The Chaos ransomware gang is using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers.

The malware is written in Rust and uses the Chrome DevTools Protocol (CDP) to control a headless browser session and establish a connection to the attacker’s server.

Since the malware routes all communication through the browser, it does not make any direct connection to the C2 infrastructure, significantly lowering the risk of detection.

The Chaos ransomware group emerged in early 2025, unrelated to the same-named ransomware family that existed since 2021.

Earlier this year, researchers at Rapid7 found that Chaos was leveraged by Iranian state-backed hackers ‘MuddyWater’ to disguise their cyber-espionage operations as financially motivated attacks.

More recent Chaos ransomware attacks observed by the Cisco Talos research team started through email or voice phishing and continued with the installation of remote management software to establish persistence.

Once inside the environment, the attacker downloaded an MSI installer posing as a Windows update, which loads msaRAT (lib.dll) directly in system memory.

Hijacking Chrome

Once launched, msaRAT searches for Chrome or Microsoft Edge and launches the browser in headless mode, where the process starts without any visible window.

Next, it enables the browser’s remote debugging interface and connects to it via CDP. After this step, it opens a new browser tab and injects JavaScript into it using CDP commands.

The injected JavaScript is responsible for building the communication channel, bypassing Chrome’s Content Security Policy (CSP), and registering several CDP bindings that enable communications.

Once the initial setup is complete, the browser contacts a Cloudflare Workers endpoint (is-01-ast[.]ols-img-12[.]workers[.]dev) to obtain WebRTC connection information and establish an encrypted channel.

Talos explains that there are two layers of encryption: the WebRTC DTLS, automatically provided by the browser, and ChaCha20-Poly1305 + ECDH key, implemented by msaRAT.

Communication is relayed through Twilio TURN (Traversal Using Relays around NAT) servers with a specific configuration to avoid direct peer-to-peer connections.

“By intentionally omitting the ICE candidates that are normally present in standard WebRTC communications, P2P connections are prevented from being established, resulting in a design where all communications are always routed through TURN,” explains Cisco.

“By routing traffic through Twilio’s legitimate service, the real IP address of the attacker’s server never appears in the network traffic, and the dual-layer infrastructure combining Twilio with Cloudflare Cisco Confidential Workers makes it significantly difficult to trace the attacker’s infrastructure.”

The researchers documented how the data exchange system works by breaking down messages into chunks called “frames,” which include key exchanges, channel opening/closing, session resets, and Windows command execution.

By using Cloudflare Workers as the signaling relay, the attacker ensures that their server remains protected as the destination IP address is assigned to Cloudflare’s infrastructure and will pass firewall and allowlist automatic verification.

Also, the “*workers.dev” free subdomain is assigned for developers and blocking it would disrupt legitimate Cloudflare Workers deployments, and affect benign services.

The researchers underline that the communication mechanism in msaRAT allows it to control the C2 exchanges without touching the network directly and bury it within normal web traffic.

The report from Cisco Talos shares a complete list of indicators of compromise (IoCs) associated with attacks using the msaRAT backdoor attacks.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Sony has just unveiled its latest cinema camera that may foreshadow some long-awaited features in its consumer mirrorless lineup. The FX5 slots between the FX3 and FX6 in the company’s “Cinema Line” and comes with features previously missing on Sony cameras like RAW video and open gate recording. With other features like the 16.6-megapixel stacked sensor, five-axis stabilization and three base ISO settings, it should be an impressive cinema camera — for a price. 

The key to the FX5’s new feature set is the all-new 16.6MP fully stacked full-frame sensor that brings what Sony calls a balance between speed and resolution. 

For the 5K RAW recording, Sony is using its own proprietary X-OCN codec (short for “Extended tonal range original camera negative”). That delivers something new to creators: 16-bit linear RAW recording with 280 trillion colors, 1,000 times more color data than 12-bit ProRes RAW or Canon’s 12-bit C-RAW codecs. These are captured via the dual CFexpress type A card slots to Sony-validated cards. The FX5 can also capture 4K at 240 fps, 4.5K 120 fps and 5K 60 fps video, all firsts for FX cameras.

Sony

Open gate recording at a 3:2 aspect ratio uses the full sensor width and allows for easy cropping or vertical video creation in post. With a new de-squeeze function, it also allows easier use of anamorphic lenses. Sony is even thinking ahead, promising 4K 240p functionality in RAW and Open Gate 3:2 XAVC-I modes, along with an updated UI optimized for vertical shooting, expected by August 2027. 

Another new thing for Sony (and the first I’ve seen on any camera) is the three base ISO settings at 800, 4000 and 12800. This allows for improved dynamic range, along with cleaner shadows and improved sharpness compared to typical dual base ISO cameras. For night shoots, clean video at ISO 12800 will be a game-changer for indie filmmakers. For even better dynamic range (up to an incredible 16 stops), you can use the Dual Gain mode at the cost of increased rolling shutter.

Stabilization is often missing on cinema cameras but Sony has gone all-in on it with the FX5. The amount of compensation depends on the lens, but an updated electronic Dynamic Active mode is supposed to provide smooth video even when walking. Interestingly, Sony has a service for filmmakers who don’t want IBIS, allowing them to do an irreversible locked sensor conversion. 

Sony

The FX5 has a relatively lightweight (1.62 pounds) and compact body much like the FX3. Though covered with quarter-inch mount screws for cinema accessories, it has a big grip like its A7 models. It comes with a nice complement of manual controls, including numbered buttons à la Canon’s C50. 

The removable OLED EVF has 3.68 million dots and 2,500-nit brightness, along with a wide color gamut. The 3.5-inch 16:9 rear display is bigger, brighter and sharper (2.76 million dots) than most camera screens and uses Sony’s four-axis articulating design that’s great for vloggers. As with Sony’s higher-end mirrorless cameras, it includes two CFexpress and two SDXC UHS-II card slots, along with mic and headphone ports, a full-sized HDMI port, ethernet and tri-band Wi-Fi. The battery is Sony’s new NPSA100 from the A7R VI, which delivers up to 130 minutes of recording time. 

Sony’s FX5 is now on pre-order starting at $4,898 (body only) with availability planned for mid-August. You can also get it with a handle that allows XLR audio connectivity for $5,498, or buy the handle separately for $798. Hopefully, some of the features like RAW and Open Gate video will trickle down to its vlogging and mirrorless cameras. 

PUBLIC SECTOR

Health service told to ensure ministers don’t mistake before-and-after comparisons for cause and effect

The UK’s statistical regulator has told NHS England to ensure ministers are briefed accurately following a row over data used to promote the purported benefits of a Palantir-run platform.

The Office for Statistics Regulation (OSR) said the health quango had accepted that it needed to communicate more clearly about data purporting to measure the benefits of the NHS Federated Data Platform (FDP), which is based on the US spy-tech firm’s technology under a £330 million contract.

“We expect NHS England to ensure that any figures cited by ministers or in official briefings about the FDP and its effectiveness are communicated in a clear, accurate manner,” the OSR said. 

Campaign group Foxglove called on health officials and ministers to correct the record with Parliament and the media on data used to illustrate the FDP’s success.

Earlier this month, the OSR, part of the UK Statistics Authority, said it was assessing how NHS England used data to make claims about the FDP’s performance, which sometimes made its way into ministerial statements.

The move followed a Freedom of Information request from Foxglove, which found that nearly a third of NHS trusts using Palantir’s health data platform were performing fewer patient procedures than before it went live.

Foxglove also said Chelsea and Westminster Hospital NHS Foundation Trust accounted for 84 percent of the reported fall in outpatient waiting lists, while only 16 trusts were using the tool provided by Palantir.

The results sit uneasily alongside NHS England’s claim that, as of June, 139 trusts used the FDP, with 137 reporting benefits. Another commonly quoted data item found that an Inpatient Care Coordination Solution (CCS) tool based on the FDP had resulted in 111,589 additional patients undergoing procedures in operating theaters.

Writing to James Murray, Secretary of State for Health and Social Care, Foxglove noted that NHS England had said in documentation that it was inappropriate to “draw conclusions about cause and effect as other variables have not been controlled for” in its published FDP data.

Foxglove said: “The claim that Palantir’s FDP has delivered a large number of additional operations has been widely repeated.”

At the time, the OSR said it was assessing the information around NHS England’s claims about the FDP’s performance.

Publishing its response yesterday, the regulator said it had engaged NHS England statisticians and conducted its own desk research based on information provided by the NHS and others who raised concerns about data used to promote the FDP’s benefits.

It noted that on June 6, NHS England added a sentence to published data, which read: “We cannot therefore draw conclusions about cause and effect as other variables have not been controlled for.” It also updated the methods page.

“NHS England has told OSR that this was motivated, in part, by NHS England having received numerous Freedom of Information requests to provide more detail on how data provided by FDP was analysed,” the OSR said.

“While the addition of this sentence is welcome, we understand why many users took this to represent a significant change in how NHS England was communicating the benefits of FDP data in relation to NHS performance.”

The statement welcomed NHS England’s decision to acknowledge that there is “more that can be done to strengthen messaging around the FDP benefits data and its onward interpretation by users.”

NHS England agreed to add further caveats to the published data and ensure public communications clearly identify before-and-after comparisons and explain that they do not establish causality.

It has also commissioned Imperial College London to evaluate the FDP, looking at products including OPTICA “where the issue around causality is most evident.” OPTICA is designed to streamline the patient discharge process. It was based on Palantir’s technology built under a £60 million series of contracts awarded without competition and then transferred to the FDP. NHS England said it would publish the results.

The OSR said it wanted to be kept informed of progress against a series of other commitments by NHS England’s Head of Profession for Statistics.

An NHS England spokesperson said: “We welcome this review from the Office for Statistics Regulation into the presentation and communication of information about the Federated Data Platform, which found the updates we made to our website have helped to make information more explicitly clear. We are implementing the recommendations in full to provide further clarity about the patient benefits being achieved through the use of the technology.”

Donald Campbell, advocacy director at Foxglove, said: “This damning report makes it clearer than ever that the Government and Palantir must withdraw these dodgy marketing claims and correct the record.

“Even the head of NHS England has admitted personally raising doubts about the claims made on Palantir’s benefits to the NHS. This intervention by the stats watchdog should be the nail in the coffin for the fairy stories we’ve heard about the extra operations supposedly delivered by Palantir’s platform.

“With a new government, there’s a chance to draw a line under the previous administration’s shameful practice of running marketing for this Trump-aligned tech giant. The new health secretary must withdraw these figures, correct the record with Parliament and the media, and ensure that the debate about whether Palantir should have a place in our NHS is conducted based on reliable, verifiable evidence – not spin.” ®

Lenovo has expanded its LOQ gaming laptop lineup with a new graphics option. The company has introduced a refreshed version of the LOQ 17IRX10, pairing Intel’s Core i7-14700HX processor with Nvidia’s newly announced GeForce RTX 5070 12GB laptop GPU. The update gives buyers another configuration to choose from without changing the overall design or feature set of the laptop.

The new variant joins Lenovo’s existing LOQ 17IRX10 lineup, which was previously available with GeForce RTX 5050, RTX 5060, and RTX 5070 8GB graphics options. While the chassis remains unchanged, the addition of a 12GB RTX 5070 brings more VRAM to the series, a specification that has become increasingly important as modern AAA games demand larger texture caches and higher memory capacity.

RTX 5070 12GB joins the existing LOQ lineup

According to Lenovo’s PSREF listing, the new configuration retains the same 115W Total Graphics Power (TGP) and 2,347MHz boost clock as the 8GB RTX 5070 model. The primary difference is the increase in graphics memory from 8GB to 12GB.

The laptop is available with an Intel Core i7-14700HX, 16GB of RAM, and a 1TB PCIe SSD. Lenovo has also retained the 17.3-inch Full HD IPS display with a 165Hz refresh rate, making the system suitable for competitive gaming where high frame rates are more important than higher display resolutions. The notebook is powered by a 60Wh battery and supports 245W fast charging.

Connectivity remains unchanged as well. The laptop includes a USB-C port with DisplayPort 1.4 and Power Delivery support, three USB-A ports, HDMI, Gigabit Ethernet, a 3.5mm audio jack, and Lenovo’s proprietary charging connector, as shown in the product diagrams.

More VRAM could make this configuration the better long-term choice

Unlike previous GPU upgrades that focused primarily on increasing raw processing power, this refresh addresses another limitation that has become more noticeable in recent games: graphics memory.

Several recent AAA titles have pushed beyond the practical limits of 8GB VRAM, particularly when high-resolution textures, ray tracing and AI-assisted upscaling are enabled simultaneously. While the RTX 5070 12GB carries the same power budget and clock speeds as its 8GB counterpart, the additional memory should provide more headroom in newer titles and help reduce texture streaming issues at higher graphics settings.

Lenovo has not announced pricing or availability for the new configuration, and Notebookcheck notes that the model is not yet listed for sale.

For buyers considering a gaming laptop in this segment, the refreshed LOQ 17IRX10 doesn’t introduce a new design or a faster processor. Instead, it offers a more balanced GPU configuration that could prove more relevant as games continue to demand additional graphics memory.

Nokia reported comparable operating profit of €434mn for the second quarter of 2026, up 18% on the same period last year and comfortably ahead of the €382mn that analysts polled by LSEG had forecast.

Net sales rose 8% to €4.82bn, or 9% at constant currency, lifted by the companies racing to build AI data centres.

The beat extended a run that began earlier in the year, when comparable operating profit jumped 54% in the first quarter.

For the first half, net sales reached €9.25bn, up 6% as reported and 7% at constant currency, while the group operating margin widened to 9.0% in the second quarter, an improvement of 70 basis points.

The Finnish network-equipment maker’s Network Infrastructure division carried the quarter, with sales up 12% to €2.04bn.

Optical Networks grew 20% and IP Networks 16%, both supplying the optical networking and routing that hyperscalers are buying to wire their AI clusters together and to link data centres across long distances.

Sales to AI and cloud customers more than doubled year on year, reaching €446mn, and the unit booked €2.8bn of fresh orders during the quarter.

Much of that came from selling fibre-optic gear to the large technology firms building AI data centres, a market Nokia has pushed into hard over the past year.

“Demand remains strong, while supply continues to be the main industry constraint, prompting our customers to place longer-term orders,” chief executive Justin Hotard said.

New orders ran well ahead of what Nokia actually shipped, a sign of a lengthening backlog. The €2.8bn of AI and cloud orders booked in the quarter comfortably exceeded the €446mn those customers bought over the same three months, as buyers moved to lock in scarce supply ahead of delivery.

Mobile Infrastructure, still the larger unit by revenue, grew 6% to €2.68bn, a steadier showing than the surging data-centre business.

The mobile networks market has stabilised after several lean years of slowing 5G spend, though it is nowhere near the double-digit growth Nokia is now booking from cloud customers, and it remains the part of the business most exposed to the memory chips whose prices are climbing.

The comparable figures flattered a messier bottom line. On a reported basis, Nokia swung to an operating loss of €50mn and posted net profit of just €5mn, down from €96mn a year earlier, after restructuring and other one-off charges weighed on the accounts.

Nokia expects about €800mn of restructuring charges across 2026, including €350mn tied to integrating its operations in China, €200mn for European restructuring, and €250mn under an earlier cost-cutting programme.

It held the quarterly dividend at €0.04 a share, payable on August 6.

The company raised its full-year outlook for comparable operating profit to between €2.1bn and €2.6bn, up from €2.0bn to €2.5bn, though €0.1bn of the increase is a technical adjustment linked to reclassifying discontinued operations.

Hotard said the group was on track to finish “somewhat above the midpoint” of that range.

The raised guidance still leaves most of the year to play for. Nokia earned roughly €715mn of comparable operating profit across the first half, which means the top of its €2.6bn target depends on the second half delivering close to €1.9bn, a back-loaded shape that leaves little room for slippage.

The results arrive against a backdrop of rising memory chip prices, which AI demand has pushed to record levels and which are squeezing makers of telecoms and networking equipment.

Rival Ericsson has flagged similar cost pressure, though Nokia’s second-quarter numbers suggest it is absorbing the hit for now.

Hotard, who joined from Intel and took over as chief executive in 2025, has steered Nokia towards the data-centre buildout rather than the slower telecoms-equipment cycle that defined the company for much of the past decade.

The next test comes with third-quarter results, when investors will watch whether that €2.8bn order book converts into the second-half momentum he is promising.

I scroll on my phone, sipping on an overpriced espresso tonic at a San Francisco café. I watch as glassy notifications pop up on my home screen, one after another, distorting the top row of app icons in neat succession. Similar to how the glass in my hand refracts the coffee’s colors, the warping effect of Apple’s Liquid Glass tugs at the edges of whatever’s behind each notification, disappearing a second later.

Apple dropped the public beta for iOS 27 in mid-July, with the software’s full release expected in September. The beta version of iOS includes a new slider for adjusting Liquid Glass’s appearance across your iPhone. Apple’s translucent operating system was polarizing when it launched in 2025, with some criticizing how the design impacted text legibility. In response, Apple rolled out updates that tampered with the Liquid Glass effect, making the smartphone interface more opaque.

With iOS 27, Apple gives users the option to make Liquid Glass even more transparent than its default. In the current public beta, this choice is available in Settings under the Appearance tab. If you tap on Liquid Glass here, you can drag it to the left for a more transparent experience.

“More clear” is on the left, with the more opaque look on the right.

Advertisement

Photograph: Reece Rogers

Fear not—if you don’t feel the same way as I do about transparency—you can drag that same slider to the right and boost the overall opacity of Liquid Glass. There’s still the option to Reduce Transparency and Increase Contrast as well.

I immediately cranked my settings to maximum clarity after I downloaded the public beta and left the setting on for a week to get the full experience. I understand why some prefer the heavily tinted version or need to switch it for accessibility reasons, yet I reveled in the warped colors and characters as I experienced Liquid Glass in its clearest glory.

Early during my tests, I found myself slowly scrolling up and down on my Slack messages, watching as the names of Slack rooms refracted behind the menu bar at the bottom of my smartphone screen. I watched as the letters curled into meaningless lines and then reformed, unharmed, on the other side. The more I stared, the more whimsical it felt, and the more I appreciated Apple’s glassy design risk.

The “more clear” setting makes icons under notifications almost glow with the Liquid Glass effect.Photograph: Reece Rodgers

Airlines from Bahrain and Japan just threw their weight behind a plane that looks nothing like the ones filling today’s skies. At the Farnborough Air Show this week, Gulf Air signed a letter of intent for an undisclosed number of JetZero Z4 aircraft, locking in preferential delivery slots for the early 2030s. Japan Airlines followed with a formal support agreement that puts its operational teams inside the design process from the start.

Gulf Air’s new deal puts the carrier at the forefront of the Z4, as it is the first Middle Eastern airline to support the project. Bahrain’s national airline believes the new plane is exactly what it needs to expand its network of routes across Europe and Asia, and it has the advantage of being the first to take possession. According to JetZero CEO Tom O’Leary, the agreement is a vote of confidence in the Z4’s capacity to give customers with a completely new level of experience at a lower cost per seat, while also being significantly more cost-effective for airlines.

At the same time, Japan Airlines announced its own agreement with JetZero, which will see them collaborate on everything from flight operations to passenger service. Takao Suzuki, JAL’s chief strategist, said the step is critical to the company’s long-term aim of achieving net-zero emissions by 2050. JetZero’s intentions for the Z4 to touch the runways in the early 2030s align precisely with JAL’s own fleet plans, thus the two firms are on the same page in terms of timeframe. That brings two more airlines to the table, joining Delta, United, Alaska, and EasyJet for a total of 17 airlines providing JetZero with the real-world feedback it need to shape its design.

Now, about the plane itself. The Z4 is a bit of an outlier, with a blended wing body design that eliminates the tube and wing configuration and instead combines the wings and fuselage as a continuous surface. According to JetZero, that is enough to reduce fuel consumption by up to 50% on mid-sized aircraft flying similar routes. It’s planned to carry roughly 250 passengers over a distance of up to 5,000 nautical miles, putting it exactly in the middle of the market where the 757 and 767 used to rule, and unlike some of its potential competitors, the engines are located at the back of the plane, high up on the body.

It means quieter cabins and the possibility of using sustainable aviation fuel instead of traditional jet fuel, and the Pratt & Whitney PW2040-class powerplants that are likely to be installed are designed with all of this in mind. Then there’s the cabin, with wider boarding doors, distinct inner cabins, and each seat having its own dedicated overhead storage area. One advantage is that the plane is designed to integrate seamlessly with existing airport infrastructure, eliminating the need for specific gates or taxiways.

Factory work is now underway, with JetZero breaking ground in mid-June on a gigantic 8 million square foot factory and final assembly plant sprawled across more than 600 acres near to the Piedmont Triad International Airport in Greensboro, North Carolina. The project is a significant undertaking, costing $4.7 billion, and is expected to create 14,500 new employment over the next decade. North Carolina created a massive incentive package for the state, one of the largest ever awarded to a company. Then, on July 21, the US Export-Import Bank signed a letter of intent that may release up to $3 billion in financing through its Make More in America initiative. This money will be utilized to help with building, production setup, and purchasing necessary equipment. JetZero intends to relocate its headquarters from California to Greensboro sometime in early 2027.

As the factory in Greensboro takes shape, the team at Northrop Grumman’s Scaled Composites plant in Mojave, California, works on the full-scale demonstrator. The primary section in the middle is now being assembled. They plan to launch their first flight in the fourth quarter of 2027. They’ve already flown a smaller Pathfinder demo to collect all of the necessary aerodynamic data. JetZero expects to submit its proposal for type certification later this year. With commercial production slated to begin by the end of 2030, they hope to have passenger flights operational by the early 2030s.
[Source]

Federal agencies have committed more than $5 billion to the Genesis Mission, an Energy Department-led effort to use artificial intelligence to accelerate scientific research, White House science adviser Michael Kratsios announced on Wednesday. The initiative selected 278 projects from more than 5,000 applications, Energy Secretary Chris Wright said at a summit in Washington. More than 15 federal agencies are contributing research awards, funding, datasets, and facilities to the programme.

The Genesis Mission was established by a November 2025 executive order and is part of what the administration describes as the largest marshalling of federal scientific resources since the Apollo programme. Under Secretary for Science Dario Gil, who is directing the effort for the Energy Department, said the mission brings together leading researchers, institutions, and technology partners to build what he called the next generation of scientific capability. The DOE received the largest response rate for any programme in the department’s history, according to Gil.

The largest single award is a $60 million investment in nuclear energy, funding a three-year project called Prometheus that will use AI to help design, license, manufacture, and operate nuclear reactors. The project team has raised more than $200 million in industry cost share and $30 million in private capital alongside the federal funding. Other funded areas include biomedical research, energy grid reliability, national security, quantum computing, and microelectronics manufacturing.

Alongside the Genesis Mission announcement, Kratsios released a report to President Trump titled “Science: A New Golden Age,” which the White House described as the first comprehensive rethinking of the US science enterprise in more than 80 years. The report calls for federal research funding to shift toward AI-powered research systems and individual scientists rather than universities, which have historically dominated federally funded scholarship. Agencies with at least $3 billion in research authority will be required to submit implementation plans within 90 days.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

The funding shift represents a deliberate attempt to reshape roughly $200 billion in annual federal research spending. The report cites the NIH Director’s Pioneer Award, which gives selected researchers up to $700,000 annually for five years without requiring a detailed experimental plan, as a model for the kind of flexible, investigator-driven funding the administration wants to expand. The blueprint also identifies national missions including commercial fusion power and returning Americans to the lunar surface by 2028.

The announcement comes as the US-China AI competition intensifies, with Stanford’s 2026 AI Index finding that the performance gap between the best American and Chinese AI models has collapsed to under three percent despite the US spending 23 times more on private AI investment. The Genesis Mission sits alongside other recent federal AI initiatives, including billions in EXIM export financing for US-built AI infrastructure and executive orders on quantum computing, as part of a broader push to maintain American technological leadership through public funding rather than export controls alone.

Ripple effect: Amid growing talk of an AI bubble, a study by Japanese market analysts has found that five of the largest American technology companies are carrying a collective “hidden” debt of over $1.65 trillion, driven largely by massive spending on AI infrastructure. That undisclosed sum exceeds the $1.35 trillion the same companies have officially reported on their balance sheets, and it has grown eightfold over the past four years.

According to estimates from Nikkei Asia, Alphabet, Microsoft, Amazon, Meta, and Oracle have together amassed roughly $3 trillion in total debt, a large share of it tied to exorbitant AI infrastructure spending – long-term data center lease agreements, along with costly servers, graphics accelerators, and other computing hardware that has yet to be delivered.

The report notes that less than half of the true debt figure appears directly on balance sheets, with the remainder disclosed only in accounting footnotes attached to SEC filings. Nikkei was careful to point out that the financial commitments behind this debt are legal under US law, but that the way they’re reported makes it harder for retail investors to accurately gauge these companies’ financial health.

Credit: App Economy Insights

Of the five companies in the study, Meta carries the largest estimated hidden debt, at around $420 billion – nearly three times what it disclosed in its FY 2026 financial statement.

The company’s Hyperion data center in Louisiana, for instance, includes a $27 billion investment from Blue Owl Capital that never appeared in its official earnings report. It’s a fully legal maneuver under current US accounting rules, but one that illustrates just how much can stay out of view.

Oracle’s hidden debt has grown roughly 30-fold over the past four years, reaching $273.3 billion as of the end of May 2026. Most of that stems from long-term leasing agreements with third-party data center operators, part of the company’s push to expand its Stargate AI data center project across sites in Texas, New Mexico, Michigan, and Wisconsin.

Credit: App Economy Insights

While much of this debt remains invisible to everyday investors, institutional players and credit rating agencies are starting to take notice. Morgan Stanley and Moody’s have both raised concerns about the practice, and S&P recently downgraded Oracle’s short-term rating from A-2 to A-3, and its long-term rating from BBB to BBB-, placing it just one notch above junk status.