In today’s cybersecurity news…
Video game platform hit by supply chain attack
Researchers at ESET documented a campaign by the North Korea-aligned threat group ScarCruft to install a backdoor on targeted Windows and Android devices. This targeted the gaming platform sqgame[.]net, popular among ethnic Koreans living in China’s Yanbian region, which borders Russia and North Korea. Since late 2024, the gaming platform has distributed trojanized components for Windows and Android games to install the BirdCall backdoor. Malicious Android apps are still being distributed by the platform as of this recording. ScarCruft has a history of targeting North Korean defectors and human rights activists.
Bleeding Llama could expose your data
Researchers at Cyera disclosed a heap out-of-bounds read issue in Ollama, the popular open source project for running local LLMs. This bug impacts Ollama’s GGUF model loader, and a maliciously crafted GGUF file could open the door to memory access that could leak API keys and tokens. This is exfiltrated with Ollama’s built-in model push feature. The entire attack chain requires three unauthenticated API calls and is possible because by default Ollama launches without authentication and listens to all network interfaces. The vulnerability was patched in version 0.17.1.
US gets more early LLM access
The US Commerce Department’s Center for AI Standards and Innovation announced it reached deals with Google, Microsoft, and xAI to give the US government early access to upcoming models to test and improve security on critical systems. This matches similar deals that have been in place with Anthropic and OpenAI since 2024. The government center has tested over 40 models so far. This comes as sources for both the Wall Street Journal and the New York Times report that the Trump administration is considering an executive order that would create a program for the government to review new AI tools.
Australia launches cyber review board
The Australian government announced the formation of the Cyber Incident Review Board, which will independently review major cyberattacks in the country. These will be no-fault reviews that focus on systemic lessons to apply to industry, rather than the culpability of individual organizations. Telstra CISO Narelle Devine will chair the group. This board is modeled after the now-defunct US Cyber Safety Review Board, established by the Biden administration in 2022 and disbanded by the Trump administration.
Huge thanks to our sponsor, Vanta
UK sees a jump in romance scams
The Report Fraud unit of the City of London Police reports that romance scam reports increased 29% in 2025 to 10,784. These resulted in £102 million in losses, with an average of £9,500 lost per scam, although some scams reached into the millions. Almost half of all losses came from people aged 55-74, with men reporting more scams but women suffering larger average losses. These scams follow the familiar playbook of using fake profiles on social media to build a relationship with a victim, before requesting money for a variety of purported emergencies. Romance scams accounted for just 3% of overall fraud losses in the UK. Romance scams account for a much larger share of cyber losses in the US, with almost $1 billion paid out in 2025.
Threat actors find a way to make compliance worse
The Microsoft Defender Research team discovered a phishing campaign using fake compliance-related communications as lures. The campaign ran in mid-April, targeting 35,000 users across thousands of organizations, primarily in the US. The emails used slick, enterprise-style HTML templates to enhance authenticity. Subject lines used time-sensitive lures, often citing “conduct policy” reviews and urging recipients to open attachments to “Review Case Materials.” The messages also included green Paubox encryption banners and showed Cloudflare CAPTCHA when clicking through malicious links. Ultimately, these led to phishing pages trying to harvest Microsoft and Google credentials.
Proto Mail adds PQC
The privacy-forward company announced that it has rolled out support for post-quantum encryption across its email platform, including for users on free plans. This will deploy as a complement to its existing RSA and ECC encryption. Users must opt-in to PQC by using new encryption keys, using the latest Proton apps, and do not support PQC on end-to-end encrypted forwarding yet. Proton Mail also announced compatibility with OpenPGP v6 and said it’s collaborating with the wider open email ecosystem to ensure quantum-safe mail can operate across all providers.
The AI “Transformation Paradox”
Microsoft released its 2026 Work Trend Index report. One of the top-level findings is that 65% of workers fear falling behind if they don’t adapt to AI, but at the same time, 45% of workers feel safer focusing on current workflows than redesigning them for AI. Only 26% of respondents said their leadership is consistently aligned on AI, opening the door to potential Shadow AI proliferation. 16% of respondents were identified as “Frontier Professionals,” those who use multi-agent systems to rethink workflows. The biggest use case for AI was analysis and reasoning, used in 49% of chats. Interaction accounted for 19%, producing work 17%, and gathering information 15%.
Cyberattack halts high-speed rail
Taiwanese authorities arrested a 23-year-old student for interfering with the TETRA communications system used by the country’s high-speed rail network. The suspect allegedly used a software-defined radio to send a “General Alarm” signal that triggered emergency braking on nearby trains. This resulted in four trains being halted for 48 minutes on April 5th. Local reports say that the TETRA radio system has not had any parameters of its verification system rotated since it was deployed 19 years ago. It’s also possible the transmissions weren’t encrypted at all, or used TEA1 encryption, which has had a known backdoor since at least 2023. The suspect faces up to 10 years in prison.