Apple was all-in on WiFi from the beginning, launching the AirPort line of products to much fanfare in 1999. In 2004, along came the AirPort Express—a fully-functional router the size of a laptop charger, that offered audio streaming to boot. As [schvabek] found out that while a lot of older Apple gear has long ago been deprecated, the AirPort Express is still very much supported and functional to this day!

Generally, you wouldn’t expect to plug in a 20-year-old Apple accessory and have it work with the company’s modern hardware. However, upon slotting the AirPort Express into a wall socket and starting the initialization process, [schvabek] noted that it was detected perfectly well by his post-2020 Macs. Only, there was a small problem—the configuration process would always stall out before completion.

Thankfully, there was a simple remedy. [schvabek] found that he could connect to the AirPort Express with his classic white plastic MacBook and complete the process. From there, he was astonished that Apple’s servers let him pull down a firmware update for a device from 2004. After that upgrade, the AirPort Express was fully functional with all his modern Apple gear. He could readily stream audio from his iPhone and MacBooks with no compatibility issues whatsoever.

It’s nice to see Apple still supporting this ancient hardware to this day. It’s a nice contrast when companies like Sonos are more than happy to brick thousands of old devices just for the sake of progress.

youtube.com/embed/RCm09eckiGA?…

hackaday.com/2025/11/24/the-ai…

Il Digital Omnibus non vale i pixel che occorre accendere per visualizzarlo. Lsa Commissione dovrebbe vergognarsi, ma solo dopo essere stata impeciata, impiumata, e portata in giro per Bruxelles a cavallo di un palo, così che il popolo possa pacatamente esprimere il proprio democratico dissenso a pomodorate.

spreaker.com/episode/dk-10x12-…

We were as excited as anyone when MARSIS (the Mars Advanced Radar for Subsurface and Ionosphere Sounding) experiment announced there was possibly liquid water under the southern polar ice cap. If there is liquid water on Mars, it would make future exploration and colonization much more feasible. Unfortunately, SHARAD (the Shallow Radar) has a new trick that suggests the data may not indicate liquid water after all.

While the news is a bummer, the way scientists used SHARAD to confirm — or, in this case, deny — the water hypothesis was a worthy hack. The SHARAD antenna is on the Mars Reconnaissance Orbiter, but in a position that makes it difficult to obtain direct surface readings from Mars. To compensate, operators typically roll the spacecraft to give the omnidirectional antenna a clearer view of the ground. However, those rolls have been under 30 degrees.

Computer modelling indicated that rolls of 120 degrees would greatly improve the SHARAD data. So far, four of these “very large roll” or VLR maneuvers have allowed more detailed probes of the surface with SHARAD. Unfortunately the new data didn’t back up the early findings. Scientists now think the reflection may be just an unusually flat surface under the ice.

Of course, just because there might not be water in that location doesn’t mean there isn’t any at all. Want to live on Mars? There’s a lot to think about.

hackaday.com/2025/11/24/water-…

We’ve all owned something where one tiny detail drives us nuts: a blinding power LED, buttons in the wrong order, or a beep that could wake the dead. This beautifully documented project fixes exactly that kind of annoyance, only this time it’s the climate-controlled seats in a 2020 Ram 1500.

[projectsinmotion] wasn’t satisfied with adjusting seat heating and ventilation only through the truck’s touchscreen. Instead, they added real physical buttons that feel just like factory equipment. The challenge? Modern vehicles control seats through the Body Control Module (BCM) over a mix of CAN and LIN buses. To pull this off, they used an ESP32-S3 board with both CAN and LIN transceivers that sits in the middle and translates button presses into the exact messages the BCM expects.

The ESP32 also listens to the CAN bus so the new physical buttons always match whatever setting was last chosen on the touchscreen, no mismatched states, no surprises. On the mechanical side, there are 3D-printed button bezels that snap into blank switch plates that come out looking completely stock, plus a tidy enclosure for the ESP32 board itself. Wiring is fully reversible: custom adapters plug straight into the factory harness. Every pinout, every connector, and every wire color is documented with WireVis diagrams we’ve covered before, making this an easily repeatable seat-hack should you have a similar vehicle. Big thanks to [Tim] for the tip! Be sure to check out some of our other car hacks turning a mass produced item into one of a kind.

hackaday.com/2025/11/24/retrof…

When you think of ultrasonics, you probably think of a cleaner or maybe a toothbrush. If you are a Star Trek fan, maybe you think of knocking out crew members or showers. But there is another practical use of ultrasonics: cutting. By vibrating a blade at 40 kHz or so, you can get clean, precise cuts in a variety of materials. The problem? Commercial units are quite expensive. So [Electronoobs] decided to roll his own. Check it out in the video below.

There are dreams and then there’s reality. Originally, the plan was for a handheld unit, but this turned out not to be very practical. Coil actuators were too slow. Piezo elements made more sense, but to move the blade significantly, you need a larger element.

Taking apart an ultrasonic cleaner revealed a very large element, but mounting it to a small blade would be a problem. The next stop was an ultrasonic toothbrush. Inside was a dual piezo element with an interesting trick. The elements were mounted in a horn that acts like an ultrasonic megaphone, if you will.

These horns are available, and he found an off-the-shelf solution with four piezos and a large horn that seemed promising. Driving the elements, though, requires a 40kHz 100VAC signal. His original board didn’t work — but he’s not giving up. But, for now, he used a simple circuit on a breadboard. However, it didn’t make a strong vibration, even with a larger horn.

Comparison with ultrasonic cleaners showed that his output voltage wasn’t enough. The expedient answer was to buy an ultrasonic cleaner kit (who knew they came as kits?) and use the boards from it to drive the horn and the blade. That worked very well.

His current thinking is that the cleaner driver may be too large, since the blade and horn get hot in use. But he still encased it with a 3D printed case and wound up with a usable tool. His next version should be portable and maybe run a little cooler.

Ultrasonic sensors are, of course, super useful. Or you can always levitate tiny things with it.

youtube.com/embed/XhMMW6Fqgn0?…

hackaday.com/2025/11/24/ultras…

Anthropic ha rilasciato Claude Opus 4.5 , il suo nuovo modello di punta, che, secondo l’azienda, è la versione più potente finora rilasciata e si posiziona al vertice della categoria nella programmazione pratica, negli scenari basati su agenti di produttività.

Il modello ha inoltre registrato miglioramenti significativi nella ricerca approfondita, nell’analisi e nelle attività di presentazione. Opus 4.5 è ora disponibile tramite app, API e in tutti e tre le principali tecnologie cloud.

Il prezzo di Sonnet 4.5 parte da 3 dollari per milione di token in input e 15 dollari per milione di token in output, con un risparmio sui costi fino al 90% con il caching rapido e del 50% con l’elaborazione batch

SOTA nell’ingegneria reale

Nel test SWE-bench Verified, il nuovo modello mostra il risultato migliore tra tutti i modelli di frontiera : Anthropic sottolinea in particolare che Opus 4.5 rappresenta un significativo passo avanti rispetto a Sonnet 4.5, superando compiti che solo poche settimane fa erano considerati “quasi impossibili” per la generazione precedente.

Oltretutto:

• Opus 4.5 è leader in 7 linguaggi di programmazione su 8 su SWE-bench Multilingual.
• I miglioramenti non si limitano al codice: il modello ha registrato notevoli progressi nella visione, nella matematica, nel ragionamento e nelle attività multimodali.
• Su Aider Polyglot, BrowseComp-Plus, Vending-Bench – anche gli indicatori SOTA o simili.

Nel contesto delle intelligenze artificiali, “SOTA” (State of the Art) indica il modello o la tecnica che raggiunge le migliori prestazioni note su uno o più benchmark rilevanti.

Un esempio di miglioramento è stato un caso del benchmark τ²: il modello si sarebbe posizionato in settima posizione, dopo GPT 5.1.

Più forte, più intelligente, più sicuro

Secondo il team, Opus 4.5 è il modello Anthropic più sicuro e resistente alle iniezioni immediate. Ha superato tutti i concorrenti in una serie di test di resilienza alle richieste di attacco. Oltretutto:

• L’esame interno delle prestazioni di Opus 4.5 ha dato risultati migliori di qualsiasi altro test mai eseguito nella storia.
• Grazie a una pipeline di ragionamento migliorata, il modello impiega molti meno token per il ragionamento e la ricerca di soluzioni.

Controllo della forza, compattazione e multi-agente

Opus 4.5 introduce una nuova importante funzionalità per gli sviluppatori: il parametro effort, che determina la profondità del ragionamento:

• Con uno sforzo medio, il modello replica Sonnet 4.5 utilizzando il 76% di token in meno.
• Al massimo, supera Sonnet 4.5 di 4,3 punti percentuali, generando il 48% di token in meno.

Secondo Anthropic, tutto ciò comporta un incremento del 15% nelle attività di ricerca approfondita degli agenti.

Aggiornamenti della piattaforma e del prodotto

Con il rilascio di Opus 4.5 sono stati introdotti i seguenti aggiornamenti:

• Claude Code: la nuova modalità Plan genera piani dettagliati, formula eventuali domande di chiarimento e crea un file plan.md modificabile prima dell’esecuzione.
• Claude Code è ora disponibile anche nell’app desktop, con supporto per sessioni parallele sia locali sia remote.
• Nell’app Claude, le conversazioni estese non si “bloccano” più: il contesto precedente viene compresso automaticamente.
• Claude per Chrome è ora disponibile per tutti gli utenti Max.
• Claude per Excel è stato ampliato in versione beta per gli utenti Max, Team ed Enterprise.

Anthropic ha inoltre aumentato i limiti di utilizzo di Opus 4.5, rendendolo più adatto come strumento di lavoro principale. L’azienda ha dichiarato che gli utenti riceveranno approssimativamente lo stesso volume di token Opus rispetto ai token Sonnet disponibili in precedenza.

L'articolo Anthropic lancia Claude Opus 4.5, il modello di intelligenza artificiale più avanzato proviene da Red Hot Cyber.

The cool part about science is that you can ask questions like what happens if you stick some moss spores on the outside of the International Space Station, and then get funding for answering said question. This was roughly the scope of the experiment that [Chang-hyun Maeng] and colleagues ran back in 2022, with their findings reported in iScience.

Used as moss specimen was Physcomitrium patens, a very common model organism. After previously finding during Earth-based experiments that the spores are the most resilient, these were subsequently transported to the ISS where they found themselves placed in the exposure unit of the Kibo module. Three different exposure scenarios were attempted for the spores, with all exposed to space, but one set kept in the dark, another protected from UV and a third set exposed to the healthy goodness of the all-natural UV that space in LEO has to offer.

After the nine month exposure period, the spores were transported back to Earth, where the spores were allowed to develop into mature P. patens moss. Here it was found that only the spores which had been exposed to significant UV radiation – including UV-C unfiltered by the Earth’s atmosphere – saw a significant reduction in viability. Yet even after nine months of basking in UV-C, these still had a germination rate of 86%, which provides fascinating follow-up questions regarding their survivability mechanisms when exposed to UV-C as well as a deep vacuum, freezing temperatures and so on.

hackaday.com/2025/11/24/testin…

Some people are not merely satisfied with functionality, or even just good looks. These persnickety snoots (I am one of them) seek something elegant, a true marriage of form and function.

Image by [YANG SHU] via Hackaday.IOShould such a person be in the market for a macro pad (or ‘macropad’ if you prefer), that snoot should look no further than [YANG SHU]’s 8-key programmable stream deck-like device.

The main goal here was the perfect fusion of display and feel. I’m not sure that an FDM-printed, DIY macro pad can look any better than this one does. But looks are only half the story, of course. There’s also feel, and of course, functionality.

Yes those are (hot-swappable) mechanical key switches, and they are powered by an ESP32-S2. Drawn on the 3.5″ LCD are icons and text for each switch, which of course can be easily changed in the config app.

There’s a three-direction tact switch that’s used to switch between layout profiles, and I’m sure that even this is satisfying on the feel front. Does it get better than this? Besides maybe printing it in black. I ask Hackaday.

KeebDeck Keyboard Gets Two Thumbs Up

Did you make it to Supercon this year? If so, you hold a badge with a special keyboard — a custom job by Hackaday superfriend [Arturo182], aka Solder Party. Were you wondering about its backstory?

Image by [Arturo182] via Solder PartyUnsatisfied with having to rely on a dwindling stock of BBQ20 keyboards, [Arturo182] created a fantastic replacement called the KeebDeck Keyboard.

This 69-key alphanumeric silicone number has all the keys a hacker needs, plus a rainbow of extras that can be used for macros. According to [Arturo182], the keyboard has a tactile feel thanks to a snap dome sheet underneath the keys, and this makes it more comfortable for long thumb-typing sessions.

Be sure to check out the teasers at the bottom of the KeebDeck page, because there is some really exciting stuff. If you want to build one, GitHub is your friend, pal.

Thanks for the tip, [Wim Van Gool]!

The Centerfold: Controlled Chaos

Image by [Tardigradium] via redditDon’t you just love the repeated primary colors throughout this centerfold? I do, and I think this whole arrangement shows amazing restraint. Controlled chaos, if you will. That’s what [Tardigradium]’s wife calls it, anyway.

Here’s what I know: That’s a Nulea m512 mouse, the keyboard is a KBD Craft Sachiel LEGO number, and that there is a Cidoo macro pad. Best of all, [Tardigradium] hand-painted the speakers. Neat-o!

Do you rock a sweet set of peripherals on a screamin’ desk pad? Send me a picture along with your handle and all the gory details, and you could be featured here!

Historical Clackers: the Gerda Typewriter Was One of Accessibility

Some of us (okay, I) would have thought that most accessibility inventions are fairly recent, say, from the 1960s onward. But consider the Gerda typewriter, which was created in 1919 to enable blind and one-armed victims of WWI to become employable typists.
Image via The Antikey Chop
According to the Antikey Chop, it’s quite possible that the German government helped grease the wheels of this project so that these soldiers would have a usable typewriter with which to get on with life.

Three versions of this index typewriter were produced: a two-handed Gerda, one with a Braille index, and one with an English index. All entered the market the same year, and were produced for a total of three years.

The Gerda’s typewheel was quite like Blickensderfer, and some even had the DHIATENSOR layout. More expensive than last week’s Clacker (75 Marks), the Gerdas for blind and sighted people with two hands cost 195 Marks, and the one-handed edition was 205 Marks. Some of the two-handed models had rectangular, wooden key-tops, and others had round, glass-topped keys.

Finally, Module-Based Keyboard Is a Sensory Nightmare

Image by Future via Games Radar
I’ve been an early adopter of keyboards in the past. This is usually to bring them to your attention, either before they’re released, or just as they’ve come out. And never have I ever had this poor of an experience.

Games Radar recently reviewed a surprisingly not-failed Kickstarter keyboard that actually shipped, the Naya Create. It may not look like it, but the Create is supposed to be a gaming keyboard. What it does look like is mouse-focused, or at least mouse-forward. And that’s the point of it. Evidently.

Those big modules are interchangeable, and there are four of them so far: the Touch (a trackpad), Track (a trackball that falls out reliably), the Tune (a dial), and the Float, which is designed for space mousing around. They sound cool enough, and might actually be the best part of this whole setup.

To fully illustrate my poit I hvemt’t corrected any of the typos experieved typim this semtemve with the Naya Create while tryig to maintain my usual speed.

But according to Games Radar, the Naya Create is so not worth the $850 (!) asking price. It has ‘mushy, low-profile switches’ and clammy caps, and although the reviewer complains about the non-staggered keys, y’all know that those are my preference at this point.

And apparently, by default, Backspace is mapped to the left side. What? Of course, you can remap any key, whenever the software decides to work. Whenever the reviewer tried to save changes, the software would say that the keyboard is disconnected. Wonderful.

Despite these shortcomings, Games Radar says the keyboard is rock-solid aluminium with good hinges. So there’s that. Just, you know, swap out the switches and keycaps, and wait for software updates, I guess.

Got a hot tip that has like, anything to do with keyboards? Help me out by sending in a link or two. Don’t want all the Hackaday scribes to see it? Feel free to email me directly.

hackaday.com/2025/11/24/keebin…

Medium format cameras have always been a step up from those built in the 35 mm format. By virtue of using a much larger film, they offer improved resolution and performance. If you want a medium format film camera, you can always hunt for some nice vintage gear. Or, you could build one from scratch — like the MRF2 from [IDENTIDEM.design.]

The MRF2 might be a film camera, but in every other way, it’s a thoroughly modern machine. It’s a rangefinder design, relying on a DTS6012M LIDAR time-of-flight sensor to help ensure your shots are always in sharp focus. An ESP32 is responsible for running the show, and it’s hooked up to OLED displays in the viewfinder and on the body to show status info. The lens is coupled with a linear position sensor for capturing accurate shots, there’s a horizon indicator in the viewfinder, and there’s also a nice little frame counter using a rotary encoder to track the film.

Shots from a prototype on Instagram show that this camera can certainly pull off some beautiful shots. We love a good camera build around these parts. You can even make one out of a mouse if you’re so inclined.

youtube.com/embed/_sIWXoqOFIU?…

hackaday.com/2025/11/24/build-…

In the closing hours of JawnCon 0x2, I was making a final pass of the “Free Stuff for Nerds” table when I noticed a forlorn Kindle that had a piece of paper taped to it. The hand-written note explained that the device was in shambles — not only was its e-ink display visibly broken, but the reader was stuck in some kind of endless boot loop. I might have left it there if it wasn’t for the closing remark: “Have Fun!”

Truth is, the last thing I needed was another Kindle. My family has already managed to build up a collection of the things. But taking a broken one apart and attempting to figure out what was wrong with it did seem like it would be kind of fun, as I’d never really had the opportunity to dig into one before. So I brought it home and promptly forgot about it as Supercon was only a few weeks away and there was plenty to keep me occupied.

The following isn’t really a story about fixing a Kindle, although it might seem like it on the surface. It’s more about the experience of working on the device, and the incredible hacking potential of these unassuming gadgets. Whether you’ve got a clear goal in mind, or just want to get your hands dirty in the world of hardware hacking, you could do far worse than picking a couple of busted Kindles up for cheap on eBay.

If there’s a singular takeaway, it’s that the world’s most popular e-reader just so happens to double as a cheap and impressively capable embedded Linux development environment for anyone who’s willing to crack open the case.

Getting Connected

We start with what’s essentially Hardware Hacking 101: the hidden serial debug port. It’s the sort of thing you learn to look for when taking apart a new gadget, and unsurprisingly, it’s also at the heart of Kindle hacking. While there’s plenty of software modifications you can do depending on the age and version of your particular Kindle, opening up the case and tapping into the serial port is always the most direct way to gain access to the system.

From my research, every Kindle (with the possible exception of the very latest models from the 2020s) have an unpopulated serial port on the board. In the case of this Kindle Paperwhite 2 from 2013, it’s even labeled. I simply soldered on some jumper wires and ran them out to a pin header to make connecting to it a little less fiddly. The only thing to watch out for is the voltage; it seems that the serial port on the majority of Kindles is 1.8 V, and connecting up a higher voltage USB-serial adapter without a level shifter could release the Magic Smoke.

With the hardware connected and my favorite serial communications tool running, it was easy to see what ailed this particular Kindle. As evidenced by the final few lines of the kernel messages, a failure of one of the voltage regulators in the MAX77696 — a power management IC designed specifically for e-ink readers — was preventing the driver module from loading fully. This in turn was triggering a reboot, presumably because some sort of watchdog routine was in place to bail out if any critical hardware issues were detected.

On the Hunt

Coming from the “normal” Linux world, the solution seemed easy enough. Since the screen was toast anyway, all I needed to do to get the Kindle booting was to prevent the kernel module from loading. That way I could at least use it for something, perhaps an energy efficient minimalist server.

But according to the MAX77696 datasheet, the chip was responsible for quite a bit more than simply driving the e-ink panel. If I pulled the kernel module entirely, there was a good chance I’d also lose features like the real-time clock and the ability to read the battery voltage as well. So I decided to change tactics: rather than keeping the driver from loading, I’d take out the watchdog that was forcing the system to reboot. But where was it?

Amazon makes it easy to manually download the latest firmware for each member of the Kindle family, and the aptly named KindleTool lets you manipulate them. In this case I used the extract function to pull out the root filesystem image, which I could then locally mount as a basic EXT3 volume.

That was refreshingly straightforward, but unfortunately didn’t get me where I needed to go. Using grep to search all the files within the filesystem for the string “failed to load eink driver” showed no hits. If the watchdog wasn’t in the root filesystem, then where was it?

Unpacking the firmware update with KindleTool also got me the kernel image, and running Binwalk against it showed there was a compressed filesystem at 0x466C. I reasoned this must be an initramfs — essentially a minimal Linux system that lives in RAM and gives the kernel a place to work as it brings up the rest of the system. If the system has some self-check capability, it’s reasonable to assume that’s where it lives.

After drilling down a few times with Binwalk’s extract function, I was able to get to the contents of the initramfs. Sure enough, another search for the error message revealed our sentinel: /bin/recovery-util.

New Kernel, Who Dis?

I had considered trying to simply remove the recovery-util program from the kernel image, but since I wasn’t 100% sure how the whole watchdog system functioned, there was no guarantee that would have worked without more trial and error. So, emboldened by how well this was all going for me so far, I took the nuclear option and decided to rebuild the kernel with my own initramfs.

It’s here that the Kindle software environment, and the community around it, really started to shine. Once again, Amazon made it ridiculously easy to get the source code for the exact firmware I was working with, and the community provided an actively maintained toolchain to build it with. A little more searching even pulled up some pre-compiled builds that were ready to use.

Actually building the kernel for the Kindle was essentially the same process as doing it on my desktop computer, with the notable addition of supplying the location of the cross compiler into each make command. But if I ever got off track, there were plenty of write-ups online to reference. I even found one that went over building a custom initramfs with BusyBox that doesn’t include any of Amazon’s programs.

But perhaps the best part was that, once I had compiled Amazon’s modified kernel and built my initramfs, installing it on the Kindle was as simple as using a modified version of Android’s fastboot command. There were no cryptographic hoops to jump through, you just give it the new kernel and away it went. It’s my understanding that newer Kindles might not be so understanding, but with at least the hardware of this vintage, there’s nothing stopping you from doing whatever you want.

Pocket Penguin Playground

With the source code, tools, and knowledge floating around out there, I was able to build my own kernel and initramfs that lets me boot into a full Linux environment on what was previously a non-functional Kindle. There are a few things I haven’t gotten to work yet, but I believe that’s largely because I’m still using the root filesystem provided by Amazon.

Now that I know how easy it is to work with Linux on the Kindle, I’m looking to push further and put together my own stripped-down environment without any of Amazon’s frameworks installed. Given how ridiculously cheap early Kindles are on the second hand market — especially if they have a busted screen — there are all sorts of tasks that I could see them performing if I had a solid base to build on.

Make no mistake, I’m greatly appreciative of the fact that we now have mature single-board computers like the Raspberry Pi available for a reasonable cost. But taking what’s essentially consumer e-waste and turning it into a useful platform for learning and experimentation is the true hacker way. So whether you’ve got a Kindle collecting dust somewhere at home, or end up grabbing a few off of eBay for a song, I invite you to bust out the USB-serial adapter and start exploring.

The global e‑commerce market is accelerating faster than ever before, driven by expanding online retail, and rising consumer adoption worldwide. According to McKinsey Global Institute, global e‑commerce is projected to grow by 7–9% annually through 2040.

At Kaspersky, we track how this surge in online shopping activity is mirrored by cyber threats. In 2025, we observed attacks which targeted not only e‑commerce platform users but online shoppers in general, including those using digital marketplaces, payment services and apps for everyday purchases. This year, we additionally analyzed how cybercriminals exploited gaming platforms during Black Friday, as the gaming industry has become an integral part of the global sales calendar. Threat actors have been ramping up their efforts during peak sales events like Black Friday, exploiting high demand and reduced user vigilance to steal personal data, funds, or spread malware.

This report continues our annual series of analyses published on Securelist in 2021, 2022, 2023, and 2024, which examine the evolving landscape of shopping‑related cyber threats.

Methodology

To track how the shopping threat landscape continues to evolve, we conduct an annual assessment of the most common malicious techniques, which span financial malware, phishing pages that mimic major retailers, banks, and payment services, as well as spam campaigns that funnel users toward fraudulent sites. In 2025, we also placed a dedicated focus on gaming-related threats, analyzing how cybercriminals leverage players’ interest. The threat data we rely on is sourced from the Kaspersky Security Network (KSN), which processes anonymized cybersecurity data shared consensually by Kaspersky users. This report draws on data collected from January through October 2025.

Key findings

• In the first ten months of 2025, Kaspersky identified nearly 4 million phishing attacks which targeted users of online stores, payment systems, and banks.
• As many as 2% of these attacks were directed at online shoppers.
• We blocked more than 146,000 Black Friday-themed spam messages in the first two weeks of November.
• Kaspersky detected more than 2 million phishing attacks related to online gaming.
• Around 09 million banking-trojan attacks were recorded during the 2025 Black Friday season.
• The number of attempted attacks on gaming platforms surged in 2025, reaching more than 20 million, a significant increase compared to previous years.
• More than 18 million attempted malicious attacks were disguised as Discord in 2025, a more than 14-time increase year-over-year, while Steam remained within its usual five-year fluctuation range.

Shopping fraud and phishing

Phishing and scams remain among the most common threats for online shoppers, particularly during high-traffic retail periods when users are more likely to act quickly and rely on familiar brand cues. Cybercriminals frequently recreate the appearance of legitimate stores, payment pages, and banking services, making their fraudulent sites and emails difficult to distinguish from real ones. With customers navigating multiple offers and payment options, they may overlook URL or sender details, increasing the likelihood of credential theft and financial losses.

From January through to October 2025, Kaspersky products successfully blocked 6,394,854 attempts to access phishing links which targeted users of online stores, payment systems, and banks. Breaking down these attempts, 48.21% had targeted online shoppers (for comparison, this segment accounted for 37.5% in 2024), 26.10% targeted banking users (compared to 44.41% in 2024), and 25.69% mimicked payment systems (18.09% last year). Compared to previous years, there has been a noticeable shift in focus, with attacks against online store users now representing a larger share, reflecting cybercriminals’ continued emphasis on exploiting high-demand retail periods, while attacks on banking users have decreased in relative proportion. This may be related to online banking protection hardening worldwide.

Financial phishing attacks by category, January–October 2025 (download)

In 2025, Kaspersky products detected and blocked 606,369 phishing attempts involving the misuse of Amazon’s brand. Cybercriminals continued to rely on Amazon-themed pages to deceive users and obtain personal or financial information.

Other major e-commerce brands were also impersonated. Attempts to visit phishing pages mimicking Alibaba brands, such as AliExpress, were detected 54,500 times, while eBay-themed pages appeared in 38,383 alerts. The Latin American marketplace Mercado Libre was used as a lure in 8,039 cases, and Walmart-related phishing pages were detected 8,156 times.

Popular online stores mimicked by scammers, January–October 2025 (download)

In 2025, phishing campaigns also extensively mimicked other online platforms. Netflix-themed pages were detected 801,148 times, while Spotify-related attempts reached 576,873. This pattern likely reflects attackers’ continued focus on high-traffic digital entertainment services with in-service payments enabled, which can be monetized via stolen accounts.

How scammers exploited shopping hype in 2025

In 2025, Black Friday-related scams continued to circulate across multiple channels, with fraudulent email campaigns remaining one of the key distribution methods. As retailers increase their seasonal outreach, cybercriminals take advantage of the high volume of promotional communications by sending look-alike messages that direct users to scam and phishing pages. In the first two weeks of November, 146,535 spam messages connected to seasonal sales were detected by Kaspersky, including 2,572 messages referencing Singles day sales.

Scammers frequently attempt to mimic well-known platforms to increase the credibility of their messages. In one of the recurring campaigns, a pattern seen year after year, cybercriminals replicated Amazon’s branding and visual style, promoting supposedly exclusive early-access discounts of up to 70%. In this particular case, the attackers made almost no changes to the text used in their 2024 campaign, again prompting users to follow a link leading to a fraudulent page. Such pages are usually designed to steal their personal or payment information or to trick the user into buying non-existent goods.

Beyond the general excitement around seasonal discounts, scammers also try to exploit consumers’ interest in newly released Apple devices. To attract attention, they use the same images of the latest gadgets across various mailing campaigns, just changing the names of legitimate retailers that allegedly sell the brand.

Scammers use an identical image across different campaigns, only changing the retailer’s branding

As subscription-based streaming platforms also take part in global sales periods, cybercriminals attempt to take advantage of this interest as well. For example, we observed a phishing website where scammers promoted an offer for a “12-month subscription bundle” covering several popular services at once, asking users to enter their bank card details. To enhance credibility, the scammers also include fabricated indicators of numerous successful purchases from other “users,” making the offer appear legitimate.

In addition to imitating globally recognized platforms, scammers also set up fake pages that pretend to be local services in specific countries. This tactic enables more targeted campaigns that blend into the local online landscape, increasing the chances that users will perceive the fraudulent pages as legitimate and engage with them.

Non-existent Norwegian online store and popular Labubu toys sale

Banking Trojans

Banking Trojans, or “bankers,” are another tool for cybercriminals exploiting busy shopping seasons like Black Friday in 2025. They are designed to steal sensitive data from online banking and payment systems. In this section, we’ll focus on PC bankers. Once on a victim’s device, they monitor the browser and, when the user visits a targeted site, can use techniques like web injection or form-grabbing to capture login credentials, credit card information, and other personal data. Some trojans also watch the clipboard for crypto wallet addresses and replace them with those controlled by the malicious actors.

As online shopping peaks during major sales events, attackers increasingly target e-commerce platforms alongside banks. Trojans may inject fake forms into legitimate websites, tricking users into revealing sensitive data during checkout and increasing the risk of identity theft and financial fraud. In 2025, Kaspersky detected over 1,088,293* banking Trojan attacks. Among notable banker-related cases analysed by Kaspersky throughout the year, campaigns involving the new Maverick banking Trojan distributed via WhatsApp, as well as the Efimer Trojan which spread through malicious emails and compromised WordPress sites can be mentioned, both illustrating how diverse and adaptive banking Trojan delivery methods are.

*These statistics include globally active banking malware, and malware for ATMs and point-of-sale (PoS) systems. We excluded data on Trojan-banker families that no longer use banking Trojan functionality in their attacks, such as Emotet.

A holiday sales season on the dark web

Apparently, even the criminal underground follows its own version of a holiday sales season. Once data is stolen, it often ends up on dark-web forums, where cybercriminals actively search for buyers. This pattern is far from new, and the range of offers has remained largely unchanged over the past two years.

Threat actors consistently seize the opportunity to attract “new customers,” advertising deep discounts tied to high-profile global sales events. It is worth noting that year after year we see the same established services announce their upcoming promotions in the lead-up to Black Friday, almost as if operating on a retail calendar of their own.

We also noted that dark web forum participants themselves eagerly await these seasonal markdowns, hoping to obtain databases at the most favorable rates and expressing their wishes in forum posts. In the months before Black Friday, posts began appearing on carding-themed forums advertising stolen payment-card data at promotional prices.

Threats targeting gaming

The gaming industry faces a high concentration of scams and other cyberthreats due to its vast global audience and constant demand for digital goods, updates, and in-game advantages. Players often engage quickly with new offers, making them more susceptible to deceptive links or malicious files. At the same time, the fact that gamers often download games, mods, skins etc. from third-party marketplaces, community platforms, and unofficial sources creates additional entry points for attackers.

The number of attempted attacks on platforms beloved by gamers increased dramatically in 2025, reaching 20,188,897 cases, a sharp rise compared to previous years.

Attempts to attack users through malicious or unwanted files disguised as popular gaming platforms (download)

The nearly sevenfold increase in 2025 is most likely linked to the Discord block by some countries introduced at the end of 2024. Eventually users rely on alternative tools, proxies and modified clients. This change significantly expanded the attack surface, making users more vulnerable to fake installers, and malicious updates disguised as workarounds for the restriction.

It can also be seen in the top five most targeted gaming platforms of 2025:

In previous years, Steam consistently ranked as the platform with the highest number of attempted attacks. Its extensive game library, active modding ecosystem, and long-standing role in the gaming community made it a prime target for cybercriminals distributing malicious files disguised as mods, cheats, or cracked versions. In 2025, however, the landscape changed significantly. The gap between Steam and Discord expanded to an unprecedented degree as Steam-related figures remained within their typical fluctuation range of the past five years, while the number of attempted Discord-disguised attacks surged more than 14 times compared to 2024, reshaping the hierarchy of targeted gaming platforms.

Attempts to attack users through malicious or unwanted files disguised as Steam and Discord throughout the reported period (download)

From January to October, 2025, cybercriminals used a variety of cyberthreats disguised as popular related to gamers platforms, modifications or circumvention options. RiskTool dominated the threat landscape with 17,845,099 detections, far more than any other category. Although not inherently malicious, these tools can hide files, mask processes, or disable programs, making them useful for stealthy, persistent abuse, including covert crypto-mining. Downloaders ranked second with 1,318,743 detections. These appear harmless but may fetch additional malware among other downloaded files. Downloaders are typically installed when users download unofficial patches, cracked clients, or mods. Trojans followed with 384,680 detections, often disguised as cheats or mod installers. Once executed, they can steal credentials, intercept tokens, or enable remote access, leading to account takeovers and the loss of in-game assets.

Phishing and scam threats targeting gamers

In addition to tracking malicious and unwanted files disguised as gamers’ platforms, Kaspersky experts also analysed phishing pages which impersonated these services. Between January and October 2025, Kaspersky products detected 2,054,336 phishing attempts targeting users through fake login pages, giveaway offers, “discounted” subscriptions and other scams which impersonated popular platforms like Steam, PlayStation, Xbox and gaming stores.

Example of Black Friday scam using a popular shooter as a lure

The page shown in the screenshot is a typical Black Friday-themed scam that targets gamers, designed to imitate an official Valorant promotion. The “Valorant Points up to 80% off” banner, polished layout, and fake countdown timer create urgency and make the offer appear credible at first glance. Users who proceed are redirected to a fake login form requesting Riot account credentials or bank card details. Once submitted, this information enables attackers to take over accounts, steal in-game assets, or carry out fraudulent transactions.

Minor text errors reveal the page’s fraudulent nature. The phrase “You should not have a size limit of 5$ dollars in your account” is grammatically incorrect and clearly suspicious.

Another phishing page relies on a fabricated “Winter Gift Marathon” that claims to offer a free $20 Steam gift card. The seasonal framing, combined with a misleading counter (“251,110 of 300,000 cards received”), creates an artificial sense of legitimacy and urgency intended to prompt quick user interaction.

The central component of the scheme is the “Sign in” button, which redirects users to a spoofed Steam login form designed to collect their credentials. Once obtained, attackers can gain full access to the account, including payment methods, inventory items, and marketplace assets, and may be able to compromise additional services if the same password is used elsewhere.

Examples of scams on Playstation 5 Pro and Xbox series X

Scams themed around the PlayStation 5 Pro and Xbox Series X appear to be generated from a phishing kit, a reusable template that scammers adapt for different brands. Despite referencing two consoles, both pages follow the same structure which features a bold claim offering a chance to “win” a high-value device, a large product image on the left, and a minimalistic form on the right requesting the user’s email address.

A yellow banner promotes an “exclusive offer” with “limited availability,” pressuring users to respond quickly. After submitting an email, victims are typically redirected to additional personal and payment data-collection forms. They also may later be targeted with follow-up phishing emails, spam, or malicious links.

Conclusions

In 2025, the ongoing expansion of global e-commerce continued to be reflected in the cyberthreat landscape, with phishing, scam activity, and financial malware targeting online shoppers worldwide. Peak sales periods once again created favorable conditions for fraud, resulting in sustained activity involving spoofed retailer pages, fraudulent email campaigns, and seasonal spam.

Threat actors also targeted users of digital entertainment and subscription services. The gaming sector experienced a marked increase in malicious activity, driven by shifts in platform accessibility and the widespread use of third-party tools. The significant rise in malicious detections associated with Discord underscored how rapidly attackers adjust to changes in user behavior.

Overall, 2025 demonstrated that cybercriminals continue to leverage predictable user behavior patterns and major sales events to maximize the impact of their operations. Consumers should remain especially vigilant during peak shopping periods and use stronger security practices, such as two-factor authentication, secure payment methods, and cautious browsing. A comprehensive security solution that blocks malware, detects phishing pages, and protects financial data can further reduce the risk of falling victim to online threats.

securelist.com/black-friday-th…

IT'S MONDAY, AND THIS IS DIGITAL POLITICS. I'm Mark Scott, and am wishing everyone a happy Thanksgiving later this week. For those who don't do 'Turkey Day,' a reminder: it's a month until Festivus.

— The United States takes over the G20 presidency in 2026. On tech, it's time other countries stepped up to fill the void.

— Washington wants to stop US states from passing AI legislation despite Alabama to Wisconsin becoming a testing ground for digital rulemaking.

— Internet freedoms worldwide have declined progressively over the last 15 years.

Let's get started

digitalpolitics.co/newsletter0…

I ricercatori del Google Threat Intelligence Group (GTIG) hanno scoperto i dettagli di una campagna di spionaggio condotta dal gruppo cinese APT24. Questa attività è in corso da circa tre anni e gli hacker utilizzano il malware BadAudio, precedentemente non documentato, nei loro attacchi.

APT24 (noto anche come Pitty Tiger) attacca agenzie governative, nonché organizzazioni nei settori sanitario, edile e ingegneristico, minerario, no-profit e delle telecomunicazioni negli Stati Uniti e a Taiwan. Secondo Google, il gruppo è specializzato nel furto di proprietà intellettuale, in particolare di informazioni che rendono le organizzazioni competitive nei loro settori.

Secondo gli esperti, dal 2022 il malware è stato diffuso alle vittime attraverso vari metodi, tra cui spear phishing, compromissione della supply chain e attacchi watering-hole.
Cronologia degli attacchi del gruppo
Da novembre 2022 a settembre 2025, APT24 ha compromesso più di 20 siti web legittimi in vari domini iniettando codice JavaScript dannoso. Lo script rilevava le impronte digitali dei visitatori (solo per sistemi Windows) e visualizzava una finta finestra pop-up che informava le vittime della necessità di aggiornare il software (in realtà, la finestra scaricava il malware BadAudio).

I ricercatori scrivono inoltre che, da luglio 2024, gli aggressori hanno ripetutamente hackerato un’azienda di marketing taiwanese di cui non è stato reso noto il nome, che fornisce librerie JavaScript ai propri clienti. Gli aggressori hanno iniettato codice dannoso in una libreria molto diffusa e hanno registrato un dominio spacciandolo per una CDN legittima. Questa combinazione ha permesso agli hacker di compromettere oltre 1.000 domini.

Da fine 2024 a luglio 2025, APT24 ha nuovamente attaccato la stessa azienda taiwanese, ma questa volta gli aggressori hanno iniettato codice JavaScript offuscato in un file JSON modificato. Una volta eseguito, lo script ha raccolto informazioni sui visitatori del sito web e ha inviato un report in formato base64 al server di comando e controllo.

Parallelamente a questa attività, a partire dall’agosto 2024, il gruppo ha lanciato attacchi di spear-phishing inviando e-mail. In questi messaggi, gli hacker si spacciavano per organizzazioni per il soccorso degli animali. Le e-mail di APT24 contenevano pixel di tracciamento nascosti, che aiutavano a confermare che il destinatario avesse aperto il messaggio.

I ricercatori segnalano che alcuni attacchi hanno utilizzato Google Drive e OneDrive (invece dei server degli hacker) per raccogliere dati, sebbene tali abusi siano stati spesso bloccati. Notano inoltre che in almeno un caso, un beacon Cobalt Strike è stato distribuito tramite BadAudio.
Schema di attacco
Il malware BadAudio è un downloader fortemente offuscato che utilizza una tecnica di ricerca DLL che consente il download del payload dannoso da parte di applicazioni legittime.

Il malware utilizza anche una sofisticata tecnica di offuscamento che scompone il codice lineare in blocchi discreti controllati da un “dispatcher” centrale. Ciò complica sia l’analisi automatica che quella manuale.

Una volta avviato, BadAudio raccoglie i dati di sistema di base (nome host, nome utente, informazioni sull’architettura), li crittografa con una chiave AES codificata e li trasmette al server degli aggressori. Il payload crittografato viene quindi scaricato e, dopo la decifratura, eseguito in memoria tramite sideload DLL.

Gli esperti sottolineano che degli otto campioni di BadAudio rilevati, solo due sono riconosciuti da oltre 25 soluzioni antivirus elencate su VirusTotal. I campioni rimanenti (creati il 7 dicembre 2022) sono rilevati da un massimo di cinque soluzioni di sicurezza.

L'articolo Scoperto BadAudio: il malware fantasma usato da APT24 per tre anni senza essere visto proviene da Red Hot Cyber.

We aren’t sure why, but [Lev Chizhov] and some other researchers have found a way to make you smell things by hitting your head with ultrasound. Apparently, your sense of smell lives in your olfactory bulb, and no one, until now, has thought to try zapping it with ultrasound to see what happens.

The bulb is somewhere behind your nose, as you might expect. This is sub-optimal for ultrasound because your nose isn’t flat, and it is full of air. Packing a subject’s nose with gel wasn’t going to win many fans. The answer was to place the transducer on the person’s forehead and shoot down at the bulb. They made a custom headset that let them precisely target areas of the subject’s bulb guided by an MRI.

So far, they have a sample size of two, but they’ve managed to induce the smell of fresh air, garbage, ozone, and burning wood. What would you do with this? Smell-o-vision? A garbage truck VR game? Let us know in the comments. We don’t think this is exactly how the last VR smell gadget we saw worked, but — honestly — we aren’t completely sure.

hackaday.com/2025/11/24/smelly…

Il patrimonio netto di Satoshi Nakamoto, la misteriosa figura nota come il fondatore di Bitcoin, è diminuito del 34% nell’ultimo mese a causa del recente crollo degli asset virtuali.

Gli analisti del settore affermano che non si tratta semplicemente di una correzione dei prezzi, ma piuttosto di un segnale che la resistenza del mercato delle criptovalute sta vacillando a causa di fattori strutturali come la controversia sulla bolla dell’intelligenza artificiale, l’incertezza sui tassi di interesse della Federal Reserve statunitense e i rischi dell’informatica quantistica.

Secondo Benzinga, il 24 (ora locale), la ricchezza stimata di Nakamoto è scesa dal picco di ottobre di 137 miliardi di dollari agli attuali 90,7 miliardi di dollari. Il mercato complessivo delle criptovalute si è indebolito poiché le principali aziende tecnologiche non hanno saputo rispondere ai ripetuti avvertimenti sulla teoria della bolla dell’intelligenza artificiale.

Nakamoto, la persona che ha ideato il sistema Bitcoin (BTC) e creato il primo blocco (il Genesis Block), non ha ancora confermato il suo vero nome o la sua nazionalità. Nonostante i tentativi di rivelare la sua identità e i documentari in tutto il mondo, non è mai apparso in pubblico rimanendo completamente avvolto nel mistero.

Si stima che Nakamoto possieda attualmente circa 1.096.000 Bitcoin. Questa cifra da sola lo avrebbe collocato all’undicesimo posto tra le persone più ricche del mondo al picco del prezzo di Bitcoin a ottobre.

È noto per non aver venduto mai un singolo Bitcoin dalla sua emissione nel 2009, guadagnandosi il titolo della “balena di sempre”. Tuttavia, con questo recente crollo, la sua classifica dei miliardari di Forbes è scesa al ventesimo posto, appena sotto il fondatore di Microsoft Bill Gates.

Il prezzo attuale di un solo Bitcoin è di circa 87.000 dollari. Anche Ethereum (ETH), un altro attore chiave nel mercato delle attività virtuali, è sceso di circa il 19% dall’inizio dell’anno, rafforzando l’avversione generale al rischio.

Con il rapido progresso dell’informatica quantistica, sta riemergendo il dibattito sul cosiddetto “Q-Day”, ovvero il momento in cui il sistema delle criptovalute potrebbe collassare. Il Q-Day si riferisce al momento in cui i computer quantistici potrebbero distruggere completamente i sistemi crittografici esistenti.

La piattaforma di previsione Metaculus aveva inizialmente previsto il Q-Day per il 2052, ma da allora lo ha anticipato al 2034 per riflettere il rapido progresso della tecnologia quantistica. All’interno del settore, sta guadagnando terreno l’argomentazione secondo cui il sistema di sicurezza di Bitcoin debba essere completamente riprogettato.

Joseph Shalom, CEO di SharpLink Gaming, ha dichiarato: “Entro i prossimi cinque-dieci anni, dovremo passare a un nuovo sistema crittografico impermeabile ai computer quantistici”.

L'articolo Il patrimonio di Satoshi Nakamoto diminuisce del 34% con il crollo delle criptovalute proviene da Red Hot Cyber.

Negli ultimi anni, il panorama della sicurezza informatica in Italia ha visto una preoccupante escalation di attacchi, con un aumento significativo dei crimini informatici. Un fenomeno particolarmente allarmante è la vendita ripetuta di database di aziende con business online da parte di threat actors sui forum del dark web come nel caso di oggi di una azienda che si occupa di prodotti sanitari e di salute e bellezza.

Come evidenziato dall’immagine, in diverse occasioni sono stati messi in vendita interi archivi contenenti dati sensibili di clienti, tra cui:

• Dati anagrafici: customer_id, firstname, lastname, email, indirizzi.
• Informazioni di contatto: telephone, fax.
• Credenziali parziali: password (spesso sotto forma di hash, ma la loro presenza aumenta il rischio di attacchi successivi come il credential stuffing).

Il fatto che lo stesso threat actor si riproponga periodicamente con la messa in vendita di nuovi o vecchi database dimostra come gli e-commerce continuino ad essere un bersaglio primario e come sia fondamentale per le aziende innalzare le proprie difese.

Misure Essenziali per Prevenire la Violazione dei Dati

Per evitare di diventare la prossima vittima di un attacco, è cruciale per le aziende di e-commerce implementare e mantenere un robusto sistema di sicurezza.

La sicurezza del database e del software richiede innanzitutto l’uso di crittografia avanzata: tutti i dati sensibili, come password e informazioni di pagamento, devono essere protetti mediante algoritmi robusti come BCrypt o Argon2 e non devono mai essere archiviati in chiaro. È consigliabile crittografare anche l’intero database. Un altro elemento fondamentale è la gestione costante di patch e aggiornamenti, perché mantenere aggiornati il core del sistema, i plugin, i temi e il DBMS rappresenta la prima linea di difesa contro vulnerabilità note, come quelle che permettono le SQL injection. Per rafforzare ulteriormente la protezione, è opportuno adottare un Web Application Firewall in grado di filtrare il traffico HTTP e bloccare tentativi comuni di attacco, tra cui XSS e SQL injection.

Anche la protezione degli accessi e dei processi di autenticazione è cruciale. L’autenticazione a più fattori dovrebbe essere attivata e obbligatoria per tutti gli accessi amministrativi, mentre l’uso di password complesse e la loro rotazione periodica contribuiscono a ridurre il rischio legato all’errore umano e a credenziali deboli. È altrettanto importante applicare il principio del minimo privilegio, consentendo l’accesso al database solo a chi ne ha reale necessità e limitando i permessi allo stretto indispensabile.

Per garantire un livello di sicurezza elevato è necessario anche un monitoraggio costante, attraverso sistemi di logging in grado di individuare rapidamente attività sospette o accessi non autorizzati. La gestione dei dati deve inoltre rispettare le normative vigenti, come il GDPR e, quando si trattano carte di pagamento, lo standard PCI-DSS. In quest’ottica diventa essenziale raccogliere solo i dati strettamente necessari. Alla protezione contribuiscono anche backup regolari e crittografati, conservati in luoghi sicuri o isolati, così da assicurare la continuità operativa in caso di attacco ransomware o violazione dei dati.

Infine, anche i clienti hanno un ruolo attivo nella prevenzione. Se un e-commerce subisce una violazione, il primo passo è cambiare immediatamente la password, soprattutto se utilizzata anche altrove. È sempre consigliabile usare password uniche per ogni servizio, preferibilmente con l’aiuto di un password manager.

Occorre inoltre prestare la massima attenzione a email, SMS o messaggi sospetti che fanno riferimento all’azienda compromessa, perché i criminali sfruttano spesso dati come nome, cognome ed email per costruire tentativi di phishing molto credibili.

L'articolo 40.000 utenti di una azienda di Salute e Bellezza sono in vendita nel Dark Web proviene da Red Hot Cyber.

Il 13 novembre, Eurofiber France, apprezzato fornitore di soluzioni di rete in fibra ottica e VPN per molte delle principali società francesi, ha rilevato che i suoi sistemi erano stati violati dagli hacker criminali.

Il portale digitale, tramite cui quotidianamente si svolgono le comunicazioni tra clienti e assistenza tecnica, presentava una vulnerabilità. La rivendicazione della responsabilità per tale falla è stata attribuita ad un pirata informatico, noto con lo pseudonimo di ByteToBreach, che ha pubblicato la notizia nei forum underground.

Secondo quanto affermato dallo stesso, sono state ottenute informazioni riguardanti all’incirca 10.000 società ed enti pubblici, alcuni dei quali con un livello di sensibilità elevato.

Secondo l’azienda, la violazione dei dati ha interessato solo i clienti di Eurofiber France e delle sue filiali e non ha avuto ripercussioni sui clienti Eurofiber in Belgio, Germania o Paesi Bassi.

“Per le vendite indirette e i partner all’ingrosso in Francia, l’impatto è molto limitato, poiché la maggior parte utilizza sistemi separati”, ha affermato Eurofiber in un avviso di incidente sul suo sito web. Di seguito un estratto dal comunicato stampa.
novembre 2025 è stato rilevato un incidente di sicurezza informatica. L'incidente riguarda la piattaforma di gestione dei ticket utilizzata da Eurofiber France e dai suoi marchi regionali (Eurafibre, FullSave, Netiwan, Avelia), nonché il portale clienti ATE, che corrisponde alla divisione cloud di Eurofiber France, operante con il marchio Eurofiber Cloud Infra France. Una vulnerabilità software in questa piattaforma è stata sfruttata da un malintenzionato, con conseguente esfiltrazione di dati relativi a queste piattaforme.

Questo incidente è limitato ai clienti di Eurofiber France e dei marchi sopra menzionati, nonché ai clienti che utilizzano il portale ATE. Non riguarda i clienti che utilizzano i servizi di altre entità Eurofiber su piattaforme situate in Belgio, Germania o Paesi Bassi, incluso Eurofiber Cloud Infra nei Paesi Bassi.

Per le vendite indirette e i partner all'ingrosso in Francia, l'impatto è molto limitato, poiché la maggior parte utilizza sistemi separati.

Nelle prime ore successive al rilevamento, la piattaforma di ticketing e il portale ATE sono stati sottoposti a misure di sicurezza rafforzate e la vulnerabilità è stata risolta. Sono state implementate ulteriori misure per prevenire ulteriori violazioni dei dati e rafforzare la sicurezza del sistema. I nostri team, in collaborazione con esperti di sicurezza informatica, sono ora concentrati sul supporto ai clienti nella gestione dell'impatto di questo incidente.

Informazioni sensibili come dati bancari o dati critici archiviati in altri sistemi non sono state interessate da questo incidente. I servizi sono rimasti pienamente operativi durante l'attacco e non sono stati compromessi dall'aggressore.

I clienti sono stati informati non appena è stato rilevato l'incidente e continueremo a tenerli pienamente informati, sia con l'evolversi della situazione, sia regolarmente, caso per caso.

In conformità con gli obblighi di legge, Eurofiber France ha segnalato l'incidente alla CNIL (Autorità francese per la protezione dei dati personali ai sensi del GDPR), ha informato l'ANSSI (Agenzia nazionale francese per la sicurezza informatica) e ha presentato un reclamo per estorsione. Ribadiamo il nostro impegno per la protezione dei dati, la sicurezza informatica e la trasparenza. I nostri team rimangono pienamente mobilitati fino alla completa risoluzione dell'incidente.
L’attacco informatico ha preso di mira solo la filiale francese di Eurofiber Group, un operatore di telecomunicazioni belga-olandese noto per la gestione di una rete in fibra ottica di 76.000 chilometri attraverso Paesi Bassi, Belgio, Germania e Francia. La buona notizia è che l’incidente è rimasto confinato alla Francia. Gli altri paesi del gruppo non sono stati colpiti, né Eurofiber Cloud Infra nei Paesi Bassi.

In Francia, la piattaforma di biglietteria di Eurofiber France e dei suoi marchi regionali (Eurafibre, FullSave, Netiwan, Avelia) è stata compromessa, così come il portale clienti ATE collegato alla divisione cloud francese. L’aggressore ha sfruttato una vulnerabilità software per ottenere l’accesso. E si può affermare con certezza che la base clienti di Eurofiber France è piuttosto impressionante.

Eurofiber collabora con il Ministero dell’Interno e altri ministeri governativi, nonché con colossi come Airbus, Thales, Orange, TotalEnergies e persino la compagnia ferroviaria nazionale francese SNCF. Su un forum specializzato, l’hacker ByteToBreach afferma di possedere configurazioni VPN, oltre a password di sistemi interni, codice sorgente, certificati digitali e persino backup SQL. Il tipo di bottino che fa venire l’acquolina in bocca ai criminali informatici.

Oggi, il gruppo ByteToBreach minaccia di rendere pubblico tutto online se Eurofiber non pagherà le sue richieste di riscatto, il cui ammontare è sconosciuto. Una tattica classica di questo tipo, purtroppo collaudata come una macchina nel mondo dei moderni attacchi informatici.

Eurofiber afferma di aver reagito immediatamente. Entro poche ore dalla scoperta dell’intrusione, i team tecnici hanno bloccato il sistema di ticketing e l’ambiente cloud, hanno corretto la violazione e rafforzato tutte le misure di sicurezza. La vulnerabilità è stata ora corretta.

L’operatore sta anche cercando di rassicurare i clienti. Secondo loro, non sono stati rubati dati bancari, né sono trapelati dati “critici” archiviati altrove. L’azienda aggiunge che i servizi sono rimasti pienamente operativi per tutta la durata dell’operazione, senza alcuna interruzione. Tuttavia, è difficile sapere con precisione quali informazioni siano state rubate, poiché Eurofiber rimane vaga su questo punto, pur promettendo di informare individualmente i clienti interessati.

L'articolo Attacco informatico a Eurofiber France: scopriamo cos’è successo proviene da Red Hot Cyber.

Il CERT-AGID ha rilevato recentemente una sofisticata campagna di phishing mirato che sta prendendo di mira gli studenti dell’Università di Padova (UniPd).

L’operazione, ancora in corso, sfrutta tecniche di ingegneria sociale particolarmente insidiose, pensate per colpire un target giovane ma altamente digitalizzato come quello universitario.

La rapidità con cui si è diffusa l’attività fraudolenta ha spinto gli analisti del CERT ad avvertire immediatamente l’Ateneo.

Secondo le prime evidenze, i criminali informatici stanno inviando email contenenti riferimenti a false borse di studio, ideate per attirare l’attenzione delle vittime e stimolare un’interazione rapida.

I messaggi rimandano a una pagina web che replica in maniera quasi identica il portale di Single Sign-On (SSO) dell’Università di Padova. Obiettivo finale: sottrarre le credenziali istituzionali degli studenti, che potrebbero poi essere utilizzate per ulteriori compromissioni o accessi non autorizzati ai servizi accademici.

A seguito dell’individuazione della minaccia, il CERT-AGID ha informato tempestivamente l’Università di Padova, mettendo in moto le procedure di risposta e mitigazione. Contestualmente, il team ha distribuito gli Indicatori di Compromissione (IoC) a tutti gli enti accreditati al feed ufficiale, per consentire un blocco rapido delle infrastrutture malevole e prevenire l’espansione dell’attacco ad altri potenziali bersagli.

Questo episodio conferma come il settore accademico sia sempre più nel mirino delle campagne di phishing, in quanto ricco di dati personali, credenziali e informazioni sensibili. Gli studenti rappresentano un target appetibile, spesso non sufficientemente formato sulle tecniche avanzate di inganno digitale. In questo contesto, la collaborazione tra CERT-AGID e gli atenei rimane un elemento chiave per il contenimento delle minacce.

Nell’era dell’intelligenza artificiale generativa, riconoscere un’e-mail di phishing è più complesso: i messaggi sono più credibili, privi di errori grammaticali e spesso personalizzati.

Per difendersi è fondamentale adottare alcuni controlli di base: verificare sempre il dominio del mittente, evitare di cliccare link sospetti, controllare che le pagine di login siano realmente quelle ufficiali, attivare l’autenticazione a più fattori e, in caso di dubbi, rivolgersi direttamente agli uffici competenti. L’AI può essere un alleato, ma anche una potente arma nelle mani dei cyber criminali: consapevolezza e verifica restano le migliori difese.

L'articolo Campagna di phishing mirato ai danni dell’Università di Padova proviene da Red Hot Cyber.

In our modern world full of planned obsolescence helping to fuel cycles of consumerism, the thing that really lets companies dial this up to the max is locked-down electronics and software. We all know the key players in this game whether it’s an automotive manufacturer, video game console producer, smart phone developer, or fruit-based computer company of choice, but there are some lesser known players desperately trying to make names for themselves in this arena too. Many power tool manufacturers like Milwaukee build sub-par battery packs that will wear out prematurely as [Tool Scientist] shows in this video.

Determining that these packs don’t actually balance their cells isn’t as straightforward as looking for leads going to the positive terminal of each. The microcontrollers running the electronics in these packs are hooked up, but it seems like it’s only to communicate status information about the batteries and not perform any balancing. [Tool Scientist] tested this hypothesis through a number of tests after purposefully adding an imbalance to a battery pack, first by monitoring i2c communications, measuring across a resistor expected to show a voltage drop during balancing, let a battery sit 21 days on a charger, and then performing a number of charge and discharge cycles. After all of that the imbalance was still there, leading to a conclusion that Milwaukee still doesn’t balance their battery packs.

Giving them the benefit of the doubt, it could be that most packs will be just fine after years without balancing, so the added cost of this feature isn’t worth it. This video was put out nearly a year ago, so it’s possible Milwaukee has made improvements since then. But a more realistic take, especially in a world dominated by subscription services and other methods of value extraction, is that Milwaukee is doing this so that users will end up having to buy more batteries. They already make user serviceability fairly difficult, so this would be in line with other actions they’ve taken. Or it could be chalked up to laziness, similar to the Nissan Leaf and its lack of active thermal management in its battery systems.

Thanks to [Polykit] for the tip!

youtube.com/embed/wG6W3hz8NMQ?…

hackaday.com/2025/11/23/expens…

An interesting trend over the last year or two has been the emergence of modern retrocomputer PCs, recreations of classic PC hardware from back in the day taking advantage of modern parts alongside the venerable processors. These machines are usually very well specified for a PC from the 1980s, and represent a credible way to run your DOS or early Windows software on something close to the original. [CNX Software] has news of a couple of new ones from the same manufacturer in China, one sporting a 386sx and the other claiming it can take either an 8088 or an 8086.

Both machines use the same see-through plastic case, screen, and keyboard, and there are plenty of pictures to examine the motherboard. There are even downloadable design files, which is an interesting development. They come with a removable though proprietary looking VGA card bearing a Tseng Labs ET4000, a CF card interface, a USB port which claims to support disk drives, a sound card, the usual array of ports, and an ISA expansion for which a dock is sold separately. The battery appears to be a LiPo pouch cell of some kind.

If you would like one they can be found through the usual channels for a not-outrageous price compared to similar machines. We can see the attraction, though maybe we’ll stick with an emulator for now. If you’d like to check out alternatives we’ve reported in the past on similar 8088 and 386sx computers.

hackaday.com/2025/11/23/a-coup…

Remember the Key Bridge collapse? With as eventful a year as 2025 has been, we wouldn’t blame anyone for forgetting that in March of 2024, container ship MV Dali plowed into the bridge across Baltimore Harbor, turning it into 18,000 tons of scrap metal in about four seconds, while taking the lives of six very unlucky Maryland transportation workers in the process. Now, more than a year and a half after the disaster, we finally have an idea of what caused the accident. According to the National Transportation Safety Board’s report, a loss of electrical power at just the wrong moment resulted in a cascade of failures, leaving the huge vessel without steerage. However, it was the root cause of the power outage that really got us: a wire with an incorrectly applied label.

Sal Mercogliano, our go-to guy for anything to do with shipping, has a great rundown of the entire cascade of failures, with the electrically interesting part starting around the 8:30 mark. The NTSB apparently examined a control cabinet on the Dali and found one wire with a heat-shrink label overlapping the plastic body of its terminating ferrule. This prevented the wire from being properly inserted into a terminal block, leading to poor electrical contact. Over time, the connection got worse, eventually leading to an undervoltage condition that tripped a circuit breaker and kicked off everything else that led to the collision. It’s a sobering thought that something so mundane and easily overlooked could result in such a tragedy, but there it is.

youtube.com/embed/znWl_TuUPp0?…

We’ve been harping a bit on the Flock situation in this space over the last month or so, but for good reason, or at least it seems to us. Flock’s 80,000-strong network of automated license plate readers (ALPRs), while understandably attractive from a law-and-order perspective, is a little hard to swallow for anyone interested in privacy and against pervasive surveillance. And maybe all of that wouldn’t be so bad if we had an inkling that the security start-up had at least paid passing attention to cybersecurity basics.

But alas, Benn Jordan and a few of his cybersecurity pals have taken a look inside a Flock camera, and the news isn’t good. Granted, this appears to be a first-pass effort, but given that the “hack” is a simple as pressing the button on the back of the camera a few times. Doing so creates a WiFi hotspot on the camera, and from there it’s off to the races. There are plenty of other disturbing findings in the video, so check it out.

youtube.com/embed/uB0gr7Fh6lY?…

Sufficiently annuated readers will no doubt recall classic toys of the ’60s and ’70s, such as Lite-Brite and Rock ‘Em Sock ‘Em Robots, and games like Mouse Trap and Toss Across. We recall owning all of those at one time or another, and surprisingly, they all sprang from the inventive mind of the same man: Burt Meyer, who died on October 30 at the age of 99. We have many fond memories of his inventions, but truth be told, we never much cared for Mouse Trap as a game; we just set up the Rube Goldberg-esque trap and played with that. The rest, though? Quality fun. RIP, Burt.

Last week, we featured the unfortunate story about a Russian humanoid robot that drunk-walked its way into “demo hell” history. And while it’s perhaps a bit too easy to poke fun at something like this, it’s a simple fact of life that the upright human form is inherently unstable, and that any mechanism designed to mimic that form is bound to fall once in a while. With that in mind, Disney Research engineers are teaching their humanoid bots to fall with style. The idea is for the robots to protect their vital parts in the event of a fall, which is something humans (usually) do instinctively. They first did hundreds of falls with virtual robots, rewarding them for correctly ending up in the target pose, and eventually worked the algorithms into real, albeit diminutive, robots. The video in the article shows them all sticking the landing, and even if some of the end poses don’t seem entirely practical, it’s pretty cool tech.

And finally, this week on the Hackaday Podcast was discussed the infuriating story of an EV-enthusiast who had trouble servicing the brakes on his Hyundai Ioniq. Check out the podcast if you want the full rant and the color commentary, but the TL;DL version is that Hyundai has the functions needed to unlock the parking brakes stuck behind a very expensive paywall. Luckily for our hacker hero, a $399 Harbor Freight bidirectional scan tool was up to the task, and the job was completed for far less than what the officially sanctioned tools would have cost. But it turns out there may have been a cheaper and more delightfully hackish way to do the job, with nothing but a 12-volt battery pack and a couple of jumper wires. Lots of vehicles with electric parking brakes use two-wire systems, so i’s a good tip for the shade tree mechanic to keep in mind.

youtube.com/embed/SbopO815aek?…

hackaday.com/2025/11/23/hackad…

The BBC wanted to show everyone how a computer might be used in schools. A program aired in 1979 asks, “Will Computers Revolutionise Education?” There’s vintage hardware and an appearance of PILOT, made for computer instructions.

Using PILOT looks suspiciously like working with a modern chatbot without as much AI noise. The French teacher in the video likes that schoolboys were practicing their French verb conjugation on the computer instead of playing football.

If you want a better look at hardware, around the five-minute mark, you see schoolkids making printed circuit boards, and some truly vintage oscilloscope close-ups. There are plenty of tiny monitors and large, noisy printing terminals.

You have to wonder where the eight-year-olds who learned about computers in the video are today, and what kind of computer they have. They learned binary and the Towers of Hanoi. Their teacher said the kids now knew more about computers than their parents did.

As a future prediction, [James Bellini] did pretty well. Like many forecasters, he almost didn’t go far enough, as we look back almost 50 years. Sure, Prestel didn’t work out as well as they thought, dying in 1994. But he shouldn’t feel bad. Predicting the future is tough. Unless, of course, you are [Arthur C. Clarke].

youtube.com/embed/2df88qJYYnM?…

hackaday.com/2025/11/23/retrot…

We’ve probably all had a few conversations with people who hold eccentric scientific ideas, and most of the time they yield nothing more than frustration and perhaps a headache. In [Bertrand Selva]’s case, however, a conversation with a flat-earth believer yielded a device that uses a pair of gyroscopes to detect earth’s rotation, demonstrating that rotation exists without the bulkiness of a Foucalt pendulum.

[Bertrand] built his apparatus around a pair of BMI160 MEMS gyroscopes, which have a least significant bit for angular velocity corresponding to 0.0038 degrees per second, while the earth rotates at 0.00416 degrees per second. To extract such a small signal from all the noise in the measurements, the device makes measurements with the sensors in four different positions to detect and eliminate the bias of the sensors and the influence of the gravitational field. Before running a test, [Bertrand] oriented the sensors toward true north, then had a stepper motor cycle the sensors through the four positions, while a Raspberry Pi Pico records 128 measurements at each position. It might run the cycle as many as 200 times, with error tending to decrease as the number of cycles increases.

A Kalman filter processes the raw data and extracts the signal, which came within two percent of the true rotational velocity. [Bertrand] found that the accuracy was strongly dependent on how well the system was aligned to true north. Indeed, the alignment effect was so strong that he could use it as a compass.

In the end, the system didn’t convince [Bertrand]’s neighbor, but it’s an impressive demonstration nonetheless. This system is a bit simpler, but it’s also possible to measure the earth’s rotation using a PlayStation. For higher precision, check out how the standards organizations manage these measurements.

youtube.com/embed/edkJiVSeGOk?…

hackaday.com/2025/11/23/measur…

You know those old cliche that the younger generations have begun to cynically despise: “follow your dreams!” “You can be anything you put your mind to!” — well, perhaps they are true on occasion. For instance when [rctestflight] had PCBs that dreamed of becoming a hydrofoil, he found a way to make that dream come true.

It’s kind of obvious in retrospect: printed circuit boards are made of FR4, which is a form of fiberglass, and you know what else is commonly made of fiberglass? Boats. So yes, the material is suited for this task. The fact that solder joints hold up to use in a little remote-control hydrofoil is less obvious, but good to know. It certainly makes for easier assembly for those of us who have developed an allergy to epoxy.

Ease of assembly wasn’t really the point here: the point was that by making the “mast” of the hydrofoil out of PCB– that’s the part that holds the underwater wing– [rctestflight] figured he could (shock!) print a circuit onto it. Specifically, a liquid-level sensor, and because microcontrollers are so cheap these days he went the “total overkill” route of embedding an ESP32 on each mast. He started with a resistive sensor, but since those self-corrode too quickly, the team switched to a capacitive sensor that doesn’t need to form a galvanic cell in salt water. Come to think of it, that might still be a problem with the solder joint between the PCBs. Good thing nobody will be riding this one.

Having such a sensor and brain close-coupled allows for a faster control loop than the sonar [rctestflight] had previously been using to control his hydrofoil’s altitude.. Pivoting each mast with its own servo made for a smooth flight over the water— well, once they got the PID tuning set, anyway. Check it out in the video embedded below.

We’ve seen PCB used for enclosures before, and even the chassis of a rover, but using it for a hydrofoil is a new hack.

youtube.com/embed/VJENemGGHHQ?…

hackaday.com/2025/11/23/a-pcb-…

Gli utenti hanno notato che la scorsa settimana gli sviluppatori Microsoft hanno disattivato il metodo di attivazione offline per Windows 11 e 10 tramite KMS38, utilizzato da anni dai pirati informatici in tutto il mondo. Tuttavia, le note di rilascio ufficiali non menzionano queste modifiche.

KMS38 è stato sviluppato dagli appassionati del progetto Massgrave (MAS, Microsoft Activation Scripts), noto per il suo archivio di strumenti non ufficiali per l’attivazione di Windows e Office.

L’essenza di questo metodo di attivazione era quella di ingannare il file di sistema GatherOSstate.exe (un’utilità che determina se il sistema corrente è adatto a un aggiornamento), estendendo il periodo di attivazione del KMS (Key Management Service) dai soliti 180 giorni al 19 gennaio 2038.

L’impostazione di una data più lontana era impedita dal problema dell’anno 2038 (Y2K38).

La lotta contro KMS38 è iniziata quasi due anni fa.

I primi segnali sono comparsi da gennaio 2024, quando gatherosstate.exe è scomparso dall’immagine di installazione di Windows 26040. Questo significava che durante gli aggiornamenti e le reinstallazioni più importanti, il sistema azzerava il periodo di grazia di attivazione, costringendo l’utente a riconnettersi al server KMS.

Tuttavia, il colpo finale a KMS38 è arrivato con l’aggiornamento facoltativo di Windows 11 KB5067036, rilasciato nell’ottobre 2025. In questo aggiornamento, Microsoft ha rimosso completamente la funzionalità GatherOSstate e, dopo il Patch Tuesday di novembre (KB5068861 e KB5067112), KMS38 ha finalmente smesso di funzionare.

Gli sviluppatori di Massgrave hanno confermato che questo metodo non funziona più. Nell’ultima versione di MAS 3.8, il supporto KMS38 è stato completamente rimosso.

Massgrave consiglia agli utenti di utilizzare metodi alternativi: HWID (ID hardware) e TSforge, che funzionano comunque.

Vale la pena notare che nel 2023 è emerso che gli stessi tecnici del supporto Microsoft a volte ricorrono alle soluzioni di attivazione Windows di Massgrave.

Inoltre, è stato ripetutamente sottolineato che gli strumenti di Massgrave sono open source e che i file di progetto sono da tempo disponibili su GitHub, di proprietà di Microsoft. Tuttavia, l’azienda non intraprende alcuna azione contro i cracker.

L'articolo Microsoft Blocca il Metodo di Attivazione KMS38 per Windows 10 e 11 proviene da Red Hot Cyber.

Today’s pressurized water reactors (PWRs) are marvels of nuclear fission technology that enable gigawatt-scale power stations in a very compact space. Though they are extremely safe, with only the TMI-2 accident releasing a negligible amount of radioactive isotopes into the environment per the NRC, the company Deep Fission reckons that they can make PWRs even safer by stuffing them into a 1 mile (1.6 km) deep borehole.

Their proposed DB-PWR design is currently in pre-application review at the NRC where their whitepaper and 2025-era regulatory engagement plan can be found as well. It appears that this year they renamed the reactor to Deep Fission Borehole Reactor 1 (DFBR-1). In each 30″ (76.2 cm) borehole a single 45 MWt DFBR-1 microreactor will be installed, with most of the primary loop contained within the reactor module.

As for the rationale for all of this, at the suggested depth the pressure would be equivalent to that inside the PWR, with in addition a column of water between it and the surface, which is claimed to provide a lot of safety and also negates the need for a concrete containment structure and similar PWR safety features. Of course, with the steam generator located at the bottom of the borehole, said steam has to be brought up all the way to the surface to generate a projected 15 MWe via the steam turbine, and there are also sampling tubes travelling all the way down to the primary loop in addition to ropes to haul the thing back up for replacing the standard LEU PWR fuel rods.

Whether this level of outside-the-box-thinking is a genius or absolutely daft idea remains to be seen, with it so far making inroads in the DoE’s advanced reactor program. The company targets having its first reactor online by 2026. Among its competition are projects like TerraPower’s Natrium which are already under construction and offer much more power per reactor, along with Natrium in particular also providing built-in grid-level storage.

One thing is definitely for certain, and that is that the commercial power sector in the US has stopped being mind-numbingly boring.

hackaday.com/2025/11/23/deep-f…

One of the hardest things about owning a classic car is finding replacement parts. Especially if the car is particularly old or rare, or if the parent company is now out of business, sometimes this can be literally impossible and a new part will have to be manufactured from scratch. The same is true of bicycles as well, and there are plenty of defunct bicycle manufacturers to choose from. [Berm Peak] found a couple old rental ebikes from a company that’s not in business anymore and set about trying to get them working again. (Video, embedded below.)

Of course, unlike many classic cars, ebikes are encumbered by proprietary electronics and software that are much harder to replace than most physical components. As a result, these bikes get most of their electronics pulled out and directly replaced. This bike also had a seized motor, so [Berm Peak] replaced it with another hub motor he had in his shop. Some of the other highlights in the build include a custom 3D-printed latching mechanism for the battery’s attachment point at the frame, a 3D printed bezel for the new display and control unit, and the reuse of some of the other fun parts of the bike like the front basket and integrated headlight.

There are a few reasons for putting so much work into a bike like this. For this specific bike at least, the underlying components are worth saving; the sturdy metal frame and belt drivetrain are robust and won’t need much maintenance in the long term. It also only cost around $500 in parts to build a bike that would take around $2,000 to purchase new, so there’s some economic incentive as well. And in general it’s more fun and better for the world to fix things like this up and get them running again rather than buying something new off the shelf. And while proprietary electronics like those found on this bike are ubiquitous in the ebike world, they’re not all completely closed-source.

youtube.com/embed/sCVs599IH6U?…

hackaday.com/2025/11/23/saving…

There’s just something about an analog synthesizer. You’d think that for electronic music, digital sampling would have totally taken over by now, but that’s really not true. The world of analog synths is alive and well, and [Polykit] has a new, open-source polyphonic synthesizer to add to the ever-growing chorus of electronic instruments.

The analog part is thanks to the eight identical voice cards that plug into the machine’s mainboard: each one has a voltage controlled oscillator to generate tones, an envelope generator, multiple voltage-controlled amplifiers, and even a pole mixing filter which is also, yes, voltage controlled. Each voice card outputs stereo, and yes, there are controllable mixing circuits for left and right output.

All that voltage control means a lot of lines from digital-to-analog converters (DACs), because while this is an analog synth, it does have a MIDI interface, and that means that a microcontroller needs to be able to speak voltage. In this case, the brains are an ATmega2560. Instead of stacking the board with enough expensive DACs to interpret the MCU’s digital signals, [Polykit] is instead is using some clever tricks to get more work out of the one DAC he has. Some things get tied together on all eight voices, like the envelope parameters; other values are run through a demultiplexer to make the most possible use of the analog lines available. Of course that necessitates some latching circuitry to hold the demuxed values on those lines, but it’s still cheaper than multiple high-quality DACs.

It’s a well-thought out bit of kit, down to the control panel and acrylic case, and the writeup is worth reading to get the full picture. The voice cards, main board and control board all have their own GitHub repositories you can find at the bottom of the main page. If you’re into video, [Polykit] has a whole series on this project you might want to check out on Makertube; we’ve embedded the first one below.

If you want to get your toes wet in the wonderful world of synthesizers, this library of seventy synths is an amazing place to start, because it has great simple projects.

Thanks to [Polykit] for the tip!

makertube.net/videos/embed/aHq…

hackaday.com/2025/11/22/diy-po…

We think of radios as audio devices, but for people who are visually impaired, it can be difficult to tell which channel you are listening to at any given time. [Sncarter] has a family member with vision impairment and built a radio to help her. Unfortunately, it was difficult to replicate, so he decided to try again. The result is an FM radio that provides audible status notifications about power and frequency. Check it out in the video below.

This isn’t just some hacked-up commercial radio, but a ground-up design that uses a TEA5767 with an ATMega328 for control. There is an LCD for when someone else might use the radio and an audio amplifier. He built the prototype on a breadboard, but moved the finished product to a PCB.

It isn’t just the electronics and the sound that are assistive. The case has raised bosses to help the user find things like the switch and rotary encoder. The Arduino can speak frequency announcements, although the quality of the voice is something he wants to tackle in the next revision.

These radios on a chip give you many design options. These same ideas can be useful for audiobook players, too.

youtube.com/embed/k918V9Mndko?…

hackaday.com/2025/11/22/assist…

Transcutaneous Electrical Nerve Stimulation (TENS) is one of those things that sounds like it must be woo when you first hear of it. “A trickle of current that can deal with chronic pain better than the pills we’ve been using for decades? Yeah, and what chakras do you hook this doo-hickie up to?” It seems too good to be true, but in fact it’s a well-supported therapy that has become part of scientific medicine. There are no crystals needed, and you’re applying electrodes to the effected area, not your chakras. Like all medical devices, it can be expensive if you have to buy the machine out-of-pocket… but it is just a trickle of current. [Leon Hillmann] shows us its well within the range of hackability, so why not DIY?

[Leon]’s TENS machine is specifically designed to help a relative with hand problems, so breaks out electrodes for each finger, with one on the palm serving as a common ground. This type of TENS is “monophasic”– that is, DC, which is easier than balancing current flowing in two directions through quivering flesh. The direct current is provided at 32 V to the digit electrodes, safely kept to a constant amperage with a transistor-based current limiting circuit. The common ground in the palm is pulsed at a rate set by an ATmega32U4 and thus controllable: 14 Hz is given as an example.

Obviously if you want to reproduce this work you’re doing it at your own risk and need to consult with relevant medical professionals (blah blah blah, caveat gluteus maximus) but this particular sort of medical device is a good fit for the average hacker. Aside from prosthetics, we haven’t seen that much serious medical hacking since the pandemic. Still, like with synthesizing medical drugs, this is the kind of thing you probably don’t want to vibe code.

hackaday.com/2025/11/22/diy-te…

A Crookes radiometer, despite what many explanations claim, does not work because of radiation pressure. When light strikes the vanes inside the near-vacuum chamber, it heats the vanes, which then impart some extra energy to gas molecules bouncing off of them, causing the vanes to be pushed in the opposite direction. On the other hand, however, it is possible to build a radiometer that spins because of radiation pressure differences, but it’s easier to use acoustic radiation than light.

[Ben Krasnow] built two sets of vanes out of laser-cut aluminium with sound-absorbing foam attached to one side, and mounted the vanes around a jewel bearing taken from an analog voltmeter. He positioned the rotor above four speakers in an acoustically well-sealed chamber, then played 130-decibel white noise on the speakers. The aluminium side of the vanes, which reflected more sound, experienced more pressure than the foam side, causing them to spin. [Ben] tested both sets of vanes, which had the foam mounted on opposite sides, and they spun in opposite directions, which suggests that the pressure difference really was causing them to spin, and not some acoustic streaming effect.

The process of creating such loud sounds burned out a number of speakers, so to prevent this, [Ben] monitored the temperature of a speaker coil at varying amounts of power. He realized that the resistance of the coil increased as it heated up, so by measuring its resistance, he could calculate the coil’s temperature and keep it from getting too hot. [Ben] also tested the radiometer’s performance when the chamber contained other gasses, including hydrogen, helium, carbon dioxide, and sulfur hexafluoride, but none worked as well as air did. It’s a bit counterintuitive that none of these widely-varying gasses worked better than air did, but it makes sense when one considers that speakers are designed to efficiently transfer energy to air.

It’s far from an efficient way to convert electrical power into motion, but we’ve also seen several engines powered by acoustic resonance. If you’d like to hear more about the original Crookes radiometers, [Ben]’s also explained those before.

youtube.com/embed/lAeJvZfVLbE?…

hackaday.com/2025/11/22/buildi…

That MacOS (formerly OS X) has BSD roots is a well-known fact, with its predecessor NeXTSTEP and its XNU kernel derived from 4.3BSD. Subsequent releases of OS X/MacOS then proceeded to happily copy more bits from 4.4BSD, FreeBSD and other BSDs.

In that respect the thing that makes MacOS unique compared to other BSDs is its user interface, which is what the open source ravynOS seeks to address. By taking FreeBSD as its core, and crafting a MacOS-like UI on top, it intends to provide the MacOS UI experience without locking the user into the Apple ecosystem.

Although FreeBSD already has the ability to use the same desktop environments as Linux, there are quite a few people who prefer the Apple UX. As noted in the project FAQ, one of the goals is also to become compatible with MacOS applications, while retaining support for FreeBSD applications and Linux via the FreeBSD binary compatibility layer.

If this sounds good to you, then it should be noted that ravynOS is still in pre-release, with the recently released ravynOS “Hyperpop Hyena” 0.6.1 available for download and your perusal. System requirements include UEFI boot, 4+ GB of RAM, x86_x64 CPU and either Intel or AMD graphics. Hardware driver support for the most part is that of current FreeBSD 14.x, which is generally pretty decent on x86 platforms, but your mileage may vary. For testing systems and VMs have a look at the supported device list, and developers are welcome to check out the GitHub page for the source.

Considering our own recent coverage of using FreeBSD as a desktop system, ravynOS provides an interesting counterpoint to simply copying over the desktop experience of Linux, and instead cozying up to its cousin MacOS. If this also means being able to run all MacOS games and applications, it could really propel FreeBSD into the desktop space from an unexpected corner.

hackaday.com/2025/11/22/ravyno…

One of our newer writers, [Tyler August], recently wrote a love letter to plasma TV technology. Sitting between the ubiquitous LCD and the vanishing CRT, the plasma TV had its moment in the sun, but never became quite as popular as either of the other display techs, for all sorts of reasons. By all means, go read his article if you’re interested in the details. I’ll freely admit that it had me thinking that I needed a plasma TV.

I don’t, of course. But why do I, and probably a bunch of you out there, like old and/or odd tech? Take [Tyler]’s plasma fetish, for instance, or many people’s love for VFD or nixie tube displays. At Supercon, a number of people had hit up Apex Electronics, a local surplus store, and came away with some sweet old LED character displays. And I’ll admit to having two handfuls of these displays in my to-hack-on drawer that I bought surplus a decade ago because they’re so cute.

It’s not nostalgia. [Tyler] never had a plasma growing up, and those LED displays were already obsolete before the gang of folks who had bought them were even born. And it’s not simply that it’s old junk – the objects of our desire were mostly all reasonably fancy tech back in their day. And I think that’s part of the key.

My theory is that, as time and tech progresses, we see these truly amazing new developments become commonplace, and get forgotten by virtue of their ever-presence. For a while, having a glowing character display in your car stereo would have been truly futuristic, and then when the VFD went mainstream, it kind of faded into our ambient technological background noise. But now that we all have high-res entertainment consoles in our cars, which are frankly basically just a cheap tablet computer (see what I did there?), the VFD becomes an object of wonder again because it’s rare.

Which is not to say that LCD displays are anything short of amazing. Count up the rows and columns of pixels, and multiply by three for RGB, and that’s how many nanoscale ITO traces there are on the screen of even the cheapest display these days. But we take it for granted because we are surrounded by cheap screens.

I think we like older, odder tech because we see it more easily for the wonder that it is because it’s no longer commonplace. But that doesn’t mean that our current “boring” tech is any less impressive. Maybe the moral of the story is to try to approach and appreciate what we’ve got now with new eyes. Pretend you’re coming in from the future and finding this “old” gear. Maybe try to figure out how it must have worked.

This article is part of the Hackaday.com newsletter, delivered every seven days for each of the last 200+ weeks. It also includes our favorite articles from the last seven days that you can see on the web version of the newsletter. Want this type of article to hit your inbox every Friday morning? You should sign up!

hackaday.com/2025/11/22/why-do…

We absolutely adore inspired labor-of-love tales such as this one. [Alastair] wanted to build a synth for his daughter’s third birthday in spite of having no prior hardware knowledge. It became the perfect excuse to learn about CAD, microcontrollers, PCB design, and of course, 3D printing.

So, why a synth for a toddler? Aside from plain old ‘why not?’, the story goes that she received a Montessori busy-type board which she seemed to enjoy, and it reminded [Alastair] of the control surface of a synth. He wondered how hard it could be to build something similar that made sound and didn’t require constant button presses.

[Alastair] began his journey by dusting off a 15-year-old Arduino Inventors Kit. The initial goal was to get potentiometer readings and map them to 12 discrete values, and then emit MIDI messages. This was easy enough, and it was time to move to a synth module and an Elegoo Nano.

The full adventure is definitely worth the read. Be sure to check out the pink version in action after the break. You really don’t wanna miss the lil’ panda bear. Trust us.

youtube.com/embed/qboig3a0YS0?…

Thanks for the tip, [dole]!

hackaday.com/2025/11/22/babys-…

There’s more to making an oscillator than meets the eye, and [lcamtuf] is here with a good primer on the subject. It starts with the old joke that if you need an oscillator it’s best to try to make an amplifier instead, but of course the real point here is to learn how to make not just a mere oscillator, but a good oscillator.

He does this by taking the oscillator back to first principles and explaining positive feedback on an amplifier, before introducing the Schmitt trigger, an RC circuit to induce a delay, and then phase shift. These oscillators are not complex circuits by any means, so understanding their principles should allow you to unlock the secrets of oscillation in a less haphazard way than just plugging in values and hoping.

Oscillation is a subject we’ve taken a deep dive into ourselves here at Hackaday, should you wish to learn any more. Meanshile [lcamtuf] is someone we’ve heard from here before, with a comparative review of inexpensive printed circuit board manufacturers.

hackaday.com/2025/11/22/its-ha…

Negli ultimi mesi il problema degli insider sta assumendo un peso sempre più crescente per le grandi aziende, e un episodio ha coinvolto recentemente CrowdStrike.

La società di cybersecurity ha infatti allontanato un dipendente ritenuto responsabile di aver condiviso con un gruppo di pirati informatici informazioni riservate sui sistemi interni dell’azienda.

Esaminati da TechCrunch, gli screenshot rivelavano dashboard interne, fra cui figurava un pannello Okta Single Sign-On (SSO) che i dipendenti adoperavano per accedere alle applicazioni dell’azienda.

Sebbene gli hacker abbiano affermato di aver ricevuto cookie di autenticazione, CrowdStrike sostiene che il suo centro operativo di sicurezza ha rilevato l’attività prima che qualsiasi accesso dannoso potesse essere pienamente stabilito.

Ha inoltre riportato che le immagini trapelate erano il risultato della condivisione delle immagini del proprio schermo da parte di un dipendente e non di un’intrusione sistemica nella rete.

“I nostri sistemi non sono mai stati compromessi e i clienti sono rimasti protetti per tutto il tempo. Abbiamo inoltrato il caso alle forze dell’ordine competenti”, ha dichiarato a TechCrunch Kevin Benacci, portavoce di CrowdStrike.

L’incidente, venuto alla luce nel tardo giovedì e nella mattinata di venerdì, ha comportato la fuga di screenshot interni su un canale Telegram pubblico gestito dal gruppo di cybercriminali noto come “Scattered Lapsus$ Hunters”.

Le fughe di dati sono emerse quando Scattered Lapsus$ Hunters, (un gruppo composto dall’unione di più gruppi di criminali informatici), ha pubblicato delle immagini che presumibilmente mostravano l’accesso all’ambiente interno di CrowdStrike.
Panoramica delle violazioni di Scattered Lapsus$ Hunters dal 2021 (Fonte pushsecurity)
Gli hacker criminali hanno affermato che queste immagini erano la prova di una compromissione più ampia ottenuta tramite una violazione da parte di terzi presso Gainsight, una piattaforma di customer success utilizzata dai clienti Salesforce.

La realtà dei fatti pare indicare una vulnerabilità di natura umana piuttosto che una falla di natura tecnica. Secondo quanto riportato, gli autori dell’attacco avrebbero tentato di corrompere un utente interno con un’offerta di 25.000 dollari al fine di ottenere un accesso facilitato alla rete.

Questo incidente fa parte di una campagna più ampia e aggressiva condotta dagli Scattered Lapsus$ Hunters, che di recente hanno preso di mira grandi aziende sfruttando fornitori terzi come Gainsight e Salesloft.

Ricordiamo che ad ottobre 2025, il gruppo ha affermato di aver esfiltrato quasi 1 miliardo di record dai clienti Salesforce, elencando vittime di alto profilo come Allianz Life, Qantas e Stellantis sul loro sito di fuga di dati.

L'articolo CrowdStrike: licenziato un insider per aver fornito dati sensibili agli hacker criminali proviene da Red Hot Cyber.

Gli specialisti di Push Security hanno notato che la piattaforma di phishing Sneaky2FAora supporta attacchi browser-in-the-browser, che consentono la creazione di finestre di accesso false e il furto di credenziali e sessioni.

Sneaky2FA e gli altri PhaaS (phishing-as-a-service)

Sneaky2FA è uno dei servizi PhaaS (phishing-as-a-service) più diffusi tra i criminali informatici. Insieme a Tycoon2FA e Mamba2FA, Sneaky2FA e mira principalmente al furto di account Microsoft 365.

Questo kit di phishing è noto per gli attacchi che utilizzano SVG e la tattica “attacker-in-the-middle”: il processo di autenticazione viene inoltrato tramite una pagina di phishing al servizio reale, consentendo agli aggressori di intercettare i token di sessione.

Di conseguenza, anche con l’autenticazione a due fattori (2FA) abilitata, gli aggressori ottengono l’accesso all’account della vittima.

La tecnica dell’attacco browser-in-the-browser (BitB)

La tecnica di attacco browser-in-the-browser (BitB) è stata descritta per la prima volta nel 2022 da un ricercatore di sicurezza noto con lo pseudonimo mr.d0x. Ha dimostrato che il browser-in-the-browser consente la creazione di moduli di accesso di phishing utilizzando finestre di browser false.

L’attacco si basa sul fatto che, quando si accede a un sito web, spesso viene visualizzato un messaggio che richiede di effettuare l’accesso utilizzando un account Google, Microsoft, Apple, Twitter, Facebook, Steam e altri. Cliccando su un pulsante di questo tipo (ad esempio, “Accedi con Google“), viene visualizzata una finestra di Single Sign-On (SSO) nel browser, che richiede di inserire le proprie credenziali e di accedere con quell’account.

Queste finestre vengono troncate, mostrando solo il modulo di accesso e una barra degli indirizzi che mostra l’URL. Questo URL verifica che l’accesso al sito avvenga tramite un dominio reale (ad esempio, google.com), rafforzando ulteriormente la fiducia dell’utente nel processo.

In sostanza, gli aggressori creano finestre di browser false all’interno di finestre di browser reali e presentano alle vittime pagine di accesso o altri moduli per rubare credenziali o codici di accesso monouso (OTP).
Esempio di attacco browser-in-the-browser (BitB)

Sneaky2F e browser-in-the-browser (BitB)

BitB è ora attivamente utilizzato in Sneaky2F: la pagina falsa si adatta dinamicamente al sistema operativo e al browser della vittima (ad esempio, imitando Edge su Windows o Safari su macOS).

L’attacco funziona come segue:

• viene richiesto di accedere con un account Microsoft per visualizzare il documento;
• Dopo aver cliccato, viene visualizzata una finestra BitB falsa con una barra degli indirizzi Microsoft falsa;
• All’interno della finestra viene caricata una pagina di phishing reverse proxy che sfrutta il vero processo di accesso per rubare le credenziali e un token di sessione.

In sostanza, l’uso della tecnica di BitB aggiunge un ulteriore livello di inganno alle capacità già esistenti di Sneaky2FA.

I ricercatori notano che il kit di phishing utilizza un offuscamento avanzato di HTML e JavaScript per eludere il rilevamento statico (il testo è intervallato da tag invisibili e gli elementi dell’interfaccia sono immagini codificate). Sebbene tutto appaia normale all’utente, questo ostacola il funzionamento degli strumenti di sicurezza. Inoltre, Sneaky2FA reindirizza bot e ricercatori a una pagina separata e innocua.

L'articolo Sneaky2FA: il phishing che ruba credenziali con attacchi browser-in-the-browser proviene da Red Hot Cyber.

The history of the game Zork is a long and winding one, starting with MUDs and kin on university mainframes – where students entertained themselves in between their studies – and ending with the game being ported to home computers. These being pathetically undersized compared to even a PDP-10 meant that Zork got put to the axe, producing Zork I through III. Originally distributed by Infocom, eventually the process of Microsoft gobbling up game distributors and studies alike meant that Microsoft came to hold the license to these games. Games which are now open source as explained on the Microsoft Open Source blog.

Although the source had found its way onto the Internet previously, it’s now officially distributed under the MIT license, along with accompanying developer documentation. The source code for the three games can be found on GitHub, in separate repositories for Zork I, Zork II and Zork III.

We previously covered Zork’s journey from large systems to home computers, which was helped immensely by the Z-machine platform that the game’s code was ported to. Sadly the original games’s MDL code was a bit much for 8-bit home computers. Regardless of whether you prefer the original PDP-10 or the Z-machine version on a home computer system, both versions are now open sourced, which is a marvelous thing indeed.

hackaday.com/2025/11/21/micros…

You have that slide rule in the back of the closet. Maybe it was from your college days. Maybe it was your Dad’s. Honestly. Do you know how to use it? Really? All the scales? That’s what we thought. [Amen Zwa, Esq.] not only tells you how slide rules came about, but also how to use many of the common scales. You can also see his collection and notes on being a casual slide rule collector and even a few maintenance tips.

The idea behind these computing devices is devilishly simple. It is well known that you can reduce a multiplication operation to addition if you have a table of logarithms. You simply take the log of both operands and add them. Then you do a reverse lookup in the table to get the answer.

For a simple example, you know the (base 10) log of 10 is 1 and the log of 1000 is 3. Adding those gives you 4, and, what do you know, 10⁴ is 10,000, the correct answer. That’s easy when you are working with numbers like 10 and 1000 with base 10 logarithms, but it works with any base and with any wacky numbers you want to multiply.

The slide rule is essentially a log table on a stick. That’s how the most common scales work, at least. Many rules have other scales, so you can quickly, say, square or cube numbers (or find roots). Some specialized rules have scales for things like computing power.

We collect slide rules, too. Even oddball ones. We’ve often said that the barrier of learning to use a slide rule weeded out many bad engineers early.

hackaday.com/2025/11/21/how-to…

[Andrew Greenberg] has some specific ideas for how open-source hardware hackers could do a better job with their KiCad schematics.

In his work with students at Portland State University, [Andrew] finds his students both reading and creating KiCad schematics, and often these schematics leave a little to be desired.

To help improve the situation he’s compiling a checklist of things to be cognisant of when developing schematics in KiCad, particularly if those schematics are going to be read by others, as is the hope with open-source hardware projects.

In the video and in his checklist he runs us through some of the considerations, covering: visual design best practices; using schematic symbols rather than packages; nominating part values; specific types of circuit gotchas; Design for Test; Design for Fail; electric rule checks (ERC); manufacturer (MFR), part number (MPN), and datasheet annotations for Bill of Materials (BOM); and things to check at the end of a design iteration, including updating the date and version number.

(Side note: in the video he refers to the book The Visual Display of Quantitative Information which we have definitely added to our reading list.)

Have some best practices of your own you would like to see on the checklist? Feel free to add your suggestions!

If you’re interested in KiCad you might like to read about what’s new in version 9 and how to customize your KiCad shortcut keys for productivity.

youtube.com/embed/X0hd_v8qRiY?…

hackaday.com/2025/11/21/making…