Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware.

The customer relationship management and digital marketing company says the attackers used the API key to create a malicious Cloudflare Worker that modified content at the CDN edge for approximately five and a half hours on September 14.

The attack affected pages on brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, and sibforms.com. The Cloudflare worker also modified the Brevo forms script, Brevo Conversations widget, and the Brevo SDK loader scripts that customers embed on their websites.

In a post-mortem published today, Brevo explained that attackers obtained a long-lived Cloudflare API key with full account permissions that had been hardcoded in application source code, which allowed them to create Cloudflare Workers, routes, and DNS records across Brevo’s zones without triggering an alert.

“Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change,” explained Brevo.

The company says the key may have been compromised as early as late August, but there’s no evidence of prior malicious activity.

Upon detecting the compromise, Brevo removed the Worker and its routes, defining the exposure window as between 16:07 and 20:30 UTC.

In the hours that followed, the company revoked the compromised key and credentials created with it, removed the hardcoded credential from its source code, deleted attacker-controlled hostnames, and purged its edge caches.

Brevo says app.brevo.com, its API, email delivery infrastructure, and customer account data were not affected.

Used in ClickFix attacks

The incident was first reported by security firm Sansec, which reported that it may have impacted up to 100,000 websites that use the affected Brevo components.

Sansec says the incident began on September 14, 2026, between 16:05 and 20:13 UTC, but has now confirmed that all malicious subdomains stopped resolving on September 15, and Brevo files are now clean.

Visitors to these websites were shown a fake Cloudflare verification page, followed by ClickFix instructions urging them to run a command on Windows.

On WordPress websites embedding an affected Brevo widget, the script also checked whether the visitor was logged in as an administrator and attempted to upload a malicious plugin from https://cdn10.sendibt1[.]com/p/wm.zip.

While SanSec was not able to retrieve the archive, BleepingComputer found it uploaded to VirusTotal and can confirm it pretends to be a WordPress plugin named “Web Media Optimizer” but acts as a persistent backdoor and JavaScript loader.

Other domains BleepingComputer saw distributing the malicious WordPress plugin and scripts include https://yelahaye[.]surf and https://boiseno[.]club.

Once installed, it hides itself from the WordPress plugin list, copies itself into the must-use plugins directory for persistence, and periodically contacts the attacker-controlled ‘https://glegchner.com/ads.php’ server.

That URL is currently returning a Base64-encoded URL pointing to JavaScript that the plugin then injects into visitors’ pages. The current Base64-encoded URL decodes to https://corralos[.]beer/a412dkoq.js, which the site injects to fetch a ClickFix lure to display.

The plugin also stores a backup copy of the last valid JavaScript URL so it can continue loading malicious code if the remote server becomes unavailable.

Finally, the plugin contains a hardcoded authentication key that allows attackers to generate a valid login session for a WordPress administrator account without knowing the account password. 

On September 10, Brevo disclosed a different SSO-related incident where attackers hijacked customer accounts and launched phishing attacks targeting customers of companies using Brevo.

One high-profile victim was cryptocurrency wallet vendor Trezor, which reported on September 11 that phishing attacks reached 347,000 user email addresses and successfully compromised at least 2,500.

Brevo did not respond to BleepingComputer’s questions as to whether the SSO incident and the Cloudflare compromise were connected.

WordPress administrators who visited an affected site while logged in on September 14 should check for unusual plugins installed or activated that day and remove them. If found, they should also rotate administrator passwords.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Photo credit: MKBHD
Apple’s iPhone 18 Pro keeps last year’s aluminum frame, 8.75 mm thickness, and camera plateau almost unchanged, so first glance will fool most people into thinking nothing moved. Engineers did color-match the rear glass to the frame, killing the two-tone look that marked the 17 Pro. Burgundy shifts between deep red and purple with the light and has become the color most reviewers mention first. Glacier is a quieter light blue, Silver finally looks clean, and Black is the darkest Pro finish Apple has offered.

The weight of the phones has increased slightly. The 6.3-inch model now weighs 211 grams, while the 6.9-inch Pro Max weighs 249 grams, which is roughly the limit of how much you’d want to carry around every day. Some people believe the smaller one is still treatable, however the larger one is a borderline situation. However, the phone’s footprint has not changed, so if you already have a case, you can continue to use it without issue. The front of the phone is now covered with Ceramic Shield 2, the IP68 rating remains, and the sides are still aluminum, albeit they appear to pick up nicks more quickly than the old titanium frames did.

Apple 2026 MacBook Neo 13-inch Laptop with A18 Pro chip: Built for AI and Apple Intelligence, Liquid…

• AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro…
• FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated…
• FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations…

Since Apple relocated the Face ID camera beneath the screen, Dynamic Island has reduced by almost a quarter. That means the pill can now store three Live activities at once, rather than just two, and you can notice the extra space when you’re viewing movies or playing video games. The display sizes remain same at 6.3 and 6.9 inches, as do the 120 Hz ProMotion panel, Always-On mode, and 3,000-nit outdoor peak brightness.

The 48-megapixel primary camera now has six laser-cut polymer blades within that are thinner than a human hair. These blades can open to f/1.48, f/1.8, f/2.8, and f/4.0. When they’re wide open at f/1.48, they can gather around half a stop more light than the 17 Pro’s fixed f/1.78, resulting in approximately 50% more light on the same sized 1/1.28-inch sensor. When you snap a shot in nite mode, the exposures are shorter, the ISO is lower, and blurring from holding the phone is less prevalent. As the blades are stopped down to f/4, a group or a close subject can stay sharp from front to back without having to rely on software blur, and if the blades close in, starbursts appear around streetlights as well as string lights. Most of the time, the auto mode keeps the blades at f/1.8 or switches to f/1.48 when it gets dark.

According to one reviewer, the sharpness peaks at f/2.8 and remains fine at f/1.8 before becoming somewhat weaker at either end, most likely due to edge fall-off or diffraction. What’s remarkable is that at f/1.48, you get true optical bokeh on close subjects, despite the fact that Portrait mode still overlays its own depth map and looks very identical to last year’s model. Low-light crops from both the center and the edges appeared to outperform the 17 Pro in side-by-side tests, and video benefits as well, with nearly four stops of range, smoother motion if you slow down the shutter, and a slew of post-capture effects that you can apply later. Autofocus is also fairly dependable, keeping the subject in focus even when it moves out of frame.

Pro Controls have now been included into the default camera app. With a single swipe, you can adjust the aperture, shutter speed (from 1/6000 to one second), white balance, and even a live histogram, and third-party apps such as Halide can also access the same iris. Photographic Styles 3 has added a few texture sliders, giving you greater control over things like Soft Skin, Glow, and Film grain. Reviewers found this was pleasant and tasteful, rather than going overboard. The 48-megapixel ultrawide and 4x/8x telephoto cameras retain their fixed apertures, while the front-facing camera remains the 18-megapixel Center Stage module.

A20 Pro is the world’s first two-nanometer chip to appear in a smartphone. Memory is given its own real estate right next to the Silicon rather than being piled on top, a tactic adopted from the M-series Macs, and there’s a vapor chamber with more than triple the surface area of last year’s version, which does an excellent job of keeping things cool. The CPU scores are 22 to 27 percent higher than the A19 Pro in terms of speed, the GPU is 40 percent higher, and the dual 16 core Neural Engine is doubling down on AI processing capacity. More amazingly, testers reported virtually no throttling during marathon video or gaming sessions, and the phone remained cool, in a positive way, even after hours of use. MKBHD referred to the chip as the unsung hero of what was essentially an S-year update.

The battery life stats were what drew everyone’s attention because they exceeded the usual yearly rise. Apple claims 36 hours of video playback on the regular Pro model and 45 on the Pro Max, and independent web-browsing tests came close with 16 hours and 17 minutes on the smaller phone and slightly less than 18 hours and 27 minutes on the Pro Max, both of which are about an hour longer than their 17-series counterparts. In the real world, a typical day of mixed usage will provide you with one full day of hands-on time from the Pro and one and a half day for the Pro Max. Then there’s wired charging, which provides a 50% boost in just 15 minutes if you have a charger with a 40 watt rating or greater.

KRAFTON India has rolled out the BGMI 4.6 update with several new experiences for players. The latest season brings the new Midnight Hunters theme mode, the return of Ocean Odyssey, and the India-first character Kiaraa. It also adds a One Punch Man collaboration, festive content, creator-focused features, and new WOW experiences. Here’s a look at the major additions coming to BGMI 4.6 and their release dates.

Midnight Hunters Brings a Vampire Twist to BGMI

BGMI 4.6 introduces Midnight Hunters as its main themed gameplay experience. The mode will remain available on Erangel from September 16 to November 16. Four locations, including Rozhok, Mylta, Quarry, and Gatka, become Vampire Takeover points. Stalber and Sosnovka Military Base now house the Nightkeeper’s Hunter Guild. The indoor arena hides secrets and offers new combat challenges. Squads can take on Guild Missions to complete special objectives and earn better rewards. Players can also explore the Hunter Shooting Range, Clock Tower, and Scream Crates. Bloodwalkers, Nightbats, the Vampire Elder, and the Nightkeeper add new threats.

The mode also changes what happens after a player gets eliminated. Bloodline Awakening allows eliminated players to return as Vampires. The game can have up to 20 active Vampires at once. These Vampires can use Claw Strike, Absorb, Blood Sense, and Blood Amberfication. Midnight Hunters also introduces several themed items. The Silvermoon Chain helps with combat, movement, and defense. Twilight Bat Wings support flight and enemy detection. Scarlet Tonic speeds up recovery, while Blood Pact connects teammates through persistent links.

Ocean Odyssey Returns, While Kiaraa Brings an India-First Experience

Ocean Odyssey is returning to Erangel on September 30 after continued requests from the BGMI community. The experience brings back the Ocean Palace, Trident, and Kraken. Players can once again explore the underwater world and enjoy its unique gameplay. While Midnight Hunters focuses on vampires, Ocean Odyssey takes players back beneath Erangel’s waters.

BGMI 4.6 also introduces Kiaraa, a new original character developed by KRAFTON India’s in-house art team for Indian players. Kiaraa follows Anamika, BGMI’s first original character IP created in India. She arrives in the game on October 8 with a new Diwali-themed Indian Bazaar on Erangel. Players can activate four peacock-shaped lamps to awaken Kiaraa and enter her Boss Battle. The season also includes Kiaraa Arena challenges, the Kiaraa Exchange Center, and daily login rewards. The Kiaraa Nakshatra Collection includes:

• Divine Peacock Glider
• Divine Radiance SCAR-L
• Divine Chariot Buggy
• Arrow Rain Emote
• Divine Edge Machete

One Punch Man, Techno Gamerz, and More Arrive in BGMI 4.6

The new BGMI season is also bringing several collaborations to the game. One Punch Man arrives on September 21 through a Spin and Mini Royale Pass. Players can collect character skins, themed sets, and other collaboration items. The Lincoln Motor Cruize runs from September 16 to November 9. It adds the Lincoln Model L and Lincoln Navigator Black Label, with multiple color options. Meanwhile, the B.DUCK collaboration introduces battles on floating platforms. Players can turn into B.DUCK and compete in turn-based collision matches. The goal is to knock opponents into the water as the play area shrinks.

Creator content also gets a major addition with the Techno Gamerz collaboration. It goes live on October 20 with a Techno Gamerz Voice experience, Sunken Templar collection, and themed weapons. BGMI will also mark Diwali with its first India-specific Prize Path. It runs from October 22 to November 15 across 20 levels. Rewards include the Royal Enfield Continental GT 650, Royal Enfield Bullet 350, Revel 01 Set, and Diwali Gold Set. The season also includes Navratri and Diwali-themed experiences.

WOW gets a Halloween update for Steal Brainrot, along with Ghost Ship Event Mode and the Brainrot Wand. Its Mobile Editor also receives new tools for creation, gameplay, performance, and customization. WOW has crossed 50,000 created maps, with more than 35,000 live maps. Over 23 million players have tried WOW, and nearly one million play it daily. Platinum Soulmeister, Sanguine Sonata, and Umbral Scorpius will arrive on September 25, October 25, and November 1, respectively.

Both a proxy and a VPN can change the public IP address a website sees when your traffic is routed through them. The bigger difference is that a VPN adds its own encrypted tunnel for traffic sent through the VPN, while a proxy is primarily an intermediary for selected traffic and does not by itself provide the same tunnel protection.

Proxy vs VPN at a Glance

The easiest way to compare a proxy and a virtual private network (VPN) is to separate three questions: where your traffic goes, what encrypts it, and which traffic is covered. The table shows the typical differences without assuming that every proxy or VPN uses the same configuration.

Proxy vs VPN comparison

There is no universal winner in every row. A VPN provides a tunnel-encryption layer that a conventional proxy does not, while a proxy can be the more direct tool when only one application or workflow needs different routing.

What a Proxy Actually Does

A proxy server sits between a client and another server. Instead of connecting directly to a website or service, your application sends selected traffic to the proxy, and the proxy makes the onward connection.

A simple path looks like this:

Application → proxy → destination

The destination normally receives the connection from the proxy rather than directly from the client. This is why a forward proxy can change the public source IP visible to a website for traffic that actually passes through it.

That does not mean traffic passing through a proxy is necessarily unencrypted. HTTP defines the CONNECT method for establishing a tunnel through a proxy. RFC 9110 explains that a CONNECT tunnel can carry a virtual connection that is then secured with Transport Layer Security (TLS).

For example, when a browser opens an HTTPS website through an HTTP proxy, it can establish a CONNECT tunnel through the proxy and then negotiate TLS with the website. The proxy supplies the route, while HTTPS supplies application-level encryption for that browser-to-website connection.

A proxy can also perform jobs that have little to do with personal privacy, including filtering requests, caching eligible responses, enforcing network policy, or routing one application differently from another.

What a VPN Actually Does

A VPN creates a protected network path between a VPN client and a VPN endpoint. Traffic selected for that route is encapsulated and protected according to the VPN protocol before it crosses the network between those endpoints.

A simplified path is:

Device or selected traffic → encrypted VPN tunnel → VPN endpoint → destination

Internet Protocol Security (IPsec) is one family of technologies used to build VPNs. RFC 4301 defines the IPsec security architecture, which supports security services at the IP layer through protocols, algorithms, keys, and policies selected for a particular deployment.

The important boundary is the VPN endpoint. The VPN tunnel protects the path between the client and that endpoint. After traffic leaves the VPN endpoint toward its final destination, protection for that part of the connection depends on other protocols. HTTPS, for example, can continue protecting a browser-to-website session independently of the VPN.

A VPN therefore does not replace HTTPS. The two protections operate across different boundaries.

How Traffic Flows Through Each

The routing difference becomes easier to understand when both paths are placed side by side.

With a proxy

An application sends traffic to the proxy because that application, operating system, or network has been configured to use it. Other applications can continue connecting normally if they are not covered by the same proxy configuration.

For example, a browser can use a proxy while another desktop application continues over the normal network route. The actual behavior depends on the application and system settings.

With a VPN

A VPN often affects routing at a broader network level. Traffic selected by the VPN routing policy enters the tunnel before reaching the VPN endpoint.

That still does not mean every VPN configuration carries every packet. Microsoft distinguishes split-tunnel and force-tunnel VPN routing. With split tunneling, specified routes use the VPN while other traffic uses the physical interface. Force tunneling instead makes the VPN the default path, subject to more-specific routing rules.

Which One Changes Your IP?

Both can change the public IP address that a destination sees.

If a browser connects through a forward proxy, the website normally receives its connection from the proxy endpoint rather than directly from the browser’s original network. If internet traffic goes through a VPN, destinations normally receive their connection from the VPN endpoint instead.

The important qualification is which traffic uses that route. If one application bypasses a proxy, its connection does not gain the proxy’s exit IP. Likewise, traffic excluded from a split-tunnel VPN continues over its non-VPN route.

Changing the visible source IP also does not erase other identifiers. Signing in to an account, keeping the same cookies, or exposing recognizable browser and application signals can still let a destination associate activity with you.

Which One Encrypts Your Traffic?

A VPN is specifically designed to create a protected tunnel between the VPN client and endpoint for traffic routed through that connection. A proxy is primarily a forwarding mechanism, so proxy use alone should not be treated as equivalent to VPN tunnel encryption.

Proxy routing and HTTPS encryption are different

Suppose you visit an HTTPS website through an HTTP proxy. The proxy can establish the route, while TLS protects the browser-to-website connection through that route. RFC 9110 explicitly describes CONNECT tunnels as virtual connections that can then be secured using TLS.

The accurate distinction is therefore not simply “proxies do not encrypt.” A conventional proxy does not inherently add the same client-to-VPN-endpoint encryption layer that a VPN tunnel provides.

VPN encryption has an endpoint too

VPN encryption also has a boundary. It protects traffic across the VPN tunnel between the client and VPN endpoint. Beyond that endpoint, the final application connection relies on its own protocols.

If a website uses HTTPS, that HTTPS connection can continue from the browser to the website while the traffic also travels inside a VPN tunnel for part of its route. The two protection layers can exist at the same time.

Because VPN and HTTPS protect different parts of a connection, using one does not make the other redundant.

What Can Your ISP, Wi-Fi Network and Websites See?

Different observers sit at different points in the route, so “who can see my traffic?” has no single answer.

Your local Wi-Fi network

For traffic routed through a properly functioning VPN tunnel, the local network sees communication with the VPN endpoint and connection metadata such as timing and data volume, while the application traffic inside the tunnel is encrypted.

A VPN can therefore be one layer of staying safe on public Wi-Fi, alongside verifying the network, keeping devices updated, using HTTPS, and protecting accounts. A VPN does not prevent phishing, remove malware already on a device, or prove that a hotspot is legitimate.

Your internet service provider

For tunneled VPN traffic, the internet service provider (ISP) can see the connection to the VPN endpoint but cannot inspect the application contents inside the encrypted tunnel in the same way it could inspect unencrypted direct traffic. Metadata and name-resolution behavior still depend on the configuration.

With a conventional proxy, ISP visibility depends more heavily on where the proxy sits, how the application connects to it, and whether the underlying application connection is protected by a protocol such as HTTPS.

The website you visit

A website can see the proxy or VPN exit address for traffic delivered through that intermediary. It can also see information you intentionally provide, including account details, and can use cookies or other browser signals to recognize sessions.

This is why changing an IP address and becoming anonymous are not the same thing.

DNS queries

The Domain Name System (DNS) converts names such as example.com into network addresses. DNS routing can differ from ordinary application traffic, especially when a VPN uses split routing.

RFC 8598 documents split-DNS behavior for IKEv2 VPNs, where selected domains can use DNS servers reachable through the VPN while other queries continue through the client’s normal DNS service. It also describes configurations that send DNS through the IPsec connection.

A blanket statement such as “a VPN always sends every DNS query through the tunnel” is therefore too broad.

Coverage: One App vs More of the Device

Proxies are often useful when only one application or traffic type needs a different route. VPNs are commonly used when broader network traffic should travel through a protected tunnel.

Microsoft’s Windows VPN documentation makes this distinction explicit: a split-tunnel configuration sends specified routes over the VPN and leaves other traffic on the physical interface, while force tunneling makes the VPN the default route unless a more-specific route says otherwise.

Windows also supports application-triggered and application-specific VPN configuration, which is another reason “proxy equals one app, VPN equals every app” is too simplistic. The useful distinction is that proxies are commonly used for selective application or protocol forwarding, while VPN technology provides network-level tunneling whose actual scope is controlled by routing policy.

The mechanics of split tunneling matter whenever you need to know which traffic is actually protected by the VPN route.

Proxy vs VPN for Common Situations

Using public Wi-Fi

A VPN can add an encrypted tunnel between your device and VPN endpoint across an untrusted local network. HTTPS still matters because it independently protects individual website connections beyond the VPN endpoint.

A proxy can change the route and destination-facing IP for configured traffic, but proxying alone should not be treated as a replacement for VPN tunnel protection when that tunnel is the security requirement.

Routing one browser or application

A proxy can be more direct when only one browser, application, or protocol needs a different network path. There may be no useful reason to change the routing of unrelated device traffic when the task is narrowly scoped.

Remote access to an organization

A VPN is designed for cases where an authenticated client needs protected network access to remote resources. Enterprise deployments can use force-tunnel, split-tunnel, or more granular application-specific policies depending on the environment.

Testing a website from another network path

A proxy can be practical for authorized quality assurance, location testing, or application-level routing when VPN tunnel protection for the rest of the device is unnecessary.

Trying to become anonymous

Neither tool is sufficient by itself. Both introduce an intermediary into the network path, while accounts, cookies, browser characteristics, application identifiers, and the intermediary operator can still matter.

A comparison of proxy, VPN, and Tor needs to separate routing, encryption, relay structure, trust, and anonymity rather than treating all three as interchangeable IP-masking tools.

Understanding what a VPN actually protects also helps separate connection privacy from device security and anonymity.

If a VPN is the appropriate technology, deciding between a free vs paid VPN is a separate question involving provider trust, usage limits, server access, device allowances, and features.

Bottom Line

Both a proxy and a VPN can change the public IP address seen by a destination for traffic routed through them. A VPN additionally provides a protected tunnel between the client and VPN endpoint for covered traffic, while a proxy is primarily a forwarding intermediary and can still carry separately encrypted traffic such as HTTPS.

Neither technology guarantees anonymity, and neither should be described without checking which traffic actually uses it. The right choice depends on whether you need selective routing, tunnel encryption, broader network coverage, or a specific combination of those functions.

Spotify spent most of its existence convincing listeners that music did not really require a screen. After building the largest paid audio-streaming service in the world, the company now appears rather interested in your eyeballs as well.

All 58 of Taylor Swift’s official music videos are now available to Spotify Premium subscribers in markets where its music-video beta is offered, stretching from “Tim McGraw” through 2026’s “Opalite.” Videos can be watched on Spotify’s TV, desktop, iOS and Android apps, giving one of the largest fanbases in popular music another reason to stay inside Spotify rather than opening YouTube. 

The implementation is more important than simply dumping videos into another menu. Start playing a supported song, tap “Switch to video,” and the video begins at the same point; switch back to audio and the song continues without restarting. It is hardly revolutionary; YouTube Music introduced essentially the same concept seven years ago, but convenience has always been Spotify’s sharpest weapon.

Related Reading:

Spotify Did Not Invent Music Videos on a Streaming Service

Before anyone starts carving Daniel Ek’s face into Mount Rushmore, Spotify is rather late to this particular party.

Apple Music already offers music videos, curated video playlists, live performances and the 24-hour Apple Music TV channel. TIDAL says its video section includes more than 650,000 music videos and other visual programming including concerts, documentaries and original shows. 

Then there is YouTube Music, which added seamless switching between songs and corresponding music videos back in 2019. At the time, Google said it had already time-matched more than five million official videos with their audio tracks. 

Spotify’s advantage is therefore not invention. It is scale, personalization and the opportunity to make video feel like an extension of what hundreds of millions of people are already doing inside the app.

Why Taylor Swift Matters

Spotify began testing music videos in 2024 and expanded the beta to Premium subscribers in the U.S. and Canada in late 2025. It has since added Videos for You, a personalized playlist refreshed daily with music videos, live performances and covers tailored to the listener. 

Taylor Swift gives Spotify a rather more visible demonstration than another obscure beta button. Her videos have long functioned as extensions of her albums and eras, and Spotify now has the complete official catalog available without forcing fans to leave the service. Or drop $9,000 on concert tickets.

The potential engagement is enormous. Spotify reported 300 million Premium subscribers and 777 million monthly active users for Q2 2026, and said at its May Investor Day that more than two-thirds of Premium subscribers had already watched music videos on Spotify. 

That last number is probably the one YouTube should circle.

Spotify Is Becoming a Lot More Than a Music App

The Swift rollout makes considerably more sense when viewed alongside what Spotify has been doing elsewhere.

After years of dangling Spotify HiFi in front of audiophiles like a carrot attached to a fishing pole, the company finally rolled out Lossless playback at up to 24-bit/44.1kHz FLAC for Premium users in 2025. Spotify has also expanded audiobooks to more than 700,000 titles across 22 markets, turning books into a substantial part of the platform rather than an interesting tab most people forget exists. 

The company is also becoming more interactive. Talk to Spotify, currently rolling out in beta to eligible Premium users, lets listeners speak or type conversational requests about music, podcasts, audiobooks and their own listening history. Spotify increasingly wants you asking it what to play rather than deciding that Google or ChatGPT should answer first. 

Then there is Reserved by Spotify, launched with Live Nation and powered by Ticketmaster. Spotify identifies some of an artist’s most engaged Premium listeners using signals such as streams, saves and shares, and can hold two concert tickets for them to purchase before the general sale. Spotify is no longer satisfied with knowing that you listen to an artist; it would also like to participate in getting you through the venue door. 

Video is following the same strategy. Spotify has already experimented with 48-hour music-video exclusives, allowing fans to watch certain new videos on Spotify before they appear elsewhere. Add personalized videos, video podcasts, lyrics, concert discovery, ticket access and artist pages, and the direction becomes rather difficult to miss. 

Spotify wants the song, the video, the podcast interview, the audiobook, the concert ticket and as much of the relationship between fan and artist as it can reasonably fit inside one green application.

Why Should Listeners Care?

Convenience is the obvious answer. If you are already listening to Taylor Swift, Noah Kahan or another artist on Spotify, moving from the song to the video requires one button instead of leaving the app, finding the correct video on YouTube and starting again.

That becomes more interesting on a television. Spotify can move from being something playing invisibly through a streamer or smart speaker to an actual visual entertainment app, while still letting listeners return to background audio the moment they decide they have had enough choreography.

Spotify’s recommendations are another advantage. The company already knows what listeners play, save, skip, revisit and share, which gives it an enormous behavioral dataset for recommending video without requiring users to build another viewing history from scratch.

Should YouTube Actually Be Worried?

It should pay attention. Panic would be premature.

YouTube still owns an enormous music-video ecosystem Spotify cannot reproduce overnight, including official releases, live performances, fan uploads, interviews, archival footage, covers, reaction videos and almost every other piece of music-related video ever pointed at a camera.

Spotify does not need to replace all of that. It only needs to remove enough reasons for its existing users to leave.

That is where Taylor Swift matters. If somebody already pays Spotify, follows her there, receives recommendations there and can now watch all 58 official videos without opening another service, YouTube loses one small piece of engagement. Repeat that across enough major artists and Spotify starts reclaiming a meaningful amount of attention.

There is also some delicious irony in Spotify borrowing a concept YouTube Music introduced in 2019 and presenting it to an audience of 300 million paying subscribers. Timing has never prevented Spotify from eventually turning somebody else’s table stakes into a very large business.

The Bottom Line

Spotify’s real play here is retention. Taylor Swift is an almost absurdly effective test case because her fans already treat the visual side of her catalog as part of the music itself. If Spotify can make watching the official video as frictionless as hearing the song, one of the most obvious reasons to jump over to another app disappears.

The expanding catalog will inevitably include considerably less essential viewing. Macklemore remains available for anyone who feels their evening is incomplete without a political lecture followed by “Hind’s Hall.” His recent MetLife performance drew objections from the Israeli-American Council, Pink and Robert Kraft — owner of the New England Patriots and Gillette Stadium and founder of the Foundation to Combat Antisemitism, who said Macklemore’s recent actions and what Kraft described as a broader history of antisemitic rhetoric and imagery were deeply offensive to the Jewish community. Macklemore was subsequently dropped from Ed Sheeran’s tour after venues objected to his participation.

That is the bargain Spotify is making as it becomes a larger visual platform: more choice also means more material you may desperately wish had remained unavailable in either format. Fortunately, the skip button remains one of the finest inventions in streaming.

Related Reading:

On September 8, Google Threat Intelligence Group (GTIG) detailed several attacks that show how quickly AI is changing the economics of cybercrime.

In one credential-harvesting campaign, a threat actor first compromised an organization’s cloud infrastructure, then built and deployed a multi-agent attack framework. The operation took less than six hours in total and resulted in thousands of third-party credentials being compromised.

The AI even managed parts of the vulnerability-scanning pipeline, troubleshot problems as they arose and rotated IP addresses with minimal human intervention.

One of the main benefits of AI for organizations is the productivity gains it can deliver. Unfortunately, threat actors can use those same capabilities to make attacks faster and easier to scale. Credentials are already routinely harvested through infostealers, and AI simply removes some of the work required to carry attacks out.

As credentials are becoming easier to steal at scale, security teams must ensure their current authentication processes are robust enough to confidently establish that users and devices connecting to internal networks are trustworthy.

AI is Automating the Credential Theft Playbook

Microsoft reported in April that AI-assisted phishing campaigns it observed were achieving click-through rates as high as 54%, compared with around 12% for traditional campaigns.

If attackers can make the same campaign more convincing without spending proportionally more time creating it, the economics of phishing start to shift in their favor. For credential theft, that’s especially important as it’s partly a numbers game. Not every recipient will click, and even those accounts that do become compromised may not provide useful access.

With AI, attackers can generate targeted messages more quickly, adapt them for different languages or industries, and create variations without writing each one from scratch. Improving the success rate at the start of that process gives attackers more credentials to test and more opportunities to find the accounts that matter.

AI therefore doesn’t need to introduce a new way to steal credentials to change the risk for organizations. Making established techniques more efficient is enough.

How to Uncover Compromised Credentials in Your Active Directory

AI may make credential theft faster and easier to scale, but attackers still benefit from familiar weaknesses such as weak and reused passwords. That makes visibility a useful first step. Before security teams can reduce credential exposure, they need to know where the weaknesses are in their own environment.

Specops Password Auditor performs a read-only scan of your Active Directory to identify password-related vulnerabilities and highlight issues with users and password policies.

The resulting report gives security teams a clearer view of where credential risk exists today, so they can prioritize what needs attention.

Download Specops Password Auditor for free here.

Successful Authentication isn’t Necessarily Trustworthy

The threat of stolen credentials is straightforward: they let an attacker use the same access routes as a legitimate user. Identity weaknesses played a material role in 89% of investigations covered by Unit 42’s 2026 Global Incident Response Report, with attackers using stolen credentials and tokens to gain access and move through environments.

Abusing valid identities changes what malicious activity looks like to defenders. There may be no exploit attempt or obviously malicious login mechanism to spot.

An attacker can access cloud services, SaaS applications and other resources through the same authentication processes employees use every day. The credentials are valid; the intent behind them is not.

The key issue for security teams is that, wherever credentials are stolen from, they provide valuable access that an organization’s authentication system is designed to accept.

This is where the distinction between authentication and trust starts to matter. A correct password, MFA response, or valid session can help establish that an authentication requirement has been met. It cannot, by itself, establish that the request is coming from a device the organization knows and trusts.

When building an identity security strategy that is truly resilient against AI-enabled attacks, the question therefore cannot stop at “Did this user authenticate successfully?” It also needs to include “What device is requesting access, and should we trust it?”

Make Stolen Credentials Less Useful

Password hygiene can reduce exposure, but no organization can assume credentials will never be compromised. The prevalence of credential harvesting malware creates situations where an attacker may end up with valid authentication material despite preventative controls.

The next question is what that credential can do.

If authentication is restricted to devices that have already been approved and bound to a user’s identity, a valid password alone is no longer enough. An attacker trying to reuse it from an unknown device has another trust check to overcome.

That is the role of solutions like Specops Device Trust. It binds user identities to trusted devices, so access depends on both who is authenticating and what device they are logging in from. In practice, that means a stolen credential used from an attacker-controlled machine will simply be blocked.

Zero Trust measures like this especially matter across a mixed workforce. BYOD policies spanning different operating systems and endpoint types are common, and it can be a challenge to implement security measures that cover them all.

Specops Device Trust applies device trust across Windows, macOS, Linux and mobile, meaning security teams have visibility over every device connecting to the network.

The principle is simple: authenticate the identity, verify the device, and require both.

Evolve Your Identity Security Strategy with Specops

AI is making credential theft faster and more scalable; it’s harder to trust traditional authentication signals alone. Strong password hygiene remains essential, but organizations also need to think about what happens when valid credentials or tokens fall into the wrong hands.

That means evolving identity security beyond “did this user authenticate?” to include whether the device is trusted and whether it remains trustworthy throughout the session.

Specops can help you better align with Zero Trust principles by bringing device trust into your identity security strategy. Book a demo to see our solutions in action.

Sponsored and written by Specops Software.

Siri might be one of the most recognisable voices on your iPhone, but that doesn’t mean you have to stick with the default. 

With iOS 27, Apple gives you more control over how Siri sounds, whether you fancy switching the accent, trying a different voice or tweaking its pace and expressiveness. Better yet, it only takes a few taps in the redesigned Siri settings menu. 

The catch? It’s limited to users of the iPhone 17 Pro, iPhone Air or later, despite the fact that Siri AI is, more generally, available on iPhone 15 Pro and later. 

That said, if you’re running relatively recent Apple hardware, here’s how you can change Siri’s voice on your iPhone in iOS 27. For more on Apple’s latest software update, take a look at how to customise the Liquid Glass effect in iOS 27.

What you’ll need

• iPhone 17 Pro, iPhone Air or later
• iOS 27

The short version

1. Open the Settings app.
2. Tap Siri.
3. Tap Voice.
4. Tap the Voice dropdown and select American or British.
5. Adjust voice, pace and expressivity.
6. Tap the Back icon to save your changes.

There’s also an analog thumbpad.