Google‘s annual Google I/O developer conference is almost upon us, and as well as getting new features for Android phones and a better look at those new Googlebooks, as a wearables enthusiast I’m curious to see what happens with Wear OS 7.
Because Google I/O is primarily for developers, we should get a better look at the latest slate of operating systems and AI powers that devs can use to design new apps and features for the likes of the Google Pixel Watch 4, Samsung Galaxy Watch8, and more upcoming, unannounced devices.
We got a bit of a glimpse of what’s coming thanks to the Android Show, a Google stream broadcast on 12 May specifically focusing on Android ecosystem updates. While no Wear OS 7 changes were mentioned specifically, we did get to see some cool new AI features that will feature on Wear OS that will help Google stay competitive against the likes of the best Garmin watches and best Apple Watches.
Advertisement
Latest Videos From
So, here are a few of the changes we know are coming to Wear OS users, along with a couple of educated guesses. We’ll find out more at Google I/O on May 19.
🎬 Watch The Android Show | I/O Edition 2026 – YouTube
The Android Show had some neat new Gemini Intelligence features on display, notably the ability to create custom widgets simply by describing them to Gemini. After doing so, Gemini will seemingly vibe-code your widget for you.
We weren’t given any indication that you could create widgets directly on a smartwatch using Gemini and its microphone, but we were shown that watches could use custom widgets too. During the stream, we see a widget created for a Google Pixel Watch 4 to display wind and rain for ideal cycling conditions.
Expect more customization like this on Wear OS 7, with the ability to pull out nuggets of information and display them front-and-center.
Advertisement
Sign up for breaking news, reviews, opinion, top tech deals, and more.
2. Complex task automation with Gemini Intelligence
During the Android Show, we saw a graphic of a message about getting lunch with a friend display on a Pixel Watch. Once the plans have been made, a prompt shows up to create a calendar event, listed as “Add lunch at Zany’s Bistro, Sun 11:30am”.
This is part of Gemini’s new ‘complex task automation’ feature, which can look at contextual information and complete tasks for you, such as booking a front-row bike for your upcoming spin class, or searching for a coffee tour in Costa Rica fitting your specifications (both examples given in the presentation).
Advertisement
Because the feature was shown as being on-watch, we’re betting Wear OS 7 will be ideal not just to serve you notifications that these things are happening, but to do some of its own on-device thinking too. For example, I bet we’ll be able to ask the watch to open Google Maps and generate a route to Zany’s Bistro based on the messages described, likely by asking a simple question like “how far is it?”
3. Rambler on watch
(Image credit: Coros)
During the Android Show, we saw director of product operations Dieter Bohn use a piece of software called Rambler, an improved AI-powered speech-to-text that interprets long-winded, unclear messages full of filler words and backtracking, rather than transcribing literally.
Advertisement
As transcription gets better, speech is becoming one of the key ways we interact with wearables today — I certainly wouldn’t get very far in the kitchen without asking my Apple Watch Ultra 3 to set a timer for me, using its raise-to-talk functionality. As we expand our usage of voice assistants with wearables, it’s hard not to see Rambler coming to Wear OS sooner rather than later.
4. Battery improvements
All these AI features need a lot of power. While it seems every upgrade promises better, more efficient battery management, this is almost a given if we’re getting upgraded AI tools — even if it’s just to keep devices like the Google Pixel Watch at, or close to, the device’s battery life listed at the point of sale.
Advertisement
5. Context, context, context
(Image credit: Future)
We’ll likely see more unannounced features, but they’ll all be revolving around the same sort of thing — using to power of AI to hoover up contextual information from existing functions to improve or iterate on previous features.
For example, if you turn up to the same pilates studio every week, Apple will combine GPS information with workout data and prompt you to start a pilates workout. Its Workout Buddy feature takes you entire exercise history and crunches it, letting you know if the mile you just ran was your fastest ever.
I’m positive we’ll see similar features on future Wear OS watches, and it might even be this year. The use of historic data from different apps to anticipate the user’s needs is already becoming a key part of the agentic AI experiences companies like Google are trying to provide.
And of course, you can also follow TechRadar on YouTube and TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too
Rumor mill: Intel is preparing to extend the life of its Raptor Lake platform, and the signal is not coming from a formal announcement, but from conversations happening around the supply chain. The company is planning a new wave of processors under the name Raptor Lake Next with a launch expected in the first half of 2027. The chips would arrive after Intel introduces its next-generation Nova Lake CPUs, which the company intends to unveil at CES next year.
That sequencing would put an older architecture alongside a newer one in the market at the same time, a decision that seems driven as much by platform and component realities as by standard product cycles.
Details about Raptor Lake Next are still thin. The name has surfaced through sources cited by Tom’s Hardware, but Intel has not disclosed specifications or confirmed how the chips will be positioned. It is also unclear whether this will involve deeper architectural changes or mostly be a continuation of existing silicon under a new label.
What is clearer is the environment shaping the decision. At least two motherboard vendors said they are increasing production of DDR4-compatible boards for both AM4 and LGA 1700, citing stronger demand for the last-generation memory. The vendors did not directly reference Raptor Lake Next, but the overlap in timing raises the possibility that the two developments are related.
Advertisement
That demand shift appears tied to ongoing volatility in memory pricing and availability. DDR5 has not fully displaced DDR4 in all segments, particularly where cost sensitivity or upgrade paths matter. Keeping a DDR4-compatible platform alive gives Intel a way to serve that part of the market without forcing a transition to newer, and often more expensive, components.
Raptor Lake, first introduced with Intel’s 13th-generation processors, already has a long runway behind it. Even so, it continues to hold ground in certain performance categories. In gaming, Raptor Lake Refresh still includes Intel’s best gaming chip, and the newer Core Ultra 7 270K Plus trails the Core i9-14900K only narrowly.
There are also indications from Intel’s own product stack that the underlying architecture is not going away. The company recently introduced Bartlett Lake processors for embedded and industrial use, built on Raptor Cove cores and the Intel 7 process.
These chips are compatible with the LGA 1700 socket used by Raptor Lake, even if they are not officially supported on consumer motherboards. But some enthusiasts have managed to run those processors on 600- and 700-series boards.
Advertisement
That continuity makes a refresh like Raptor Lake Next easier to execute. That lets Intel keep using a mature process, support hardware that is already in the field, and tweak performance or pricing without forcing a full platform change.
The strategy may also mirror what AMD has done in response to similar market conditions. Faced with memory constraints, Team Red recently brought back a prior-generation DDR4-based chip, an example of how older platforms can stay relevant when pricing and supply line up.
It’s still worth remembering that, as with any roadmap detail emerging from vendor conversations, plans could change.
I know there is a rather large price difference between the Bowers & Wilkins Px8 S2 and the Sennheiser HDB 630. The Px8 S2 sits at $799, while the HDB 630 lands at $499. That $300 gap is not nothing. It is the difference between my $250 seat for The Wizard of Oz at the Sphere and the $450 first-level ticket that promised the full wraparound experience, flying monkeys included.
So why compare them?
Because the two are surprisingly close in a few areas that matter, and the gap is not as ridiculous as it looks on paper. Some readers will throw eggs. Probably the same bitter Rush fans still pretending Anika Nilles has not been killing it behind the kit on the Fifty Something tour because accepting reality would apparently violate the sacred scrolls of 2112. Someone get poor Geddy a glass of tea and a throat lozenge. He still remembers every word, but a few of those notes are landing somewhere near the corner of Bathurst and Wilson.
Could I have used the Bowers & Wilkins Px7 S3 instead? Sure. That would have made the pricing cleaner. It also would have required having a pair around, and this is what I had in front of me. Reviewing is not fantasy football. You work with the gear on the desk, the train, the airplane, the hotel room, and occasionally the Wawa-adjacent dog walk.
Advertisement
So here we are: a $799 British luxury wireless flagship versus a $499 German wireless headphone with a very useful USB-C dongle and enough sonic discipline to make the comparison less silly than it sounds.
Can der kleine David from Wedemark make the British Goliath blink?
Let’s find out.
This comparison is based on our full reviews of both models, which are linked below for readers who want the deeper individual breakdowns.
Advertisement
Related Reviews:
Why This Comparison Makes More Sense Than It Should
The Bowers & Wilkins Px8 S2 and Sennheiser HDB 630 are not aimed at identical buyers, but they do overlap in one very important way: Both are built for listeners who care more about sound quality than ANC trickery, app gimmicks, or whether their headphones match the color of their laptop. Which, for most of us, is a yes.
The Px8 S2 is the more luxurious headphone. Nappa leather, exposed cable detailing, a slimmer frame, stronger passive isolation, physical buttons, Bluetooth 5.3, aptX Lossless, aptX Adaptive, aptX HD, USB-C playback, 3.5mm wired playback, and a more powerful low-end presentation all reinforce its flagship position.
The HDB 630 is the more practical and more value-driven headphone. It offers 24-bit/96kHz playback via USB-C, Bluetooth 5.2 with aptX Adaptive and aptX HD, and the included BTD 700 USB-C dongle, which makes higher-quality Bluetooth easier to access from more phones, tablets, and laptops. Add in the better app, parametric EQ, crossfeed, bass boost, longer battery life, and more spacious midrange-focused presentation, and the Sennheiser starts looking like the more sensible troublemaker.
Advertisement. Scroll to continue reading.
Advertisement
One is wearing a tailored British overcoat. The other shows up with German paperwork, better battery life, and a dongle that actually solves a problem.
Design & Build Quality
Bowers & Wilkins Px8 S2
The Px8 S2 wins the materials contest.
One area where the Px8 S2 clearly pulls ahead is visibility. The Bowers & Wilkins branding, materials, and overall look stand out in a way the Sennheiser does not.
That became obvious during my usual coffee shop testing. My Asbury Park routine has become slightly more complicated lately, so I have been spending more time at a different local spot where the coffee is better, Hebrew is not uncommon, and the parking lot looks like a Range Rover, BMW, and Tesla owner’s support group.
This is also a crowd that includes some of my children’s former classmates, parents, soccer coaches, and baseball coaches, all of whom know I am the guy who rolls up in large Toyota SUVs with 150,000 to 200,000 miles on them and considers that “nicely broken in.”
Advertisement
They noticed the Px8 S2. More than once. The Sennheiser HDB 630 drew less attention, which may be a positive depending on your personality, wardrobe, or tolerance for conversations before caffeine. But in terms of brand presence and visual appeal, the Bowers made the stronger impression.
The HDB 630 is more understated. It borrows from the MOMENTUM 4 & 5 platform but feels more substantial than most Sony or Bose competitors. The travel case is practical, the accessories are well organized, and the included USB-C cable, 3.5mm analog cable, airline adapter, and BTD 700 dongle make the package feel complete.
Winner: Bowers & Wilkins Px8 S2
Comfort & Fit
Sennheiser HDB 630
On paper, these two are almost identical in weight. The Px8 S2 weighs 310 grams. The HDB 630 weighs 311 grams. On the head, they feel different.
The Px8 S2 has a firmer clamp. That helps with passive isolation and keeps the headphones planted while walking, commuting, or pushing through public transit crowds with the usual mixture of resignation and mild rage. The padding is comfortable, and the slimmer frame makes the Px8 S2 easier to wear for long stretches than the original Px8.
Advertisement
The HDB 630 has a lighter clamp and softer Japanese Protein Leatherette ear cushions. It feels less locked-in than the Bowers models, which some listeners will prefer. The pads can get warm during longer sessions, especially on trains or in warmer spaces, but the overall comfort is strong.
If you want a firmer, more secure fit, the Px8 S2 is better. If you want a lighter clamp and less pressure, the HDB 630 makes more sense.
Advertisement. Scroll to continue reading.
Winner: Tie, depending on fit preference
Advertisement
Battery Life
Sennheiser HDB 630
This one is not close.
The Px8 S2 delivers roughly 28 to 30 hours in real-world use with ANC. That is perfectly respectable.A 15-minute quick charge adds about seven hours, which is useful if you forgot to charge them before a flight or a long NJ Transit day. With the World Cup landing at MetLife Stadium this weekend, seven hours may only get you through the first cheerful lie about how smoothly NJ Transit is handling the crowds.
The HDB 630 averaged roughly 53 to 54 hours in real-world use, with around 51 to 52 hours when ANC was engaged all the time at above-average listening levels. A 10-minute charge also delivers about seven hours of playback.
That is almost a full week of commuting from a single charge. Sennheiser wins this category before the Bowers even finishes lacing its shoes.
Winner: Sennheiser HDB 630
Advertisement
Connectivity & Hi-Res Support
Bowers & Wilkins Px8 S2
The Px8 S2 has the stronger native Bluetooth spec. It supports Bluetooth 5.3 with aptX Lossless, aptX Adaptive, aptX HD, aptX Classic, AAC, and SBC, along with multipoint connectivity. It also supports wired playback via USB-C and 3.5mm, and both cables are included in the case.
For Android users with compatible hardware, that gives the Bowers & Wilkins a very complete wireless toolkit. For Apple users, the usual aptX problem remains. iPhones, iPads, and Macs do not support aptX Adaptive or aptX Lossless natively, so the Px8 S2’s best Bluetooth performance still depends on using the right source device.
The HDB 630 is more limited on the headphone side. It supports Bluetooth 5.2 with SBC, AAC, aptX, aptX HD, and aptX Adaptive. It does not support LDAC, Bluetooth LE Audio, or aptX Lossless. That gives the Px8 S2 the clear advantage on the spec sheet.
Where Sennheiser fights back is with the included BTD 700 USB-C dongle. The dongle gives Android, iOS, Windows, and macOS users a more reliable path to aptX Adaptive or aptX HD from devices that might otherwise be limited to AAC or basic Bluetooth codec support. That matters because a lot of phones, tablets, and laptops still handle Bluetooth audio with all the grace of a vending machine rejecting a perfectly good dollar bill.
The important distinction is that the BTD 700 improves the source side of the chain, but the HDB 630 headphones are still limited to the codecs they can actually receive: SBC, AAC, aptX, aptX HD, and aptX Adaptive. So no, the HDB 630 does not magically become an aptX Lossless headphone because the dongle knows a few extra tricks.
Advertisement
Winner: Bowers & Wilkins Px8 S2 for native Bluetooth support.
Advertisement. Scroll to continue reading.
Real-world compatibility winner: Sennheiser HDB 630, because the included BTD 700 dongle makes aptX Adaptive and aptX HD easier to access across more source devices, including Apple hardware.
Controls & App Experience
The Px8 S2 has the better physical controls. Real buttons still matter. Volume, playback, power, and Quick Action controls are easy to use without poking blindly at the side of your head like you are trying to reboot a router in the dark.
The Bowers & Wilkins Music app is clean and simple. It gives you ANC controls, wear sensor adjustment, battery status, Quick Action customization, and a basic EQ. It works. It also does not give you much room to shape the sound.
Advertisement
The Sennheiser Smart Control Plus app is far more useful. Parametric EQ, crossfeed, bass boost, ANC customization, and on-head detection controls make it the better tool for listeners who actually want to tune the headphone.
The downside? Touch controls. They work, but they are not as satisfying or consistent as physical buttons. I will take buttons every time. I am old enough to remember when pressing something meant something happened.
The Px8 S2 provides better passive isolation and stronger ANC. Penn Station, airports, Rutt’s Hutt, Kosher Square Pizza, and Rook Coffee in Oakhurst are not exactly anechoic chambers with better parking. In all of them, the Bowers did a better job lowering the outside world.
The passive isolation is so strong that there were times when ANC felt less necessary. That is a good problem to have. The issue is that ANC and Transparency mode do affect the sound. Clarity, low-end definition, and soundstage depth can shift depending on the source and the mode.
Advertisement
The HDB 630’s Hybrid Adaptive ANC is effective, but not as strong as the Bowers & Wilkins. Voices and sharper environmental sounds remain more noticeable. Passive isolation is also not quite at the same level.
The upside is that Sennheiser’s ANC does less damage to the sound. It tightens the presentation slightly and can shave off a bit of openness, but it does not flatten the music or make everything feel like it was run through cheesecloth.
If isolation is the priority, buy the Bowers. If preserving the music matters more than muting the entire planet, Sennheiser has a stronger argument.
Winner for isolation: Bowers & Wilkins Px8 S2 Winner for sonic consistency with ANC engaged: Sennheiser HDB 630
Advertisement
Advertisement. Scroll to continue reading.
Sound Quality: Bass
The Px8 S2 has the stronger low end. Sub-bass and mid-bass hit with more authority, more speed, and more physical impact. These are not neutral headphones, and they do not need to apologize for that.
The important part is that the bass does not smear the midrange. The Px8 S2 adds weight and drive without turning everything into wireless sludge. Rock, pop, electronic music, and modern recordings benefit from that extra punch.
The HDB 630 is leaner. Bass is present, controlled, and well integrated, but it does not hit with the same force or definition as the Px8 S2. Bass heads will probably prefer the Bowers. That is not a character flaw. Some people like their low end with a chair and a name tag.
Advertisement
Sennheiser’s choice is different: less skull pressure, more clarity, more space, and better midrange detail.
The Sennheiser has the stronger midrange focus. Vocals are more present, instruments have more breathing room, and the presentation feels cleaner through the center of the mix. Acoustic music, jazz, piano, and vocal-driven recordings benefit from that approach.
Advertisement
The Px8 S2 is clear and detailed, but male vocals sit slightly farther back than the instruments. Sam Cooke’s “Lost and Lookin’” was clean and crisp, but some of the warmth and texture I expect from that recording were pulled back. Nick Cave’s “Into My Arms” had the full, heavy piano weight the track demands, but his voice lost some of the growl and chest-shaking presence that give the song its emotional gravity.
That does not make the Px8 S2 weak through the midrange. It just tells you where Bowers & Wilkins made its choices. Compared with the HDB 630’s more midrange-forward balance, the Px8 S2 puts more emphasis on bass impact, speed, detail, and top-end air than on vocal intimacy.
Female vocals can vary by recording. Amy Winehouse comes through with the attitude intact. Aretha Franklin sounded clearer than lush, with a touch less body than expected.
Winner: Sennheiser HDB 630
Advertisement
Sound Quality: Treble and Detail
The Px8 S2 has more top-end energy. In my review, I noted that its top end had more air and sparkle, giving the sound a greater sense of openness and a slightly brighter character. The important part is that it does not turn hard or fatiguing with poor recordings, and with better tracks, the extra bite and presence are obvious.
Advertisement. Scroll to continue reading.
Amy Winehouse’s “Valerie” is a useful example. That track can grate with the wrong gear, but the Px8 S2 kept the guitar notes sharp, her vocals clean and crisp, and never pushed things into hardness. Dolly Parton’s “Jolene” and “I Will Always Love You” also showed that the Bowers does not round off the top end or soften the edges just to make everything easier to digest.
The HDB 630 is smoother through the top end. On Gotye’s “Somebody That I Used to Know,” the Sennheiser stayed clean and controlled, with no splashy treble tantrums. On Amy Winehouse’s “Valerie,” it avoided turning a bright recording into dental work, which is always appreciated before lunch.
Advertisement
So the Px8 S2 sounds more vivid and energetic up top, while the HDB 630 sounds smoother and more controlled. If you want more bite, air, and sparkle, Bowers wins this round. If you want a calmer treble balance that still preserves detail and space, Sennheiser makes the better case.
Winner: Tie, depending on taste
Soundstage & Imaging
The HDB 630 is the more spacious headphone. For a closed-back wireless design, it creates an unusually open presentation with strong imaging and a real sense of air. No, it is not an open-back headphone. Let’s not start selling magic beans. But it gets closer than most wireless ANC models have any right to.
The Px8 S2 has a precise and stable soundstage. Width, depth, and height are solid, and instruments are placed accurately. It sounds organized and controlled, but not as expansive as the HDB 630.
Advertisement
The Bowers gives you solidity and impact. The Sennheiser gives you space and separation.
Winner: Sennheiser HDB 630
Which One Sounds Better?
The Px8 S2 sounds bigger, punchier, and more dynamic. It has stronger low-end authority, a livelier top end, better passive isolation, and a more premium feel. It is the headphone I would pick for travel, louder environments, rock, electronic music, pop, and situations where I want more physical engagement from a wireless headphone.
The HDB 630 sounds cleaner, more spacious, and more balanced through the midrange. It gives up some bass weight and luxury finish, but gains clarity, app flexibility, battery life, and a more open presentation. It is the headphone I would pick for long listening sessions, vocal music, jazz, acoustic recordings, and anyone who wants less lifestyle theater and more actual listening substance.
Advertisement
The Px8 S2 is more fun in the visceral sense. The HDB 630 is more honest in the musical sense. The Sennheiser is the better fit for the audiophile purist who puts neutrality, midrange clarity, and tonal discipline ahead of bass weight, luxury finish, and the understandable desire to look slightly more important at the coffee shop.
Which One Is the Better Value?
Sennheiser HDB 630 Wireless Headphones with Travel Case
The Sennheiser HDB 630 is the better value.
Advertisement. Scroll to continue reading.
At $499, it delivers excellent clarity, long battery life, a useful app, USB-C hi-res playback, aptX Adaptive, strong comfort, and the included BTD 700 dongle. That dongle is not just filler in the box. It solves a real problem for people using phones, tablets, and laptops that do not always support the best Bluetooth performance natively.
The Px8 S2 justifies some of its higher price through better materials, stronger isolation, more authoritative sound, physical controls, broader codec support, and a more luxurious design. It feels like a flagship.
Advertisement
But $799 is still $799. At that price, the Px8 S2 has to be judged as a luxury wireless headphone, not just a better-sounding alternative. It clears that bar in many ways, but not every listener needs what it does best.
Value winner: Sennheiser HDB 630Bowers & Wilkins Px8 S2 Wireless Headphones in Warm Stone and Black
The Bottom Line
The Px8 S2 is the more premium, more physical, and more visually distinctive headphone. It has stronger bass, better passive isolation, more effective ANC, physical controls, and the kind of build quality that makes the price easier to understand, if not exactly painless.
The HDB 630 is the smarter value play. It gives you better battery life, a more useful app, stronger tuning flexibility, a more spacious presentation, and a cleaner midrange balance for considerably less money.
Advertisement
Can the German David slay the British Goliath?
Not quite. But he lands enough clean shots that Bowers & Wilkins should keep both gloves up.
Which One Should You Buy?
Buy the Bowers & Wilkins Px8 S2 if you want the more premium, more visually distinctive, and more physically engaging headphone. It delivers stronger bass, better passive isolation, more effective ANC, physical controls, and a more energetic presentation. It is the better choice for travel, commuting, louder environments, and listeners who want their wireless headphones to feel like a flagship product.
Skip the Px8 S2 if you want the best value, the longest battery life, the most flexible app, or the most neutral midrange. It is also not ideal if you dislike a more bass-forward tuning or expect ANC and Transparency mode to leave the sound completely untouched.
Advertisement
Buy the Sennheiser HDB 630 if you care more about clarity, neutrality, midrange balance, battery life, app control, and practical hi-res support than luxury materials or coffee-shop visibility. It is the better choice for long listening sessions, vocal music, jazz, acoustic recordings, and listeners who want a more spacious presentation for considerably less money.
Skip the HDB 630 if you want maximum bass punch, the strongest ANC, the most luxurious build, physical controls, or aptX Lossless support built into the headphones themselves.
Advertisement. Scroll to continue reading.
The Px8 S2 wins on luxury, isolation, bass impact, and flagship presence. The HDB 630 wins on value, battery life, app control, midrange clarity, and everyday flexibility.
In a coordinated effort, the FBI, working with Google and Black Lotus Labs, has dismantled a massive Chinese phishing-as-a-service operation called Outsider Enterprise with thousands of phishing websites used to steal credit card data and passwords.
The cybercrime operation used AI and distributed phishing kits for campaigns impersonating various trusted brands in texts sent through AT&T, T-Mobile, and Verizon.
Outsider Enterprise has been active since at least 2023 and operated at a massive scale, with Google linking to it 9,000 fake websites and more than a million fraudulent URLs.
Authorities believe that phishing campaigns powered by Outsider Enterprise led to stealing more than 3.8 million credit card records, causing an estimated $1.9 billion in losses.
[subtitle]
Advertisement
The action against Outsider Enterprise has technical and legal components and is part of the FBI’s larger Operation Riptide that targets cybercrime activity and infrastructure.
During the technical takedown, the FBI and partners seized multiple administration servers, a Shopify e-commerce storefront, and an account the threat actor used to test the phishing service.
The agency also seized around $100,000 USDT from Outsider payment wallets. Thousands of phishing domains that the threat actor registered at U.S. providers are now redirecting to an FBI splash page.
FBI seizes site used by Outside Enterprise phishing-as-a-service source: FBI
The agency also took over a Telegram bot linked to Outsider Enterprise that contained information on customers of the phishing service.
According to Google, the AI-assisted phishing operation has impacted hundreds of thousands of users worldwide.
Advertisement
The tech giant has filed a civil lawsuit targeting the operation’s infrastructure, and is coordinating with telecommunications service providers AT&T, T-Mobile, and Verizon to block fraudulent messages before they reach to subscribers.
“Our civil lawsuit targets an organized cybercrime operation known as the ‘Outsider Enterprise’. Based in China and coordinating through Telegram, this network distributes “phishing kits” that allow criminals to blast out fake text campaigns that look like they’re from Google and other trusted brands,” Google says.
Over a two-week period in May, Google says that a total of 2.5 million SMS messages were sent to Android users from the Outsider Enterprise infrastructure. Android users flagged 55,000 of them as fraudulent.
The company estimates that hundreds of thousands of victims lost millions to these scams.
Advertisement
Google is using this opportunity “to combine aggressive legal action and collaboration with federal and state governments” and is advocating for seven bipartisan U.S. anti-scam bills, including the Stop SCAMS Act, to strengthen legal protections against AI-enabled fraud.
The Stop SCAMS Act would require the FBI to lead a coordinated national anti-scam strategy, bringing together federal agencies, law enforcement, and private companies to better track, disrupt, and prevent fraud and scam operations.
In the meantime, Google underlined that Android users are protected from these threats by AI-powered defenses.
Fable 5 topped GPT 5.5 on every major benchmark but was pulled by the US government after three days, making GPT 5.5 the top model you can actually use.
The result is a strange moment in AI. The model that demonstrably outperforms everything else on the market is the one you cannot use. GPT 5.5, which OpenAI launched in late April under the internal codename “Spud,” is now the strongest model available to developers and consumers, not because it improved but because its only real competitor was removed.
The benchmark gap between the two is not close. On SWE-Bench Pro, which measures a model’s ability to resolve real software engineering issues across open-source codebases, Fable 5 scored 80.3% to GPT 5.5’s 58.6%, a 22-point difference. On SWE-Bench Verified, a curated subset of the same benchmark, Fable 5 reached 95.0%.
The coding benchmarks tell a similar story. Fable 5 leads the Code Arena by 98 Elo points, scoring 1,665 to GPT 5.5’s 1,501. On FrontierCode Diamond, a benchmark designed to test the most difficult programming tasks, Fable 5 scored 29.3% while GPT 5.5 managed 5.7%, and on the broader Chatbot Arena leaderboard Fable 5 sits at number one with GPT 5.5 in fourth.
Advertisement
GPT 5.5 does have one area of strength. On Terminal-Bench 2.0, which evaluates interactive terminal-based coding tasks rather than codebase-level issue resolution, GPT 5.5 scored 82.7% compared to Fable 5’s approximately 88.0%. The gap is narrower there, and the benchmark tests a different skill, executing commands and debugging in real time rather than reading and patching large repositories.
Pricing also favours OpenAI. GPT 5.5 costs $5 per million input tokens and $30 per million output tokens, half the price of Fable 5’s $10 and $50 respectively. For developers running high-volume applications where the performance difference is less critical than cost, GPT 5.5 is the more practical choice even when both models are available.
Fable 5 launched on June 9 as Anthropic’s first Mythos-class model made available to the general public. It offered a one-million-token context window and 128,000 output tokens. Anthropic made it available at no extra cost to Pro, Max, Team, and Enterprise subscribers until June 22, a promotional window that the government directive cut short after just three days.
The shutdown came via an export control directive issued on June 12. The government cited a jailbreak vulnerability as the reason for pulling both Fable 5 and the broader Mythos 5 model family. Anthropic has disputed the severity of the finding, saying the vulnerabilities identified are minor, publicly known, and achievable by GPT 5.5 without any bypass techniques, while reports indicate that Amazon CEO Andy Jassy played a role in triggering the government’s review.
Advertisement
The practical consequence is that developers and researchers who were evaluating Fable 5 for production use have had to revert to GPT 5.5 or Anthropic’s earlier Opus models. For coding-heavy workflows, the downgrade is significant. The 22-point gap on SWE-Bench Pro represents the difference between a model that can resolve four out of five real-world software issues and one that handles roughly three out of five.
Whether Fable 5 returns depends on Anthropic’s negotiations with the government over the export control classification. The company has publicly argued that the directive is disproportionate and that the cited vulnerabilities do not justify pulling the model entirely. Until that dispute is resolved, GPT 5.5 holds the top spot by default, the best model available not because it is the best model that exists.
A little over a decade ago, schools were swept into what many described as a movement to prepare students for the future of work. That work was coding — “Hello, world!”
Districts introduced new courses, nonprofits expanded access to computer science education and a growing ecosystem of programs promised to teach students the skills needed to enter the tech workforce. For many, it felt like a necessary correction to a rapidly digitizing world. But over time, a more complicated picture emerged.
While access to computer science education expanded, the relationship between early coding exposure and long-term workforce outcomes became uneven. The “learn to code” movement raised an important question that still lingers today: Which skills actually endure when technologies change? That question has resurfaced in a new form.
Advertisement
Today, generative AI is driving a similar wave of urgency. Schools are once again being encouraged to adapt quickly, often with the same underlying rationale that teachers must prepare students for a future shaped by emerging technologies.
But if the instructional role of AI remains unclear, and if the tools themselves are likely to evolve rapidly, the more persistent challenge may lie elsewhere.
After conducting a two-year research project alongside teachers, who are adapting and are open to integrating AI, we found that uptake is still minimal. Most of our participants, including those who are engineering or computer science teachers, still struggle to identify a clear or universal instructional use case for widespread AI integration.
So, what should students learn to help them adapt to whatever comes next?
Advertisement
A growing body of research suggests that the answer may lie not in teaching students how to use a particular AI system, but in helping them understand the computational ideas that make those systems possible.
NEWSLETTERS
STAY AHEAD IN EDUCATION.
Sign up for EdSurge newsletters for timely news, insights and analysis.
The Limits of Teaching the Tool
In recent years, many discussions about AI education have centered on teaching students how to use generative tools effectively. Prompt engineering, for example, has become a common topic in professional development workshops and online tutorials.
Advertisement
Yet, focusing heavily on tool-specific skills can create a familiar educational problem, because technology changes faster than curricula.
Teaching students how to interact with a specific interface risks becoming the equivalent of teaching to standardized tests, rather than teaching students important lessons that don’t appear on state exams.
The history of computing education offers a useful example. In the early 2010s, a wave of coding initiatives encouraged schools to teach programming skills broadly. While many of those programs expanded access to computer science education, subsequent analysis showed that workforce pipelines in technology remained uneven, and many students learned tool-specific skills without developing deeper computational reasoning abilities.
That experience offers a cautionary lesson for the current AI moment. If the goal of integrating AI into education is long-term preparation for technological change, focusing narrowly on how to use today’s tools may not be the most durable strategy.
Computational thinking refers to a set of problem-solving practices used in computer science and other analytical disciplines. These include:
breaking complex problems into smaller components
recognizing patterns
designing step-by-step processes
evaluating the outputs of automated systems
These skills apply not only to programming but also to fields ranging from engineering to public policy.
Importantly, they also help students understand how algorithmic systems operate.
Advertisement
When students learn computational thinking, they gain the ability to analyze how technologies like AI produce results rather than simply accepting those results as authoritative.
In this sense, computational thinking provides a conceptual bridge between traditional academic skills and emerging digital systems.
What Teachers Are Already Doing
Many teachers in our study were already moving in this direction, often without using the term computational thinking.
When teachers asked students to analyze chatbot errors, they were encouraging students to examine how algorithmic systems produce outputs. When they designed exercises comparing training data and algorithms to everyday processes, they were helping students reason about how automated systems work.
Advertisement
These approaches do not require students to rely heavily on AI tools themselves. Instead, they position AI as a case study for examining how technology shapes information.
That framing aligns with longstanding educational goals around critical thinking, media literacy and problem-solving.
Implications for Educators
If the instructional use case for generative AI remains uncertain, educators may benefit from focusing on skills that remain valuable regardless of which tools dominate in the future.
Several practical approaches are already emerging in classrooms. Teachers can use AI systems as objects of analysis, asking students to evaluate outputs, identify errors and investigate how models generate responses.
Advertisement
Lessons can connect AI to broader topics such as data quality, algorithmic bias and information reliability.
Assignments that emphasize reasoning, structured problem solving and evidence evaluation continue to support the kinds of cognitive work that remain central to learning.
These approaches allow students to engage with AI without allowing the technology to replace the thinking process itself.
Implications for EdTech Developers
The experiences teachers described also highlight an opportunity for edtech companies.
Advertisement
Many current AI tools were developed as general-purpose language systems and later introduced into education contexts. As a result, teachers are often left to determine whether and how those tools align with classroom learning goals. Future products may benefit from deeper collaboration with educators during the design process.
Teachers in our conversations were already experimenting with small classroom applications, designing AI literacy lessons and building course-specific chatbots.
These experiments resemble early-stage product development.
Partnerships between educators, edtech developers and product managers could help identify instructional problems that AI systems could realistically address.
Advertisement
The Next Phase of the Research
The conversations described in this series represent an early attempt to document how teachers are navigating the arrival of generative AI.
As schools continue experimenting with these tools, the next challenge will be to develop governance frameworks that help educators evaluate when and how AI should be used in learning environments.
Our research team is beginning the next phase of this work by partnering with school districts to develop guidance for AI governance and inviting edtech companies interested in exploring these questions collaboratively.
Rather than assuming that AI will inevitably transform classrooms, this phase of the project will focus on identifying the conditions under which AI tools actually support teaching and learning and how to reduce harm when they don’t.
Until the answer becomes clearer, many teachers will likely continue doing what professionals in any field do when new technologies appear: experimenting cautiously, adopting what works and relying on their judgment to decide where or if the tool belongs.
If your school, district, organization, or edtech company is interested in learning more about joining our next project on AI governance, contact our research team at research@edsurge.com.
The pace represents a structural shift, not a spike. The total number and value of projects disrupted in Q1 roughly matched the full-year total for 2025, according to the report. The number of active anti-data center groups more than doubled from 396 at the end of 2025 to 833 by March, spread across 49 states, with Maryland, Ohio, and Texas hosting the most.
The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!
Legislative momentum is building alongside the grassroots resistance. Data Center Watch counted 14 statewide measures introduced in Q1 2026, and a separate analysis by MultiState identified moratorium bills across 11 states with proposed pauses ranging from three months to four years. More than 300 data-center-related bills were introduced in statehouses in just the first six weeks of the year.
None of the statewide moratoriums have passed yet, but they are getting close. Maine’s legislature passed one in April that would have paused permitting for facilities drawing 20 megawatts or more, the first of its kind in the country. Governor Janet Mills vetoed it but said she would have signed it if the bill had exempted a specific project in Jay, Maine that had strong local support, and she separately signed a law barring data centers from state tax incentives.
Advertisement
A Heatmap Pro poll found that a majority of Americans would “strongly” oppose a data center being built near their home, a shift from a survey nine months earlier that showed the public roughly evenly divided. Gallup data puts the figure at 70% opposed. The speed of the opinion shift suggests the issue is crossing from local planning disputes into broader political territory.
The industry is spending as though the opposition will not hold. US utilities plan to spend $1.4 trillion by 2030 on grid infrastructure driven largely by data centre demand, and hyperscaler capital expenditure is projected to exceed $690 billion in 2026 alone. The gap between what the industry wants to build and what communities are willing to accept is widening faster than either side expected.
In some cases, opposition is now mobilising before any project is officially filed. The mere rumour of a data center has been enough to trigger organised resistance, according to the report. That pre-emptive organising makes siting decisions harder even in states without formal moratoriums, because local permitting bodies face political pressure before a single application lands on their desk.
The Atlantic published a contrarian essay on Friday arguing that the backlash is overblown and that data centers can bring real economic benefits to host communities. The piece acknowledged that opposing data centers is good politics but argued it is not always good policy. Whether that argument gains traction will depend on whether the industry can demonstrate tangible local benefits beyond tax revenue, something most communities have not yet seen.
Advertisement
The report paints a picture of an industry that assumed it could build its way through local opposition with money and speed, and a country that is deciding otherwise, one zoning board at a time.
The multiview features on Apple TV 4K work similarly for all sports. However, because MLB baseball is a lot more limited in the number of games/streams available, the method of access is slightly different there. In general, you’ll need to select one stream you’ll want in the grouping and the multiview options will appear in the playback controls or in-stream menu. Selecting those will give you the ability to build your multiview from a menu of currently available games and shows. Once again, you’ll be able to watch up to four streams simultaneously — with the exception of baseball.
When you’re watching an MLB game, a multiview icon will appear on the player controls beside the options for subtitles, alternate audio feeds and picture-in-picture (PiP). Because Apple TV only broadcasts a maximum of two MLB games at once, there will only be three options to build a multiview feed: the two games and Apple’s MLB Big Inning studio show.
MLS fans have the ability to watch up to four games in multiview, or up to three games and Apple TV’s MLS 360 whiparound show. The studio show offers live look-ins at in-progress games, real-time analysis and ongoing discussions of all the day’s action. To set up your MLS multiview, start by watching any match. You’ll see the multiview icon in the playback controls where you can then browse the available live games and shows.
Formula 1 may be the most recent addition to the Apple TV sports lineup, but the racing series also has the most unique multiview options. Since Apple has partnered with F1, Apple TV subscribers get an F1 TV Premium subscription for this season. However, a lot of what’s included with that access is available in the Apple TV app — including the multiview selection. Once you pick your main feed, the multiview option shows up in the in-stream menu just below the main playback view. You can make it appear by swiping down on the Apple TV 4K remote.
Advertisement
In addition to the main race feed, you can create a multiview with a driver tracker, telemetry chart (live timing) and dedicated cameras for P1, P2 and P3. You can also choose from the driver’s onboard cameras for each car. The Apple TV app provides some pre-made multiview recipes, but you have the ability to create an entirely custom setup as you see fit. Lastly, Apple gives race fans the option of the Sky Sports feed with its commentary team if you prefer that coverage over the F1 TV crew that Apple TV’s main broadcast uses.
For all three sports, you can choose to highlight each of the streams in multiview by swiping over from box to box. Doing so pipes in the audio from that stream although the video from the others will always be visible so long as multiview is active. If you want to watch one of the feeds in your multiview on its own, simply click to select it.
In addition to multiview, the Apple TV 4K also supports picture-in-picture (PiP). This allows you to keep a game or race minimized in the corner of your screen while you browse other apps and menus on the streaming box. The PiP option is also available in the playback controls once you’ve selected a game, race or show. And unlike multiview, the feature works with anything you’re watching — even workouts in the Fitness app.
Almond Robotics launched Axol this week as a dual-arm robot built specifically for teams developing physical AI systems that must function in factories, warehouses, kitchens, and other unpredictable settings. The company spent the past year putting existing robots through real shifts in grocery stores and production lines. Those machines repeatedly hit limits that slowed progress or caused outright failures.
When attempting to insert its hand inside bins or equipment, reach usually fails. Payloads led the motors to overheat for extended periods of time, and the exposed cables were repeatedly bent until they broke. Singularities would regularly intervene, requiring the robot to slam on the brakes or perform more maneuvers to get back to a safe position. Even more frustrating, it would take forever to collect clean, labeled demo data because the robot couldn’t seem to approach the task in the same manner that a human operator would. Axol grew out of those hard lessons. Almond designed everything with long-term, contact-rich work in mind, and he devised a technique to accelerate data collection for training in the event that a human operator was absent.
Each arm has seven degrees of flexibility and extends 860 millimeters from shoulder to fingertip, providing a robot with substantially more workspace than identical research arms without the need to reposition the base every five seconds. The wrist joints alone can perform full 180 degrees of pitch and yaw, giving the robot plenty of flexibility and reducing any annoying singularities that would normally limit the usable workspace on other platforms, all of which adds up to smoother trajectories when the robot is attempting to reach for something complex.
Payload peaks at 6.5 kilograms, and in typical operation, the actuators can support a steady four kilogram weight without ever throttling back owing to heat. That level of sustained capacity is essential for tasks that include frequent lifting, pressing, or tool use. All of the cables inside the item are routed internally, so there is no risk of them catching on anything or wearing out due to frequent movement. Two FAKRA GMSL 2.0 connections are neatly positioned at each wrist, ready to be connected to high-speed stereo cameras that deliver low-latency vision where it counts: precision grabbing and insertion.
Standard grippers include two fingers and interchangeable tips, and because the technology is modular, teams can easily swap in custom end effectors as projects progress without having to start over. The control loops operate at a constant 500 Hz, which is necessary for responsive, fine-grained movements, especially when dealing with delicate touch operations.
Axol delivers the robot directly from Almond’s workshop in San Francisco’s Dogpatch district, which is advantageous for a number of reasons, including faster part availability and on-site maintenance options for Bay Area deployments. Just as important, the software stack is given equal attention. The full solution is accessible as an open source Python SDK, which includes low-level CAN motor control, bimanual inverse kinematics, ZED camera streaming, and LeRobot connectivity, as well as a WebXR teleoperation pipeline for any compatible headset. The system records everything, including synchronized joint positions, camera frames, and actions, in policy-training-ready formats.
Since Almond is addressing startups and research groups, pricing is modest, hence the standalone Axol is listed at $7,999 during the launch window. The set includes a height-adjustable mobile platform, three ZED X One S cameras, an NVIDIA Orin NX 16 GB computer unit, and all necessary cables for $11,999, which includes shipping. Both options are available currently. [Source]
Germany’s reputation as tournament specialists has taken a battering in the past decade, with the four-time World Cup winners suffering group-stage exits in 2018 and 2022.
However, Die Mannschaft are ready to resume normal service at the FIFA World Cup 2026, led by exciting young playmakers Jamal Musiala and Florian Wirtz, and the familiar figure of 40-year-old Manuel Neuer in goal. They are unsurprisingly strong favourites in their Group E opener against tournament debutants Curacao in Houston, where a heavy victory would all-but guarantee a place in the last 32 and avoid the humiliation of falling at the first hurdle for the third successive World Cup.
Curacao have already made history just by qualifying for the tournament. The Caribbean island will be the smallest nation ever represented at a World Cup with a population of only 156,000 – to put that into perspective, that is more than two-and-a-half times smaller than Iceland, the previous country to hold that record. Experienced Dutch manager Dick Advocaat will ensure his team are as compact and hard to break down as possible, but they could hardly have asked for a more difficult opening match and the principal aim will be to avoid a thrashing.
Advertisement
So, read on as we show you exactly how to watch Germany vs Curacao for free from anywhere in the FIFA World Cup 2026.
How to watch Germany vs Curacao for free
Germany vs Curacao is available to watch for free in multiple countries, including the UK, Australia, Brazil, Belgium, Ireland, Netherlands, Switzerland and Turkey.
Abroad? Can’t access your free stream? Unblock your free World Cup stream with Norton VPN — more on that below.
Advertisement
Use a VPN to watch Germany vs Curacao live streams
It’s the World Cup, and if you’re traveling, you might discover your usual Germany vs Curacao stream is suddenly unavailable due to geo-restrictions.
Don’t worry, that’s exactly where a VPN can help. A virtual private network lets you connect to servers around the world so you can securely access your usual World Cup coverage as if you were back home.
Those looking for a streaming service instead can watch Germany vs Curacao on Fox One (3-day free trial).
Advertisement
Visiting the US from the UK? You can still watch your World Cup stream for free thanks to Norton VPN (try for 60 days).
How to watch Germany vs Curacao in the UK
UK customers are in luck as they can stream Germany vs Curacao for free on ITV. Live coverage is on ITV1 and ITVX.
You require a TV license and a valid UK postcode for an account (e.g. SE1 7PB).
Advertisement
Norton VPN can unlock your stream if you’re abroad today.
How to watch Germany vs Curacao in Australia
(Image credit: free)
Germany vs Curacao will be shown for free in Australia on SBS On Demand.
The streaming platform has every game of the tournament for free, making it the perfect place for your World Cup viewing.
Advertisement
Traveling for work or on holiday? A VPN like Norton VPN can help unlock your free stream.
How to watch Germany vs Curacao in Canada
(Image credit: Other)
In Canada, TSN and free-to-air channel CTV will be broadcasting Germany vs Curacao.
You can live stream via the TSN+ streaming platform, which costs CA$8 per month or CA$80 per year.
Advertisement
CTV will require your TV provider login details, but is also available via streaming platform Crave if you want an alternative.
Outside of Canada? Use Norton VPN whilst you’re traveling away from home to unlock your stream.
Germany vs Curacao: Match Information
What time does Germany vs Curacao start?
Germany vs Curacao kicks-off at 6pm BST / 1pm ET on Sunday, June 14. That’s 3am AEST on Monday, June 15 in Australia.
Advertisement
What are the squads for Germany vs Curacao?
Germany
Goalkeepers: Oliver Baumann (Hoffenheim), Manuel Neuer (Bayern Munich), Alexander Nubel (Stuttgart).
Defenders: Waldemar Anton (Borussia Dortmund), Nathaniel Brown (Eintracht Frankfurt), Joshua Kimmich (Bayern Munich), David Raum (RB Leipzig), Antonio Rudiger (Real Madrid), Nico Schlotterbeck (Borussia Dortmund), Jonathan Tah (Bayern Munich), Malick Thiaw (Newcastle United).
Midfielders: Nadiem Amiri (Mainz), Leon Goretzka (Bayern Munich), Pascal Gross (Brighton and Hove Albion), Jamie Leweling (Stuttgart), Jamal Musiala (Bayern Munich), Felix Nmecha (Borussia Dortmund), Aleksandar Pavlovic (Bayern Munich), Angelo Stiller (Stuttgart), Florian Wirtz (Liverpool).
Advertisement
Forwards: Maximilian Beier (Borussia Dortmund), Kai Havertz (Arsenal), Lennart Karl (Bayern Munich), Leroy Sane (Galatasaray), Deniz Undav (Stuttgart), Nick Woltemade (Newcastle United).
Of course, most broadcasters have streaming services that you can access through mobile apps or via your phone’s browser.
You can also stay up-to-date with all of the key World Cup moments on the official social media channels on X/Twitter (@FIFAWorldCup), Instagram (@FIFAWorldCup), TikTok (@FIFAWorldCup) and YouTube (@FIFA).
Advertisement
We test and review VPN services in the context of legal recreational uses. For example: 1. Accessing a service from another country (subject to the terms and conditions of that service). 2. Protecting your online security and strengthening your online privacy when abroad. We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.
Chinese hackers took control of a target organization’s authentication stack and maintained persistence for 10 years, with full visibility into the administrative activity.
Dubbed “Operation Highland,” the intrusion is attributed to the Velvet Ant cyberespionage threat group, which targeted vulnerable internet-facing systems before pivoting to a network with no direct external path.
Chinese hackers of the “Velvet Ant” activity cluster breached the isolated critical infrastructure network of a large organization and conducted cyber-espionage operations for 10 years.
The campaign, dubbed “Operation Highland” by Sygnia researchers who discovered it, began in 2016, targeting vulnerable internet-facing systems before pivoting to an “air-gapped” environment with no direct internet connection.
Velvet Ant’s lengthy espionage operations were documented in 2024, when Sygnia warned of a campaign targeting F5 BIG-IP devices that operated undetected for three years.
Advertisement
Also in 2024, Cisco warned of a zero-day in NX-OS running on Nexus switches, which was exploited by Velvet Ant to gain access to targets.
Velvet Ant attack chain
The attack begins with the compromise of internet-facing servers, though the researchers don’t mention the specific product or any vulnerability used.
Velvet Ant deployed a modified GS-Netcat reverse shell disguised as a legitimate system component that connected to a hardcoded relay domain, providing encrypted remote shell access.
The shell achieved persistence either via a malicious systemd service or through startup script modification.
Advertisement
Dissasembler showing the use of GS-Netcat Source: Sygnia
Next, Velvet Ant installed a custom SOCKS5 proxy for network traffic tunneling, enabling it to reach internal systems that are not directly accessible from the internet.
The proxy ran as a daemon masquerading as ‘smbd -D,’ using different filenames and ports on each host, and turning compromised servers into internal pivot points.
SOCKS5 proxy script Source: Sygnia
The most interesting part of the attack was building a remote execution path into the isolated network.
To achieve this, Velvet Ant modified the configuration of a compromised internet-facing Nginx server to proxy specially crafted requests to a compromised backend server.
The backend server’s Nginx configuration was also altered to forward requests to a FastCGI process (fcgiwrap) listening on a separate port.
The FastCGI wrapper acted as an execution bridge, processing requests and launching a custom binary named ‘uptime.’
Advertisement
The tool established SSH connections to systems within the isolated critical infrastructure network using parameters supplied in HTTP POST requests.
“By chaining these modifications, Velvet Ant established a remote-execution path into the segregated environment via simple HTTP requests, with no direct connection to the critical infrastructure network ever required.” – Sygnia
Having established their access into the isolated environment, Velvet Ant shifted focus to long-term persistence and credential theft by targeting Linux Pluggable Authentication Modules (PAM), a set of libraries that let administrators set up methods to authenticate users.
The attackers replaced legitimate ‘pam_unix.so’ modules with backdoored versions that accept hardcoded passwords and harvest user credentials.
Advertisement
Sygnia identified nine distinct variants of the malicious PAM module, each compiled in a separate build environment, indicating a well-resourced threat actor.
The researchers say that two of the malicious PAM modules stand out for acting as a backdoor only and for collecting credentials.
Velvet Ant actors also replaced OpenSSH components such as ssh, sshd, and scp with trojanized versions that captured credentials, logged commands entered during SSH sessions, and stored the collected data locally for future retrieval.
Sygnia says that by extending control to the authentication process by modifying the PAM and OpenSSH components, the threat actor had access to credentials as they were used in the target environment and could bypass the authentication flow.
Advertisement
“Administrative activity became fully observable: every login; every command executed across compromised hosts. Access was no longer tied to a specific foothold but embedded into the authentication process itself,” the researchers explain.
This way, the hackers ensured their persistence despite password changes and session terminations, and reduced “the effectiveness of conventional containment measures.”
Complex cleanup
Sygnia says even after discovering the compromise, remediating it and removing Velvet Ant from the compromised environment was particularly complicated.
The threat actors had replaced so many critical components with custom versions that removing them was likely to break authentication, lock legitimate administrators out, and cause operational outages.
Advertisement
To tackle this problem, the researchers built a testing lab to validate the binary replacement process, profiled each host, tested the results, and prepared rollback procedures before attempting the cleanup.
Sygnia recommends that defenders treat authentication components such as PAM, OpenSSH, and Windows LSASS as critical security assets and protect them with EDR, file integrity monitoring, hardened privileged access, multi-factor authentication (MFA), and continuous monitoring for unauthorized modifications.
Organizations should plan for offline recovery, which includes strict backups with an adequate schedule for automatically creating snapshots with immutable copies.
The restoration process should consider testing the backups and recovery hosts running operating systems that have been validated, along with the recovery scripts.
Advertisement
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
You must be logged in to post a comment Login