Salta al contenuto principale



Vi viene in mente qualche SW Open Source per gestire la prenotazione di scrivanie in un'azienda dove si fa smart working e le scrivanie vengono usate a rotazione (nessuno ha la sua e quindi ci si mette dove capita)?



Danimarca: crollano i socialdemocratici, a Copenaghen vince la sinistra


@Notizie dall'Italia e dal mondo
A Copenaghen ed in altre città della Danimarca crollano i socialdemocratici, puniti per la loro svolta a destra, e avanzano diversi partiti di sinistra più o meno radicale
L'articolo Danimarca: crollano i socialdemocratici, a Copenaghen vince la sinistra proviene da




Truffe online sfruttano la condivisione schermo di WhatsApp: come difendersi


@Informatica (Italy e non Italy 😁)
Una nuova tattica ingannevole sta inducendo le persone a condividere lo schermo del proprio telefono durante una videochiamata su WhatsApp per rubare dati, identità e il loro denaro. Un meccanismo di truffa particolarmente efficace da cui è





Trump tra insulti e aggressività, gli attacchi a giornalisti e rivali

[quote]NEW YORK – Offese rivolte alle donne, alle persone con disabilità e anche ai suoi avversari. Gli insulti e le umiliazioni sembrano essere parte integrante della comunicazione del presidente degli…
L'articolo Trump tra insulti e aggressività, gli attacchi a giornalisti e rivali su



Manovra, si tratta. La Lega rilancia sulle pensioni. Ipotesi condono “largo” fino al 2025

Alle 16 il termine per l'indicazione degli emendamenti segnalati, cioè quelli per i quali i gruppi chiedono un esame in via prioritaria
L'articolo Manovra, si tratta. La Lega rilancia sulle pensioni. Ipotesi condono “largo” fino al 2025 su Lumsanews.



Space&Underwater, il 3 dicembre la Conferenza a Roma. Tra gli speaker Samantha Cristoforetti


@Informatica (Italy e non Italy 😁)
Nel contesto geopolitico come affrontare e vincere le sfide per la Cybersecurity nello Spazio e nella Dimensione Subacquea? Sono due domìni sempre più strategici e interconnessi da cui dipendono sia la continuità delle transazioni



Difesa comune, perché l’innovazione non è più un’opzione

@Notizie dall'Italia e dal mondo

L’incontro promosso da Sopra Steria Italia e dall’Ambasciata di Francia a Palazzo Farnese ha mostrato come la difesa europea stia vivendo una stagione in cui innovazione, governance dei dati e capacità industriali procedono insieme. La discussione tra istituzioni italiane e francesi, vertici militari e



Medici per i diritti umani denuncia uccisioni prigionieri di Gaza nelle carceri israeliane


@Notizie dall'Italia e dal mondo
Il rapporto, "Deaths of Palestinians in Israeli custody: enforced disappearances, systematic killings and cover-ups", descrive una macchina repressiva che con l’inizio dell'offensiva contro Gaza ha acquisito una violenza



Klimt da record, il ritratto di Elizabeth Lederer venduto per 236 milioni di dollari

[quote]NEW YORK – La produzione artistica di Gustav Klimt segna un nuovo primato. Il ritratto di Elizabeth Lederer, opera del pittore austriaco, è stato battuto da Sotheby’s per 236 milioni…
L'articolo Klimt da record, il ritratto di Elizabeth Lederer venduto per 236 milioni



Pioggia di droni russi Ucraina. Zelensky vola in Turchia, Mosca allontana un piano di pace

[quote]KIEV – Sale ancora il bilancio dei morti nel massiccio attacco russo di stanotte, 19 novembre, in Ucraina. Nella città di Ternopil il conteggio delle vittime è arrivato a sedici,…
L'articolo Pioggia di droni russi Ucraina. Zelensky vola in Turchia, Mosca



Anna Pompili al Festival Margherita per ricordare l’eredità di Etienne Emile Baulieu

📍Auditorium Centro Culturale Roberto Gritti – Biblioteca di Ranica, Bergamo🗓Sabato 22 novembre 2025 – ore 21:00


Nell’ambito del Festival Margherita – Nessun dogma sotto questo cielo, giunto alla sua quarta edizione e dedicato a Margherita Hack, si terrà la presentazione-dialogo “L’eredità di Etienne Emile Baulieu. L’inventore della pillola abortiva RU486”. A portare il contributo dell’Associazione Luca Coscioni sarà Anna Pompili, ginecologa e consigliera generale dell’Associazione, da sempre impegnata nella promozione dei diritti sessuali e riproduttivi. Insieme a lei interverranno il ginecologo Corrado Melega, tra i primi in Italia ad aver utilizzato la RU486.

Sarà occasione per approfondire l’impatto della RU486 in Italia e sulle battaglie ancora in corso per garantirne un accesso realmente libero e sicuro.

L'articolo Anna Pompili al Festival Margherita per ricordare l’eredità di Etienne Emile Baulieu proviene da Associazione Luca Coscioni.



IT threat evolution in Q3 2025. Mobile statistics
IT threat evolution in Q3 2025. Non-mobile statistics

The quarter at a glance


In the third quarter of 2025, we updated the methodology for calculating statistical indicators based on the Kaspersky Security Network. These changes affected all sections of the report except for the statistics on installation packages, which remained unchanged.

To illustrate the differences between the reporting periods, we have also recalculated data for the previous quarters. Consequently, these figures may significantly differ from the previously published ones. However, subsequent reports will employ this new methodology, enabling precise comparisons with the data presented in this post.

The Kaspersky Security Network (KSN) is a global network for analyzing anonymized threat information, voluntarily shared by users of Kaspersky solutions. The statistics in this report are based on KSN data unless explicitly stated otherwise.

The quarter in numbers


According to Kaspersky Security Network, in Q3 2025:

  • 47 million attacks utilizing malware, adware, or unwanted mobile software were prevented.
  • Trojans were the most widespread threat among mobile malware, encountered by 15.78% of all attacked users of Kaspersky solutions.
  • More than 197,000 malicious installation packages were discovered, including:
    • 52,723 associated with mobile banking Trojans.
    • 1564 packages identified as mobile ransomware Trojans.



Quarterly highlights


The number of malware, adware, or unwanted software attacks on mobile devices, calculated according to the updated rules, totaled 3.47 million in the third quarter. This is slightly less than the 3.51 million attacks recorded in the previous reporting period.

Attacks on users of Kaspersky mobile solutions, Q2 2024 — Q3 2025 (download)

At the start of the quarter, a user complained to us about ads appearing in every browser on their smartphone. We conducted an investigation, discovering a new version of the BADBOX backdoor, preloaded on the device. This backdoor is a multi-level loader embedded in a malicious native library, librescache.so, which was loaded by the system framework. As a result, a copy of the Trojan infiltrated every process running on the device.

Another interesting finding was Trojan-Downloader.AndroidOS.Agent.no, which was embedded in mods for messaging and other apps. It downloaded Trojan-Clicker.AndroidOS.Agent.bl onto the device. The clicker received a URL from its server where an ad was being displayed, opened it in an invisible WebView window, and used machine learning algorithms to find and click the close button. In this way, fraudsters exploited the user’s device to artificially inflate ad views.

Mobile threat statistics


In the third quarter, Kaspersky security solutions detected 197,738 samples of malicious and unwanted software for Android, which is 55,000 more than in the previous reporting period.

Detected malicious and potentially unwanted installation packages, Q3 2024 — Q3 2025 (download)

The detected installation packages were distributed by type as follows:

Detected mobile apps by type, Q2* — Q3 2025 (download)

* Changes in the statistical calculation methodology do not affect this metric. However, data for the previous quarter may differ slightly from previously published figures due to a retrospective review of certain verdicts.

The share of banking Trojans decreased somewhat, but this was due less to a reduction in their numbers and more to an increase in other malicious and unwanted packages. Nevertheless, banking Trojans, still dominated by Mamont packages, continue to hold the top spot. The rise in Trojan droppers is also linked to them: these droppers are primarily designed to deliver banking Trojans.

Share* of users attacked by the given type of malicious or potentially unwanted app out of all targeted users of Kaspersky mobile products, Q2 — Q3 2025 (download)

* The total may exceed 100% if the same users experienced multiple attack types.

Adware leads the pack in terms of the number of users attacked, with a significant margin. The most widespread types of adware are HiddenAd (56.3%) and MobiDash (27.4%). RiskTool-type unwanted apps occupy the second spot. Their growth is primarily due to the proliferation of the Revpn module, which monetizes user internet access by turning their device into a VPN exit point. The most popular Trojans predictably remain Triada (55.8%) and Fakemoney (24.6%). The percentage of users who encountered these did not undergo significant changes.

TOP 20 most frequently detected types of mobile malware


Note that the malware rankings below exclude riskware and potentially unwanted software, such as RiskTool or adware.

Verdict%* Q2 2025%* Q3 2025Difference in p.p.Change in ranking
Trojan.AndroidOS.Triada.ii0.0013.78+13.78
Trojan.AndroidOS.Triada.fe12.5410.32–2.22–1
Trojan.AndroidOS.Triada.gn9.498.56–0.93–1
Trojan.AndroidOS.Fakemoney.v8.886.30–2.59–1
Backdoor.AndroidOS.Triada.z3.754.53+0.77+1
DangerousObject.Multi.Generic.4.394.52+0.13–1
Trojan-Banker.AndroidOS.Coper.c3.202.86–0.35+1
Trojan.AndroidOS.Triada.if0.002.82+2.82
Trojan-Dropper.Linux.Agent.gen3.072.64–0.43+1
Trojan-Dropper.AndroidOS.Hqwar.cq0.372.52+2.15+60
Trojan.AndroidOS.Triada.hf2.262.41+0.14+2
Trojan.AndroidOS.Triada.ig0.002.19+2.19
Backdoor.AndroidOS.Triada.ab0.002.00+2.00
Trojan-Banker.AndroidOS.Mamont.da5.221.82–3.40–10
Trojan-Banker.AndroidOS.Mamont.hi0.001.80+1.80
Trojan.AndroidOS.Triada.ga3.011.71–1.29–5
Trojan.AndroidOS.Boogr.gsh1.601.68+0.080
Trojan-Downloader.AndroidOS.Agent.nq0.001.63+1.63
Trojan.AndroidOS.Triada.hy3.291.62–1.67–12
Trojan-Clicker.AndroidOS.Agent.bh1.321.56+0.240

* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions.

The top positions in the list of the most widespread malware are once again occupied by modified messaging apps Triada.ii, Triada.fe, Triada.gn, and others. The pre-installed backdoor Triada.z ranked fifth, immediately following Fakemoney – fake apps that collect users’ personal data under the guise of providing payments or financial services. The dropper that landed in ninth place, Agent.gen, is an obfuscated ELF file linked to the banking Trojan Coper.c, which sits immediately after DangerousObject.Multi.Generic.

Region-specific malware


In this section, we describe malware that primarily targets users in specific countries.

VerdictCountry*%**
Trojan-Dropper.AndroidOS.Hqwar.bjTurkey97.22
Trojan-Banker.AndroidOS.Coper.cTurkey96.35
Trojan-Dropper.AndroidOS.Agent.smTurkey95.10
Trojan-Banker.AndroidOS.Coper.aTurkey95.06
Trojan-Dropper.AndroidOS.Agent.uqIndia92.20
Trojan-Banker.AndroidOS.Rewardsteal.qhIndia91.56
Trojan-Banker.AndroidOS.Agent.wbIndia85.89
Trojan-Dropper.AndroidOS.Rewardsteal.abIndia84.14
Trojan-Dropper.AndroidOS.Banker.bdIndia82.84
Backdoor.AndroidOS.Teledoor.aIran81.40
Trojan-Dropper.AndroidOS.Hqwar.gyTurkey80.37
Trojan-Dropper.AndroidOS.Banker.acIndia78.55
Trojan-Ransom.AndroidOS.Rkor.iiGermany76.90
Trojan-Dropper.AndroidOS.Banker.bgIndia75.12
Trojan-Banker.AndroidOS.UdangaSteal.bIndonesia75.00
Trojan-Dropper.AndroidOS.Banker.bcIndia74.73
Backdoor.AndroidOS.Teledoor.cIran70.33

* The country where the malware was most active.
** Unique users who encountered this Trojan modification in the indicated country as a percentage of all Kaspersky mobile security solution users attacked by the same modification.

Banking Trojans, primarily Coper, continue to operate actively in Turkey. Indian users also attract threat actors distributing this type of software. Specifically, the banker Rewardsteal is active in the country. Teledoor backdoors, embedded in a fake Telegram client, have been deployed in Iran.
Notable is the surge in Rkor ransomware Trojan attacks in Germany. The activity was significantly lower in previous quarters. It appears the fraudsters have found a new channel for delivering malicious apps to users.

Mobile banking Trojans


In the third quarter of 2025, 52,723 installation packages for mobile banking Trojans were detected, 10,000 more than in the second quarter.

Installation packages for mobile banking Trojans detected by Kaspersky, Q3 2024 — Q3 2025 (download)

The share of the Mamont Trojan among all bankers slightly increased again, reaching 61.85%. However, in terms of the share of attacked users, Coper moved into first place, with the same modification being used in most of its attacks. Variants of Mamont ranked second and lower, as different samples were used in different attacks. Nevertheless, the total number of users attacked by the Mamont family is greater than that of users attacked by Coper.

TOP 10 mobile bankers

Verdict%* Q2 2025%* Q3 2025Difference in p.p.Change in ranking
Trojan-Banker.AndroidOS.Coper.c13.4213.48+0.07+1
Trojan-Banker.AndroidOS.Mamont.da21.868.57–13.28–1
Trojan-Banker.AndroidOS.Mamont.hi0.008.48+8.48
Trojan-Banker.AndroidOS.Mamont.gy0.006.90+6.90
Trojan-Banker.AndroidOS.Mamont.hl0.004.97+4.97
Trojan-Banker.AndroidOS.Agent.ws0.004.02+4.02
Trojan-Banker.AndroidOS.Mamont.gg0.403.41+3.01+35
Trojan-Banker.AndroidOS.Mamont.cb3.033.31+0.29+5
Trojan-Banker.AndroidOS.Creduz.z0.173.30+3.13+58
Trojan-Banker.AndroidOS.Mamont.fz0.073.02+2.95+86

* Unique users who encountered this malware as a percentage of all Kaspersky mobile security solution users who encountered banking threats.

Mobile ransomware Trojans


Due to the increased activity of mobile ransomware Trojans in Germany, which we mentioned in the Region-specific malware section, we have decided to also present statistics on this type of threat. In the third quarter, the number of ransomware Trojan installation packages more than doubled, reaching 1564.

Verdict%* Q2 2025%* Q3 2025Difference in p.p.Change in ranking
Trojan-Ransom.AndroidOS.Rkor.ii7.2324.42+17.19+10
Trojan-Ransom.AndroidOS.Rkor.pac0.2716.72+16.45+68
Trojan-Ransom.AndroidOS.Congur.aa30.8916.46–14.44–1
Trojan-Ransom.AndroidOS.Svpeng.ac30.9816.39–14.59–3
Trojan-Ransom.AndroidOS.Rkor.it0.0010.09+10.09
Trojan-Ransom.AndroidOS.Congur.cw15.719.69–6.03–3
Trojan-Ransom.AndroidOS.Congur.ap15.369.16–6.20–3
Trojan-Ransom.AndroidOS.Small.cj14.918.49–6.42–3
Trojan-Ransom.AndroidOS.Svpeng.snt13.048.10–4.94–2
Trojan-Ransom.AndroidOS.Svpeng.ah13.137.63–5.49–4

* Unique users who encountered the malware as a percentage of all Kaspersky mobile security solution users attacked by ransomware Trojans.


securelist.com/malware-report-…



IT threat evolution in Q3 2025. Non-mobile statistics


IT threat evolution in Q3 2025. Mobile statistics
IT threat evolution in Q3 2025. Non-mobile statistics

Quarterly figures


In Q3 2025:

  • Kaspersky solutions blocked more than 389 million attacks that originated with various online resources.
  • Web Anti-Virus responded to 52 million unique links.
  • File Anti-Virus blocked more than 21 million malicious and potentially unwanted objects.
  • 2,200 new ransomware variants were detected.
  • Nearly 85,000 users experienced ransomware attacks.
  • 15% of all ransomware victims whose data was published on threat actors’ data leak sites (DLSs) were victims of Qilin.
  • More than 254,000 users were targeted by miners.


Ransomware

Quarterly trends and highlights

Law enforcement success


The UK’s National Crime Agency (NCA) arrested the first suspect in connection with a ransomware attack that caused disruptions at numerous European airports in September 2025. Details of the arrest have not been published as the investigation remains ongoing. According to security researcher Kevin Beaumont, the attack employed the HardBit ransomware, which he described as primitive and lacking its own data leak site.

The U.S. Department of Justice filed charges against the administrator of the LockerGoga, MegaCortex and Nefilim ransomware gangs. His attacks caused millions of dollars in damage, putting him on wanted lists for both the FBI and the European Union.

U.S. authorities seized over $2.8 million in cryptocurrency, $70,000 in cash, and a luxury vehicle from a suspect allegedly involved in distributing the Zeppelin ransomware. The criminal scheme involved data theft, file encryption, and extortion, with numerous organizations worldwide falling victim.

A coordinated international operation conducted by the FBI, Homeland Security Investigations (HSI), the U.S. Internal Revenue Service (IRS), and law enforcement agencies from several other countries successfully dismantled the infrastructure of the BlackSuit ransomware. The operation resulted in the seizure of four servers, nine domains, and $1.09 million in cryptocurrency. The objective of the operation was to destabilize the malware ecosystem and protect critical U.S. infrastructure.

Vulnerabilities and attacks
SSL VPN attacks on SonicWall


Since late July, researchers have recorded a rise in attacks by the Akira threat actor targeting SonicWall firewalls supporting SSL VPN. SonicWall has linked these incidents to the already-patched vulnerability CVE-2024-40766, which allows unauthorized users to gain access to system resources. Attackers exploited the vulnerability to steal credentials, subsequently using them to access devices, even those that had been patched. Furthermore, the attackers were able to bypass multi-factor authentication enabled on the devices. SonicWall urges customers to reset all passwords and update their SonicOS firmware.

Scattered Spider uses social engineering to breach VMware ESXi


The Scattered Spider (UNC3944) group is attacking VMware virtual environments. The attackers contact IT support posing as company employees and request to reset their Active Directory password. Once access to vCenter is obtained, the threat actors enable SSH on the ESXi servers, extract the NTDS.dit database, and, in the final phase of the attack, deploy ransomware to encrypt all virtual machines.

Exploitation of a Microsoft SharePoint vulnerability


In late July, researchers uncovered attacks on SharePoint servers that exploited the ToolShell vulnerability chain. In the course of investigating this campaign, which affected over 140 organizations globally, researchers discovered the 4L4MD4R ransomware based on Mauri870 code. The malware is written in Go and packed using the UPX compressor. It demands a ransom of 0.005 BTC.

The application of AI in ransomware development


A UK-based threat actor used Claude to create and launch a ransomware-as-a-service (RaaS) platform. The AI was responsible for writing the code, which included advanced features such as anti-EDR techniques, encryption using ChaCha20 and RSA algorithms, shadow copy deletion, and network file encryption.

Anthropic noted that the attacker was almost entirely dependent on Claude, as they lacked the necessary technical knowledge to provide technical support to their own clients. The threat actor sold the completed malware kits on the dark web for $400–$1,200.

Researchers also discovered a new ransomware strain, dubbed PromptLock, that utilizes an LLM directly during attacks. The malware is written in Go. It uses hardcoded prompts to dynamically generate Lua scripts for data theft and encryption across Windows, macOS and Linux systems. For encryption, it employs the SPECK-128 algorithm, which is rarely used by ransomware groups.

Subsequently, scientists from the NYU Tandon School of Engineering traced back the likely origins of PromptLock to their own educational project, Ransomware 3.0, which they detailed in a prior publication.

The most prolific groups


This section highlights the most prolific ransomware gangs by number of victims added to each group’s DLS. As in the previous quarter, Qilin leads by this metric. Its share grew by 1.89 percentage points (p.p.) to reach 14.96%. The Clop ransomware showed reduced activity, while the share of Akira (10.02%) slightly increased. The INC Ransom group, active since 2023, rose to third place with 8.15%.

Number of each group’s victims according to its DLS as a percentage of all groups’ victims published on all the DLSs under review during the reporting period (download)

Number of new variants


In the third quarter, Kaspersky solutions detected four new families and 2,259 new ransomware modifications, nearly one-third more than in Q2 2025 and slightly more than in Q3 2024.

Number of new ransomware modifications, Q3 2024 — Q3 2025 (download)

Number of users attacked by ransomware Trojans


During the reporting period, our solutions protected 84,903 unique users from ransomware. Ransomware activity was highest in July, while August proved to be the quietest month.

Number of unique users attacked by ransomware Trojans, Q3 2025 (download)

Attack geography

TOP 10 countries attacked by ransomware Trojans


In the third quarter, Israel had the highest share (1.42%) of attacked users. Most of the ransomware in that country was detected in August via behavioral analysis.

Country/territory*%**
1Israel1.42
2Libya0.64
3Rwanda0.59
4South Korea0.58
5China0.51
6Pakistan0.47
7Bangladesh0.45
8Iraq0.44
9Tajikistan0.39
10Ethiopia0.36

* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.
** Unique users whose computers were attacked by ransomware Trojans as a percentage of all unique users of Kaspersky products in the country/territory.

TOP 10 most common families of ransomware Trojans

NameVerdict%*
1(generic verdict)Trojan-Ransom.Win32.Gen26.82
2(generic verdict)Trojan-Ransom.Win32.Crypren8.79
3(generic verdict)Trojan-Ransom.Win32.Encoder8.08
4WannaCryTrojan-Ransom.Win32.Wanna7.08
5(generic verdict)Trojan-Ransom.Win32.Agent4.40
6LockBitTrojan-Ransom.Win32.Lockbit3.06
7(generic verdict)Trojan-Ransom.Win32.Crypmod2.84
8(generic verdict)Trojan-Ransom.Win32.Phny2.58
9PolyRansom/VirLockTrojan-Ransom.Win32.PolyRansom / Virus.Win32.PolyRansom2.54
10(generic verdict)Trojan-Ransom.MSIL.Agent2.05

* Unique Kaspersky users attacked by the specific ransomware Trojan family as a percentage of all unique users attacked by this type of threat.

Miners

Number of new variants


In Q3 2025, Kaspersky solutions detected 2,863 new modifications of miners.

Number of new miner modifications, Q3 2025 (download)

Number of users attacked by miners


During the third quarter, we detected attacks using miner programs on the computers of 254,414 unique Kaspersky users worldwide.

Number of unique users attacked by miners, Q3 2025 (download)

Attack geography

TOP 10 countries and territories attacked by miners
Country/territory*%**
1Senegal3.52
2Mali1.50
3Afghanistan1.17
4Algeria0.95
5Kazakhstan0.93
6Tanzania0.92
7Dominican Republic0.86
8Ethiopia0.77
9Portugal0.75
10Belarus0.75

* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.
** Unique users whose computers were attacked by miners as a percentage of all unique users of Kaspersky products in the country/territory.

Attacks on macOS


In April, researchers at Iru (formerly Kandji) reported the discovery of a new spyware family, PasivRobber. We observed the development of this family throughout the third quarter. Its new modifications introduced additional executable modules that were absent in previous versions. Furthermore, the attackers began employing obfuscation techniques in an attempt to hinder sample detection.

In July, we reported on a cryptostealer distributed through fake extensions for the Cursor AI development environment, which is based on Visual Studio Code. At that time, the malicious JavaScript (JS) script downloaded a payload in the form of the ScreenConnect remote access utility. This utility was then used to download cryptocurrency-stealing VBS scripts onto the victim’s device. Later, researcher Michael Bocanegra reported on new fake VS Code extensions that also executed malicious JS code. This time, the code downloaded a malicious macOS payload: a Rust-based loader. This loader then delivered a backdoor to the victim’s device, presumably also aimed at cryptocurrency theft. The backdoor supported the loading of additional modules to collect data about the victim’s machine. The Rust downloader was analyzed in detail by researchers at Iru.

In September, researchers at Jamf reported the discovery of a previously unknown version of the modular backdoor ChillyHell, first described in 2023. Notably, the Trojan’s executable files were signed with a valid developer certificate at the time of discovery.

The new sample had been available on Dropbox since 2021. In addition to its backdoor functionality, it also contains a module responsible for bruteforcing passwords of existing system users.

By the end of the third quarter, researchers at Microsoft reported new versions of the XCSSET spyware, which targets developers and spreads through infected Xcode projects. These new versions incorporated additional modules for data theft and system persistence.

TOP 20 threats to macOS

Unique users* who encountered this malware as a percentage of all attacked users of Kaspersky security solutions for macOS (download)

* Data for the previous quarter may differ slightly from previously published data due to some verdicts being retrospectively revised.

The PasivRobber spyware continues to increase its activity, with its modifications occupying the top spots in the list of the most widespread macOS malware varieties. Other highly active threats include Amos Trojans, which steal passwords and cryptocurrency wallet data, and various adware. The Backdoor.OSX.Agent.l family, which took thirteenth place, represents a variation on the well-known open-source malware, Mettle.

Geography of threats to macOS

TOP 10 countries and territories by share of attacked users
Country/territory%* Q2 2025%* Q3 2025
Mainland China2.501.70
Italy0.740.85
France1.080.83
Spain0.860.81
Brazil0.700.68
The Netherlands0.410.68
Mexico0.760.65
Hong Kong0.840.62
United Kingdom0.710.58
India0.760.56

IoT threat statistics


This section presents statistics on attacks targeting Kaspersky IoT honeypots. The geographic data on attack sources is based on the IP addresses of attacking devices.

In Q3 2025, there was a slight increase in the share of devices attacking Kaspersky honeypots via the SSH protocol.

Distribution of attacked services by number of unique IP addresses of attacking devices (download)

Conversely, the share of attacks using the SSH protocol slightly decreased.

Distribution of attackers’ sessions in Kaspersky honeypots (download)

TOP 10 threats delivered to IoT devices

Share of each threat delivered to an infected device as a result of a successful attack, out of the total number of threats delivered (download)

In the third quarter, the shares of the NyaDrop and Mirai.b botnets significantly decreased in the overall volume of IoT threats. Conversely, the activity of several other members of the Mirai family, as well as the Gafgyt botnet, increased. As is typical, various Mirai variants occupy the majority of the list of the most widespread malware strains.

Attacks on IoT honeypots


Germany and the United States continue to lead in the distribution of attacks via the SSH protocol. The share of attacks originating from Panama and Iran also saw a slight increase.

Country/territoryQ2 2025Q3 2025
Germany24.58%13.72%
United States10.81%13.57%
Panama1.05%7.81%
Iran1.50%7.04%
Seychelles6.54%6.69%
South Africa2.28%5.50%
The Netherlands3.53%3.94%
Vietnam3.00%3.52%
India2.89%3.47%
Russian Federation8.45%3.29%

The largest number of attacks via the Telnet protocol were carried out from China, as is typically the case. Devices located in India reduced their activity, whereas the share of attacks from Indonesia increased.

Country/territoryQ2 2025Q3 2025
China47.02%57.10%
Indonesia5.54%9.48%
India28.08%8.66%
Russian Federation4.85%7.44%
Pakistan3.58%6.66%
Nigeria1.66%3.25%
Vietnam0.55%1.32%
Seychelles0.58%0.93%
Ukraine0.51%0.73%
Sweden0.39%0.72%

Attacks via web resources


The statistics in this section are based on detection verdicts by Web Anti-Virus, which protects users when suspicious objects are downloaded from malicious or infected web pages. These malicious pages are purposefully created by cybercriminals. Websites that host user-generated content, such as message boards, as well as compromised legitimate sites, can become infected.

TOP 10 countries that served as sources of web-based attacks


This section gives the geographical distribution of sources of online attacks (such as web pages redirecting to exploits, sites hosting exploits and other malware, and botnet C2 centers) blocked by Kaspersky products. One or more web-based attacks could originate from each unique host.

To determine the geographic source of web attacks, we matched the domain name with the real IP address where the domain is hosted, then identified the geographic location of that IP address (GeoIP).

In the third quarter of 2025, Kaspersky solutions blocked 389,755,481 attacks from internet resources worldwide. Web Anti-Virus was triggered by 51,886,619 unique URLs.

Web-based attacks by country, Q3 2025 (download)

Countries and territories where users faced the greatest risk of online infection


To assess the risk of malware infection via the internet for users’ computers in different countries and territories, we calculated the share of Kaspersky users in each location on whose computers Web Anti-Virus was triggered during the reporting period. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries and territories.

This ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out Web Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.

Country/territory*%**
1Panama11.24
2Bangladesh8.40
3Tajikistan7.96
4Venezuela7.83
5Serbia7.74
6Sri Lanka7.57
7North Macedonia7.39
8Nepal7.23
9Albania7.04
10Qatar6.91
11Malawi6.90
12Algeria6.74
13Egypt6.73
14Bosnia and Herzegovina6.59
15Tunisia6.54
16Belgium6.51
17Kuwait6.49
18Turkey6.41
19Belarus6.40
20Bulgaria6.36

* Excluded are countries and territories with relatively few (under 10,000) Kaspersky users.
** Unique users targeted by web-based Malware attacks as a percentage of all unique users of Kaspersky products in the country/territory.
On average, over the course of the quarter, 4.88% of devices globally were subjected to at least one web-based Malware attack.

Local threats


Statistics on local infections of user computers are an important indicator. They include objects that penetrated the target computer by infecting files or removable media, or initially made their way onto the computer in non-open form. Examples of the latter are programs in complex installers and encrypted files.

Data in this section is based on analyzing statistics produced by anti-virus scans of files on the hard drive at the moment they were created or accessed, and the results of scanning removable storage media: flash drives, camera memory cards, phones, and external drives. The statistics are based on detection verdicts from the on-access scan (OAS) and on-demand scan (ODS) modules of File Anti-Virus.

In the third quarter of 2025, our File Anti-Virus recorded 21,356,075 malicious and potentially unwanted objects.

Countries and territories where users faced the highest risk of local infection


For each country and territory, we calculated the percentage of Kaspersky users on whose computers File Anti-Virus was triggered during the reporting period. This statistic reflects the level of personal computer infection in different countries and territories around the world.

Note that this ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out File Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.

Country/territory*%**
1Turkmenistan45.69
2Yemen33.19
3Afghanistan32.56
4Tajikistan31.06
5Cuba30.13
6Uzbekistan29.08
7Syria25.61
8Bangladesh24.69
9China22.77
10Vietnam22.63
11Cameroon22.53
12Belarus21.98
13Tanzania21.80
14Niger21.70
15Mali21.29
16Iraq20.77
17Nicaragua20.75
18Algeria20.51
19Congo20.50
20Venezuela20.48

* Excluded are countries and territories with relatively few (under 10,000) Kaspersky users.
** Unique users on whose computers local Malware threats were blocked, as a percentage of all unique users of Kaspersky products in the country/territory.

On average worldwide, local Malware threats were detected at least once on 12.36% of computers during the third quarter.


securelist.com/malware-report-…



Charge NiMH Batteries with Style, Panache and an RP2040


The increasing dominance of lithium cells in the market place leave our trusty NiMH cells in a rough spot. Sure, you can still get a chargers for the AAs in your life, but it’s old tech and not particularly stylish. That’s where [Maximilian Kern] comes in, whose SPINC project was recently featured in IEEE Spectrum— so you know it has to be good.

With the high-resolution LED, the styling of this device reminds us a little bit of the Pi-Mac-Nano— and anything that makes you think of a classic Macintosh gets automatic style points. There’s something reminiscent of an ammunition clip in the way batteries are fed into the top and let out the bottom of the machine.

[Maximilian] thought of the, ah, less-detail-oriented amongst us with this one, as the dedicated charging IC he chose (why reinvent the wheel?) is connected to an H-bridge to allow the charger to be agnostic as to orientation. That’s a nice touch. An internal servo grabs each battery in turn to stick into the charging circuit, and deposits it into the bottom of the device once it is charged. The LCD screen lets you monitor the status of the battery as it charges, while doubling as a handy desk clock (that’s where the RP2040 comes in). It is, of course, powered by USB-C-PD as all things are these days. Fast-charging upto 1A is enabled, but you might want to go slower to keep your cells lasting as long as possible. Firmware, gerbers and STLs are available on GitHub under a GPL-3.0 license– so if you’re still using NiCads or want to bring this design into the glorious lithium future, you can consider yourself welcome to.

We recently featured a AA rundown, and for now, it looks like NiMH is still the best bang for your buck, which means this project will remain relevant for a few years yet. Of course, we didn’t expect the IEEE to steer us wrong.

Thanks to [George Graves] for the tip.


hackaday.com/2025/11/19/charge…



Margaret Glaspy – The Golden Heart Protector
freezonemagazine.com/articoli/…
Un EP di duetti che è anche una confessione intima C’è qualcosa di profondamente umano nel modo in cui Margaret Glaspy affronta la voce altrui. In The Golden Heart Protector, la cantautrice californiana trapiantata a New York trasforma l’idea del duetto in un gesto di ascolto, più che di esposizione. Non cerca la fusione spettacolare, […]
L'articolo Margaret Glaspy –


ho smesso di avere rispetto per...


... continua qui: noblogo.org/differx/ho-smesso-…

reshared this



La differenza fondamentale di Luciano Floridi

@Politica interna, europea e internazionale

L’intelligenza artificiale non è soltanto una nuova tecnologia: è la forza che sta ridefinendo il nostro presente. Capace di apprendere, adattarsi e decidere in autonomia, l’IA sta già trasformando in profondità la nostra vita quotidiana, l’economia, le imprese, il lavoro, l’istruzione, la politica, la cultura e



intitolerei questo post "i cani del sinai", come il titolo di un celebre libro di Franco Fortini critico verso #israele
seguendo il link https://t.ly/YiBWu si trova un riferimento alle pratiche di #tortura messe in atto dallo stato sionista contro #prigionieri palestinesi. tra queste pratiche ce n'è una, particolarmente atroce e umiliante, che ha una terribile consonanza con quell'espressione fortiniana.
in reply to differx

Dico solo che se io vedo un indirizzo ofuscato per il quale non ho neppure una vaga indicazione che mi anticipi dove porta, senza uno straccio di descrizione che mi spieghi di cosa si tratta, posso solo pensare allo SPAM; non lo seguitò mai.

Se chi pubblica pensa che non valga la pena spendere due minuti per spiegare perché il riferimento proposto può essere interessante, perché mai dovrei dedicare tempo a guardarlo?

Preferisco spenderlo per dire: rispettate chi vi legge.
@differx @poliversity

in reply to Pare 🚲 🌞

@Pare 🚲 🌞 @Poliversity - Università ricerca e giornalismo
ecco il post corretto: poliverso.org/display/0477a01e…


intitolerei questo post "i cani del sinai", come il titolo di un celebre libro di Franco Fortini critico verso #israele
seguendo il link https://t.ly/YiBWu si trova un riferimento alle pratiche di #tortura messe in atto dallo stato sionista contro #prigionieri palestinesi. tra queste pratiche ce n'è una, particolarmente atroce e umiliante, che ha una terribile consonanza con quell'espressione fortiniana.



c'è chi pensa che il fine giustifica il mezzo. che hitler e stalin fossero diversi, perché stalin aveva uno "scopo di giustizia", mentre hitler il male puro. ma alla fine il mezzo mangia la persona, e quindi non c'è differenza tra stalin e hiter, neppure sul piano ideologico, perché alla fine conta quello che fai e quello che hai realizzato, e cioè una dittatura spietata in entrambi i casi.

reshared this



ilgiorno.it/milano/cronaca/stu…

quello che io chiamo un classico involucro vuoto che parla, mangia ma che non ha un'anima o niente dentro. una specie di macchina assassina. che poi è a quanto pare è lo stato finale dell'umanità. anche chi non andrebbe a uccidere la gente per strada, è infatti spesso non in grado di esprimere un pensiero coerente e logico, e tutto sommato diventa difficile da definire una piena persona. che questo coincida con il 60% di definiti analfabeti funzionali?



Perché l’alleanza tra Nvidia, Microsoft e Anthropic non convince i mercati

L'articolo proviene da #StartMag e viene ricondiviso sulla comunità Lemmy @Informatica (Italy e non Italy 😁)
Nvidia e Microsoft investiranno 10 e 5 miliardi di dollari in Anthropic. La startup di intelligenza artificiale fondata dai fratelli Amodei vuole accrescere ancora la sua capacità di calcolo, dopo il recente accordo con



La Francia in rivolta sui pesticidi riscrive il rapporto tra scienza e potere


@Notizie dall'Italia e dal mondo
Il 7 agosto 2025, il Consiglio costituzionale francese ha dichiarato incostituzionale la cosiddetta legge Duplomb, approvata dal Parlamento un mese prima. La norma prevedeva la reintroduzione dell’acetamiprid, pesticida vietato dal 2018 per la sua comprovata



è sbagliato mettere sempre di mezzo la chiesa... ci fosse solo e soltanto unico cattivo... sarebbe bello. di certo gli italiani non sono estranei a questa cultura maschilista e patriarcale, di bullismo e di machismo.

credo che il primo passo per liberarsi della chiesa sia liberarsi dall'ossessione e smettere di parlarne. dopotutto qualcuno diceva che va bene che si parli di qualcuno, anche male, purché se ne parli... parlarne così è dare e sopratutto riconoscere (molto peggio) potere. è un palloncino che va lasciaro sgonfiare naturalmente, senza pestarlo continuamente. da ignorare.

dopotutto i grandi mangiatori di preti, la cosiddetta sinistra "vera", quella che oggi difende un fascista come putin, ha prodotto una cultura altrettanto tossica...

sarà pur vero che la sinistra, sempre quella "vera", non ha mai mangiato bambini, ma è pur vero che sostiene putin che lo fa, con quelli ucraini. si dice attorno ai 35'000 bambini. che oggi combattono in ucraina a fianco dei russi, con il cervello lavato, e più sfortunati dei russi.




La Francia in rivolta sui pesticidi riscrive il rapporto tra scienza e potere


@Notizie dall'Italia e dal mondo
Il 7 agosto 2025, il Consiglio costituzionale francese ha dichiarato incostituzionale la cosiddetta legge Duplomb, approvata dal Parlamento un mese prima. La norma prevedeva la reintroduzione dell’acetamiprid, pesticida vietato dal 2018 per la sua comprovata




Oggi è la Giornata nazionale in memoria delle vittime della strada. In occasione della ricorrenza studentesse e studenti parteciperanno, presso il Teatro Don Bosco di Roma, all'iniziativa di formazione in materia di educazione e sicurezza stradale pr…



di Enrico Nardelli È stato appena emesso dal Consiglio di Stato il parere favorevole alle Nuove Indicazioni Nazionali per la scuola dell’...



Kissing is ubiquitous among many animals, especially primates, suggesting deep evolutionary roots of the behavior.#TheAbstract


Scientists Discover the Origin of Kissing — And It’s Not Human


🌘
Subscribe to 404 Media to get The Abstract, our newsletter about the most exciting and mind-boggling science news and studies of the week.

Kissing is one of humanity’s most cherished rituals—just think of the sheer variety of smooches, from the “wedding kiss” to the “kiss of death.” Now, scientists have discovered that the origins of this behavior, which is widespread among many primates, likely dates back at least 21 million years, according to a study published on Tuesday in the journal Evolution and Human Behavior.

In other words, our early primate relatives were sitting in a tree, K-I-S-S-I-N-G, in the early Miocene period. Moreover, the deep evolutionary roots of kissing suggest that Neanderthals likely smooched each other, and probably our human ancestors as well. The new study is the first attempt to reconstruct the evolutionary timeline of kissing by analyzing a wealth of observations about this behavior in modern primates and other animals.

“It is kind of baffling to me that people haven't looked at this from an evolutionary perspective before,” said Matilda Brindle, an evolutionary biologist at the University of Oxford who led the study, in a call with 404 Media. “There have been some people who have put ideas out there, but no one's done it in a systematic way.”

“Kissing doesn't occur in all human cultures, but in those that it does, it's really important,” she added. “That's why we thought it was really exciting to study.”
A collage of mouth-to-mouth contact across species. Image: Brindle, Matilda et al.
The ritual of the “first kiss” is a common romantic trope, but tracking down the “first kiss” in an evolutionary sense is no easy feat. For starters, the adaptive benefits of kissing have long eluded researchers. Mouth-to-mouth contact raises the odds of oral disease transfer, and it’s not at all clear what advantages puckering up confers to make it worth the trouble.

“Kissing is kind of risky,” Brindle said. “You're getting very close to another animal's face. There could be diseases. To me, that suggests that it is important. There must be some benefits to this behavior.”

Some common explanations for sex-related kissing include mate evaluation—bad breath or other red flags during a smoochfest might affect the decision to move on to copulation. Kissing may also stimulate sexual receptiveness and perhaps boost the odds of fertilization. In platonic contexts, kissing could serve a social purpose, similar to grooming, of solidifying bonds between parents and offspring, or even to smooth over conflicts between group members.

“We know that chimpanzees, when they've had a bit of a bust up, will often go and kiss each other and make up,” Brindle said. “That might be really useful for navigating social relationships. Primates are obviously an incredibly social group of animals, and so this could be just a social lubricant for them.”

Though most of us have probably never considered the question, Brindle and her colleagues first had to ask: what is a kiss? They made a point to exclude forms of oral contact that don’t fall into the traditional idea of kissing as a prosocial behavior. For example, lots of animals share food directly through mouth-to-mouth contact, such as regurgitation from a parent to offspring. In addition, some animals display antagonistic behavior through mouth-to-mouth contact, such as “kiss-fighting” behavior seen in some fish.

The team ultimately defined kissing as “a non-agonistic interaction involving directed, intraspecific, oral-oral contact with some movement of the lips/mouthparts and no food transfer.” Many animals engage in kissing under these terms—from insects, to birds, to mammals—but the researchers were most interested in primates.

To that end, they gathered observations of kissing across primate species and fed the data into models that analyzed the timeline of the behavior through the evolutionary relationships between species. The basic idea is that if humans, bonobos, and chimpanzees all kiss (which they do) then the common ancestor of these species likely kissed as well.

The results revealed that the evolutionary “first kiss” likely occurred among primates at least 21 million years ago. Since Neanderthals and our own species, Homo sapiens, are known to have interbred—plus they also shared oral microbes—the team speculates that Neanderthals and our own human ancestors might have kissed as well.

While the study provides a foundation for the origins of kissing, Brindle said there is not yet enough empirical data to test out different hypotheses about its benefits—or to explain why it is important in some species and cultures, but not others. To that end, she hopes other scientists will be inspired to report more observations about kissing in wild and captive animal populations.

“I was actually surprised that there were so few data out there,” Brindle said. “I thought that this would be way better documented when I started this study. What I would really love is, for people who see this behavior, to note it down, report it, so that we can actually start collecting more contextual information: Is this a romantic or a platonic kiss? Who were the actors in it? Was it an adult male and an adult female, or a mother and offspring? Were they eating at the time? Was there copulation before or after the kiss?”

“These sorts of questions will enable us to pick apart these potential adaptive hypotheses,” she concluded.

🌘
Subscribe to 404 Media to get The Abstract, our newsletter about the most exciting and mind-boggling science news and studies of the week.




HOPE Hacking Conference Banned From University Venue Over Apparent ‘Anti-Police Agenda’#News #HOPE


HOPE Hacking Conference Banned From University Venue Over Apparent ‘Anti-Police Agenda’


The legendary hacker conference Hackers on Planet Earth (HOPE) says that it has been “banned” from St. John’s University, the venue where it has held the last several HOPE conferences, because someone told the university the conference had an “anti-police agenda.”

HOPE was held at St. John’s University in 2022, 2024, and 2025, and was going to be held there in 2026, as well. The conference has been running at various venues over the last 31 years, and has become well-known as one of the better hacking and security research conferences in the world. Tuesday, the conference told members of its mailing list that it had “received some disturbing news,” and that “we have been told that ‘materials and messaging’ at our most recent conference ‘were not in alignment with the mission, values, and reputation of St. John’s University’ and that we would no longer be able to host our events there.”

The conference said that after this year’s conference, they had received “universal praise” from St. John’s staff, and said they were “caught by surprise” by the announcement.

“What we're told - and what we find rather hard to believe - is that all of this came about because a single person thought we were promoting an anti-police agenda,” the email said. “They had spotted pamphlets on a table which an attendee had apparently brought to HOPE that espoused that view. Instead of bringing this to our attention, they went to the president's office at St. John's after the conference had ended. That office held an investigation which we had no knowledge of and reached its decision earlier this month. The lack of due process on its own is extremely disturbing.”

“The intent of the person behind this appears clear: shut down events like ours and make no attempt to actually communicate or resolve the issue,” the email continued. “If it wasn't this pamphlet, it would have been something else. In this day and age where academic institutions live in fear of offending the same authorities we've been challenging for decades, this isn't entirely surprising. It is, however, greatly disappointing.”

St. John’s University did not immediately respond to a request for comment. Hacking and security conferences in general have a long history of being surveilled by or losing their venues. For example, attendees of the DEF CON hacking conference have reported being surveilled and having their rooms searched; last year, some casinos in Las Vegas made it clear that DEF CON attendees were not welcome. And academic institutions have been vigorously attacked by the Trump administration over the last few months over the courses they teach, the research they fund, and the events they hold, though we currently do not know the specifics of why St. John’s made this decision.

It is not clear what pamphlets HOPE is referencing, and the conference did not immediately respond to a request for comment, but the conference noted that St. Johns could have made up any pretext for banning them. It is worth mentioning that Joshua Aaron, the creator of the ICEBlock ICE tracking app, presented at HOPE this year. ICEBlock has since been deleted by the Apple App Store and the Google Play store after being pressured by the Trump administration.

“Our content has always been somewhat edgy and we take pride in challenging policies we see as unfair, exposing security weaknesses, standing up for individual privacy rights, and defending freedom of speech,” HOPE wrote in the email. The conference said that it has not yet decided what it will do next year, but that it may look for another venue, or that it might “take a year off and try to build something bigger.”

“There will be many people who will say this is what we get for being too outspoken and for giving a platform to controversial people and ideas. But it's this spirit that defines who we are; it's driven all 16 of our past conferences. There are also those who thought it was foolish to ever expect a religious institution to understand and work with us,” the conference added. “We are not changing who we are and what we stand for any more than we'd expect others to. We have high standards for our speakers, presenters, and staff. We value inclusivity and we have never tolerated hate, abuse, or harassment towards anyone. This should not be news, as HOPE has been around for a while and is well known for its uniqueness, spirit, and positivity.”




“Most drivers are unaware that San Jose’s Police Department is tracking their locations and do not know all that their saved location data can reveal about their private lives and activities."#Flock


ACLU and EFF Sue a City Blanketed With Flock Surveillance Cameras


Lawyers from the American Civil Liberties Union (ACLU) and Electronic Frontier Foundation (EFF) sued the city of San Jose, California over its deployment of Flock’s license plate-reading surveillance cameras, claiming that the city’s nearly 500 cameras create a pervasive database of residents movements in a surveillance network that is essentially impossible to avoid.

The lawsuit was filed on behalf of the Services, Immigrant Rights & Education Network and Council on American-Islamic Relations, California, and claims that the surveillance is a violation of California’s constitution and its privacy laws. The lawsuit seeks to require police to get a warrant in order to search Flock’s license plate system. The lawsuit is one of the highest profile cases challenging Flock; a similar lawsuit in Norfolk, Virginia seeks to get Flock’s network shut down in that city altogether.

“San Jose’s ALPR [automatic license plate reader] program stands apart in its invasiveness,” ACLU of Northern California and EFF lawyers wrote in the lawsuit. “While many California agencies run ALPR systems, few retain the locations of drivers for an entire year like San Jose. Further, it is difficult for most residents of San Jose to get to work, pick up their kids, or obtain medical care without driving, and the City has blanketed its roads with nearly 500 ALPRs.”

The lawsuit argues that San Jose’s Flock cameras “are an invasive mass surveillance technology” that “collect[s] driver locations en masse.”

“Most drivers are unaware that San Jose’s Police Department is tracking their locations and do not know all that their saved location data can reveal about their private lives and activities,” it adds. The city of San Jose currently has at least 474 ALPR cameras, up from 149 at the end of 2023; according to data from the city, more than 2.6 million vehicles were tracked using Flock in the month of October alone. The lawsuit states that Flock ALPRs are stationed all over the city, including “around highly sensitive locations including clinics, immigration centers, and places of worship. For example, three ALPR cameras are positioned on the roads directly outside an immigration law firm.”

Andrew Crocker, surveillance litigation director for the EFF, told 404 Media in a phone call that “it’s fair to say that anyone driving in San Jose is likely to have their license plates captured many times a day. That pervasiveness is important.”
DeFlock's map of San Jose's ALPRsA zoomed in look at San Jose
A search of DeFlock, a crowdsourced map of ALPR deployments around the country, shows hundreds of cameras in San Jose spaced essentially every few blocks around the city. The map is not exhaustive.

The lawsuit argues that warrantless searches of these cameras are illegal under the California constitution’s search and seizure clause, which Crocker said “has been interpreted to be even stronger than the Fourth Amendment,” as well as other California privacy laws. The case is part of a broader backlash against Flock as it expands around the United States. 404 Media’s reporting has shown that the company collects millions of records from around the country, and that it has made its national database of car locations available to local cops who have in turn worked with ICE. Some of those searches have violated California and Illinois law, and have led to reforms from the company. Crocker said that many of these problems will be solved if police simply need to get a warrant to search the system.

“Our legal theory and the remedy we’re seeking is quite simple. We think they need a warrant to search these databases,” he said. “The warrant requirement is massive and should help in terms of preventing these searches because they will have to be approved by a judge.” The case in Norfolk is ongoing. San Jose Police Department and Flock did not immediately respond to a request for comment.




The move comes after intense pressure from lawmakers and 404 Media’s months-long reporting about the airline industry's data selling practices.

The move comes after intense pressure from lawmakers and 404 Media’s months-long reporting about the airline industryx27;s data selling practices.#Impact


Airlines Will Shut Down Program That Sold Your Flights Records to Government


Airlines Reporting Corporation (ARC), a data broker owned by the U.S.’s major airlines, will shut down a program in which it sold access to hundreds of millions of flight records to the government and let agencies track peoples’ movements without a warrant, according to a letter from ARC shared with 404 Media.

ARC says it informed lawmakers and customers about the decision earlier this month. The move comes after intense pressure from lawmakers and 404 Media’s months-long reporting about ARC’s data selling practices. The news also comes after 404 Media reported on Tuesday that the IRS had searched the massive database of Americans flight data without a warrant.

“As part of ARC’s programmatic review of its commercial portfolio, we have previously determined that TIP is no longer aligned with ARC’s core goals of serving the travel industry,” the letter, written by ARC President and CEO Lauri Reishus, reads. TIP is the Travel Intelligence Program. As part of that, ARC sold access to a massive database of peoples’ flights, showing who travelled where, and when, and what credit card they used.
The ARC letter.
“All TIP customers, including the government agencies referenced in your letter, were notified on November 12, 2025, that TIP is sunsetting this year,” Reishus continued. Reishus was responding to a letter sent to airline executives earlier on Tuesday by Senator Ron Wyden, Congressman Andy Biggs, Chair of the Congressional Hispanic Caucus Adriano Espaillat, and Senator Cynthia Lummis. That letter revealed the IRS’s warrantless use of ARC’s data and urged the airlines to stop the ARC program. ARC says it notified Espaillat's office on November 14.

ARC is co-owned by United, American, Delta, Southwest, JetBlue, Alaska, Lufthansa, Air France, and Air Canada. The data broker acts as a bridge between airlines and travel agencies. Whenever someone books a flight through one of more than 12,800 travel agencies, such as Expedia, Kayak, or Priceline, ARC receives information about that booking. It then packages much of that data and sells it to the government, which can search it by name, credit card, and more. 404 Media has reported that ARC’s customers include the FBI, multiple components of the Department of Homeland Security, ATF, the SEC, TSA, and the State Department.

Espaillat told 404 Media in a statement “this is what we do. This is how we’re fighting back. Other industry groups in the private sector should follow suit. They should not be in cahoots with ICE, especially in ways may be illegal.”

Wyden said in a statement “it shouldn't have taken pressure from Congress for the airlines to finally shut down the sale of their customers’ travel data to government agencies by ARC, but better late than never. I hope other industries will see that selling off their customers' data to the government and anyone with a checkbook is bad for business and follow suit.”

“Because ARC only has data on tickets booked through travel agencies, government agencies seeking information about Americans who book tickets directly with an airline must issue a subpoena or obtain a court order to obtain those records. But ARC’s data sales still enable government agencies to search through a database containing 50% of all tickets booked without seeking approval from a judge,” the letter from the lawmakers reads.

Update: this piece has been updated to include statements from CHC Chair Espaillat and Senator Wyden.




A bipartisan letter reveals the IRS searched a database of hundreds of millions of travel records without first conducting a legal review. Airlines like Delta, United, American, and Southwest are selling these records to the government through a co-owned data broker.#arc #Privacy


IRS Accessed Massive Database of Americans Flights Without a Warrant


The IRS accessed a database of hundreds of millions of travel records, which show when and where a specific person flew and the credit card they used, without obtaining a warrant, according to a letter signed by a bipartisan group of lawmakers and shared with 404 Media. The country’s major airlines, including Delta, United Airlines, American Airlines, and Southwest, funnel customer records to a data broker they co-own called the Airlines Reporting Corporation (ARC), which then sells access to peoples’ travel data to government agencies.

The IRS case in the letter is the clearest example yet of how agencies are searching the massive trove of travel data without a search warrant, court order, or similar legal mechanism. Instead, because the data is being sold commercially, agencies are able to simply buy access. In the letter addressed to nine major airlines, the lawmakers urge them to shut down the data selling program. Update: after this piece was published, ARC said it already planned to shut down the program. You can read more here.

This post is for subscribers only


Become a member to get access to all content
Subscribe now




Dalle ore 12.00 di domani, mercoledì #19novembre, la piattaforma #CartadelDocente sarà accessibile per gli insegnanti che dispongano di eventuali residui dell’Anno Scolastico 2024/2025 e per i beneficiari di sentenze a cui è stata data esecuzione.

Roberto Rossetti reshared this.



Gipfel zur Europäischen Digitalen Souveränität: Kehrtwende für die „Innovationsführerschaft“


netzpolitik.org/2025/gipfel-zu…



Un canale di informazioni, aggiornamenti, notizie dal Ministero dell'Istruzione e del Merito. Ci trovate anche su Twitter, Instagram, Facebook.