Una nuova variante del trojan bancario Coyote ha iniziato a utilizzare un metodo insolito per tracciare gli utenti Windows: gli aggressori hanno imparato a utilizzare il sistema Microsoft UI Automation (UIA), progettato per le persone con disabilità, per tracciare le visite ai siti di banking e di scambio di criptovalute. Questo consente al malware di raccogliere dati riservati, inclusi login e password, bypassando al contempo i moderni strumenti di sicurezza.

La piattaforma UIA è stata progettata per consentire alle tecnologie assistive, come gli screen reader, di interagire con gli elementi dell’interfaccia utente di Windows. Le applicazioni compatibili con UIA creano un cosiddetto albero di automazione, in cui ogni elemento (pulsante, finestra, scheda) può essere individuato, analizzato e persino controllato dall’esterno tramite un’apposita API. Questa architettura ha permesso di creare soluzioni intuitive per le persone con disabilità. Tuttavia, è stata proprio questa versatilità e potenza ad attirare l’attenzione dei criminali informatici.

Gli esperti di Akamai avevano lanciato l’allarme sul rischio di un attacco di questo tipo già a dicembre 2024. All’epoca, avevano ipotizzato che UIA potesse essere utilizzata per aggirare i sistemi di difesa di classe EDR (Endpoint Detection and Response), poiché il framework era considerato “sicuro” e non destava sospetti negli antivirus. Ma ora, a partire da febbraio 2025, hanno registrato l’effettivo utilizzo di questa vulnerabilità in attacchi attivi. Si tratta del primo caso nella storia in cui un trojan inizia a utilizzare le funzionalità di UIA per rubare informazioni dal computer di una vittima.

Il trojan Coyote è apparso per la prima volta nel febbraio 2024 e da allora è in fase di sviluppo attivo. Prende di mira principalmente utenti brasiliani ed è in grado di rubare credenziali da 75 banche e piattaforme di criptovalute. In precedenza, il suo arsenale includeva metodi classici: keylogging, finestre di login false e intercettazione dei clic. Ma ora, con l’avvento del supporto UIA, il trojan è diventato molto più sofisticato e pericoloso.

Quando un utente apre un browser e visita il sito web di una banca o di un exchange, Coyote cerca innanzitutto di identificarlo tramite il titolo della finestra. Se non trova una corrispondenza, si connette all’albero UIA, estrae gli indirizzi dalle schede e dalla barra degli indirizzi e li confronta con un elenco hard-coded di 75 servizi target. Tra questi, Banco do Brasil, CaixaBank, Santander, Bradesco, nonché i servizi di criptovalute Binance, Electrum, Bitcoin e Foxbit. Se l’indirizzo corrisponde, il modulo spia viene attivato.

La particolarità dell’attacco è che per ora è limitato alla fase di ricognizione: il trojan si limita a monitorare l’interfaccia utente e a verificare se il bersaglio desiderato è aperto. Tuttavia, gli specialisti di Akamai hanno dimostrato che lo stesso meccanismo può essere utilizzato per leggere i dati di input, inclusi login e password. Hanno pubblicato un esempio tecnico che mostra come l’UIA possa essere utilizzata per acquisire il contenuto dei campi di input, ovvero un furto di account a tutti gli effetti.

Al momento della pubblicazione, Microsoft non aveva rilasciato dichiarazioni in merito a eventuali piani per introdurre ulteriori restrizioni o misure di sicurezza contro tali abusi. Tuttavia, la situazione ricorda un problema di lunga data nell’ecosistema Android, dove i servizi di accessibilità vengono sistematicamente utilizzati in modo improprio da app dannose. In risposta a ciò, Google ha introdotto misure di sicurezza da anni, inasprendo i requisiti per le app che accedono all’interfaccia di Accessibilità.

Framework come UIA nascono con buone intenzioni: aiutare le persone con disabilità a usare i computer come tutti gli altri. Ma con lo sviluppo di vettori di attacco non convenzionali da parte degli aggressori, questi potenti meccanismi di sistema stanno diventando sempre più strumenti per la criminalità informatica.

L'articolo Coyote, il trojan che fa la storia! fruttati i sistemi per i disabili per violare i conti bancari proviene da il blog della sicurezza informatica.

The Juno spacecraft was launched towards Jupiter in August of 2011 as part of the New Frontiers series of spacecraft, on what would originally have been a 7-year mission, including a nearly 5 year cruise to the planet. After a mission extension, it’s currently orbiting Jupiter, allowing for many more years of scientific data to be gathered using its instruments. One of these instruments is the JunoCam (JCM), a visible light camera and telescope. Unfortunately the harsh radiation environment around Jupiter had led many to believe that this camera would fail before long. Now it seems that NASA engineers have successfully tested a fix.
Location of the Juno spacecraft’s science instruments.
Although the radiation damage to JCM was obvious a few dozen orbits in – and well past its original mission’s 34 orbits – the big question was exactly was being damaged by the radiation, and whether something could be done to circumvent or fix it. The good news was that the image sensor itself was fine, but one of the voltage regulators in JCM’s power supply was having a bad time. This led the engineers to try annealing the affected part by cranking up one of the JCM’s heaters to a balmy 25°C, well above what it normally is kept at.

This desperate step seemed to work, with massively improved image quality on the following orbits, but soon the images began to degrade again. Before an approach to Jupiter’s moon Io, the engineers thus tried it again but this time cranked the JCM’s heater up to eleven and crossed their fingers. Surprisingly this fixed the issue over the course of a week, until the JCM seems as good as new. Now the engineers are trying their luck with Juno‘s other instruments as well, with it potentially providing a blueprint for extending the life of spacecraft in general.

Thanks to [Mark Stevens] for the tip.

hackaday.com/2025/07/23/anneal…

A recent news report about Secret Service surveillance of former FBI Director James Comey suggests that the Trump administration is abusing its spying powers.

You may remember that the Secret Service and Department of Homeland Security launched an investigation into Comey for posting a picture on Instagram during his beach vacation of seashells spelling out “8647.” Conservatives claimed that Comey’s post was a threat to our 47th president, Donald Trump. Never mind that “86” is slang for banning someone or something, not killing them. There’s also that whole First Amendment thing.

Then, The New York Times reported earlier this month that the Secret Service, as part of its investigation, had Comey “followed by law enforcement authorities in unmarked cars and street clothes and tracked the location of his cellphone” as Comey returned home from his vacation, even though he had already submitted to a phone interview and agreed to an in-person interview.

As the Center for Democracy & Technology’s Jake Laperruque pointed out, that kind of surveillance — real-time location tracking based on cellphone data — generally requires court approval. Although the Supreme Court hasn’t ruled on whether it requires a warrant, several other courts have held that it does.

There’s an important exception, however, to the Fourth Amendment’s warrant requirement. Known as exigent circumstances, it allows for warrantless searches in emergencies. Sources told the Times that the Secret Service invoked that exact exception to justify following Comey.

But Reason Magazine does a good job explaining why that rationale is bunk:

“‘A variety of circumstances may give rise to an exigency sufficient to justify a warrantless search, including law enforcement’s need to provide emergency assistance to an occupant of a home…engage in ‘hot pursuit’ of a fleeing suspect…or enter a burning building to put out a fire and investigate its cause,’ the U.S. Supreme Court wrote in Missouri v. McNeely (2013).

“None of those factors apply here: Comey was on the move, but he was not ‘fleeing’—he was coming home from vacation. If the Secret Service really thought he warranted further scrutiny, it had plenty of time to get a warrant from a judge.”

At least three federal appeals courts have permitted warrantless tracking of real-time cellphone location in emergencies. In one case, a man with a criminal history broke a window at his former girlfriend’s home with a gun and threatened to kill her, her seven-year-old, and other family members before fleeing. In another, a man running a drug operation murdered a potential informant, leaving police concerned that other informants who had infiltrated the operation were at risk. And in the third case, a gang member previously charged with drug crimes threatened to “shoot up” an informant.

These cases are a far cry from posting a picture of seashells on social media. And even if authorities truly believed Comey intended to threaten Trump, he had no way of carrying out that threat at the time he was tracked, since Trump was in the Middle East.

In other words, in Comey’s case, the Trump administration expanded the exigent circumstances exception beyond recognition. But it isn’t the only recent example of the government abusing its power to spy using cellphone data. A recent investigation by Straight Arrow News also detected evidence of a cellphone tracking device commonly known as a “stingray” at an anti-Immigration and Customs Enforcement protest, despite DHS policy requiring a warrant for its use except in — you guessed it — exigent circumstances.

These reports should raise red flags for everyone concerned about surveillance — including journalists and their sources. We already know that the government has tracked at least some physical movements of journalists in past leak investigations. Cellphone location data tracking allows even more all-encompassing surveillance.

If authorities are willing to claim that Comey’s social media post is an emergency justifying warrantless real-time cellphone location tracking, it’s not hard to imagine that they could make a similar (bogus) claim about a suspected whistleblower or a journalist who reports critically on the administration. It wouldn’t be any more meritless than their claims that journalism is inciting crimes or threatening national security.

Concerningly, there’s very little constraint on the government if it decides to abuse the exigent circumstances exception to make emergency requests to cellphone providers for users’ location information. While courts can suppress evidence obtained through illegal searches, they can’t undo the illegal search itself, and officers and officials who abuse the Fourth Amendment face no personal repercussions.

Cellphone providers also seem unable to detect and refuse bogus emergency requests. The three major cellphone carriers — AT&T, Verizon, and T-Mobile — receive thousands or tens of thousands of emergency requests every year. While they require a certification of emergency from the government authority making the request, clearly that process isn’t foolproof if something like the Comey “emergency” can slip through the cracks.

That makes public scrutiny of real-time cellphone location tracking and the government’s reliance on the exigent circumstances exception all the more important. The Fourth Estate — and confidential sources like those who spoke to the Times — may be our most powerful remaining check on the surveillance state.

freedom.press/issues/emergency…

When journalist Ben Camacho set out to cover protests in Paramount, California, he did not expect to become a part of the story he was reporting. But that’s what happened after he was shot twice with crowd-control munitions by Los Angeles County sheriff’s deputies June 7.

“As a reporter of color, there’s this dynamic where I’m out there on the field and I look like the majority of people that are protesting. … There’s this kind of other layer that I feel,” said Camacho, co-founder of The Southlander, during a Freedom of the Press Foundation (FPF) webinar July 9.

Despite having a press badge and camera around his neck, Camacho was hit in the knee and then in the elbow with “less-lethal” projectiles. The pain sent him into shock, screaming and scrambling for cover. The injuries left him unable to work for a week, with lingering pain in his knee and elbow that continues to affect him a month later.

Camacho shared his story alongside three other journalists during “Reporting under fire: Protests and press freedom in Los Angeles,” an event spotlighting a growing crisis in California’s streets and newsrooms.

youtube.com/embed/DOUI5404rQ0?…

Speakers Adam Rose, press rights chair and secretary of the Los Angeles Press Club, Sean Beckner-Carmitchel, an independent videographer, and Tina-Desiree Berg, a journalist for Status Coup, also spoke on the harassment, violence, and intimidation they faced in their own city while covering LA’s immigration protests.

They emphasized practical steps journalists can take to protect themselves while continuing to cover critical stories. Among the advice shared:

• Wear protective gear. Bring a gas mask and ballistic goggles, and keep your press pass clearly visible. Berg recommended wearing Kevlar leggings beneath pants for added protection.
• Travel with colleagues. Watching out for each other can make all the difference, especially if someone is injured.
• Be aware of your surroundings. Always assess your situation and be prepared to move quickly.
• Document everything. Keep records and collect evidence of any violations or incidents.
• Conduct a mental health check-in. Emotional and psychological impacts from covering trauma should not be overlooked. Camacho shared that he gauges how he’s feeling mentally each day before deciding whether to head out into the field.
• Utilize your resources. There are numerous training and mental health resources available to journalists. The Dart Center at Columbia University runs a Journalist Trauma Support Network. Many organizations, such as the LA Press Club, offer grants for journalists.

These precautions were shared alongside firsthand accounts, showing how deeply the panelists’ advice is rooted in their lived realities.

California has seen dozens of press freedom violations in 2025 alone, including detentions, assaults, and equipment seizures, according to the U.S. Press Freedom Tracker.

Although Rose was not physically targeted, he provided context from his role at the LA Press Club, highlighting the large number of press freedom violations in LA in the first weeks of June alone.

The incidents ranged from journalists being detained and kettled to more severe outcomes like hospitalization and life-changing injuries.

“We see these agencies acting lawlessly,” Rose said. “They are shooting journalists with ‘less-lethal’ munitions. They’re detaining and even arresting journalists simply for doing their job.”

The violence has unfolded despite legal protections. California’s Senate Bill 98 created Penal Code 409.7, barring California law enforcement from interfering with journalists’ work during protests.

Yet the reality on the ground tells a different story as federal law enforcement has been brought in.

Berg shared her experiences witnessing the protests that erupted in LA starting June 6, sparked by outrage over Immigration and Customs Enforcement detentions of asylum-seekers.

She said the early days of June protests were some of the most intense she’s ever seen, with multiple law enforcement agencies present in force, including the LA Police Department, the California Highway Patrol, the Department of Homeland Security, and the National Guard.

“This particular issue has drawn people from all walks of life and all age groups in large numbers,” Berg said. “When you have the large numbers, a large number of protesters out there, accompanied by all these various forms of law enforcement, it could be a more risky, dangerous situation.”

She witnessed police deploying tear gas into crowds, escalating tensions. To her, that weekend marked the beginning of a new wave of unrest.

“I knew at that moment that this was the start of something,” Berg said. “These things sort of just were compounded, and that weekend became, you know, what was the whole full-blown start of these protests.”

Beckner-Carmitchel also shared his encounters while covering protests in the LA area. A tear gas canister struck him in the head, exploded, and left him temporarily blinded and with a large hematoma.

Fortunately, he passed concussion protocols, but the potential for permanent injury was high.

Since then, he said he has been hit by plastic rounds and other projectiles at least three times.

“It’s been difficult to report under these conditions, and I’m sure everyone can agree,” Beckner-Carmitchel said.

But these journalists are not just recounting their stories, they’re seeking accountability. The LA Press Club, Status Coup, and Southlander are now joined in various lawsuits against the LAPD, the LA Sheriff’s Department, and the DHS, arguing their First Amendment rights were violated.

The stories shared during the webinar showed a troubling pattern: reporters targeted for simply doing their jobs of documenting the truth. And yet, despite injury, trauma, and intimidation, they continue to report.

“I get motivated when I’m told not to do something,” Beckner-Carmitchel said. “That’s why I became a journalist in the first place.”

Watch the whole event here.

This article was originally published by the National Press Club Journalism Institute here and is republished with permission.

freedom.press/issues/pressing-…