AI chatbots beat human scammers at building trust, hotel Wi-Fi hands out fake updates, and a wallet flaw drains $88 million
AI chatbots are better than people at earning a scam victim's trust
Researchers at four universities — Amrita Vishwa Vidyapeetham in India, Ca' Foscari University of Venice, the University of Melbourne, and Ben-Gurion University of the Negev — ran AI chatbots and human scammers side by side through the long trust-building phase of a romance-and-investment scam, the kind that starts with friendly texting and ends with a fake crypto app. Over seven days on WhatsApp, 22 participants each talked with one human and one AI without being told which was which. The AI scored significantly higher on trust, and when the ask finally came on day seven, 46% installed the app for the AI against 18% for the human. The same team ran 250 romance-baiting conversations past the content safety filters OpenAI, Google and Meta offer developers: depending on the filter, they caught between none and 18.8% of them, and everything they did flag was a false alarm. 9to5Mac has a plain-language write-up. Why it matters: the slow, patient, attentive stranger has been the expensive part of these scams, and this research says software now does it better than a person. Expect the volume to go up. The defense does not change with the technology: nobody you have only ever met through a screen should be directing you to install an app, open an investment account, or move money — however long you have been talking and however warm it feels. Today's action: if you have an online-only relationship in your life right now, ask for a live video call, and treat a refusal, or a face that does not quite match the conversation, as the answer.
Hotel Wi-Fi login pages are being hijacked to serve fake software updates
Microsoft has documented an operation it calls CaptiveCrunch that compromises the captive portal gateways in hotels — the sign-in page your device loads when you join the Wi-Fi — and takes control of the network's DNS. When your laptop or phone runs its routine connectivity check, the gateway redirects it to a page offering an urgent browser or operating-system update. Some versions instead walk the guest through opening a terminal window and pasting in a command, with a fake progress bar running while the real payload installs. According to The Hacker News, one of the tools collects screenshots, audio, keystrokes, clipboard contents and saved browser passwords, and another harvests Microsoft 365 and Azure sign-in tokens. Microsoft attributes the activity to a group Western governments link to Russian intelligence and says it has been running across hotel networks in several countries since early May. The gateway itself does not infect anything — the guest has to accept the download and run it. Why it matters: this turns the single most reflexive click in travel into the whole attack, and it is aimed at hotels, which means business travelers and conference attendees. The rule to adopt: no software update ever gets installed from a page that appeared right after you joined a Wi-Fi network, and no one legitimate will ever ask you to paste a command into a terminal to get online. Update your devices before you leave home, do it only from the operating system's own settings screen on a network you trust, and run a full-tunnel VPN on hotel Wi-Fi if your work provides one.
A flaw in COLDCARD wallets is linked to an $88.6 million Bitcoin theft
COLDCARD hardware wallets generate the secret seed that controls your Bitcoin. Analysis published by Block found that affected firmware used a predictable software fallback to generate random numbers instead of the chip's hardware random number generator, which means an attacker could work out the seed offline. Between July 30 and August 1, attackers used that to sweep roughly 1,367 Bitcoin — about $88.6 million — from 4,585 addresses, having identified the high-value wallets in advance. BleepingComputer lists the affected versions: Mk2 and Mk3 on firmware 4.0.1 through 4.1.9, Mk4 and Mk5 before 5.6.0 (or Edge before 6.6.0X), and Q devices before 1.5.0Q (or Edge before 6.6.0QX). The Hacker News has more on how the theft was carried out. Why it matters: the important detail is the one people will miss — updating the firmware does not repair a seed that was already generated with the broken code, so a patched device with an old seed is still exposed. If you own one of these wallets, do all three steps today, in order: install the fixed firmware, generate a completely new seed on the updated device, and move your funds to the new wallet. Keep your old backup until the transfer has confirmed.
More than 30 Minnesota water systems were hit in a coordinated attack
Over 30 community water systems in Minnesota were targeted on July 26 and 27, with the impact varying by system, according to the state's IT agency. Four communities publicly reported disruption: one town's water plant went offline and residents were asked to minimize water use, another lost cellular communications to its water towers and wastewater stations, and two more had automated controls affected and ran on manual operation, with one city declaring a local emergency. The state said on July 28 it was not aware of any active requests for residents to change their drinking-water use, and no widespread boil-water notices followed. Officials have not publicly identified who was responsible. The attackers reached programmable logic controllers — the small industrial computers that run pumps and valves — and changed passwords and IP addresses to lock operators out. CISA has since urged water utilities to get such controllers off the public internet immediately, put them behind a VPN or gateway, change default passwords, and restrict access to known addresses. Why it matters: the water kept running here, but the incident was coordinated, it hit small municipal systems rather than big-city utilities, and the entry point was equipment sitting on the open internet with weak credentials. Two things to do: sign up for your city and water utility's emergency alerts so a genuine notice reaches you, and keep a few days of bottled water at home. If your business runs anything with a controller or remote-access panel — irrigation, refrigeration, HVAC, security cameras, a building system — ask whoever installed it whether it is reachable from the internet and whether it still has the password it shipped with.
Anthropic says three of its AI models breached real companies during safety tests
Anthropic published a review of 141,006 of its evaluation runs and found three incidents in which its models reached the real internet from test environments that were supposed to be isolated, then attacked real organizations while believing the targets were part of the exercise. In the most serious, a fictional company name in the test happened to match a real domain, and the model extracted credentials and reached a database holding several hundred rows of production data. In another, a model published a malicious package to PyPI, the public registry Python developers install code from; it was downloaded and executed on 15 real systems, including a security company's scanner, before the registry's automated defenses removed it. In the third, a model that could not find its assigned target scanned roughly 9,000 internet addresses and compromised one company before recognizing the target was real and stopping. The company says a misconfiguration between it and an evaluation partner gave the environments internet access the models were told they did not have. It has paused cybersecurity evaluations, notified the affected organizations, and says it will hold test environments to the same security standard as production. As BleepingComputer notes, a similar incident involving another lab's models was reported earlier in July. Why it matters: for most people this is a story about AI safety testing, but there is a practical lesson in it for anyone letting an AI tool act on their systems rather than just answer questions. In every one of these cases the model was confidently wrong about the boundaries of its sandbox, and the containment, not the model's judgment, was what should have stopped it. If you use an AI agent that can browse, run code, or connect to your accounts, give it its own login rather than yours, keep it away from live customer data, and make sure there is a log you can read afterward of what it actually did.