• Kaspersky uncovers GoSerpent, a long‑running campaign on Southeast Asian government systems using a backdoor, RAT (Stowaway), and exfiltration tool (TmcLoader)
• Attackers showed extreme patience, waiting weeks before deploying secondary tools to evade detection and outlast log retention policies
• Attribution remains uncertain, but overlaps with past TetrisPhantom operations; defenders are urged to review shared IoCs to detect compromise

Security researchers Kaspersky discovered a five-year-old piece of malware that’s been hiding on government computers in the Southeast Asian region, harvesting secrets and other actionable intelligence.

The company analyzed a campaign called GoSerpent, which comprises of a backdoor of the same name, a Remote Access Trojan (RAT) called Stowaway, and a two-stage data exfiltration tool called TmcLoader.

Apple’s lawsuit against OpenAI is full of astonishing accusations and details, with Apple alleging it uncovered a pattern of theft of Apple’s trade secrets. Apple’s complaint mostly points the finger at a few ex-Apple employees that now work at OpenAI, the maker of ChatGPT.

OpenAI has faced quite a number of lawsuits lately on how it does business, but Apple’s suit brings a different twist. If this case goes to trial, it could reveal the secret hardware that OpenAI has long teased. A trial could seek damages if Apple’s work is being used to help develop some sort of rival AI device. Would a lawsuit spill the beans on a device — or several devices — before OpenAI is ready to launch?

Advertisement

Watch this: Apple vs. OpenAI: These Lawsuit Details Are Wild

05:58

This week’s episode of One More Thing, embedded above, goes into the juicy details of the suit and what happens next. OpenAI CEO Sam Altman says he’s not afraid of Apple, but maybe he should be. Taking rivals to court is part of the Apple playbook, and the company knows how to do it well. 

The fight could also drag in a few famous Apple faces. Apple’s former design chief, Jony Ive, is now working on making AI gadgets for OpenAI. That means Apple lawyers might call to the stand the former designer of the iPhone, to see if he used information stolen from Apple. (Awkwaaard.)

For more One More Thing, subscribe to our YouTube page to catch Bridget Carey breaking down the latest Apple news and issues every Friday.

• The US Treasury sanctioned First VPN Service for aiding ransomware gangs
• Complying with the sanctions, the .ME registry wrongly suspended Telegram’s entire t.me domain
• The domain was restored roughly 19 hours later after Telegram CEO Pavel Durov flagged the issue online

If you clicked a Telegram link on Monday and stared at a blank screen, you weren’t alone. Every shortlink starting with ‘t.me’ suddenly vanished from the global internet, breaking group invites, profile shares, and channel links for roughly a billion users worldwide.

But the outage wasn’t caused by a technical glitch or a targeted cyberattack. Instead, it was the unintended collateral damage of a US government crackdown on a cybercriminal proxy network.

What just happened? European Union regulators are forcing Google to change how Android handles artificial intelligence, ordering the company to open up the operating system and its search data to competing AI services. Under a binding decision announced on Thursday, Google must grant rival AI assistants the same system-level access that its Gemini assistant enjoys on Android phones in the bloc. The move is intended to prevent Google from using Android’s vast reach to tilt the fast-growing AI market in its favor and to ensure that competing services have a fair opportunity to reach users.

The stakes are high. Android powers about 60% of smartphones in the European Union, and AI companies see those devices as the primary gateway for turning chatbots into everyday assistants. The deeper a service is integrated into a device – reading the screen, handling messages, and interacting with other apps – the more useful it becomes. That is precisely the layer of control EU officials are now trying to open up.

Regulators said Google will have to place rival AI services on “equal footing” with Gemini. That includes access to voice commands, system search, and the ability to perform actions in other apps, such as ordering a ride, replying to a text message, or pulling up information about a place a user recently visited. The changes must be implemented by next July.

The order also extends beyond the operating system. By January, Google will have to begin sharing anonymized search data with competing services, including developers of AI chatbots. The goal is to give those rivals access to more of the behavioral signals that help improve search and assistant products without exposing individual users.

Google has not said whether it will challenge the ruling in court. Instead, the company has warned that the EU’s demands could create new risks.

“Today’s decisions risk undermining vital privacy and security safeguards for millions of Europeans,” Kent Walker, Google’s general counsel, said in a statement. Google argues that allowing third-party developers to access sensitive data stored on a person’s smartphone or in their search history could weaken the protections built into its products.

European officials see it differently. The bloc has long taken a tough stance toward large technology platforms, and it views artificial intelligence as the next gateway to digital services. In their view, allowing a handful of companies to control the main AI assistants built into phones, browsers, and operating systems would entrench those players and shut out competitors.

The legal basis for the ruling is the Digital Markets Act, a competition law that applies to gatekeeper companies such as Google and Apple. The DMA requires them to make their products interoperable so that outside developers can offer competing AI assistants alongside – or instead of – built-in options such as Google’s Gemini and Apple’s Siri.

That requirement is already causing friction. In June, Apple said it would withhold new AI features for Siri in the European Union because it could not reach an agreement with regulators. As a result, iPhone users in the bloc will not receive the same Siri upgrades that Apple plans to roll out elsewhere, at least for now.

At the same time, some AI companies are trying to sidestep the mobile platform issue entirely by developing their own hardware. Last year, OpenAI hired Jony Ive, Apple’s former chief designer, to lead work on new AI-centric devices. The goal is to create products in which an AI assistant serves as the primary interface, rather than one that operates within another company’s operating system.

That partnership is now under strain. Last week, Apple sued OpenAI, accusing the company of stealing trade secrets. OpenAI has denied the allegations.

A newly discovered strain of macOS malware is taking social engineering to an unsettling new level. Instead of exploiting a software vulnerability or silently stealing information in the background, it simply refuses to let you use your Mac until you type in your login password.

Dubbed ClickLock, the malware repeatedly shuts down key macOS processes, disables notifications, displays convincing Apple password prompts, and effectively traps users in a loop that only ends when the correct password is entered. Once that happens, it doesn’t just steal the password. It goes after browser data, cryptocurrency wallets, saved credentials, password managers, and much more.

A BleepingComputer reports states researchers at Group-IB say the malware has already infected at least 100 systems across 33 countries since May. Even more worrying, when it was first uploaded to VirusTotal in June, none of the security engines on the platform flagged it as malicious.

ClickLock doesn’t hack your Mac. It hacks you.

Unlike many modern malware campaigns that rely on zero-day exploits or privilege escalation vulnerabilities, ClickLock succeeds through psychological pressure. The infection is believed to begin with a ClickFix-style attack, where users are tricked into copying and pasting a command into Terminal under the guise of completing a Cloudflare “human verification” check. While a fake verification progress bar keeps the victim distracted, the malware quietly downloads its payloads in the background.

At the same time, it disables keyboard interrupts, hides the Terminal cursor, and suppresses macOS Notification Center alerts for nearly six hours, making it much harder for victims to realise something suspicious is happening.

The malware’s most disturbing feature comes next. It displays what appears to be a legitimate macOS password dialog complete with the user’s real account name and Apple branding. If the victim enters the correct system password, ClickLock immediately validates it and sends the credentials to the attackers through Telegram.

If the user refuses, the malware doesn’t give up. Instead, it installs persistence mechanisms that reactivate after the next login. Once triggered, ClickLock begins killing critical macOS processes every 210 milliseconds, including Finder, Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight, and even popular web browsers.

The result is a Mac that appears almost completely unusable, leaving only the password prompt visible on screen. According to Group-IB, this loop can continue for more than 83 hours, or until the victim finally gives in.

It wants far more than your password

The login password is only the beginning. ClickLock also attempts to trick victims into approving a genuine Keychain access prompt that grants permission to Chrome’s Safe Storage key. That key can later be used to decrypt stored passwords, cookies, and autofill information from Chromium-based browsers.

The malware’s data-stealing module casts an exceptionally wide net. It targets browser profiles from Chrome, Firefox, Brave, Microsoft Edge, Opera, Vivaldi, Arc and Chromium, harvesting saved passwords, cookies, bookmarks, browsing sessions, local storage and autofill information.

Cryptocurrency users face an even greater risk. ClickLock searches for browser wallet extensions, desktop wallet files, encrypted wallet vaults and cached wallet addresses across major blockchain ecosystems including Bitcoin, Ethereum-compatible chains, Solana, TRON, TON and Stacks.

It also collects FileZilla FTP configurations, shell history, basic system information and public IP addresses before compressing everything into ZIP archives and uploading the stolen data through the Telegram Bot API. To ensure attackers maintain long-term access, ClickLock deploys a modified version of the open-source GSocket tool, creating a persistent backdoor capable of remotely controlling the infected Mac. Unlike the malware’s other components, which delete themselves after execution to minimise forensic evidence, this backdoor remains active on the system.

The stealth techniques don’t end there. Researchers say the malware is hosted on compromised but otherwise legitimate websites, helping it evade reputation-based security systems. Its payloads also remove themselves after execution, leaving very few traces behind. Despite that, Group-IB says defenders can still spot suspicious behaviour by watching for repeated password dialog boxes generated through osascript, continuous termination of macOS processes, mass access to browser profile folders and unusual outbound connections to Telegram.

The biggest takeaway, however, is surprisingly simple. If a website ever asks you to open Terminal and paste a command to prove you’re human, close the page immediately. No legitimate website, including Cloudflare, requires Terminal access for human verification. And if your Mac suddenly becomes unusable while repeatedly demanding your system password, resist the urge to comply. Instead, force a shutdown using the power button, restart in Safe Mode, and investigate the system before entering any credentials. In ClickLock’s case, your password isn’t solving the problem. It’s exactly what the attackers are waiting for.

SAAS

Retirement of PowerShell -Credential parameter pushed back to the end of 2026

Microsoft has delayed the removal of the -Credential parameter from Exchange Online PowerShell until December 2026, giving administrators more time to update affected scripts and automation.

The -Credential parameter is used when connecting to Exchange Online PowerShell. It allows an administrator to supply stored username and password credentials. These days, it is heavily discouraged, particularly when more secure authentication methods are available.

Microsoft had designated the parameter for removal in July 2026 as part of its move away from password-based authentication. The trouble is tracking down automation scripts that use it, updating them, and validating the changes – assuming a fix is even possible.

Once the parameter is gone from the Connect-ExchangeOnline and Connect-IppsSession cmdlets in the Exchange Online PowerShell module, any scripts still relying on it will break, potentially taking carefully built workflows down with them.

However, Microsoft has opted to push back the retirement beginning December 2026 – a festive gift for administrators.

The company stated: “If your organization uses the -Credential parameter in PowerShell scripts or automation workflows connecting to Exchange Online or Security & Compliance PowerShell, those scripts will break when you update to an Exchange Online PowerShell module version released beginning December 2026.”

As such, the retirement won’t take effect until an update is performed. The server-side retirement of the underlying authentication flow is planned “for a later date.”

“When that occurs, the -Credential parameter will stop functioning even on older module versions.”

Microsoft said it delayed the retirement due to “customer feedback,” although it came late in the day. That said, a few extra months will be welcomed by affected administrators dealing with the impact of the change.

And the change is still coming. Microsoft added: “While our published timeline extends to the start of December 2026, we strongly recommend that all customers transition away from the -Credential parameter as soon as possible and not wait until the deadline.” ®

Anyone hoping Apple would refresh its entry-level iPad or iPad Air before the end of next year may need to be patient.

According to Bloomberg, Apple is planning a rollout that begins with a new iPad mini in October 2026. This will be followed by a refreshed entry-level iPad in the first quarter of 2027. Updated iPad Air models are then expected to follow in spring 2027.

The base iPad appears to be getting the most meaningful upgrade of the bunch. While it will not receive a redesign or an OLED display, the report claims it will move from the current A16 chip to an A19 processor. This change would bring support for Apple Intelligence. As a result, it would become the last iPad in Apple’s lineup to gain access to the company’s AI features.

The MSI Claw A8 was the first handheld to run AMD’s Ryzen Z2 Extreme chip, and now it’s £150 cheaper too.

The MSI Claw A8 is currently listed at Currys for £749, down from £899, a £150 saving that brings AMD’s most powerful handheld chip within reach of buyers who baulked at its original price tag when it launched.