The IT Nerd

Cybernews has analyzed the Resemble AI Deepfake Incident Database and found that there have been 83 deepfake incidents at educational institutions around the globe since the start of 2025. Researchers then analyzed the cases to understand who is being targeted, who is creating the content, and where these cases are happening. 

Here are the key findings:

• 71% of recorded deepfakes at educational institutions involved sexual content;
• 97% of victims were female;
• 72% of victims were minors;
• 65% of deepfake incidents at educational institutions happened at secondary schools;
• Students themselves were the perpetrators in 57% of cases, while teachers/staff were the perpetrators in 18% of cases.

The cases show just how big a problem AI-generated deepfakes have become at schools, and how vulnerable children are. Creating a convincing fake no longer requires advanced technical skills, which is why prevention, clear school policies, and effective guardrails on AI platforms are as important as ever.

For more information on this, here’s the full study:

https://cybernews.com/ai-news/deepfakes-at-educational-institutions-research

By Stefanie Schappert

For most ransomware and extortion gangs, the end goal has always been pretty simple: money.

Steal enough sensitive data, threaten to leak it, and hope the victim decides paying millions of dollars is better than dealing with the fallout.

But what happens when money is no longer the ransom?

This week, the notorious ShinyHunters hacker group announced it had breached multiple FBI systems, claiming it made off with sensitive data belonging to “almost all” FBI agents, employees, and even job applicants.

The FBI has said it is investigating the alleged breach.

The thing is, in this case, the hackers aren’t asking the FBI for millions of dollars – they’re asking the FBI to take back what the group says are “false allegations” about how they operate. 

ShinyHunters gave the FBI seven days to remove or correct statements it made in a May cyber advisory that the group says falsely accused it of exaggerating hacking claims, threatening victims and their families, engaging in swatting, and falsely claiming to possess compromising material. 

Seemingly insulted by the suggestion, ShinyHunters also took the time to “unequivocally” declare they are “NOT SEXTORTIONISTS” and “unequivocally” unrelated to the nihilistic hacking collective known as The Com.

The hackers also “unequivocally” (they used the word unequivocally a lot) insist the attack has nothing to do with money.

So why would a cybercriminal group go to such extraordinary lengths to defend its reputation?

Because in the world of cyber extortion, reputation is just another form of currency.

Honor among thieves

Extortion only works if the victim believes the threat.

If hackers threaten to dump sensitive information if a victim refuses to pay, there has to be some reason for that company to believe they will. 

If companies begin to suspect a hacker group is bluffing, the threat loses its power, the ransomware gang loses leverage over its victims, and the well runs dry, so to speak.

That’s why an FBI warning suggesting ShinyHunters may exaggerate its claims isn’t simply an insult. 

From the hackers’ perspective, it potentially damages the very credibility their business model depends on.

And ShinyHunters isn’t the first cybercrime group I’ve seen fiercely protective of its public image.

Last year, another fine group of extortionists – known as the Qilin gang – contacted my newsroom after taking issue with how I characterized the ransomware group in an article, politely requesting I correct it. 

Rather than get on the bad side of one of the most active gangs for nearly two years running, I kindly obliged. 

And it appears ShinyHunters has joined the quest, publicly taking issue with how journalists are covering the FBI story, in an obvious attempt to control the narrative.  

ShinyHunters also slammed journalists for mishandling the proof samples it so graciously provided, essentially “ruining the experience for everyone.” 

Citing the inappropriate sharing of highly sensitive data (yes, the irony is not lost here), the hackers – who clearly have a reputation to uphold – simply decided they would no longer engage with media for this faux pas. 

Cash is king – or is it?

For organizations negotiating with these groups, this raises a much bigger question.

As hackers accumulate increasingly sensitive information capable of destroying careers, exposing trade secrets, or putting people’s physical safety at risk, organizations may face demands that have nothing to do with money.

Think of all the highly sensitive data out there potentially at risk.  

Medical records, trade secrets, proprietary technology, private communications, customer databases, information about executives – or, in the FBI’s case, home addresses, phone numbers, family information, and other personal details of highly specialized federal agents.

Furthermore, with ransomware attacks, the public may eventually learn that an organization was breached, but rarely sees everything that happens behind the scenes: the negotiations, whether a ransom is paid, or how much.

In the past few years at least, we’ve become accustomed to hackers demanding tens of millions of dollars from their victims in exchange for stolen data.

But stolen information, as we’ve now witnessed, can be leveraged for much more than money, and the more damaging the information, the greater the leverage. 

From a simple retraction or public statement to a forced change in corporate behavior – or potentially a demand we haven’t even seen or thought of yet – many cyber insiders believe the stakes are evolving. 

The question we must ask isn’t simply how much a victim is willing to pay to protect its data, but what else it would be willing to do to protect it.

ABOUT THE EXPERT

Stefanie Schappert is a Senior Journalist at Cybernews covering cybersecurity, AI, national security, cyber policy, critical infrastructure, data privacy, and the human impact of technology. Based in New York, she is the first American journalist at Cybernews and a broadcast news veteran previously at Fox News, NY1 News, and Verizon FiOS 1. She holds a Master’s degree in Cybersecurity and is ISC2 Certified in Cybersecurity (CC). A guest commentator on TV, radio, and podcasts, including CBS News, iHeartMedia, and KTLA, Schappert explores how technology and cyber risk shape society, from ransomware attacks and hacker groups to emerging technologies and digital policy. She has been published in Fortune and cited by the US Senate, FCC, HHS, Henry Jackson Society, academic institutions, and other leading technology publications.

Cybernews has a study they’ve just released analyzing the privacy policies of leading router brands. We examined what user data these companies disclose collecting and what their policies leave unclear.

Here are the most concerning things we found after analyzing the privacy policies of 25 leading router brands:

Pre-purchase transparency is blocked 

Because relevant privacy terms are often inaccessible until after purchase, registration, or setup, consumers cannot make informed privacy decisions before buying.

Catch-all policy increases legal ambiguity 

High-risk-scoring brands like D-Link, Omada, and Wyze performed poorly largely due to overly vague, corporate-wide policies that create legal ambiguity around network monitoring.

Universal DNS opacity

All 25 analyzed vendors (100%) received a Not Specified rating for DNS request logging, failing to confirm or deny whether they record the domain names users visit. Given that DNS is one of the most revealing signals a router can log (it’s basically a timestamped list of every site a user visits), providers seem rather too ambiguous about it.

Pervasive geolocation exposure

Zero analyzed brands explicitly rule out tracking precise device location (7 confirm doing so outright, 6 do it conditionally, while 12 fail to specify), and 92% (23 of 25) either partially confirm or fail to disclose whether they harvest nearby Wi-Fi network identifiers (SSIDs/BSSIDs). Ultimately, this opens the door to highly invasive physical location tracking.

The full report is available here: 

https://cybernews.com/privacy/router-privacy-index-2026-industry-wide-transparency-failures-exposed

Cybernews researchers uncovered a large underground proxy network comprising thousands of hijacked devices worldwide, all controlled by a single Russian hacker. This brute-force campaign has already gained access to 87,000 vulnerable IPs, and the hacker is reselling them to residential proxy providers and individual users via Telegram bots and various websites.

Key information:

• The threat actor leases its proxy network to multiple residential proxy platforms and over 20,000 end users, earning over $200,000 in two years.
• The hacker “patched” official Claude Code so that it disables all security and accepts any large language model.
• The discovered server leaked everything: malicious tools, AI software, client lists, IP addresses with credentials, and logs of others hacking it. 
• The campaign has been running for about two years, targeting devices with outdated VPN protocols like PPTP and L2TP.
• The leaked database had over 56,000 illicit users, with over 11,000 having linked Telegram accounts. Some of the users registered using their real names.

“The brute-forcing campaign monetizes compromised hosts by deploying proxy software and renting access. The hacker’s malicious actions are beyond doubt. Yet it also highlights another issue – owners neglect security by leaving old or unprotected devices running, and malicious actors abuse their environments for cybercrime,” said Aras Nazarovas, information security researcher at Cybernews.

For more information, here’s the full report:

https://cybernews.com/security/russian-vpn-hacker-brute-forcing-routers-building-proxy-empire

The streaming platform Twitch, along with its users, has found itself a victim of an alleged dark web data leak. A new advertisement has appeared on a well-known hacker forum, claiming that a threat actor has stolen information on about 40,000 Twitch users.

At any given moment, more than 2 million viewers are watching streams on Twitch. Even the remote possibility of a data leak or breach could therefore affect a large number of people.

Cybernews researchers investigated the claims, and here is what was found:

• The attacker claims to have stolen usernames, URLs, emails, legal names, followers’ numbers, and the status of account verification
• The data appears scraped, not taken from a direct Twitch breach.
• Some emails were not public, so the attacker may have abused Twitch’s API.
• Non-public emails in the sample suggest that the attacker may have exploited Twitch’s API.

“From what I see, this indeed looks like a data scrape, not a breach,” one of our researchers said. It is likely that the attacker compiled the dataset through other means, like collecting information from public streamers’ profiles.

For more information, read the article here:

https://cybernews.com/security/twitch-data-leak-claim-40000-streamers

New research from Cybernews’ 2026 AI Trustworthiness Ranking reveals a transparency gap among Canada’s leading AI companies: 82% won’t clearly disclose how long they retain user data, and 59% don’t say whether that data is used to train their AI models.

Cybernews has published its ranking, evaluating 500 AI companies across 36 countries on security, data privacy, transparency, and public perception. As part of the project, the team rated 17 leading Canadian AI companies.

Key findings:

• According to the Cybernews AI Trustworthiness Ranking, Canadian AI companies scored an average of 64 out of 100.
• 82% of leading Canadian AI companies do not clearly disclose how long they retain user data.
• 59% of top Canadian AI companies do not clearly disclose whether they use user data to train AI models.
• Transparency was Canada’s strongest area, with an average score of 92, while security was the weakest at 28.
• Vidyard ranked first in trustworthiness, followed by Ideogram, Spellbook, LANDR, and Thomson Reuters.

You can explore the full AI Trustworthiness Ranking and individual company scores here: AI Trustworthiness Ranking 2026

Cybernews researchers have discovered an exposed server belonging to an affiliate of the Gentlemen ransomware gang. Through the server, the Cybernews team gained a rare inside look at a massive AI-powered ransomware operation.

The discovery shows how AI is changing cybercrime: a single attack costs as little as $0.40–$4.00 in tokens per company, not counting the supporting infrastructure costs. “Ransomware has effectively turned into a passive revenue stream,” said Aras Nazarovas, a security researcher at Cybernews, who discovered the leaking server.

Here are the key findings:

• The exposed server contained 3.1TB of data stolen from over 30 companies.
• The brain behind the exposed ransomware operation is an AI agent. Malicious activity relies almost entirely on AI automation, with minimal human oversight.
• The AI agent can simultaneously compromise and extort multiple targets and is used at all stages of the attack, including determining ransom demands.
• The compromised companies spanned marketing, healthcare, consulting, compliance, real estate, software development, telecommunications, manufacturing, and transportation, suggesting that attacks are opportunistic.

The findings were responsibly reported to CERT and the police in Lithuania prior to publication, and the authorities shared the information with international partners.

You can find the full Cybernews investigation here:

https://cybernews.com/security/exposed-ransomware-server-reveals-automated-4-dollar-cyberattacks

Users are considering giving Grok Bot access to their bank accounts, with one user suggesting it could “track spending, move money, pay bills, and watch for weird charges.”

Elon Musk encouraged the user to “try it out,” adding that if “Grok Bot messes up, we will make you whole.”

Cybernews information security researcher Rasa Jurgutytė warns that giving an AI agent this level of access could create risks that reimbursement cannot fix.

Her comments:

• “In this case, where an agent essentially performs bank operations on your behalf, so many things can go wrong. An agent might misunderstand a request at best, or can be manipulated via prompt injections/malicious requests at worst.”
• By giving Grok Bot access to your data, there’s also a risk of accidental information disclosure.
• In this context, leaked data could include “your transaction history, balances, payment method, or personal information, which is much worse than a brief summary of your spending habits, or whatever else a person might ask on a prompt,” Jurgutytė told Cybernews.
• While Musk tells the user not to worry, as he will reimburse potential damages caused by Grok Bot, Musk “cannot undisclose your information,” Jurgutytė concludes.

Feel free to use Rasa’s comments in your coverage. I can also provide additional information if useful.

Here’s the full Cybernews article about this for more context: https://cybernews.com/ai-news/grok-bot-connect-bank-acccount/ 

Android users were shocked last year to find Android System SafetyCore installed on their devices without consent, silently “scanning” content. Google is now developing an API that makes the content classification functionality available to third-party apps.

Cybernews looked into what SafetyCore does, the new Content Safety Manager API, and whether malicious apps or spyware could abuse it to scan for sensitive images.

Key findings:

• SafetyCore performs image classification on the device to prevent users from seeing nudity when they receive, send, or forward messages in Google Messages.
• Google states that this feature doesn’t send identifiable data or any classified content or results to Google’s servers.
• Android just introduced a new API for developers – Content Safety Manager. It uses the on-device content safety service to classify content and exposes this functionality to app creators.
• The API can accept images but also other media types, and returns four broad types: allowed / warning / blocked / unclassified.
• Google doesn’t have complete control over what third-party apps do with the data.
• Combined with excessive permissions, a malicious app could abuse the content-scanning capability to inspect large amounts of user content. This could lead to privacy-invasive profiling, or much worse – exfiltrating sensitive photos or other private data, and potentially even demanding a ransom.
• According to Google Play Store, Android System SafetyCore has over 1 billion downloads and an average score of 3.6 stars from nearly 240,000 reviews.

Here’s the full article: https://cybernews.com/security/android-content-safety-manager-api-privacy-concerns/

Cybernews has launched the AI Trustworthiness Ranking, a new project assessing 500 AI companies from 36 countries based on publicly available information related to security, data privacy, organizational transparency, and public perception. Each company receives a Trustworthiness Score from 0 to 100, calculated from the four weighted pillars.

Companies scoring 75+ are designated AI Trustworthiness Leaders of 2026. The ranking covers 21 AI categories, ranging from AI assistants and productivity tools to coding, music, and creative platforms. The Ranking will be updated yearly.

The AI Trustworthiness Ranking aims to help people understand which AI companies they can trust. With hundreds of AI tools available, it can be difficult to know how responsibly the companies behind them operate or what happens to users’ data once they start using their products. 

The Ranking is guided by an Advisory Board of experts in AI, cybersecurity, and technology, who provide external expertise and perspectives on the project.

Google’s Gemini tops the list

According to the Ranking, the ten most trustworthy AI companies are Google (Gemini), Krisp, Fireflies.ai, Adobe, Magnific, Writesonic, Veryfi, Salesforce, Grammarly, and Lovable.

Companies in the Office & Productivity category achieved the highest average Trustworthiness score at 78 out of 100, while Music & Audio ranked lowest, with an average score of 54.

Of the four pillars assessed, security received the lowest average score at just 32 out of 100, while organizational transparency was the strongest-performing pillar, with an average score of 90 out of 100. 

Nearly two-thirds of AI companies lack clear disclosures on AI training

For the Data Privacy pillar, Cybernews analyzed the privacy policies of all 500 companies to assess how clearly they explain how they collect, share, use, and retain user data.

The analysis found that 63% of companies do not clearly disclose whether they use user data to train their AI models. Of these, 42% do not address AI training on user data in their privacy policies at all, while 21% provide only vague information.

Data retention disclosures showed a similar pattern. 65% of companies do not clearly disclose how long they retain user data. 9% don’t mention anything about retention or deletion, while 56% only mention it vaguely, without any precise retention periods.

Explore the full AI Trustworthiness Ranking and individual company scores here: https://cybernews.com/ai-knowledge-base/ai-trustworthiness-ranking-2026/