AI news you can use — August 21, 2026
Attackers are taking over accounts without ever stealing a password
Google's threat intelligence team published research on three suspected Russian espionage groups that break into accounts by abusing ordinary features rather than by finding software flaws. One approach: a phishing page asks for your phone number, then shows you a real WhatsApp linking code or QR code. Complete it and the attacker's device is quietly attached to your WhatsApp account. In some cases the page then invited the target to join a "secure call," which triggered hidden code in the browser to record audio and video. A second approach used emails impersonating government officials, with step-by-step screenshots walking the target through creating an app password on their Google account — a code meant for older software that works even when two-step verification is switched on. The named targets were academics, diplomats, defence staff and think-tank researchers in Europe and the US, and Google says it has disabled the accounts and cloud projects involved.
Why it matters: The targeting was narrow but the techniques work on anyone, because nothing about them looks like an attack — you are typing a real code into a real login screen. Take ten minutes today: in WhatsApp, open Settings, then Linked Devices, and log out anything you do not recognise, then turn on two-step verification so a stranger cannot re-register your number. In your Google account security settings, delete any app passwords you are not actively using. And treat a linking code or QR code offered by a web page the way you would treat handing someone your unlocked phone — no legitimate service needs you to do that to prove who you are.
A fake IT help desk is messaging staff on Microsoft Teams
A phishing campaign is impersonating company IT support over Microsoft Teams and talking employees into installing a program described as a "PowerShell Cleaner." The installer is hosted on Microsoft's own cloud service, so the download link looks trustworthy at a glance. What actually installs is malware researchers are calling SynkLoader: it profiles the machine, sets up remote access, tunnels out through the network, and can display a convincing fake Windows lock screen to capture the password the user types into it. Researchers note the software takes care to measure the size of the company network it lands in, which is the sort of reconnaissance that precedes a ransomware demand.
Why it matters: Chat apps have inherited the trust email lost, and a message inside Teams feels like it came from a colleague. Set one rule with your staff this week: real IT support never arrives as an unexpected chat message asking you to install something, and any such request gets verified by phone or in person before anyone clicks. If a Windows lock screen appears out of nowhere, press Ctrl+Alt+Delete or Alt+Tab first — a fake one cannot survive either.
Walmart is finally turning on tap-to-pay
Walmart says Tap to Pay arrives on August 24 at selected Walmart stores and Sam's Club locations, reaching every US store and club by the end of 2026 and fuel stations by mid-2027. The company's own announcement describes eligible contactless cards, phones and smartwatches rather than naming particular wallets; coverage of the change reports that this is what finally brings Apple Pay and Google Pay to the checkout. Walmart had stayed out for roughly a decade, promoting its own scan-the-code Walmart Pay instead.
Why it matters: Paying with a phone or watch is not just faster — the shop never receives your actual card number, because a one-time substitute is sent in its place. That makes a tampered card reader far less useful to whoever tampered with it. If you have never set up the wallet on your phone, it takes about two minutes and works nearly everywhere now; this was one of the last big holdouts.
ChatGPT can now read and send your Apple Messages
OpenAI has released a Messages plug-in for ChatGPT that can search your text history, summarise threads, suggest replies, draft new messages and send them. It is off by default and has to be switched on, and it needs Full Disk Access — a permission that hands an application the run of everything on the computer, not only the messages database. OpenAI says the plug-in runs locally on the device and does not build a full index of your texts, and it advises against granting standing approval for sending, so each outgoing message still gets a look from you first. Exactly what is retained once ChatGPT has read a conversation is not spelled out.
Why it matters: Your text history is one of the most sensitive things you own — it contains bank verification codes, appointment details, client conversations and family matters, all in one searchable pile. Handing any assistant Full Disk Access to get at it is a much bigger grant than it sounds like, so only do it if you have a concrete task it solves, and leave the per-message confirmation on so nothing goes out under your name without you reading it. If you share a computer with staff or family, this is not a setting to switch on casually.
Google published a button that lets readers pin your site
Google has released an embeddable "preferred source" button that any website can add — two lines of HTML, per the official documentation. A reader who clicks it marks your site as one they want to see more of, and is returned to the page they were reading. From then on, that reader is more likely to see your site in Top Stories, in Discover and News, and in Google's AI-generated answers. Google says hundreds of thousands of sites have already been selected this way and that people click through to a preferred source at roughly twice the usual rate.
Why it matters: If your business publishes anything — a blog, a recipe archive, service guides, a newsletter — you have probably watched search traffic drift as AI answers absorb the clicks. This will not lift you above competitors in general search, because it only changes what people who deliberately opted in are shown. That is exactly why it is worth doing: it is a free way to keep the readers you already earned, rather than a trick to acquire new ones. Add the button to your site and mention it once to your existing audience.