new banking Trojan named Maverick, which contains many code overlaps with Coyote. In this blog post, we detail the entire infection chain, encryption algorithm, and its targets, as well as discuss the similarities with known threats.

Key findings:

• A massive campaign disseminated through WhatsApp distributed the new Brazilian banking Trojan named “Maverick” through ZIP files containing a malicious LNK file, which is not blocked on the messaging platform.
• Once installed, the Trojan uses the open-source project WPPConnect to automate the sending of messages in hijacked accounts via WhatsApp Web, taking advantage of the access to send the malicious message to contacts.
• The new Trojan features code similarities with another Brazilian banking Trojan called Coyote; however, we consider Maverick to be a new threat.
• The Maverick Trojan checks the time zone, language, region, and date and time format on infected machines to ensure the victim is in Brazil; otherwise, the malware will not be installed.
• The banking Trojan can fully control the infected computer, taking screenshots, monitoring open browsers and websites, installing a keylogger, controlling the mouse, blocking the screen when accessing a banking website, terminating processes, and opening phishing pages in an overlay. It aims to capture banking credentials.
• Once active, the new Trojan will monitor the victims’ access to 26 Brazilian bank websites, 6 cryptocurrency exchange websites, and 1 payment platform.
• All infections are modular and performed in memory, with minimal disk activity, using PowerShell, .NET, and shellcode encrypted using Donut.
• The new Trojan uses AI in the code-writing process, especially in certificate decryption and general code development.
• Our solutions have blocked 62 thousand infection attempts using the malicious LNK file in the first 10 days of October, only in Brazil.

Initial infection vector

The infection chain works according to the diagram below:

The infection begins when the victim receives a malicious .LNK file inside a ZIP archive via a WhatsApp message. The filename can be generic, or it can pretend to be from a bank:

The message said, “Visualization allowed only in computers. In case you’re using the Chrome browser, choose “keep file” because it’s a zipped file”.

The LNK is encoded to execute cmd.exe with the following arguments:

The decoded commands point to the execution of a PowerShell script:

The command will contact the C2 to download another PowerShell script. It is important to note that the C2 also validates the “User-Agent” of the HTTP request to ensure that it is coming from the PowerShell command. This is why, without the correct “User-Agent”, the C2 returns an HTTP 401 code.

The entry script is used to decode an embedded .NET file, and all of this occurs only in memory. The .NET file is decoded by dividing each byte by a specific value; in the script above, the value is “174”. The PE file is decoded and is then loaded as a .NET assembly within the PowerShell process, making the entire infection fileless, that is, without files on disk.

Initial .NET loader

The initial .NET loader is heavily obfuscated using Control Flow Flattening and indirect function calls, storing them in a large vector of functions and calling them from there. In addition to obfuscation, it also uses random method and variable names to hinder analysis. Nevertheless, after our analysis, we were able to reconstruct (to a certain extent) its main flow, which consists of downloading and decrypting two payloads.

The obfuscation does not hide the method’s variable names, which means it is possible to reconstruct the function easily if the same function is reused elsewhere. Most of the functions used in this initial stage are the same ones used in the final stage of the banking Trojan, which is not obfuscated. The sole purpose of this stage is to download two encrypted shellcodes from the C2. To request them, an API exposed by the C2 on the “/api/v1/” routes will be used. The requested URL is as follows:

• hxxps://sorvetenopote.com/api/v1/3d045ada0df942c983635e

To communicate with its API, it sends the API key in the “X-Request-Headers” field of the HTTP request header. The API key used is calculated locally using the following algorithm:

• “Base64(HMAC256(Key))”

The HMAC is used to sign messages with a specific key; in this case, the threat actor uses it to generate the “API Key” using the HMAC key “MaverickZapBot2025SecretKey12345”. The signed data sent to the C2 is “3d045ada0df942c983635e|1759847631|MaverickBot”, where each segment is separated by “|”. The first segment refers to the specific resource requested (the first encrypted shellcode), the second is the infection’s timestamp, and the last, “MaverickBot”, indicates that this C2 protocol may be used in future campaigns with different variants of this threat. This ensures that tools like “wget” or HTTP downloaders cannot download this stage, only the malware.

Upon response, the encrypted shellcode is a loader using Donut. At this point, the initial loader will start and follow two different execution paths: another loader for its WhatsApp infector and the final payload, which we call “MaverickBanker”. Each Donut shellcode embeds a .NET executable. The shellcode is encrypted using a XOR implementation, where the key is stored in the last bytes of the binary returned by the C2. The algorithm to decrypt the shellcode is as follows:

• Extract the last 4 bytes (int32) from the binary file; this indicates the size of the encryption key.
• Walk backwards until you reach the beginning of the encryption key (file size – 4 – key_size).
• Get the XOR key.
• Apply the XOR to the entire file using the obtained key.

WhatsApp infector downloader

After the second Donut shellcode is decrypted and started, it will load another downloader using the same obfuscation method as the previous one. It behaves similarly, but this time it will download a PE file instead of a Donut shellcode. This PE file is another .NET assembly that will be loaded into the process as a module.

One of the namespaces used by this .NET executable is named “Maverick.StageOne,” which is considered by the attacker to be the first one to be loaded. This download stage is used exclusively to download the WhatsApp infector in the same way as the previous stage. The main difference is that this time, it is not an encrypted Donut shellcode, but another .NET executable—the WhatsApp infector—which will be used to hijack the victim’s account and use it to spam their contacts in order to spread itself.

This module, which is also obfuscated, is the WhatsApp infector and represents the final payload in the infection chain. It includes a script from WPPConnect, an open-source WhatsApp automation project, as well as the Selenium browser executable, used for web automation.

The executable’s namespace name is “ZAP”, a very common word in Brazil to refer to WhatsApp. These files use almost the same obfuscation techniques as the previous examples, but the method’s variable names remain in the source code. The main behavior of this stage is to locate the WhatsApp window in the browser and use WPPConnect to instrument it, causing the infected victim to send messages to their contacts and thus spread again. The file sent depends on the “MaverickBot” executable, which will be discussed in the next section.

Maverick, the banking Trojan

The Maverick Banker comes from a different execution branch than the WhatsApp infector; it is the result of the second Donut shellcode. There are no additional download steps to execute it. This is the main payload of this campaign and is embedded within another encrypted executable named “Maverick Agent,” which performs extended activities on the machine, such as contacting the C2 and keylogging. It is described in the next section.

Upon the initial loading of Maverick Banker, it will attempt to register persistence using the startup folder. At this point, if persistence does not exist, by checking for the existence of a .bat file in the “Startup” directory, it will not only check for the file’s existence but also perform a pattern match to see if the string “for %%” is present, which is part of the initial loading process. If such a file does not exist, it will generate a new “GUID” and remove the first 6 characters. The persistence batch script will then be stored as:

• “C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\” + “HealthApp-” + GUID + “.bat”.

Next, it will generate the bat command using the hardcoded URL, which in this case is:

• “hxxps://sorvetenopote.com” + “/api/itbi/startup/” + NEW_GUID.

In the command generation function, it is possible to see the creation of an entirely new obfuscated PowerShell script.

First, it will create a variable named “$URL” and assign it the content passed as a parameter, create a “Net.WebClient” object, and call the “DownloadString.Invoke($URL)” function. Immediately after creating these small commands, it will encode them in base64. In general, the script will create a full obfuscation using functions to automatically and randomly generate blocks in PowerShell. The persistence script reassembles the initial LNK file used to start the infection.

This persistence mechanism seems a bit strange at first glance, as it always depends on the C2 being online. However, it is in fact clever, since the malware would not work without the C2. Thus, saving only the bootstrap .bat file ensures that the entire infection remains in memory. If persistence is achieved, it will start its true function, which is mainly to monitor browsers to check if they open banking pages.

The browsers running on the machine are checked for possible domains accessed on the victim’s machine to verify the web page visited by the victim. The program will use the current foreground window (window in focus) and its PID; with the PID, it will extract the process name. Monitoring will only continue if the victim is using one of the following browsers:

* Chrome
* Firefox
* MS Edge
* Brave
* Internet Explorer
* Specific bank web browser

If any browser from the list above is running, the malware will use UI Automation to extract the title of the currently open tab and use this information with a predefined list of target online banking sites to determine whether to perform any action on them. The list of target banks is compressed with gzip, encrypted using AES-256, and stored as a base64 string. The AES initialization vector (IV) is stored in the first 16 bytes of the decoded base64 data, and the key is stored in the next 32 bytes. The actual encrypted data begins at offset 48.

This encryption mechanism is the same one used by Coyote, a banking Trojan also written in .NET and documented by us in early 2024.

If any of these banks are found, the program will decrypt another PE file using the same algorithm described in the .NET Loader section of this report and will load it as an assembly, calling its entry point with the name of the open bank as an argument. This new PE is called “Maverick.Agent” and contains most of the banking logic for contacting the C2 and extracting data with it.

Maverick Agent

The agent is the binary that will do most of the banker’s work; it will first check if it is running on a machine located in Brazil. To do this, it will check the following constraints:

What each of them does is:

• IsValidBrazilianTimezone()
  Checks if the current time zone is within the Brazilian time zone range. Brazil has time zones between UTC-5 (-300 min) and UTC-2 (-120 min). If the current time zone is within this range, it returns “true”.
• IsBrazilianLocale()
  Checks if the current thread’s language or locale is set to Brazilian Portuguese. For example, “pt-BR”, “pt_br”, or any string containing “portuguese” and “brazil”. Returns “true” if the condition is met.
• IsBrazilianRegion()
  Checks if the system’s configured region is Brazil. It compares region codes like “BR”, “BRA”, or checks if the region name contains “brazil”. Returns “true” if the region is set to Brazil.
• IsBrazilianDateFormat()
  Checks if the short date format follows the Brazilian standard. The Brazilian format is dd/MM/yyyy. The function checks if the pattern starts with “dd/” and contains “/MM/” or “dd/MM”.

Right after the check, it will enable appropriate DPI support for the operating system and monitor type, ensuring that images are sharp, fit the correct scale (screen zoom), and work well on multiple monitors with different resolutions. Then, it will check for any running persistence, previously created in “C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\”. If more than one file is found, it will delete the others based on “GetCreationTime” and keep only the most recently created one.

C2 communication

Communication uses the WatsonTCP library with SSL tunnels. It utilizes a local encrypted X509 certificate to protect the communication, which is another similarity to the Coyote malware. The connection is made to the host “casadecampoamazonas.com” on port 443. The certificate is exported as encrypted, and the password used to decrypt it is Maverick2025!. After the certificate is decrypted, the client will connect to the server.

For the C2 to work, a specific password must be sent during the first contact. The password used by the agent is “101593a51d9c40fc8ec162d67504e221”. Using this password during the first connection will successfully authenticate the agent with the C2, and it will be ready to receive commands from the operator. The important commands are:

Agent profile info

In the “INFOCLIENT” command, the information sent to the C2 is as follows:

• Agent ID: A SHA256 hash of all primary MAC addresses used by all interfaces
• Username
• Hostname
• Operating system version
• Client version (no value)
• Number of monitors
• Home page (home): “home” indicates which bank’s home screen should be used, sent before the Agent is decrypted by the banking application monitoring routine.
• Screen resolution

Conclusion

According to our telemetry, all victims were in Brazil, but the Trojan has the potential to spread to other countries, as an infected victim can send it to another location. Even so, the malware is designed to target only Brazilians at the moment.
It is evident that this threat is very sophisticated and complex; the entire execution chain is relatively new, but the final payload has many code overlaps and similarities with the Coyote banking Trojan, which we documented in 2024. However, some of the techniques are not exclusive to Coyote and have been observed in other low-profile banking Trojans written in .NET. The agent’s structure is also different from how Coyote operated; it did not use this architecture before.
It is very likely that Maverick is a new banking Trojan using shared code from Coyote, which may indicate that the developers of Coyote have completely refactored and rewritten a large part of their components.
This is one of the most complex infection chains we have ever detected, designed to load a banking Trojan. It has infected many people in Brazil, and its worm-like nature allows it to spread exponentially by exploiting a very popular instant messenger. The impact is enormous. Furthermore, it demonstrates the use of AI in the code-writing process, specifically in certificate decryption, which may also indicate the involvement of AI in the overall code development. Maverick works like any other banking Trojan, but the worrying aspects are its delivery method and its significant impact.
We have detected the entire infection chain since day one, preventing victim infection from the initial LNK file. Kaspersky products detect this threat with the verdict HEUR:Trojan.Multi.Powenot.a and HEUR:Trojan-Banker.MSIL.Maverick.gen.

IoCs

securelist.com/maverick-banker…

Every now and then in histories of the 20th’s century’s earlier years, you will see pictures of cars and commercial vehicles equipped with bulky drums, contraptions to make their fuel from waste wood. These are portable gas generators known as gasifiers, and to show how they work there’s [Greenhill Forge] with a build video.
A gasifier on a vintage tractor. Per Larssons Museum, CC BY 2.5.
When you burn a piece of wood, you expect to see flame. But what you are looking at in that flame are the gaseous products of the wood breaking down under the heat of combustion. The gasifier carefully regulates a burn to avoid that final flame, with the flammable gasses instead being drawn off for use as fuel.

The chemistry is straightforward enough, with exothermic combustion producing heat, water vapour, and carbon dioxide, before a further endothermic reduction stage produces carbon monoxide and hydrogen. He’s running his system from charcoal which is close to pure carbon presumably to avoid dealing with tar, and at this stage he’s not adding any steam, so we’re a little mystified as to where the hydrogen comes from unless there is enough water vapour in the air.

His retort is fabricated from sheets steel, and is followed by a cyclone and a filter drum to remove particulates from the gas. It relies on a forced air draft from a fan or a small internal combustion engine, and we’re surprised both how quickly it ignites and how relatively low a temperature the output gas settles at. The engine runs with a surprisingly simple gas mixer in place of a carburetor, and seems to be quite smooth in operation.

This is one of those devices that has fascinated us for a long time, and we’re grateful for the chance to see it up close. The video is below the break, and we’re promised a series of follow-ups as the design is refined.

youtube.com/embed/nXEDKRbiJe4?…

hackaday.com/2025/10/15/keep-t…

If there ever was a toy that enjoys universal appeal and recognition, the humble Rubik’s Cube definitely is on the list. Invented in 1974 by sculptor and professor of architecture Ernő Rubik with originally the name of Magic Cube, it features a three-by-three grid of colored surfaces and an internal mechanism which allows for each of these individual sections of each cube face to be moved to any other face. This makes the goal of returning each face to its original single color into a challenge, one which has both intrigued and vexed many generations over the decades. Maybe you’ve seen one?

Although there have been some variations of the basic 3×3 grid cube design over the years, none have been as controversial as the recently introduced WOWCube. Not only does this feature a measly 2×2 grid on each face, each part of the grid is also a display that is intended to be used alongside an internal processor and motion sensors for digital games. After spending many years in development, the Rubik’s WOWCube recently went up for sale at $299, raising many questions about what market it’s really targeting.

Is the WOWCube a ‘real’ Rubik’s Cube, and what makes something into a memorable toy and what into a mere novelty gadget that is forgotten by the next year like a plague of fidget spinners?

The Cube’s Genius

Rubik’s Cube components with the nylon core visible. (Credit: Encik Tekateki)
Originally created as a 3D visualization aid for Rubik’s students, the key to the Cube is a sphere. Specifically, the rotation occurs around said internal sphere, with the outer elements interlocked in such a way that they allow for free movement along certain planes. It is this simple design that was turned into a toy by the 1980s, with its popularity surging and never really fading.

There are a few definitions of a ‘toy’, which basically all come down to ‘an object to play with’, meaning something that provides pleasure through act of interacting with it, whether that’s in the innocent sense of a child’s playing time, or the mind-in-gutter adult sense. These objects are thus effectively without real purpose other than to provide entertainment and potentially inflict basic skills on a developing mind.

Although this may seem like a clear-cut distinction, there is a major grey zone, inside of which we find things like of ‘educational toys’ and games like chess. These are toys which are explicitly designed to only provide some kind of reward after a puzzle is solved, often requiring various levels of mental exertion.

It’s hard to argue that a Rubik’s Cube isn’t an educational toy, especially considering its original purpose within the education system. After shuffling the faces of the cube, the goal is to somehow move the individual blocks of color back to their fellow colors on a singular face. This is a process that can be done through a variety of methods, the easiest of which is to recognize the patterns that are formed by the colors.

Generally, solving a Rubik’s Cube is done algorithmically, using visual recognition of patterns and applying the appropriate response. While a casual ‘Cuber’ can solve a standard 3×3 cube in less than half an hour using the basic layer-by-layer algorithm, so-called speedcubers can knock this down to a few seconds by applying far more complicated algorithms. As of May 2025 the world record for fastest single solve stands at 3.05 seconds, achieved by Xuanyi Geng.

In this regard, one can easily put Rubik’s Cube in the same general ‘toy’ category as games like chess, go, and shogi. Although the Cube isn’t by itself a multiplayer game, it also clearly invites competition and a social atmosphere in which to better oneself at the game.

Does It WOW?

With the Cube so firmly established in the global community’s psyche and the multi-colored ‘toy’ a symbol of why paying attention during math classes can absolutely pay off later in life, this brings us to the WOWCube. Looking at the official website for the item, one can’t help but feel less than inspired.
Would you rather play this than solve a Rubik’s Cube? (Credit: WOWCube)
Backing up a bit, the device itself is already a major departure from the Cube. Although the WOWCube’s price tag at $299 is absolutely worthy of a ‘Wow’, the 2×2 configuration is decidedly underwhelming. Yes, it rotates like a Cube, and you could use it like a regular 2×2 Cube if that is your thing and you hate a challenge, but the general vibe is that you’re supposed to be playing the equivalent of Flash or phone games on the screens, in addition to using it like a geometrically-challenged smartphone to display statuses and notifications.

For these applications you have the use of a total of 24 1.4″ IPS LC displays, each with a 240 x 240 resolution. Due to the 2×2 configuration, you have eight blocks that can be moved around, each with its own built-in processor, battery, speaker and 6-axis IMU sensor for gyroscope and accelerometer functionality. These blocks communicate with each other using a magnetic system, and after up to five hours of play time you have to recharge it on the special charger.

Currently you can only pre-order the special Rubik’s WOWCube, with delivery expected ‘by Christmas 2025’. You can however get a good idea of what the experience will be like from videos like the 2022 review video of a pre-production unit by MetalJesusRocks, who also helpfully did a teardown while reconnecting the battery in one block after it disconnected during use.
The 2022 preproduction WOWCube with a block removed. (Credit: MetalJesusRocks, YouTube)
The internals of a 2022-era WOWCube block. (Credit: MetalJesusRocks, YouTube)

Although this happened with a preproduction unit, it provides some indications regarding the expected lifespan of a WOWCube, as these devices are likely to experience constant mechanical forces being applied to it. With no touchscreen, you have to sometimes rather violently tap the cube or shake it to register user input, which will likely do wonders for long-term reliability.

In the earlier referenced pre-production review, the conclusion was – especially after having a group of random folk try it out – that although definitely an interesting device, it’s too expensive and too confused about who or what it is targeting. This is also the vibe in a brief production unit review by major gadget YouTube channel Mrwhosetheboss, whose ‘Overkill Toys’ video spent a few minutes fiddling with a 2023-era, $599 Black Edition WOWCube before giving it the ‘impressive, but why’ thumbs down.

This also reveals the interesting aspect here, namely that the WOWCube never was designed by the Rubik’s Cube company for Rubik’s Cube users, but rather it’s the Cubios Inc. company that created the WOWCube Entertainment System. The company that owns the Rubik’s brand name, Spin Master, has decided to make this $299 version of with official Rubik’s Cube branding. Basically, you could have bought your own WOWCube all along for the past few years now.

More Of A MehCube

Considering the overwhelming chorus of crickets that greeted the release of earlier versions of the WOWCube Entertainment System, it seems unlikely that slapping Rubik’s Cube branding on a WOWCube will do much to change the outcome. Although Cube enthusiasts don’t mind shelling out a few hundred bucks for a magnetically levitated, fairy dust-lubricated Cube to gain that 0.1 second advantage in competitive solving, this is totally distinct from this WOWCube product.

While absolutely impressive from a technological perspective, and likely a fun toy for (adult) children who can use it to keep themselves occupied with a range of potentially educational games, the price tag and potentially fragile nature of the device rather sours the deal. You do not want to give the WOWCube to a young child who may drop it harder than a $1,400 iPad, while giving Junior a dodgy $5 Rubik’s Cube clone to develop their algorithmic skills with is far less of a concern.

So if Rubik’s Cube fans don’t seem interested in this device, and the average person might be interested, but only if it was less than $100, it would seem that the WOWCube is condemned to be just another overpriced gadget, and not some kind of ‘digital re-imagining’ of the veritable Cube, as much as the marketing makes you want to sign up for a WOWClub subscription and obligatory ‘AI’ features.

hackaday.com/2025/10/15/rubiks…

We were recently tipped off to quite a resource — on the Texas Instruments website, there’s a page where you can view and download a compendium of analog sub-circuits.

Individual circuits can be downloaded in the form of PDF files. If you chose to register (which is free), you’ll also gain access to the pair of e-books listed at the bottom of the page: Analog Engineer’s Circuit Cookbook: Amplifiers and Analog Engineer’s Circuit Cookbook: Data Converters. The data converter circuits can be further subdivided into analog-to-digital converter (ADC) circuits and digital-to-analog converter (DAC) circuits.

There are more than 60 amplifier circuits including basic circuits, current sensing circuits, signal sources, current sources, filters, non-linear circuits (rectifiers/clamps/peak detectors), signal conditioning, comparators, sensor acquisition, audio, and integrated amplifier circuits using MSP430 microcontrollers.

You’ll also find 39 analog-to-digital converter (ADC) circuits including low-power, small size, and cost optimized circuits; level translation and input drive circuits; low-level sensor input circuits; input protection, filtering and isolation circuits; and commonly used auxiliary circuits. Finally, there are 15 digital-to-analog converter (DAC) circuits including audio outputs, auxiliary and biasing circuits, current sources, and voltage sources.

Thanks to [Lee Leduc] for letting us know over on the EEVblog Forum.

hackaday.com/2025/10/15/more-t…

L’Australian Signals Directorate (ASD) ha lanciato un nuovo allarme sulla crescente attività di gruppi di hacker sponsorizzati dal Partito Comunista Cinese, accusati di condurre operazioni di spionaggio digitale e di furto di dati sensibili contro istituzioni australiane.

Il Cyber Threat Report 2024-2025, pubblicato martedì, evidenzia che nel corso dell’ultimo anno l’ASD ha gestito 1.200 incidenti di sicurezza informatica, segnando un aumento dell’11% rispetto all’anno precedente.

APT40: la cyber-spia di Pechino

Il documento attribuisce buona parte delle intrusioni al gruppo APT40, collegato al Ministero della Sicurezza dello Stato (MSS) cinese. Il collettivo sarebbe coinvolto in campagne di infiltrazione mirate a raccogliere informazioni strategiche da reti governative, infrastrutture critiche e agenzie di difesa australiane.

Secondo il rapporto, APT40 ha messo in atto “operazioni malevole” contro reti nazionali e regionali di interesse strategico per la Cina, sfruttando router domestici e di piccoli uffici (SOHO) infetti per creare botnet difficili da individuare. Il traffico dannoso verrebbe così mascherato tra quello legittimo dei proprietari dei dispositivi, rendendo complessa l’attività di difesa.

Le indagini dell’ASD rivelano inoltre che, una volta ottenuto l’accesso iniziale, il gruppo tende ad abbandonare i malware tradizionali, preferendo utilizzare credenziali rubate per impersonare utenti legittimi e mantenere l’accesso alle reti compromesse. Questo approccio consente agli hacker di operare per lunghi periodi senza essere scoperti.

L’allarme del governo australiano

Il vice primo ministro e ministro della Difesa Richard Marles ha sottolineato che il rapporto dell’ASD “descrive un panorama di minacce sempre più complesso”, ricordando che “lo spionaggio informatico e la criminalità digitale rappresentano ormai una minaccia concreta per i servizi essenziali del Paese”.

Marles ha ribadito l’urgenza di una cooperazione stretta tra governo e industria privata per rafforzare la resilienza digitale nazionale: “Solo unendo le forze possiamo proteggere le arterie informatiche dell’economia australiana”.

In una dichiarazione congiunta, il ministro per la Sicurezza informatica Tony Burke e il Dipartimento federale degli Affari Interni hanno aggiunto che i cittadini restano un elemento chiave della difesa digitale del Paese.
“Anche azioni semplici come aggiornare regolarmente i software, usare passphrase complesse e abilitare l’autenticazione a più fattori possono ridurre drasticamente il rischio di attacchi”, ha affermato Burke, ricordando che la maggior parte degli incidenti è prevenibile.

Un attacco ogni sei minuti

Il Cyber Threat Report rivela che nel periodo 2024-2025 l’Australian Cyber Security Centre (ACSC) ha ricevuto 84.700 segnalazioni di reati informatici, pari a una ogni sei minuti.
La frode d’identità è risultata il crimine digitale più frequente, con un incremento annuo dell’8%.

Nel corso dell’anno, la Cyber Security Hotline ha gestito oltre 42.500 chiamate, con un aumento del 16% rispetto all’anno precedente, registrando una media di 116 richieste giornaliere.

Perdite record per imprese e cittadini

Le perdite economiche dovute agli attacchi informatici sono cresciute in modo significativo.
Le vittime individuali hanno subito perdite medie di 33.000 dollari australiani (+8%), mentre le aziende hanno registrato un aumento del 50%, raggiungendo 80.850 dollari australiani per incidente.

L’ASD ha inoltre segnalato che circa l’11% degli incidenti gestiti ha riguardato attacchi ransomware, mentre gli attacchi DoS/DDoS hanno superato quota 200, con un incremento del 280% rispetto al 2023-2024.

Il caso Qantas: 5,7 milioni di clienti esposti

La pubblicazione del rapporto arriva pochi giorni dopo la diffusione sul dark web dei dati di 5,7 milioni di clienti Qantas, sottratti da hacker ignoti.
Le informazioni compromesse includevano nomi, indirizzi, contatti telefonici, e-mail, date di nascita e dettagli dei frequent flyer, oltre a indirizzi di casa e preferenze alimentari.

La compagnia aerea australiana ha annunciato l’attivazione di una hotline di supporto 24 ore su 24 e la messa a disposizione di consulenze per la protezione dell’identità dei clienti colpiti.

L'articolo Australia nel mirino di hacker cinesi: svelato il nuovo rapporto dell’intelligence proviene da il blog della sicurezza informatica.

Questo signore con l'aria un po' alla Gèc Nìcolson si chiama Gianluca (ué figa) Soncin.
Ha una cinquantina d'anni, proprio come il vignaiolo Emanuele Ragnedda; è nato a Biella e abita a Cervia.
Veste con eleganza, e la cosa già dovrebbe destare sospetti.
Secondo il gazzettaio del 16 ottobre 2025 guadagna denaro vendendo e comprando automobili invece che facendo strizzare frutta per venderne il succo fermentato, e ha anche lui i comportamenti di consumo di chi guadagna -o meglio, di chi vuol fare intendere di guadagnare- molto denaro.
Il che dovrebbe destare ancora più sospetti.
Chi guadagna molto denaro dovrebbe essere contento di non doversela vedere con l'indigenza.
Invece chi guadagna molto denaro -e soprattutto chi vuol fare intendere di guadagnarne- risulta per lo più decisamente antipatico.
Il che fa aumentare i sospetti e li rafforza.
Se poi si legge che una volta stretta con burocratica rapidità una relazione peccaminosa con un individuo consimile di sesso opposto -solo con i costumi da bagno al posto delle automobili- lo avrebbe esortato, incentivato e accompagnato all'uso di "sostanze psicotrope", i sospetti diventano certezze.
Una attendibile ricostruzione dei comportamenti di consumo e della natura delle relazioni tra individui di questo genere non è certo ricavabile dal gazzettaio; unica fonte documentale minimamente attendibile sarebbero i rispettivi estratti conto.
Ma insomma, dal poco che si può capire -oltre a vendere e comprare automobili- Gianluca Soncin nel corso degli ultimi due anni avrebbe trovato il tempo per le seguenti attività relazionali, non si sa se remunerate o meno.
L'epilogo si è tenuto in un quartiere della periferia milanese eloquentemente privo di qualsiasi caratteristica instagrammabile.
La coprotagonista è sempre la stessa, che a distanza di chissà quanti anni verrà ricordata come una "fotomodella a cui piace vestire alla modo [sic] rigorosamente firmato, uscire con gli amici, viaggiare per il mondo e gustarsi ogni momento della giornata per essere felice".

Estate 2024: viaggio all’Elba. Lui la tempesta di calci e pugni durante una lite, e «cerca di buttarla dal balcone».
Settembre 2024: un’altra aggressione, questa volta durante una gita a Venezia.
Lo scorso aprile lei vuole chiudere la relazione. Lascia Cervia. Lui l’avverte: «Se mi lasci t’ammazzo, e ammazzo tua madre». Pamela spaventata si sfoga con l’ex: «Non posso lasciarlo altrimenti m’ammazza». Tra loro è un tira e molla.
Il 9 maggio, nella casa di Milano interviene la polizia per una lite.
Gli episodi si moltiplicano.
Ad agosto lui le punta una pistola alla pancia.
Sabato scorso, durante una gita a Padova, lui minaccia di ucciderle il cane, la schiaffeggia.
Dopo quel giorno, lei lo caccia di casa.

Solo che il Gianluca (ué figa) si era fatto una copia delle chiavi.

(ovvero: per fare una call non c'è bisogno di un'app)

Ricevo un link per partecipare a una call importante a cui tenevo. Sapevo che era su Zoom, ma pensavo che avrei potuto partecipare tramite il browser, come sono quasi sicuro che si potesse fare fino a qualche tempo fa.
E invece no. Clicco su "Partecipa alla riunione". Compare il popup: "Non hai aperto Zoom? Tocca per installare l'app Zoom Workplace". Non la voglio la vostra app con l'AI companion e tutte le altre menate, fatemi continuare da browser, siamo nel 2025 mica nel 2012.
E niente, l'opzione non c'è. Non c'è neanche da desktop. Ti devi installare l'app e basta.

Amen, niente riunione. Per fortuna la registravano.

Il post sulle alternative libere per le call ce l'avevo "in canna" da un po', ora questa mi pare l'occasione giusta per scriverlo...

N.B.: tutte le istanze riportate offrono chiamate senza limiti di tempo e utilizzabili liberamente senza login.

1) JITSI

Da sempre il re dei software open source per le videochiamate.
Sviluppato dalla statunitense 8x8, offre chiamate con un numero massimo di partecipanti limitato solo dalla capacità del server che lo ospita. L'istanza "di bandiera" (meet.jit.si) supporta fino a 75 partecipanti.
Tra le feature figurano tutte le più comuni: chat interna, sfondi personalizzati, condivisione schermo, lavagna interattiva e altro.
Per un ente con un suo server è facilissimo installarlo e avere così un'istanza tutta propria.
Ma anche senza avere un server proprio, ci sono una quantità di server pubblici che lo offrono come servizio libero, senza login, senza app, senza limitazioni (a dir la verità, da cellulare compare una schermata che ti chiede se vuoi proseguire con l'app, ma puoi scegliere di restare nel browser). Se si sceglie di usare l'app client, questa è disponibile sia per Adroid che su iOs.
Tra i server pubblici italiani segnalo quello della Lixper Srl di Torino, smaug.lixper.it. Restando in Europa, si può scegliere quello di Systemli in Germania, o quello del collettivo Disroot nei Paesi Bassi.
Per non parlare degli "chatons" francesi: li trovate in questa pagina, nella casella "videoconferenza", e potete cambiare istanza cliccando sull'icona con le due frecce. Le istanze Evolix, Colibris e Deuxfleurs danno anche la possibilità di registrare la chiamata (da desktop).
Anche il servizio di videochiamata della svizzera Infomaniak, utilizzabile senza login, è basato su Jitsi (la registrazione delle chiamate è disponibile solo per chi ha un account Kdrive).
Infine, anche Brave Talk utilizza internamente jitsi, ma per utilizzarlo è necessario installare il browser Brave.

2) MIROTALK

Un progetto più recente ma decisamente interessante, ideato dall'italo-croato Miroslav Pejic, che si basa sulla tecnologia peer-to-peer per alleggerire il carico del server (ne ha parlato approfonditamente @morrolinux@mastodon.uno).
Anch'esso molto ricco di feature (chat, lavagna, screen e file sharing e registrazione integrale della chiamata da desktop - da cellulare si riesce a registrare l'audio di tutti i partecipanti insieme al solo video della propria fotocamera).
La webapp di base è open source e si può installare localmente (questa l'istanza pubblica pilota, utilizzabile da browser), mentre servizi più complessi per aziende sono a pagamento.

3) BRIEFING

Un'altra bella alternativa open source e privacy friendly (anche per le chiamate uno a uno), con alcune utili feature come chat, condivisione schermo, disegno a mano libera o testo, diverse opzioni di visualizzazione e anche un gioco di scacchi integrato.
Facilmente installabile anche su server proprio, il software è sviluppato dal tedesco Dirk Holtwick, che mantiene un'istanza pubblica, oltre a un'app client per iOs.

4) EduMEET

Software open source che brilla per la leggerezza, adatto ad essere usato anche su pc più datati, e che mantiene comunque un buon set di feature (chat, condivisione schermo, invio file, possibilità di aggiungere un altro flusso video e controllo diretto sulla risoluzione e il framerate per migliorare le prestazioni.
Due istanze pubbliche italiane sono offerte dal CNR (Consiglio Nazionale per le Ricerche) e consiglio di accedervi tramite il sito IoRestoACasa, un servizio nato in tempi di lockdown e fornito dal gruppo omonimo di Fabriano, che mantiene anche una versione modificata del software originale.
Restando invece a quest'ultimo, sviluppato all'interno della collaborazione europea Géant, si può usarlo qui sul server italiano del consorzio GARR, o ancora provare l'istanza pilota.

5) BigBlueButton

Probabilmente il software open source più completo e avanzato, con funzioni quali presentazione integrata (da file o direttamente dalle note), lavagna interattiva, sondaggio e cronometro, oltre alla classica chat e alle note condivise formattate. Queste caratteristiche lo rendono un'ottima scelta per una classe virtuale, per conferenze e seminari accademici (è diventato, tra l'altro, lo standard francese per la didattica a distanza).
Nato all'interno dell'Università Carleton di Ottawa (Canada), se ne può trovare qui un'istanza pubblica utiizzabile liberamente (gestita dall'organizzazione Senfcall di Darmstadt, Germania). Creando un account su Senfcall è possibile creare stanze permanenti per i propri corsi e seminari, che possono ospitare senza problemi anche 250 partecipanti.

#Google #nogoogle #googlemeet #zoom #degafam #monopolio #alternative #call