Connect with us
DAPA Banner

Tech

When attackers already have the keys, MFA is just another door to open

Published

on

Login prompt

The Figure breach exposed 967,200 email records without a single exploit. Understanding what that enables — and why your MFA cannot contain it — is an architectural problem, not a user education problem.

In February 2026, TechRepublic reported that Figure, a financial services company, exposed nearly 967,200 email records in a newly disclosed data breach. No vulnerability was chained. No zero-day was burned. The records were accessible, and now they are in adversary hands.

Coverage of breaches like this tends to stop at the count. That is the wrong place to stop. The number of exposed records is not the event — it is the starting inventory for the event that follows.

To understand the actual risk, you have to follow the attack chain that a credential exposure like this enables, step by step, and ask honestly whether the authentication controls in your environment can interrupt it at any point.

Advertisement

Most cannot. Here is why.

What Adversaries Do With 967,000 Email Records

Exposed email addresses are not static data. They are operational inputs. Within hours of a record set like this becoming available, adversaries are running it through several parallel workflows simultaneously.

The first is credential stuffing. Figure customers and employees almost certainly reused passwords across services. Adversaries combine the exposed addresses with breach databases from prior incidents — LinkedIn, Dropbox, RockYou2024 — and test the resulting pairs against enterprise portals, VPN gateways, Microsoft 365, Okta, and identity providers at scale. Automation handles the volume.

Success rates on credential stuffing campaigns against fresh email lists routinely run at two to three percent. On 967,000 records, that is 19,000 to 29,000 valid credential pairs.

Advertisement

The second workflow is targeted phishing. AI-assisted tooling can now generate personalized phishing campaigns from an email list in minutes. The messages reference the organization by name, impersonate internal communications, and are visually indistinguishable from legitimate correspondence.

Recipient-specific targeting — using job title, department, or public LinkedIn data to tailor the lure — is standard practice, not a capability reserved for nation-state actors.

The third is help desk social engineering. Armed with a valid email address and basic OSINT, adversaries impersonate employees in calls to IT support teams, requesting password resets, MFA device resets, or account unlocks.

This attack vector bypasses authentication technology entirely — it targets the human process that exists to handle authentication failures.

Advertisement

In each of these workflows, no technical vulnerability is required. The adversary’s goal is not to break in. It is to log in as a valid user. The breach does not create access. It creates the conditions under which access becomes achievable through the authentication system itself.

Token’s Biometric Assured Identity platform is built for organizations where authentication failure is not an acceptable outcome.

See how Token can strengthen identity assurance across your existing IAM, SSO & PAM stack.

Learn More

Why Legacy MFA Cannot Interrupt This Chain

This is the part of the analysis that most incident post-mortems underweight. Organizations read about a credential exposure and conclude that their MFA deployment protects them. For the attack chain described above, that conclusion is structurally incorrect.

Advertisement

Modern adversary tooling executes what security researchers call a real-time phishing relay, sometimes referred to as an adversary-in-the-middle (AiTM) attack. The mechanics are precise.

An adversary builds a reverse proxy that sits between the victim and the legitimate service. When the victim enters credentials on the spoofed page, the proxy forwards those credentials to the real site in real time.

The real site responds with an MFA challenge. The proxy forwards that challenge to the victim. The victim responds — because the page looks legitimate and the MFA prompt is real. The proxy forwards the response. The adversary receives an authenticated session.

Push notification MFA, SMS one-time codes, and TOTP authenticator apps are all vulnerable to this relay. They authenticate the exchange of a code. They do not verify that the individual completing the exchange is the authorized account holder. They cannot distinguish a direct session from a proxied one.

Advertisement

Toolkits that automate this attack — Evilginx, Modlishka, Muraena, and their derivatives — are publicly available, actively maintained, and require no advanced tradecraft to operate. The capability is not exotic. It is the baseline.

MFA fatigue compounds this. Adversaries who obtain valid credentials but cannot relay the session in real time will instead trigger repeated push notifications until a user approves one out of frustration or confusion. This attack has been used successfully against organizations with mature security programs, including in incidents that received significant public coverage.

The common thread across all of these techniques: legacy MFA places a human being at the final decision point of the authentication chain, then relies on that human to make the correct call under conditions specifically engineered to defeat it.

The Structural Problem Legacy MFA Cannot Solve

The security industry’s standard response to authentication failures is user education. Train people to recognize phishing. Teach them to verify unexpected MFA prompts. Remind them not to approve requests they did not initiate.

Advertisement

This response is not wrong. It is insufficient, and the insufficiency is architectural, not motivational.

A relay attack does not require a user to recognize a phishing page. The MFA prompt they receive is real, issued by the legitimate service, delivered through the same app they use every day. There is nothing anomalous for the user to detect. The attack is designed to be invisible to the human in the loop — and it is.

The deeper problem is that the authentication architecture most organizations have deployed was not designed to answer the question that actually matters in a post-breach environment: was the authorized individual physically present and biometrically verified at the moment of authentication?

Push notifications do not answer this question. SMS codes do not answer this question. TOTP does not answer this question. USB hardware tokens answer a related but different question — they prove the registered device was present, not the authorized person.

Advertisement

Auditors, regulators, and cyber insurers are increasingly drawing this distinction explicitly. The question “can you prove the authorized individual was there?” is appearing in CMMC assessments, NYDFS examinations, and underwriter questionnaires. Device presence is no longer accepted as a proxy for human presence in high-stakes access contexts.

What Phishing-Resistant Authentication Actually Requires

FIDO2/WebAuthn gets cited frequently in this conversation, and it is a meaningful step forward — but it is not sufficient on its own. Standard passkey implementations bind the credential to a device or cloud account.

Cloud-synced passkeys inherit the vulnerabilities of the cloud account: SIM swap attacks against the recovery phone number, account takeover via credential phishing, recovery flow exploitation. Device-bound passkeys prove device possession. They do not prove human presence.

Phishing-resistant authentication that closes the relay attack vector requires three properties simultaneously:

Advertisement
  • Cryptographic origin binding: the authentication credential is mathematically tied to the exact origin domain. A spoofed site cannot produce a valid signature because the domain does not match. The attack fails before any credential is transmitted.
  • Hardware-bound private keys that never leave secure hardware: the signing key cannot be exported, copied, or exfiltrated. Compromise of the endpoint does not compromise the credential.
  • Live biometric verification of the authorized individual: not a stored biometric template that can be replayed, but a real-time match that confirms the authorized person is physically present at the moment of authentication.

When all three properties are present, a relay attack has no viable path. The adversary cannot produce a valid cryptographic signature from a spoofed site. They cannot relay a session because the cryptographic binding fails the moment the origin changes.

They cannot use a stolen device because the biometric verification fails without the authorized individual. They cannot social-engineer an approval because there is no approval prompt — the authentication either completes with a live biometric match at the registered hardware, or it does not complete.

Token: Cryptographic Identity That Verifies the Human, Not the Device

TokenCore was built on a single, uncompromising principle: verify the human, not the device, credential, or session.

Most authentication products add factors to a weak foundation. Token replaces the foundation. The platform combines enforced biometrics, hardware-bound cryptographic authentication, and physical proximity verification — three properties that must all be satisfied simultaneously for access to be granted.

There is no fallback. There is no bypass code a user can enter in the field. The authorized individual is either present and verified, or access does not occur.

Advertisement

This matters precisely because of the attack chain described above. Token’s Biometric Assured Identity platform eliminates each link:

  • No Phishing. Every authentication is cryptographically bound to the exact origin domain. A spoofed login page produces no valid signature — Token simply refuses to authenticate.
  • No Replay. The private signing key never leaves the hardware. A relayed session cannot be reconstructed because the cryptographic material it would need to replicate is physically inaccessible.
  • No Delegation. A live fingerprint match is required for every authentication event. A colleague, an adversary with a stolen device, or a social engineering target cannot complete authentication on behalf of the authorized individual.
  • No Exceptions. There is no code, no recovery flow, and no help-desk override that can substitute for biometric presence. The control is absolute because the risk is absolute.

The form factor matters too. Token is wireless — Bluetooth proximity, no USB port required. Authentication takes one to three seconds: the user initiates a session, taps their fingerprint on the Token device, Bluetooth proximity confirms physical presence within three feet, and access is granted.

For on-call administrators, trading floor operators, and defense contractors working across multiple workstations, this eliminates the friction that drives the shadow IT and workaround behavior legacy hardware tokens create.

Unlike USB-based alternatives, Token is field-upgradeable over the air. As adversaries evolve their tooling, Token’s cryptographic controls can be updated remotely and immediately — without replacing hardware or reissuing devices. The investment does not expire when the threat landscape changes.

Token verifies the human. Not the session. Not the device. Not the code. The human.

Advertisement
Mitigate Risk and Secure Vulnerabilities with TokenCore
Mitigate Risk and Secure Vulnerabilities with TokenCore

The Honest Assessment

The Figure breach will produce downstream authentication attacks. So will the next breach, and the one after that. The adversary infrastructure that runs credential stuffing, AI-generated phishing, and real-time relay attacks operates continuously against exposed email records.

The question is not whether these attacks will be attempted against your environment. They will be.

The relevant question is whether your authentication architecture requires human judgment to succeed — or whether it is designed so that human judgment is not the failure point.

Legacy MFA, in all of its common forms, requires human judgment. A user must recognize the anomaly, question the prompt, and make the correct decision under adversarial pressure. That is a brittle dependency at a critical control point, and adversaries have built an entire toolchain to exploit it.

Token removes that dependency. The device signs for the legitimate domain with a confirmed biometric match — or it does nothing. There is no prompt to manipulate. There is no decision to engineer. There are no exceptions.

Advertisement

That is not a feature. It is the architectural requirement for authentication that holds under the conditions this breach, and every breach like it, creates.

See How Token Closes the Gap

Token’s Biometric Assured Identity platform is built for organizations where authentication failure is not an acceptable outcome — defense contractors, financial institutions, critical infrastructure, and enterprise environments with high-privilege access requirements.

Cryptographic. Biometric. Wireless. No phishing. No replay. No delegation. No exceptions.

Learn more. Visit tokencore.com.

Advertisement

Sponsored and written by Token.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

QiDi Max 4 review: The FDM multicolor printer that you want

Published

on

The QIDI Max 4 is a 3D printer capable of multi-color printing, equipped with heating and cooling elements and a massive build volume. It’s a serious 3D printer for those who need it.

Large enclosed QIDI 3D printer on a wooden table, with a laptop displaying colorful robotic artwork and printer control software, beside a window with blinds and a nearby door
QIDI Max 4 3D Printer Review

I consider myself a professional amateur 3D printing hobbyist. The Anet A8 was my starter printer about five years ago. Between then and now, I’ve picked up and messed with a Creality Ender 3 and an Anycubic Photon series resin printer.
More recently, I’ve even tried my hand at building my own HyperCube Evolution. Before I could finish it, my steam for the hobby ran out.
Continue Reading on AppleInsider | Discuss on our Forums

Source link

Continue Reading

Tech

Plot twist in downtown Seattle: Barnes & Noble bookstore opening soon in Amazon’s backyard

Published

on

Browsing in another new Barnes & Noble bookstore, in Bellevue, Wash. (GeekWire File Photo / Kurt Schlosser)

A new retail storyline is close to beginning in downtown Seattle with the opening this month of a Barnes & Noble bookstore — six years after the chain closed its longtime downtown location.

The new store at 520 Pike St. is about four blocks from Pike Place Market and another four from Amazon’s headquarters, in a 29-story Tishman Speyer office building. A grand opening event is planned for April 29 at 9 a.m., with a ribbon cutting and a book signing with bestselling author Robin Hobb (“Blood of Dragons”).

Downtown Seattle Association President and CEO Jon Scholes signaled his excitement Monday for the return of a major national retailer to an area hit hard by retail exits and depleted foot traffic during and after the pandemic.

“A strong signal to others who may have left the market over the last 6 years and to those that have yet to plant a flag here,” Scholes wrote on LinkedIn alongside a picture of the outside of the store. “With a record residential population, visitor numbers that are beating 2019 level and an increasing return of locals – there are many great reasons to be downtown.”

The store will be a short walk from the HQ towers and Spheres that make up Amazon’s Denny Triangle home. The tech giant got its start as an online bookseller, and on its way to disrupting multiple retail verticals, the company’s e-commerce dominance took a toll on physical bookstores, including Barnes & Noble. Amazon even opened physical Amazon Books locations, a concept that lasted about seven years before they were shut down in 2022.

Advertisement

In an especially ironic twist, Barnes & Noble moved into two vacant Amazon Books locations in the Boston area in 2022.

Barnes & Noble CEO James Daunt said in a television interview last year that he believes the experience in a physical store wins out when compared to shopping online with Amazon or elsewhere. Customers engage with other books and other customers about books.

“You will have an experience, and when you walk out of the store with [a book] in your bag it will lift you,” Daunt said. “It’s the same book, but I promise you it’s a better book, and the reading of it will be more pleasurable because you bought it in a bookstore.”

Barnes & Noble left its Pacific Place location at 600 Pine St. in Seattle in January 2020, after 22 years. Shoppers told GeekWire at the time that they were saddened by the loss of downtown’s only bookstore.

Advertisement

The chain still operates locations in the Northgate and University District areas of Seattle and has several locations in Western Washington. The opening of a new location at Bellevue Square attracted a steady stream of book lovers in January 2025.

The company, which peaked at 726 locations nationwide in 2008, has undergone a revival since the pandemic, opening nearly 60 stores in 2024 and dozens more in 2025. It has plans to open 60 more this year and is already back over 700 stores.

FOX 13 reported in December that the new downtown Barnes & Noble space will be 17,538 square feet and offer an array of books, toys, games, magazines, gift items and more. The company signed a 10-year lease — the largest retail lease in downtown Seattle since 2020.

Source link

Advertisement
Continue Reading

Tech

Mozilla says Microsoft is using Copilot and Edge to tighten its grip on Windows

Published

on


In a recent statement, Mozilla argued that Microsoft’s design choices – particularly those that link the Windows experience tightly to Edge and Copilot – undermine genuine user control. When Microsoft embeds features that favor its own browser and AI tools, it removes opportunities for competing software to be used at…
Read Entire Article
Source link

Continue Reading

Tech

AMC will stream ‘The Audacity’ premiere in 21 parts on TikTok

Published

on

While it’s not unusual for networks to promote new shows by releasing full episodes on YouTube, AMC is doing something a bit different for its Silicon Valley-focused comedy “The Audacity.”

The show’s premiere will be available on TikTok, starting on Sunday morning. It will be split into 21 segments, each lasting about three minutes, according to Deadline. The segments will be numbered, allowing users to watch the premiere in its entirety if they choose.

This could be a smart way to build buzz among younger viewers for a show that AMC’s chief marketing officer described as the network biggest launch of the year. Or it might just be an odd attempt to recreate Quibi.

Created by Jonathan Glatzer and starring Billy Magnussen and Sarah Goldberg, “The Audacity” doesn’t depict real companies or executives, but it aims to provide a darkly comedic look at many issues created by today’s technology.

Advertisement

And if you don’t want to watch in three-minute segments, you can catch the full premiere on AMC and its streaming service AMC+. It will also stream simultaneously on Samsung’s free service Samsung TV Plus.

Source link

Continue Reading

Tech

Webinar: From noise to signal

Published

on

Threat intel

Cyberattacks rarely come out of nowhere—threat actors often leave behind signals long before an intrusion begins.

On Thursday, April 30, 2026 at 2:00 PM ET, BleepingComputer will host a live webinar titled “From noise to signal: What threat actors are targeting next” with Tammy Harper, Threat Intelligence Researcher at RansomLook.

The webinar explores how security teams can monitor early warning signs across underground communities and translate them into actionable defense.

We will examine how threat actors use dark web forums, Telegram channels, and access broker marketplaces to coordinate attacks, share vulnerabilities, and advertise compromised access, often revealing their intentions weeks before an attack is launched.

Advertisement

Flare Systems, a threat intelligence firm specializing in monitoring external threat surfaces, helps organizations detect these early signals across the dark web and other hidden channels. By providing visibility into attacker behavior and emerging threats, Flare enables security teams to move from reactive defense to proactive risk reduction.

In this session, attendees will learn how to identify meaningful signals within online “chatter,” track evolving adversary tactics, and turn intelligence into prioritized defensive actions before attackers gain a foothold.

Flare webinar

Threat actors don’t operate in silence

From vulnerability discussions and leaked credentials to access broker listings and Telegram coordination, attackers frequently communicate and prepare in ways that can be observed.

However, these signals are often fragmented, noisy, and difficult to interpret without the right approach.

Advertisement

This webinar will explore how to cut through that noise, identify patterns, and understand what truly indicates an impending attack versus background activity.

The upcoming webinar will cover:

  • How to monitor underground forums, dark web sites, and Telegram channels for early attack signals
  • How to identify shifts in attacker tactics and priorities
  • How to translate threat intelligence into defensive priorities
  • How to proactively reduce risk before intrusions begin

Don’t miss this opportunity to learn how to move from reactive defense to proactive security strategy.

Register now to secure your spot!

Source link

Advertisement
Continue Reading

Tech

AI health tech is booming. The cures are not.

Published

on

The drug discovery revolution is real but radically overstated, the health chatbots are a documented hazard, and the diseases that matter most remain stubbornly unsolved.

At Novartis, sometime in late 2025, a team of researchers working on Huntington’s disease used generative AI to computationally design 15 million potential compounds for a type of molecule called a molecular glue degrader, one that could cross the blood-brain barrier and attack a protein implicated in the illness.

From those 15 million candidates, the team synthesised roughly 60 in the laboratory. They arrived at a promising scaffold now moving forward for further optimisation. Fifteen million possibilities narrowed to 60. It is, by any honest measure, an extraordinary feat of computational triage. It is also, by any honest measure, not a cure for Huntington’s disease.

That gap, between what AI can do in a laboratory and what it has actually delivered to patients, is the defining tension of health technology in 2026. The industry speaks in the language of revolution. The evidence speaks in the language of incremental, uncertain, and frequently disappointing progress. 

Advertisement

Somewhere between the two, more than 40 million people a day are typing their symptoms into ChatGPT, and patient safety organisations are warning that this might be the single most dangerous use of the technology in existence.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

The pitch for AI in drug discovery is seductive and, in its narrow terms, accurate. Traditional drug development takes 10 to 15 years and costs an average of $2.5 billion per successful compound, with approximately 90 per cent of candidates failing in clinical trials.

Advertisement

AI can compress early discovery timelines by 30 to 40 per cent and reduce preclinical candidate development from three to four years to as little as 13 to 18 months. Insilico Medicine brought an AI-discovered drug for idiopathic pulmonary fibrosis from target identification to Phase II trials in under 30 months, a process that traditionally takes six to eight years.

As of January 2024, at least 75 drugs or vaccines from AI-first biotechs had entered clinical trials, according to Boston Consulting Group.

These are real achievements. They are also achievements that stop well short of the finish line. As of December 2025, no AI-discovered drug has received FDA approval. Not one. The pharmaceutical industry’s 90 per cent clinical failure rate has not demonstrably improved.

Scientific commentary has noted that AI-discovered compounds appear to show progression rates similar to traditionally discovered ones, meaning the technology is getting us to the starting gate faster without improving our odds of crossing it.

Advertisement

Dr Raminderpal Singh, writing in Drug Target Review in February 2026, offered a summary that should be required reading for anyone tempted to confuse acceleration with transformation: the most important question for this year, he argued, is not whether AI can speed up preclinical timelines (it can) but whether it can improve clinical success rates.

Until Phase III data and regulatory approvals answer that question, the pharmaceutical industry’s cautious approach to AI investment appears, in his words, “entirely justified.” One unnamed CEO was blunter: “AI has really let us all down in the last decade when it comes to drug discovery. We’ve just seen failure after failure.”

There is a reason no amount of computation has cured Alzheimer’s, or pancreatic cancer, or ALS, or Huntington’s, or any of the diseases that continue to kill people while AI companies raise billions. The reason is not a lack of processing power. It is that human biology is irreducibly complex. Diseases with poorly understood mechanisms do not become well understood simply because you can screen millions of compounds faster.

The blockage was never the speed of molecular screening. It was, and remains, our fundamental ignorance of how these diseases work at the cellular level, how animal models fail to predict human outcomes, and how clinical trials must unfold over years to determine whether a compound is safe and effective in a living body.

Advertisement

AI cannot bypass biology. It cannot shorten a five-year clinical trial to five months. It cannot make a patient’s immune system behave like a predictive model. Novartis, to its credit, acknowledged this plainly at the World Economic Forum in January 2026: human biology remains deeply complex, translating research into clinical studies takes time, and for many diseases, long and rigorous trials are still needed. AI, the company said, is not a magic wand. It is a tool for navigating complexity more intelligently.

That is a defensible claim. It is also a profoundly different one from the narrative that Sam Altman floated when he mused that one day we might simply ask ChatGPT to cure cancer.

If AI’s performance in drug discovery is a story of genuine but overstated progress, its performance as a health assistant is something closer to a cautionary tale.

In January 2026, the patient safety organisation ECRI ranked the misuse of AI chatbots in healthcare as the number one health technology hazard for the year. The tools, ECRI noted, are not regulated as medical devices, not validated for clinical use, and increasingly relied upon by patients, clinicians, and healthcare staff.

Advertisement

ECRI documented cases in which chatbots suggested incorrect diagnoses, recommended unnecessary testing, promoted substandard medical supplies, and, in at least one instance, invented a body part. More than 40 million people turn to ChatGPT daily for health information, according to OpenAI’s own analysis. A quarter of its 800 million regular users ask healthcare questions every week.

The most rigorous test of whether this actually helps anyone came in February 2026, when researchers at the University of Oxford published a randomised controlled study of 1,298 participants in Nature Medicine. The results were sobering. When tested alone on medical scenarios, the LLMs performed impressively, correctly identifying conditions in 94.9 per cent of cases.

When real people used the same models to assess their own symptoms, performance collapsed: participants identified relevant conditions in fewer than 34.5 per cent of cases and chose the correct course of action in fewer than 44.2 per cent. These results were no better than the control group, which used traditional resources like web searches and their own judgement.

The study’s lead medical practitioner, Dr Rebecca Payne of Oxford’s Nuffield Department of Primary Care, was direct. “Despite all the hype,” she said, “AI just isn’t ready to take on the role of the physician.”

Advertisement

The problem, she explained, is that medicine is not a knowledge retrieval exercise. It is a conversation. Doctors probe, clarify, check understanding, and guide, actively eliciting information that patients often do not know is relevant. The chatbots do not do this.

They respond to whatever the user types, and users, understandably, do not know what to type. The result is a two-way communication breakdown in which the model sounds authoritative and the patient walks away with a mix of good and dangerous advice they cannot tell apart.

The mental health space is arguably worse. The American Psychological Association issued a health advisory noting that generative AI chatbots were not created to deliver mental health care and wellness apps were not designed to treat psychological disorders, yet both are being used for exactly those purposes.

Stanford researchers found that therapy chatbots exhibited measurable stigma toward conditions like alcohol dependence and schizophrenia, and that this stigma persisted across newer and larger models. The default industry response, that the problems will improve with more data, was not supported by the evidence.

Advertisement

None of this means AI is useless in healthcare. That would be as dishonest as the hype in the opposite direction. AI-powered imaging tools are improving early detection of certain cancers. Administrative applications, transcribing consultations, generating referral letters, summarising patient records, are saving clinicians genuine time.

Drug discovery, despite its failure to produce an approved drug, is becoming faster and more computationally sophisticated in its early stages. These are real contributions. They are also, notably, contributions that fall into the category of assistance rather than intelligence: the technology is at its best when it is doing clerical work, not clinical reasoning.

Dr Payne framed it with a precision that the industry would do well to adopt. The proper role for LLMs in healthcare, she said, is as “secretary, not physician.” That single sentence captures something the billions in investment have not: a realistic assessment of where these tools actually belong.

Alzheimer’s is expected to affect 78 million people worldwide by 2030. Parkinson’s, according to a 2025 BMJ study, is projected to reach 25 million by 2050. Pancreatic cancer’s five-year survival rate has barely moved in decades.

Advertisement

These are the diseases that AI was supposed to be our best hope for cracking.

Instead, three years into the generative AI era, the most visible health application of the technology is 40 million people a day asking a chatbot whether their headache means something serious, and a patient safety organisation telling them to be very, very careful about the answer.

Source link

Advertisement
Continue Reading

Tech

Rockstar Games has confirmed it was hit by third-party data breach

Published

on

An experienced hacking group has claimed to have infiltrated Rockstar Games‘ cloud servers, while the game publisher has confirmed that there was a “third-party data breach.” ShinyHunters, a hacker group that’s been linked to data breaches targeting Microsoft, Google, Ticketmaster and others, posted a message on its website with a final warning to Rockstar to “pay or leak.” The hack was first spotted by Hackread and the Cybersec Guru.

ShinyHunters didn’t detail what Rockstar data it gained access to, only adding that the company had until April 14 to reach out or that the group would leak the compromised info that would lead to “several annoying (digital) problems.” Rockstar Games confirmed the breach to Kotaku, explaining that “a limited amount of non-material company information was accessed in connection with a third-party data breach,” and that the incident had “no impact on our organization or our players.”

Previously, Rockstar had to deal with a major hack that led to a leak including plenty of gameplay footage and assets for Grand Theft Auto VI in 2022. Following the hack, one of the 18-year-old members of the Lapsus$ group responsible for the leak, was sentenced to an “indefinite hospitalization.”

Source link

Advertisement
Continue Reading

Tech

Flight Path Data Shows How Mosquitoes Target Humans

Published

on

Infectious diseases borne by mosquitoes—such as malaria, dengue fever, and Zika fever—claim more than 770,000 lives worldwide each year. Understanding how mosquitoes find humans has long been a challenge in controlling the spread of these diseases. However, little has been known about how mosquitoes integrate multiple cues, including visual information and carbon dioxide, to approach their targets.

In this context, a research team led by the Georgia Institute of Technology and Massachusetts Institute of Technology has succeeded in automatically deriving a dynamic model governing mosquito flight by applying Bayesian inference statistical methods to a vast amount of data recording mosquito movements.

Bayesian inference is a statistical technique that probabilistically determines the most plausible model parameters from observed data. Using this method, the researchers were able to construct a mathematical model that could reproduce experimental results with high accuracy while compressing mosquito behavior to fewer than 30 parameters.

“The big question was, how do mosquitoes find a human target?” explains Cheng-Yi Fei, a postdoctoral researcher at MIT. “There were previous experimental studies on what kind of cues might be important. But nothing has been especially quantitative.”

Advertisement

Mosquitoes Have Two Modes of Flight

The research team released two female Aedes aegypti mosquitoes into a sealed experimental space and recorded their flight paths in 0.01-second increments using two infrared cameras. The data obtained from a total of 20 experiments exceeds 53 million points, with more than 400,000 flight paths recorded. This represents the largest dataset ever collected for a study quantitatively measuring mosquito flight.

The experiment began by photographing mosquitoes flying around human subjects, who were dressed in dark-colored clothing. This observation revealed that Aedes aegypti mosquitoes were concentrating their approach on human heads. This was a fundamental discovery that served as the starting point for the entire study.

Next, the researchers experimented with subjects dressed in black on one side and white on the other. They found that although carbon dioxide and body odor were emitted equally from both sides of the body, the mosquitoes’ flight trajectories were concentrated only on the black side. Although strange at first glance, this result vividly demonstrated that visual stimuli play an important role in the search for targets in a windless environment.

Furthermore, a detailed analysis of mosquitoes flying in a stimulant-free environment revealed that their flight patterns could be broadly classified into two types. One was the active state, in which they actively explored the space while maintaining a speed of approximately 0.7 meter per second. The other was the idle state, in which they flew almost without using thrust. The idle state is thought to be a preparation stage for landing and was observed more frequently near the ceiling of the experimental space.

Advertisement

Analysis of mosquito responses to visual stimuli revealed that mosquitoes are attracted to dark objects and slow down when they get within about 40 centimeters. However, without additional cues such as body odor, humidity, or heat, mosquitoes often flew away even after approaching their target. This suggests that visual stimuli alone are insufficient to induce landing and blood-sucking.

The response to carbon dioxide sources was entirely different. Mosquitoes that entered within a radius of about 40 centimeters of the carbon dioxide source suddenly slowed to 0.2 m/s and began flying erratically, swaying without a clear direction. Numerical simulations also showed that mosquitoes can detect carbon dioxide concentrations as low as 0.1 percent and that their detection range extends to approximately 50 centimeters from the source.

Furthermore, the mosquito response changed even more dramatically when visual stimuli and carbon dioxide were presented simultaneously. The mosquitoes began to circle around the target, and significantly more mosquitoes concentrated near the target than when either stimulus was used on its own.

Source link

Advertisement
Continue Reading

Tech

There’s a sneaky way to watch UFC 327 really cheap…

Published

on

UFC 327 promises high-stakes drama as Jiří Procházka takes on Carlos Ulberg for the vacant UFC light heavyweight championship at Miami’s Kaseya Center. With Alex Pereira moving up to heavyweight, the division is wide open, and Procházka has a golden opportunity to reclaim the belt he never truly lost in the Octagon.

And with analysts like Dustin Poirier, Din Thomas, and Michael Chiesa predicting a comfortable win for the Czech former champion – who’s coming off the back of two knockout wins – Ulberg will have a point to prove, especially since he’s on a red-hot nine-fight winning streak.

Source link

Continue Reading

Tech

Anti-data center vote in Wisconsin puts future AI projects on notice

Published

on


Residents of Port Washington, Wisconsin, have done something no other community in the country has done with data centers: They’ve voted to put the brakes on future development in the region by approving a referendum. From now on, city officials require voter approval before handing out tax incentives worth more…
Read Entire Article
Source link

Continue Reading

Trending

Copyright © 2025