from the ctrl-alt-speech dept

Ctrl-Alt-Speech is a weekly podcast about the latest news in online speech, from Mike Masnick and Everything in Moderation‘s Ben Whitelaw.

Subscribe now on Apple Podcasts, Overcast, Spotify, Pocket Casts, YouTube, or your podcast app of choice — or go straight to the RSS feed.

In this week’s roundup of the latest news in online speech, content moderation and internet regulation, Mike is joined by First Amendment lawyer Ari Cohn. Together they discuss:

Support the podcast by joining our Patreon, with special founder membership available until May 28th.

Filed Under: age verification, ari cohn, artificial intelligence, chatbots, content moderation, free speech, trust and safety

Companies: character.ai

A new trojan named TCLBanker, which targets 59 banking, fintech, and cryptocurrency platforms, uses a trojanized MSI installer for Logitech AI Prompt Builder to infect systems.

Additionally, the malware includes self-spreading worm modules for WhatsApp and Outlook that automatically infect new victims.

The new banking trojan was discovered by Elastic Security Labs, whose researchers believe it’s a major evolution of the older Maverick/Sorvepotel malware family.

While TCLBanker currently appears focused in Brazil, specifically checking timezone, keyboard layout, and locale, LATAM malware has, in the past, been updated to broaden its targeting scope, so the risk of the threat expanding is real.

TCLBanker capabilities

Elastic warns that TCLBanker is extremely well protected against analysis and debugging, featuring environment-dependent payload decryption routines that fail in sandboxes or analyst environments.

It also runs a persistent watchdog thread that continuously hunts for analysis tools like x64dbg, IDA, dnSpy, Frida, ProcessHacker, Ghidra, de4dot, and others.

The malware is loaded within the context of the legitimate Logitech application via DLL side-loading, so it won’t trigger any alarms from security products protecting the infected host.

The researchers noted that, while the loader is rich in features, none go very far toward being truly advanced, and code artifacts indicate that AI may have been used in its development.

The banking module monitors the browser address bar every second using Windows UI Automation APIs, watching for when the victim opens a website of one of its 59 targeted platforms.

When that happens, it establishes a WebSocket session with the command-and-control (C2), sends victim and system information, and starts remote control operations.

The capabilities given to the operators include:

• Live screen streaming
• Screenshot capturing
• Keylogging
• Clipboard hijacking
• Shell command execution
• Window management
• File system access
• Process enumeration
• Remote mouse/keyboard control

During active sessions, the Task Manager process is killed to prevent disruptions and hide the malicious activity from the victim.

To support data theft, TCLBanker uses a WPF-based overlay system that can push to victims fake credential prompts, PIN keypads, phone-number collection forms, fake “bank support” waiting screens, fake Windows Update screens, and various fake progress screens.

There are also “cutout” overlays that stay on top, allowing only selected portions of real applications to be shown to the victim, and masking other parts.

WhatsApp and Outlook worms

An interesting aspect of TCLBanker is its ability to propagate autonomously to contacts linked to the primary victim.

The malware searches Chromium browser profiles for authenticated WhatsApp Web IndexedDB data, and launches a hidden Chromium instance that hijacks the victim’s account.

Then, it harvests contacts, filters for Brazilian numbers, and sends them spam messages from the victim’s account, leading them to TCLBanker distribution platforms.

Another worm module abuses Microsoft Outlook through COM automation, launching the app, harvesting contacts and sender addresses, and sending phishing emails through the victim’s email account.

Elastic concludes that TCLBanker is as a characteristic example of the evolution of LATAM malware, offering lower-tier cybercriminals features that were once only available in highly sophisticated tools.

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.

Claim Your Spot

As noted earlier, Mozilla’s characterization of AI-assisted vulnerability discovery as a game changer has been met with massive, vocal skepticism in many quarters. Critics initially scoffed when Mozilla didn’t obtain CVE designations for any of the 271 vulnerabilities. Like many developers, however, Mozilla doesn’t obtain CVE listings for internally discovered security bugs. Instead, they are bundled into a single patch. Normally, Bugzilla reports detailing these “rollups” are hidden for several months after being fixed to protect those who are slow to patch. Now that Mozilla has revealed a dozen of them, the same critics will surely claim they too were cherry-picked and conceal less accurate results.

Of the 271 bugs found using Mythos, 180 were sec-high, Mozilla’s highest designation for internally reported vulnerabilities. These types of vulnerabilities can be exploited through normal user behavior, such as browsing to a web page. (The only higher rating, sec-critical, is reserved for zero-days.) Another 80 were sec-moderate, and 11 were sec-low.

The critics are right to keep pushing back. Hype is a key method for inflating the already high puffed-up valuations of AI companies. Given the extensive praise Mozilla has given to Mythos, it’s easy for even more trusting people to wonder: What’s it getting in return? Far from settling the debate, Thursday’s elaborations are likely to only further stoke the controversy.

To hear Grinstead tell it, however, the details are clear evidence of the usefulness of AI-assisted discovery, and Mozilla’s motivation is simple.

“People are a bit burned from the last year of these slop commits so we felt it was important to show some of our work, open up some of the bugs, and talk about it in a little more detail as a way to hopefully spur some action or continue the conversation,” he said. “There’s no sort of marketing angle here. Our team has completely bought in on this approach. We are trying to get a message out about this technique in general and not any specific model provider, company, or anything like that.”

The ShinyHunters extortion gang has breached education technology giant Instructure again, this time exploiting a vulnerability to deface Canvas login portals for hundreds of colleges and universities.

The defacements, which were visible for roughly 30 minutes before being taken offline, displayed a message from ShinyHunters claiming responsibility for the earlier Instructure breach and threatening to leak stolen data if a ransom is not paid.

The message warns that Instructure and schools have until May 12 to contact them to negotiate a ransom, or students’ data will be leaked.

“ShinyHunters has breached Instructure (again). Instead of contacting us to resolve it they ignored us and did some ‘security patches’,” reads the defacement.

“If any of the schools in the affected list are interested in preventing the release of their data, please consult with a cyber advisory firm and contact us privately at TOX to negotiate a settlement. You have till the end of the day by May 12 2026 before everything is leaked,” continued the message.

BleepingComputer has learned that threat actors defaced the Canvas login portals for approximately 330 educational institutions, replacing the standard login pages with an extortion message. This defacement message also appeared in the Canvas app.

The defacement was allegedly caused by a vulnerability in Instructure’s systems that allowed the threat actor to modify the login portals. Instructure has since taken Canvas offline while they respond to the latest cyberattack.

Last week, Instructure disclosed that it was investigating a cyberattack after threat actors claimed to have stolen 280 million student and staff records tied to 8,809 schools, universities, and education platforms using its Canvas learning management system.

The ShinyHunters gang later told BleepingComputer that the stolen data included user records, private messages, enrollment data, and other information allegedly gathered through Canvas data export features and APIs.

Instructure confirmed that data was stolen during the attack but that they are continuing to investigate the incident.

BleepingComputer has repeatedly contacted Instructure with questions about the attack, including today’s, and whether they plan on notifying students and staff about the data breach. However, our emails have so far remained unanswered.

Canvas is one of the most widely used learning management systems in higher education and K-12 environments, helping schools manage coursework, assignments, grading, and communication between students and faculty.

Who is ShinyHunters

The name ShinyHunters has long been associated with numerous threat actors who have conducted data breaches since 2018.

This year, threat actors using the ShinyHunters name have become among the most prolific groups conducting data theft and extortion attacks against companies worldwide.

Primarily focusing on Salesforce and other cloud SaaS environments, the threat actors are linked to a growing number of breaches involving companies such as Google, Cisco, PornHub, and online dating giant Match Group.

The extortion gang commonly breaches third-party integration companies and uses stolen authentication tokens to access connected SaaS environments and steal customer data.

The threat actors are also known for conducting voice phishing (vishing) attacks targeting Okta, Microsoft, and Google single sign-on (SSO) accounts, impersonating IT support staff to trick employees into entering credentials and multi-factor authentication (MFA) codes on phishing sites.

As BleepingComputer first reported, the ShinyHunters group has also recently adopted device code vishing attacks to obtain Microsoft Entra authentication tokens.

After stealing credentials and authentication codes, the threat actors hijack SSO accounts to breach connected enterprise services such as Salesforce, Microsoft 365, Google Workspace, SAP, Slack, Adobe, Atlassian, Zendesk, and Dropbox.

While members of the ShinyHunters gang are responsible for numerous attacks, they are also known to operate as an extortion-as-a-service group, conducting extortion on behalf of other threat actors in exchange for a share of ransom payments.

There have been numerous arrests linked to the ShinyHunters name, including suspects connected to the Snowflake data-theft attacks, breaches at PowerSchool, and the operation of the Breached v2 hacking forum.

Yet despite these arrests, companies continue to receive extortion emails signed with the message, “We are ShinyHunters.”

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.

Claim Your Spot

Apple has failed to reduce the scope of a UK class-action lawsuit, and all iCloud users in the country will be owed $95 if the company loses.

Apple has had its fair share of lawsuits in the United Kingdom, with ongoing cases regarding App Store fees, an alleged price-fixing scheme with retailers, and more.

In November 2024, consumer rights group and publication Which? also sued Apple, alleging that the company had an anti-competitive way of locking users into paying for iCloud storage.

It was argued that Apple breached UK competition law and abused its dominant market position by not letting iOS and iPadOS choose an alternative cloud provider. Additionally, Apple was accused of charging “rip-off prices” for iCloud storage in the country.

As Apple failed to narrow down the scope of the class-action lawsuit, the case is now moving to trial.

As Which? claims in a social media post, Apple locked “millions of consumers into its iCloud service at rip-off prices.” The group says that around 40 million UK iCloud users may be eligible for compensation equating to $95, assuming its lawsuit is successful.

The lawsuit seeks damages for iPhone and iPad users who paid for iCloud storage. However, with the principle of Forgone Consumer Surplus (FCS), the suit also argues that iCloud users in the UK were priced out of an iCloud subscription, as Apple abused its market position.

Hypothetically, users who found Apple’s roughly $12 monthly payment for 2TB of cloud storage would have paid around $11 if it were a “fair” market price. Per the FCS legal theory, those potential customers “lost” $1 because of Apple’s uncompetitive pricing and the lack of an adequate alternative.

Consumer rights group Which? argued that Apple should pay these hypothetical buyers, even though they never really lost anything or paid for anything in the traditional sense.

It says that “around 40 million Apple customers in the UK who have used iCloud services on or after 8 November 2018” could be entitled to compensation.

Apple attempted to narrow the scope of the lawsuit so that it only included UK iCloud users who paid for a subscription. “We reject any suggestion that our iCloud practices are anticompetitive and will vigorously defend against any legal claim otherwise,” said the company in 2024.

However, its attempts were unsuccessful. The UK’s Competition Appeal Tribunal ruled in a two-to-one vote that the FCS legal theory is applicable. In essence, the class-action suit could result in compensation for both paying and non-paying UK iCloud users.

The iCloud restrictions that inspired the lawsuit

iCloud itself has been around since 2011, when it debuted with iOS 5. The service delivered system-wide integration, allowing users to sync their notes, emails, photos, files, and more via the cloud storage platform.

Apple has been accused of using uncompetitive pricing for its iCloud storage options in the UK.

At the time, Apple gave its users 5GB of iCloud storage for free. While that may have been generous all those years ago, Which? argued that 5G wouldn’t meet consumer needs in 2024 and beyond.

There might be some truth to this claim, as almost two-thirds of US Apple users paid for extra iCloud storage in 2024. However, Apple dealt with a lawsuit about its 5GB free iCloud storage option in the United States, and that case was ultimately dismissed the same year.

The UK lawsuit against Apple, however, is still ongoing, and it revolves around more than just the free 5GB storage plan.

Which? also argued that Apple made iCloud the simplest cloud service to use on iOS. Alternative cloud storage options on iOS truly don’t deliver the same degree of integration.

If you wanted to store your photos and videos via Google Drive, for instance, you’d have to install the app yourself. You also wouldn’t be able to use a Google-designed tool or locking tool in place of Find My on iOS, which requires the use of an iCloud account.

If the UK lawsuit against Apple succeeds, all iCloud users in the country will be automatically opted in, meaning they’ll be eligible for payment. This includes UK consumers who have used iCloud on or after November 8, 2018.

The case could also set a precedent in the country. One member of the UK’s Competition Appeal Tribunal argued that we could see a multitude of similar cases centered around hypothetical purchases.

Still, the outcome of the class-action lawsuit remains to be seen, and it could be months before a decision is made.

The person who connected Jeff Bezos to one of the most ambitious electric vehicle startups in America has left its board. Melinda Lewison, who manages the Bezos family office and was listed as a director on Slate Auto’s corporate filings, has departed the company’s board months before its first truck is scheduled to roll off the production line in Warsaw, Indiana.

The departure follows a pattern of leadership changes at the startup that has raised 1.4 billion dollars on the strength of an idea, a factory, and a name. That name, more than any specification sheet or reservation count, has been the organising principle of Slate Auto’s public identity since TechCrunch revealed Bezos’s involvement in April 2025.

The backing

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

Advertisement

Slate Auto was incubated inside Re:Build Manufacturing, the industrial conglomerate founded by Jeff Wilke, who served as chief executive of Amazon’s worldwide consumer division before retiring in 2021. Wilke and Miles Arnone, Re:Build’s chief executive, created the company under the working name Re:Car before spinning it out as an independent entity in 2023.

Bezos’s connection to Slate was indirect but unmistakable. Lewison, the head of his family office, appeared on corporate filings as a director. The arrangement gave Slate the most valuable asset a pre-revenue startup can possess: the implicit endorsement of the world’s second-richest person, without requiring Bezos himself to make public statements, attend events, or stake his reputation on production timelines.

Bezos has separately committed to a 10 billion dollar physical AI laboratory called Project Prometheus, and his family office has backed ventures across space, media, agriculture, and nuclear energy. The pattern is consistent: large bets on capital-intensive physical infrastructure, managed at arm’s length through intermediaries. Lewison’s board seat was the mechanism through which that pattern extended to Slate. Her departure removes it.

The changes

The board departure is the second significant leadership change at Slate in three months. In March, the company replaced chief executive Chris Barman with Peter Faricy, a former Amazon Marketplace vice president who had been advising Slate alongside work with McKinsey and Bessemer Venture Partners. Barman moved to the role of president of vehicles.

The timing of both changes is notable. Slate opened preorders in June 2025 and crossed 100,000 refundable reservations within two weeks. The reservation count has since grown to more than 160,000. The company closed a 650 million dollar Series C in April 2026, led by TWG Global, the investment firm run by Los Angeles Dodgers owner Mark Walter and Thomas Tull. Total funding reached 1.4 billion dollars.

A startup that changes its chief executive and loses a high-profile board member in the months before first production is not necessarily in trouble. Leadership transitions at this stage can reflect the shift from fundraising mode to operational execution, and Faricy’s Amazon logistics background is arguably better suited to manufacturing scale-up than Barman’s earlier role. But the optics matter for a company whose brand has been built on the Bezos connection.

Amazon-backed ventures have reached significant milestones recently, including nuclear startup X-Energy’s 1.02 billion dollar IPO in April. But X-Energy is a company where the Amazon relationship deepened over time, culminating in a 500 million dollar investment and a five-gigawatt power purchase commitment. At Slate, the Bezos connection appears to be narrowing rather than expanding.

The truck

The vehicle at the centre of this is deliberately unglamorous. Slate’s electric truck is priced in the mid-20,000 dollar range before federal incentives, which could push the effective cost below 20,000 dollars. It offers a 52.7 kilowatt-hour battery with 150 miles of range in the standard configuration, or an 84.3 kilowatt-hour battery with 240 miles in the extended version. Payload capacity is 1,400 pounds. The design is boxy, utilitarian, and deliberately analog, with physical controls and minimal software.

The positioning is anti-Tesla in every dimension. Where Tesla’s Cybertruck is a 80,000 dollar stainless steel statement piece, Slate is pitching a work truck for tradespeople, small business owners, and first-time EV buyers who want something that functions like the cheap trucks Detroit stopped making a decade ago. The company offers more than 100 accessories and a do-it-yourself SUV conversion kit.

The Warsaw, Indiana factory, a former R.R. Donnelley printing facility, has received approximately 400 million dollars in investment and is projected to create more than 2,000 jobs in Kosciusko County. Production is scheduled to begin late 2026, with preorders opening in June alongside official pricing.

The market

A dozen electric vehicle models have been discontinued in the United States as tariffs, tax credit changes, and import costs reshape the market. The result is a landscape that structurally favours domestically manufactured vehicles, particularly those priced below the 55,000 dollar threshold for the federal EV tax credit. Slate’s price point and Indiana factory position it squarely within these incentive boundaries.

The affordable EV truck segment is no longer uncontested. Kia has confirmed an electric pickup and plans to deploy Atlas robots in its Georgia factories, targeting the same domestic-manufacturing advantage that Slate is pursuing. Hyundai, Scout Motors, and several Chinese manufacturers exploring US assembly are all eyeing the segment below 40,000 dollars.

Volkswagen has overtaken Amazon as Rivian’s largest shareholder after a one billion dollar software milestone payment, illustrating how quickly investor relationships shift in the EV startup landscape. Rivian, which went public at a 153 billion dollar valuation in 2021 and saw its market capitalisation collapse by more than 90 per cent, remains the most prominent cautionary tale for EV startups that raise billions before achieving sustainable production economics.

Slate’s 160,000 reservations, collected at 50 dollars each on a fully refundable basis, represent intent rather than commitment. The conversion rate from reservation to binding order will determine whether the Warsaw factory’s capacity is a strength or an albatross.

The question

Every electric vehicle startup that has reached the production stage has experienced some version of the transition Slate is undergoing. The founders who attract early capital and generate excitement are not always the operators who can run a factory, manage a supply chain, and deliver vehicles on time. Faricy’s appointment suggests Slate’s investors understand this. Lewison’s departure suggests the Bezos orbit has decided its involvement has reached a natural conclusion, or that the risk profile of a pre-production automaker no longer fits the family office’s portfolio strategy.

What Slate has that most failed EV startups did not is a realistic product for a market that exists. The truck is not a hypercar, a flying taxi, or a autonomous robotaxi. It is a cheap, simple vehicle for people who need to move things, built in a state that wants the jobs, priced for a tax credit that currently exists, and manufactured domestically in a trade environment that punishes imports.

The question is whether the company can execute without the halo. Bezos’s name opened doors, attracted co-investors, and generated media coverage that a startup building affordable trucks in Indiana would not otherwise have received. The 1.4 billion dollars is in the bank. The factory is under construction. The reservations are on the books. And the person who represented the most famous investor in the building has walked out the door, six months before the first truck is supposed to drive through it.