Unrelenting IT issues cost millions of hours in lost productivity

Posted in Commentary with tags on September 30, 2025 by itnerd

Nexthink has released ‘Cracking the DEX Equation: The Annual Workplace Productivity Report’ showing that poor DEX directly costs global businesses an average of 470,000 hours per year, equivalent to around 226 full-time employees. This indicates that digital friction is a vital and underreported element of the global productivity crisis.

Nexthink’s analysis – the first of its kind – is based on proprietary data from more than 20m endpoints across 474 global businesses. The report finds that the average employee suffers 14 negative digital experiences a week. These include device crashes, application glitches, or slow load times, and can reduce productivity and collaboration while also increasing employee frustration and stress. Crucially, the research also indicates a strong inverse correlation between an organization’s DEX score and productivity loss. For every 10-point increase to the overall DEX score, employees would recoup an average of 22 productive minutes each week. 

The research also suggests that these consistent disruptions are not just a threat to enterprise productivity, but also to the quality of work employees produce. The average negative event lasts a little under 3 minutes (167 seconds), yet research from the American Psychological Association suggests that even delays of less than 5 seconds are enough to triple people’s error rate. Moreover, research from the University of California has shown that when employees are taken out of their flow state it takes around 23 minutes for them to return, further increasing the amount of lost time.

Averaging lost time by industry shows significant variation with retailers, healthcare providers, and financial service companies suffering 1.7x the time loss of the tech industry. The number of disruptive events per week was almost identical, regardless of industry however, suggesting that the variance in time loss is down to the severity of events rather than the volume.

The figures in this report are derived from aggregated, anonymized telemetry from organizations largely in the early stages of DEX management.

For more information on the impact of DEX on workplace productivity, please read the full ‘Workplace Productivity’ report 

Meta AI fooled into teaching weapon creation…. Yikes!

Posted in Commentary with tags on September 30, 2025 by itnerd

Cybernews researchers discovered that Meta’s personal assistant, which is integrated into Messenger, WhatsApp, Instagram, and other apps, is easy to manipulate into revealing harmful information. The Llama 4-based chatbot was easily tricked into providing instructions on making a Molotov cocktail.

The assistant was easily tricked by utilizing the so-called “narrative jailbreaking” practice. The technique masks the harmful request by asking the bot to tell a “story” to bypass safety filters. To execute the jailbreak, the team simply asked the chatbot to tell a story about the Winter War between Finland and the Soviet Union, requesting details about how the incendiary devices were made back then. 

While it’s unlikely that people will flock to Meta for advice on Molotov cocktail-making, the issue highlights the possibility of abusing the chatbot for purposes that appear to be beyond the scope of what an AI assistant ought to be capable of.

The team disclosed the issue to Meta immediately after discovering it. After the publication went live, the company told Cybernews it had resolved the problem.

Also, Cybernews researchers recently discovered that Lenovo’s customer service assistant, Lena, had an XSS vulnerability that allowed the running of remote scripts on corporate machines if you asked nicely.

Meanwhile, another chatbot, used by the travel agency Expedia, allowed users to ask for a recipe for making a Molotov cocktail. The company eventually fixed the issue, and the chatbot stopped advising on making incendiary devices.

To read the full research report, please click here.

2025 Paywall Index: A Data-Driven Study Across Industries

Posted in Commentary with tags on September 30, 2025 by itnerd

Website Planet has published a study which explores how paywalls have evolved beyond news media to become the internet’s default business model, shaping digital content, SaaS, streaming, and even academic publishing.

Among our key findings:

  • Paywalls surged in the 2010s (120 new launches) but appear to have stagnated in the 2020s.
  • Hard paywalls dominate, with 50% of services relying on this model.
  • Nearly half (46.03%) of freemium models are in the software/SaaS sector.
  • Pay-per-view is rare overall, but 65% of academic journals with paywalls use it.

You can check their full research here: https://www.websiteplanet.com/blog/2025-paywall-index-a-data-driven-study-across-industries/

Cybersecurity Awareness Month Is Tomorrow

Posted in Commentary with tags on September 30, 2025 by itnerd

With Cybersecurity Awareness Month kicking off tomorrow, I have a comment from Chris Mierzwa, Sr. Director, Global Resilience Programs at Commvault.

For background, Chris Mierzwa is a seasoned technology executive with over 30 years of experience in the IT solutions space. As a former CTO and SVP at Sirus Computer Solutions (now CDW), he led strategic initiatives across infrastructure, cloud, and partner ecosystems, overseeing billion-dollar revenue targets and complex M&A Integrations.

“As we approach another Cybersecurity Awareness Month, it serves as a stark reminder that enterprises must get ‘back to basics’ and focus on creating stronger security foundations. Among the many different threat vectors, I implore business leaders to pay close attention to social engineering – the increasingly dangerous Achilles’ heel of every organization.  

Enterprises are underestimating threat actors’ ability to understand the more formidable adult psyche. With the help of AI, cybercriminals can now alter their voices, accents, and launch social engineering attacks in multiple languages with real-time translation, leaving employees with no cues to suspect malicious intent. On top of that, threat actors recognize that employees only receive minimal cybersecurity training, meaning they don’t have the knowledge or skillset to recognize the newest and most sophisticated threats.” 

New Spearphishing Attacks Uses DarkCloud Infostealer to Steal Credentials

Posted in Commentary with tags on September 30, 2025 by itnerd

Researchers have uncovered new spearphishing campaign that leverages the DarkCloud Infostealer to steal FTP credentials, keystrokes and other information. You can find out more details about this campaign here: https://www.esentire.com/blog/eye-of-the-storm-analyzing-darkclouds-latest-capabilities

Henrique Teixeira, SVP of Strategy at Saviynt, commented:

“Infostealers are a type of malware often specifically designed to steal user credential data. 46% of the time, infostealers are running in employee devices not managed by their employers (https://www.verizon.com/business/resources/infographics/2025-dbir-infographic.pdf). While it’s important to stay aware of new versions and campaigns utilizing these vectors, it’s even more critical for cybersecurity and identity leaders to understand the full attack chain of these modern campaigns.

“Data stolen by infostealers is typically sold later to other criminals via Initial Access Brokers (IABs) on the dark web. However, this isn’t the only method used to gain access to organizations. As we’ve seen recently, these groups often employ a multi-pronged approach that can include extortion, social engineering, and compromising third-party access. AI has also risen in the methods of cyber attacks. Therefore, a more complete strategy to protect and defend against modern attacks requires understanding their anatomy and recognizing that credential abuse is the #1 vector of attack, and a low hanging fruit for attackers (and defenders).

“This attack highlights the importance of being able to measure and understand the current state of identity controls, and how resilient and prepared organizations are. This includes implementing least privilege principles for all accounts, discovering and removing long-standing privileges, and avoiding static and long-lived tokens. Identity security also needs to be applied to machine identities, or non-human identities (NHIs). Research shows that, in fact, 80% of the most recent identity-based attacks compromise non-human accounts instead of human ones ([https://nhimg.org/the-ultimate-guide-to-non-human-identities](https://nhimg.org/the-ultimate-guide-to-non-human-identities)).”

Since spearpishing is a highly targeted attack, it illustrates how careful that you have to be in order to not become a victim of such an attack. Thus consider yourself warned and act accordingly. This article will help you with that: https://www.fortinet.com/resources/cyberglossary/spear-phishing

CISA Issues Alert Regarding Cisco Firewall Zero-Days

Posted in Commentary with tags on September 29, 2025 by itnerd

Late last week, the Cybersecurity and Infrastructure Security Agency issued an emergency directive in response to a widespread campaign that involves exploiting zero-day vulnerabilities in Cisco firewall devices – giving threat actors access to the devices and enabling them to execute malicious code and malware.

Here is some commentary on the significance of these vulnerabilities and insights for security leaders from cybercrime expert and VP of Cyber Risk for HITRUST, Tom Kellermann.

“The exploitation of Cisco firewalls underscores the dangerous nature of island hopping through security vendors’ vulnerabilities. This systemic attack to U.S. government agencies represents a clear and present danger to national security. Cybersecurity vendors must ramp up their own security postures in 2025 and the private sector must expand third party risk management to include cybersecurity vendors in order to mitigate future widespread attacks by China.”

Once again it is time to patch all the things. Because this is one of those “today problems” which seem to be multiplying like rabbits. That’s not a good place for those of us on the side of keeping users and organizations safe to be.

ESET Research’s has a deep dive into DeceptiveDevelopment, North Korean crypto theft via fake job offers

Posted in Commentary with tags on September 29, 2025 by itnerd

ESET Research has released new findings on DeceptiveDevelopment, also known as Contagious Interview – a threat group aligned with North Korea that has grown increasingly active in recent years. The group is primarily focused on cryptocurrency theft, targeting freelance developers across Windows, Linux, and macOS platforms. The newly published research paper traces the group’s evolution from early malware families to more advanced toolsets. These campaigns rely heavily on sophisticated social engineering tactics, including fake job interviews and the ClickFix technique, to deliver malware and exfiltrate cryptocurrency. ESET also analyzed open-source intelligence (OSINT) data that sheds light on the operations of North Korean IT workers involved in fraudulent employment schemes and their ties to DeceptiveDevelopment. These findings are being presented today at the annual Virus Bulletin (VB) Conference.

DeceptiveDevelopment is a North Korea-aligned group active since at least 2023, focused on financial gain. The group targets software developers on all major systems – Windows, Linux, and macOS – and especially those in cryptocurrency and Web3 projects. Initial access is achieved exclusively via various social engineering techniques like ClickFix, and fake recruiter profiles similar to Lazarus’s Operation DreamJob to deliver trojanized codebases during staged job interviews. Its most typical payloads are the BeaverTail, OtterCookie, and WeaselStore infostealers, and the InvisibleFerret modular RAT.

The attackers opted for various methods to compromise users, relying on clever social engineering tricks. Via both fake and hijacked profiles, they pose as recruiters on platforms like LinkedIn, Upwork, Freelancer.com, and Crypto Jobs List. They offer fake lucrative job opportunities in order to attract their target’s interest. Victims are requested to participate in a coding challenge or pre-interview task.

In addition to fake recruiter accounts, the attackers have customized and improved the social engineering method called ClickFix. Victims are lured to a fake job interview site and asked to fill out a detailed application form, investing significant time and effort. At the final step, they’re prompted to record a video answer, but the site displays a camera error and offers a “How to fix” link. This link instructs users to open a terminal and copy a command that should solve the camera or microphone issue, which instead of fixing the issue, downloads and executes malware.

While research into DeceptiveDevelopment is primarily based on data from ESET telemetry and reverse-engineering the group’s toolset, it is interesting to point out its connections to fraud operations by North Korean IT workers. According to the FBI’s “Most Wanted” poster, the IT worker campaign has been ongoing since at least April 2017 and has become increasingly prominent in recent years. In a joint advisory released in May 2022, the IT worker campaign is described as a coordinated effort by North Korea-aligned workers to gain employment at overseas companies, whose salaries are then used as funding for the regime. They have also been known to steal internal company data and use it for extortion, as stated in an announcement by the FBI in January 2025.

As ESET Research discovered from available OSINT data, fake CVs, and other related materials, the IT workers mainly focus on employment and contract work in the West, specifically prioritizing the United States. However, our findings based on the acquired materials have shown a shift toward Europe, with targets in countries such as France, Poland, Ukraine, and Albania. The workers utilize AI to perform their job tasks and rely heavily on AI for manipulating photos in their profile pictures and CVs, and even perform face swaps in real-time video interviews to look like the persona they are currently using. They utilize remote interviewing platforms like Zoom, MiroTalk, FreeConference, or Microsoft Teams for various social engineering techniques. Proxy interviewing poses a severe risk to employers, since hiring of an illegitimate employee from a sanctioned country may not only be irresponsible or underperforming, but could also evolve into a dangerous insider threat.

The research paper “DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception” summarizes the evolution of the group’s two flagship toolsets, InvisibleFerret and BeaverTail. At the same time, it identifies newly discovered links between DeceptiveDevelopment’s Tropidoor backdoor and the PostNapTea RAT used by the Lazarus group. Furthermore, it provides a comprehensive analysis of TsunamiKit and WeaselStore, new toolkits used by DeceptiveDevelopment and documents the functionality of a WeaselStore C&C server and its API.

For a more detailed analysis of DeceptiveDevelopment operations and tools, check out the latest ESET Research white paper “DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception” or the brief accompanying blogpost on WeLiveSecurity.com. M

Harrods Has Been Pwned With 430K Records Swiped

Posted in Commentary with tags on September 29, 2025 by itnerd

Hackers have apparently breached British retail giant Harrods via a third-party supplier stealing 430,000 records that included sensitive e-commerce customer information.

Harrods said it would not engage with the “threat actor” and added the affected data, taken from a third-party provider, was limited to basic information and did not include passwords or payment details.

“Our focus remains on informing and supporting our customers. We have informed all relevant authorities and will continue to co-operate with them,” a spokesperson said in a statement.

The majority of Harrods customers shop in-store, so it is understood the breach has affected only a small proportion of its shoppers.

Dmitry Dontov, CEO of Spin.AI, provided the following comments:

“The Harrods breach is yet another example of the need to secure the entire supply chain. If attackers are unable to breach your core workspace, they can often access data through external partners. Even retail giants must assume that the perimeter defense is not enough. Incident resilience, real-time monitoring, as well as third-party tool visibility and security are now essential.”

Supply chain attacks are all the rage due to how effective it is for threat actors to pwn an organization via this attack vector. Thus it is in your best interests to make sure that the companies that you get services from are as secure as you are. Otherwise you might be the next headline related to a supply chain attack.

Abby Connect Scales Personalized Service and Launches AI Receptionist with Deepgram’s Real-Time Speech-to-Text

Posted in Commentary with tags on September 29, 2025 by itnerd

Deepgram today announced that Abby Connect, a premier virtual receptionist service, has successfully launched its new AI Receptionist product line built on Deepgram’s real-time speech-to-text technology. By choosing Deepgram, Abby Connect is scaling its high-touch customer experience while meeting the demanding needs of industries such as law, healthcare, and home services.

For more than 20 years, Abby Connect has built its reputation on creating a warm, human first impression for every call. But scaling that personal service 24/7 – while managing rising client demand and costs – presented a major challenge. Abby Connect turned to Deepgram to help strike the right balance between efficiency and empathy.

Why Abby Connect Chose Deepgram 

After evaluating Google Cloud Speech-to-Text, AWS Transcribe, AssemblyAI, and Whisper, Abby Connect found Deepgram’s performance to be unmatched:

  • Accuracy in the Real World – Deepgram outperformed competitors on noisy calls, including from HVAC job sites.
  • Low Latency for Natural Conversations – Sub-300ms streaming latency enabled real-time, two-way AI dialogue without delays.
  • Ease of Integration – Developer-friendly APIs and transparent pricing simplified rollout.
  • Domain Customization – Tuned for industry-specific terminology, from legal to medical.

Results Delivered

By leveraging both Deepgram’s real-time and pre-recorded transcription APIs, Abby Connect achieved measurable results:

  • New AI Receptionist Product Line – Successfully launched, automating repetitive call types like scheduling and FAQs.
  • 5x Boost in QA Productivity – Quality assurance teams now review five times more calls per day.
  • 30% Reduction in Audit Time – Faster reviews mean stronger agent coaching and more consistent service.
  • Scale to 100,000+ Calls per Month – Deepgram reliably transcribes massive call volumes to power both AI and human workflows.

Abby Connect is now exploring how to extend Deepgram-powered transcription into even more advanced conversational AI, including large language models trained on call data to detect intent, measure sentiment, and enable smarter escalations.

To learn more, please read the Abby Connect case study found here: https://deepgram.com/customers/abby-connect 

Dedicated IP is now available on Surfshark’s extension

Posted in Commentary with tags on September 29, 2025 by itnerd

Surfshark has launched a dedicated IP feature for its browser extension, available on Google Chrome, Mozilla Firefox, and Microsoft Edge. This addition allows users to route only browser traffic through a dedicated IP.

According to Justas Pukys, Senior Product Manager at Surfshark, the company constantly looks for opportunities to improve the user experience and provide innovative solutions across the industry.

A dedicated IP is well known for reducing human verification requests (CAPTCHA). When multiple users share the same IP address, websites often send verification requests, such as “Select images with traffic lights.” Dedicated IP minimizes this issue by assigning a static address, making traffic appear more consistent to websites. Also, as only one user generates traffic through the IP, it may lead to more stable connections.

Additionally, dedicated IP simplifies access to remote networks by eliminating the unpredictability of changing addresses associated with shared VPN servers. This provides unrestricted service access, allowing users to access apps and websites that block shared IPs or don’t work when IP changes frequently.

Currently Surfshark offers 20 dedicated IP locations: Australia – Sydney; Brazil – Sao Paulo; Canada – Toronto; France – Paris; Germany – Frankfurt am Main; Hong Kong – Hong Kong; Italy – Milan; Japan – Tokyo; the Netherlands – Amsterdam; Poland – Warsaw; Singapore – Singapore; South Africa – Johannesburg; Turkey – Istanbul; United Kingdom – London; United States – Dallas, Denver, Las Vegas, Los Angeles, New York, and San Jose.

The dedicated IP feature is available on Android, Windows, iOS, and macOS and supports all major protocols, including WireGuard®, for maximum speed. Since it has now been included in the extension, all users can access it on Google Chrome, Mozilla Firefox, and Microsoft Edge browsers.