A Ukrainian man has pleaded guilty to operating OnlyFake, an AI-powered website that generated and sold more than 10,000 photos of fake identification documents to customers worldwide.

27-year-old Yurii Nazarenko (also known as “John Wick,” “Tor Ford,” and “Uriel Septimberus”) admitted that his OnlyFake subscription-based platform used artificial intelligence to generate realistic-looking counterfeit passports, driver’s licenses, and Social Security cards.

“We rely on government issued IDs to combat terrorism, hijackings, fraud, money laundering, and a host of other crimes,” said U.S. Attorney Jay Clayton on Thursday. “OnlyFake’s manufacture of fraudulent IDs and other documents puts us all at risk and must be stopped.”

According to the indictment, Nazarenko’s OnlyFake platform allowed customers to generate fake digital versions of U.S. driver’s licenses for all 50 states and U.S. passports and passport cards, as well as digital versions of identification documents for roughly 56 other countries.

Customers could also customize the fake digital documents with personal details, opt for randomized information, and choose whether the finished product appeared as a scan or a tabletop photograph.

New York federal prosecutors said that the primary use of these fake digital documents was to circumvent Know Your Customer (KYC) verification requirements at banks and cryptocurrency exchanges, which are safeguards designed to prevent money laundering mandated under the Patriot Act.

Undercover FBI agents made multiple purchases from the OnlyFake website between May and June 2024, obtaining fake New York state IDs, U.S. passports, and a Social Security card.

OnlyFake only accepted cryptocurrency payments, and also offered bulk packages of up to 1,000 fake documents at a discount. Nazarenko further attempted to cover his tracks by routing cryptocurrency payments through multiple wallets and deleting emails after 404 Media reported on the site in February 2024.

“Yurii Nazarenko developed a website to produce more than 10,000 fake identification documents, earning hundreds of thousands of dollars from these illicit sales,” added FBI Assistant Director in Charge James C. Barnacle, Jr. “This platform offered its clients a myriad of criminal opportunities, including bypassing traditional regulations to launder money.”

Nazarenko was extradited from Romania in September 2025 and has agreed to forfeit $1.2 million. He is now facing a maximum sentence of 15 years in prison and is scheduled for sentencing on June 26, 2026.

Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.

Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.

Download The Report

The Marshals is a new Yellowstone spin-off airing on CBS (but don’t drop Paramount Plus — it’ll stream there too). 

Luke Grimes reprises his role as Kayce Dutton in the Yellowstone sequel series. The former Navy SEAL joins an elite unit of US Marshals to bring range justice to Montana, according to a synopsis from CBS. In addition to Grimes, the show includes Yellowstone actors Gil Birmingham as Thomas Rainwater, Mo Brings Plenty as Mo and Brecken Merrill as Tate. Spencer Hudnut is the showrunner of Marshals — formerly known as Y: Marshals — and Taylor Sheridan is an executive producer. 

When to watch the Marshals premiere on Paramount Plus

In addition to airing on CBS on Sunday, March 1, the premiere of Marshals will stream on Paramount Plus — and the subscription tier you have matters. You can watch the first episode live with Paramount Plus Premium, which includes your local CBS station. If you subscribe to Paramount Plus Essential, you can watch the premiere on demand the following Monday, but not live on Sunday. 

Here’s a clear breakdown of how to watch the first four episodes of Marshals.

• Episode 1, Piya Wiconi: Premieres on CBS/Paramount Plus Premium on March 1 at 8 p.m. ET/8 p.m. PT/7 p.m. CT. Streams on Paramount Plus Essential on March 2.
• Episode 2, Zone of Death: Premieres on CBS/Paramount Plus Premium on March 8 at 8 p.m. ET/8 p.m. PT/7 p.m. CT. Streams on Paramount Plus Essential on March 9.
• Episode 3, Road to Nowhere: Premieres on CBS/Paramount Plus Premium on March 15 at 8 p.m. ET/8 p.m. PT/7 p.m. CT. Streams on Paramount Plus Essential on March 16.
• Episode 4, The Gathering Storm: Premieres on CBS/Paramount Plus Premium on March 22 at 8 p.m. ET/8 p.m. PT/7 p.m. CT. Streams on Paramount Plus Essential on March 23.

You can also watch CBS and the first episode of Marshals without cable with a live TV streaming service such as YouTube TV, Hulu Plus Live TV or the DirecTV MyNews skinny bundle. In addition to being a lower-cost option, Paramount Plus allows you to watch the other two Yellowstone spin-offs — the prequels 1883 and 1923.

Advertisement

After a price increase in early 2026, the ad-supported Essential version runs $9 per month or $90 per year, and the ad-free Premium version runs $14 per month or $140 per year. Paying more for Premium gives you downloads, the ability to watch more Showtime programming than Essential and — as mentioned — access to your live, local CBS station.

As a smart home reviewer, I love the connected home. My house is full of connected devices, from thermostats to ovens to lighting and robots (lawnmowers and vacuum cleaners). They all make my life easier and better, but even I’m a little shaken by the latest hack.

As reported by The Verge, Sammy Azdoufal accidentally hacked almost 7000 DJI Romo vacuum cleaners, gaining full remote control of them. Azdoufal used the AI-powered Claude Code to reverse engineer DJI’s protocols, so that he could remote control is robot with a PS5 controller.

But his remote control app ended up talking to the entire install base of DJI Romo vacuum cleaners. At this point, every robot could be remotely controlled and camera feeds could be viewed, bypassing the PIN lock that’s in place.

The flaw was due to the token used. Azdoufal extracted the token used to access his device, but this also gave him access to every other device. The security issue was reported to DJI, and has now been closed, but this incident should be seen as a warning shot across the bows.

When security teams talk about attack surface, the conversation usually starts in familiar places. Servers, identity systems, VPN access, cloud workloads, maybe browsers. Those are visible. They show up in diagrams and asset inventories.

What gets less attention are the everyday tools people use to actually get work done.

PDF readers. Compression utilities. Remote access clients. Word processors. Spreadsheet tools. Email clients. Browsers. Screen sharing software. Update managers. The background software that quietly powers normal business activity.

Most organizations do not spend much time debating whether to deploy these. They are simply part of operating in a digital economy. Contracts arrive as PDFs. Finance works in spreadsheets. HR reviews resumes. IT supports users remotely. Executives live in email and browsers. These tools become part of the environment almost by default.

At Action1, where visibility into third-party software exposure across endpoints is a daily focus, these background tools consistently emerge as a defining part of the real-world attack surface.

That commonness is what makes them attractive targets from a threat actor’s perspective.

The value of being ordinary

From the outside, modern enterprises look different. Networks vary. Architectures change. Security stacks evolve. But, inside most environments, the same classes of applications appear again and again, and more often than not, the same software titles dominate the majority of installations.

It is difficult to function in modern business without an email client, document processing software, a browser, and tools for packaging, previewing, and sharing files. Using similar products is less about preference and more about compatibility.

Business depends on exchanging information in formats everyone else can use. Without those standards, we go back to the days of file-format wars, “I cannot open that, we use something else,” and lost time just trying to make data usable. That friction is why the industry standardized, and why the same major names still dominate.

Attackers pay attention to that.

Rather than predicting every custom application an organization might run, they look for overlap. If a vulnerability appears in a widely used PDF engine, spreadsheet parser, email preview component, or remote access utility, the chances it connects with something real are high. The exploit is aimed less at unique architecture and more at familiarity.

Most successful exploitation does not rely on exotic techniques. It relies on muscle memory. Users open PDFs, Word files, spreadsheets, and links all day long. Attackers are betting those actions feel routine enough that nobody hesitates.

That familiarity shapes how campaigns are built, and it should influence how defense strategies are planned.

How probability shapes attacks

Many attacks historically looked like guesswork. An attacker might send a crafted email for Outlook, hoping the recipient uses Outlook. Or attach a weaponized spreadsheet, hoping Excel is present. Or send a malicious PDF, hoping the reader is vulnerable.

There is uncertainty in that approach. The exploit launches before the attacker truly knows what exists on the other end. This increases chances the attack will be detected before being effective, and it risks valuable exploit code to failure, where it may be detected, profiled, then henceforth scanned and detected.

What changes with common utilities is the probability curve.

Email clients, browsers, word processors, spreadsheets, PDF readers, and archive tools appear in most business environments because the work itself requires them. An attacker does not need perfect information to expect something compatible nearby.

Instead of treating exploitation as a one-off guess, attackers think in likelihood. They invest effort where overlap is largest. The more widespread the tool, the more attractive it becomes as an entry point.

That is why vulnerabilities in these utilities move quickly through exploit ecosystems. Once something works in a familiar toolchain, it scales. If one user relies on Outlook, Word, and Adobe, there is a good chance coworkers and business relations do as well for interoperability reasons.

The standard business footprint in practice

These tools also travel together.

If an email clearly originated from Outlook, it already hints at part of the environment. Email workflows connect to document workflows. If Outlook is present, Word and Excel are often nearby.

Each utility reinforces the presence of others.

For attackers, that enables paths rather than isolated exploits. An issue in an email client connects to attachment handling, preview engines, document renderers, shared libraries, and integrations that tend to coexist on the same system.

Instead of targeting a single application, the attack surface starts to resemble the business footprint itself, the collection of tools people rely on every day.

When vulnerabilities appear in that footprint, they attract more attention because they fit naturally into how people already work.

Quiet signals and small leaks

Another part of the story is information people do not realize they share.

Documents often contain metadata. PDFs reference the engine that produced them. Spreadsheets carry formatting behavior tied to specific suites. Email headers expose client details. Browser traffic advertises user agents. File structures reveal habits and versions.

A single attachment, email, or shared document can quietly describe parts of the software stack behind it.

In isolation it does not look sensitive. Often it is not even visible. Over time it builds a picture of what tools are common, what standards they follow, and how files are processed.

What created it, what version, how recently, so when old software details show in current workflows, the software processing it is old. And old software often means years of exploit potential bottled up in one package. That is often what turns speculation into precision.

Those breadcrumbs help attackers shape payloads that align with what exists on the other side, increasing effectiveness while reducing noisy experimentation.

Why third-party software drifts

Most enterprises put real effort into operating system patching. Update pipelines are understood. Browsers update often. Mobile devices follow management policies. Systems start with baselines and are monitored.

Third-party utilities live differently.

Vendors ship different installers. Some auto-update. Some rely on users. Some get disabled by packaging systems. Some stay frozen because workflows depend on a version.

Over time, multiple builds of the same tool spread across endpoints. Some become stale. Some live for years with known vulnerabilities simply because they fell off the radar.

In Action1’s analysis of enterprise environments, it is common to find multiple versions of the same third-party application coexisting, some lagging years behind current security fixes. This fragmentation quietly accumulates exploit potential without triggering obvious alerts.

From a security view, that drift matters because attackers do not need new exploits. They benefit from whatever version still exists somewhere in the footprint. A five-year-old PDF reader quietly carries five years of cumulative exploit potential.

What feels like small technical debt widens the opportunity window for major exploitation.

Trust and everyday behavior

There is also a human side to these tools.

Email, documents, browsers, and archives feel like infrastructure. People trust them like desks and keyboards. Opening a PDF does not feel like running code. Previewing an email does not feel like execution. Extracting a file feels routine.

By the time behavior looks unusual, the initial interaction already happened in a place people rarely question. These actions occur thousands of times a day, which makes tracing a compromise back to a document, email, or user extremely difficult.

Looking at the footprint, not just the platform

For leadership teams, the value here is perspective, not fear.

Security strategies often start with the platform layer, operating systems, networks, identity, cloud infrastructure. Those matter, but they do not tell the full story of how work actually happens.

Work happens in email clients, spreadsheets, PDFs, browsers, archive tools, and remote sessions. That is where files open, previews render, links get clicked, and data moves between people.

That makes them predictable.

That is why third-party patching often carries more risk weight than expected. The operating system may be tightly managed, while the tools on top quietly define real exposure.

Looking at the footprint is less about assuming weakness and more about understanding where everyday work intersects with real security concerns.

A quieter way to think about patching

Third-party patching often feels operational rather than strategic. Yet these utilities sit at the intersection of people, files, and execution.

They are ordinary, and that is exactly why they matter.

Not because every organization looks the same, but because they look similar enough that attackers design around that similarity.

When teams examine environments, the focus is usually infrastructure. There is also value in asking what the standard business suite looks like across endpoints, how it evolves, and how consistently it stays current.

Which tools are actually needed? Which are simply part of a default deploy? Which stay installed even when unused? Which stop getting updated because nobody notices them?

This is why, in practice, teams working with platforms like Action1 consistently see third-party patching deliver a greater reduction in real-world risk than many more visible security controls. Exploitation rarely hinges on a single overlooked vulnerability. It is enabled by years of accumulated drift across third-party applications that quietly fall out of date while remaining embedded in everyday workflows.

Those conditions exist long before an exploit is written or deployed. They shape the practical attack surface by defining which software actually executes, which files get opened, and which actions feel routine enough to avoid scrutiny.

Third-party software is not adjacent to the platform — it is part of how the platform operates, and it is often where exposure concentrates when everything else appears well-managed.

Action1is a founder-led company, brought to you by the original minds behind Netwrix. At the time of this writing, it is one of the fastest-growing private software companies in the US because organizations are recognizing that OS and third-party patching can no longer be treated as a secondary task.

Addressing modern risk requires continuous visibility into third-party software and the ability to remediate vulnerable applications across endpoints quickly and consistently. When teams evaluate modern patch management solutions, Action1 increasingly represents the option designed around that reality.

Activate your first 200 free endpoints and see how effective patch management can transform your team’s security posture.

Sponsored and written by Action1.

The Bugatti W16 Mistral ‘La Perle Rare’, the last of a vanishing breed, marks the end of an era defined by raw mechanical power and an obsessive quest of perfection. There are only 99 of these Mistrals in total, and each starts at over €5 million. ‘La Perle Rare’, on the other hand, is a handmade unique that will cost a little more than $8-9 million.

It all began at the 2023 Pebble Beach Concours d’Elegance, when a client commissioned Bugatti to produce something absolutely special. Over time, the client and Jascha Straub, the guy in charge of Bugatti’s bespoke business, came up with proposals ranging from a silver tint to numerous shades of white before settling on something that seemed to capture the essence of light. The project began in August 2023, and we can safely assume that the designers in Berlin and engineers in Molsheim worked long hours on it.

LEGO Technic Bugatti Chiron Pur Sport Hypercar Building Toy for Boys & Girls – Sports Car Toy W/Realistic…

• HIGH SPEED THRILLS – Kids construct an authentic race car with the LEGO Technic Bugatti Chiron Pur Sport Hypercar (42222) building toy for boys and…
• REALISTIC FEATURES & FUNCTIONS – Young builders can steer using the knob on top, explore the W16 engine, and open the doors and hood to discover…
• VIBRANT BUGATTI DESIGN – This hypercar model features the eye-catching orange bodywork and black design inspired by the real Bugatti Chiron Pur…

The exterior of ‘La Perle Rare’ is a true show-stopper, with a two-tone color scheme that separates the vehicle into two distinct areas. The top area is a warm color tinged with gold and iridescence, as well as a sprinkle of metallic particles that sparkle beautifully. The second part is a sophisticated, warm white color. Getting the separating lines between the colors just right required a lot of precision. Even the wheels received special treatment, resulting in stunning diamond-cut rims painted in the interior color of the vehicle, which is an understatement given that the wheels are coated in a custom paint combination that matches the exact colors of gold and white. The end result is a car that shines like a rare gem while maintaining the original Mistral design.

Rembrandt Bugatti’s famed Dancing Elephant sculpture is featured in a few of the car’s more subtle details, like the gear selector, body panels behind the front wheels, and even the headrests. To add a personal touch, the name ‘La Perle Rare’ is stitched in the center tunnel, stamped on the engine cover, and painted on the active rear wing. These little details return the automobile to Bugatti’s artistic roots.

Inside ‘La Perle Rare,’ the cabin takes on an entirely new level of brightness, a luminous continuation of the outer motif that is difficult to describe. Every visible piece of carbon fibre has been coated white to give it a jewel-like appearance. Door panels feature alternating white and warm gold lines that look lovely on their sculpted, concave surfaces. The ambient lighting has just the right amount of warmth to it, highlighting the interplay between light and material. The steering wheel, center console clocks, and door handles are all machined and polished aluminum, with each meant to catch reflections in a particularly stunning way.

The power comes from the same quad-turbocharged 8.0-litre W16 engine found in all Mistrals. It’s not exactly small in any way, with 1,579 horsepower and 1,600 Nm of torque, it can go from 0 to 62 in 2.4 seconds, 0 to 124 in 5.6 seconds, and 0 to 186 in 12.1 seconds, and all of that power is sent to all four wheels via a seven-speed dual clutch transmission. Top speed? The record for the fastest open-top production car is already in the records, 282 mph and all, thanks to this car, but, for obvious reasons, you won’t be able to get it up to that sort of speed on the road, closer to 236 mph if you want to play it safe.
[Source]

Samsung and the State of Texas have reached a settlement agreement over the alleged unlawful collection of content-viewing information through its smart TVs

As part of the agreement, the TV manufacturer will revise its privacy disclosures to clearly explain its data collection and processing practices to consumers.

Last December, Texas Attorney General Ken Paxton filed a lawsuit against several TV manufacturers, including Samsung, alleging that they use Automated Content Recognition (ACR) technology to collect and process viewing data without first obtaining their express, informed consent.

In January, Texas obtained a short-lived temporary restraining order (TRO) against Samsung to stop the unlawful collection of consumer data in the state, confirming a violation of the Texas Deceptive Trade Practices Act (DTPA).

Although the order was vacated on the following day, the lawsuit remained active.

The allegations against Samsung were that it uses ACR technology to capture screenshots of consumers’ TVs to determine what they’re watching. The South Korean tech giant would use this information for targeted advertising.

In support of the TRO, the Court found that there was “good cause to believe” that Samsung automatically enrolled customers in this system using “dark patterns” that included “over 200 clicks spread across four or more menus for a consumer to read the privacy statements and disclosures.”

In a statement to BleepingComputer, Samsung stated that, while it does not agree that its Viewing Information Services (VIS) system violated any regulations, it has agreed to “make enhancements to further strengthen our privacy disclosures.”

“While we maintain our original television privacy policy and notices followed existing Texas state regulations, as a trusted brand, Samsung is proud to be at the forefront of protecting consumer privacy and security,” stated a spokesperson of Samsung Electronics America.

“The settlement affirms what Samsung has said since this lawsuit was filed – Samsung TVs do not spy on consumers. In fact, Samsung allows you to control your privacy – and change your privacy settings at any time.”

“As part of the agreement, Samsung must halt any collection or processing of ACR viewing data without obtaining Texas consumers’ express consent,” announced Texas AG Ken Paxton.

“Additionally, it compels Samsung to promptly update its smart TVs and implement disclosures and consent screens that are clear and conspicuous to ensure that Texans can make an informed decision regarding whether their data is collected and how it’s used.”

Paxton commended Samsung for agreeing to implement consumer safeguards, while he underlined that others haven’t moved with a similar fervor as of yet.

Smart TV manufacturers, including Sony, LG, Hisense, and TCL Technologies, have not made any changes in response to the lawsuits yet.

Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.

Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.

Download The Report