This week on The Awareness Angle, we hit 1.2 million views on a single video across TikTok and Instagram, which is pretty wild for an independent podcast. Thank you to everyone who watched and shared.

ADT gets breached for the third time in under a year and it all started with a phone call. An AI coding agent wipes a startup's entire database and all its backups in nine seconds, then writes its own incident report admitting it broke every safety rule it had. The supply chain attack that started with Trivy has now hit Checkmarx and Bitwarden, with three criminal groups teaming up to turn supply chain access into ransomware. And the UK government's annual cyber report says 43% of businesses were breached last year, phishing was behind 85% of them, and despite M&S, Co-op and JLR making national headlines, nothing's really changed. Plus Instructure's Canvas LMS breached again, Itron's smart meters filing quietly on a Friday night, Microsoft Teams helpdesk impersonation going wild, 610,000 Roblox accounts stolen by three lads in Ukraine, QR code scams in Toronto, and a toaster with a touchscreen that nobody asked for.

All of that in this week's Awareness Angle.

Watch or listen to the episode today - YouTube | Spotify | Apple Podcasts

Visit riskycreative.com for past episodes, our blog, and our merch.

Click to watch us on YouTube

This Week's Stories

Almost Half of UK Businesses Hit by Cyber Attacks, Government Report Finds

Watch | Read

The UK government's annual Cyber Security Breaches Survey landed this week and the numbers are huge. 43% of UK businesses, roughly 612,000, experienced a cyber attack or breach in the past year. Of those that reported a breach, 85% said phishing was involved. Not "one of the top threats," nearly all of them. And as we discussed on the show, that likely includes voice phishing and other channels beyond just email. Despite a year that included M&S, Co-op and Jaguar Land Rover all making national headlines, cyber hygiene among SMEs has actually gotten worse on several measures. Only 15% of businesses review the risks posed by their direct suppliers, just 6% look at the wider supply chain, and a quarter of businesses don't even know what their ransomware policy is. As Ant pointed out, that means people are making impulse decisions in the heat of the moment, and that's never wise.

The cyber security minister has written to 180 of the UK's largest businesses urging them to sign a new Cyber Resilience Pledge, but as we discussed, it's not those 180 companies that need the most help. It's the smaller businesses in their supply chains, the ones making the spigot rings for a Land Rover Defender, that are really feeling the impact when something goes wrong. If you work in security awareness, this report is ammunition. Share it with your CISO. As Luke Pettigrew said, these are exactly the kind of stats you need to make the case for investment and resources.

The Awareness Angles

The gap between knowing and doing - Most organisations know cyber is a risk. The problem is that awareness still isn't translating into action, especially among smaller businesses. If you need one stat to justify your programme's existence, 85% of breaches involved phishing is it.

High-profile breaches aren't moving the needle - M&S, Co-op and JLR all made national headlines, and the overall picture barely shifted. We said at the time that those breaches would be a wake-up call for the country. The data says otherwise. Shock value alone doesn't drive behaviour change.

A quarter of businesses don't know their own ransomware policy - That's not a technical problem, that's a communication problem. If your people don't know what the plan is before something happens, there is no plan.

ADT Breached Again by ShinyHunters Vishing Attack

Watch | Read

Home security giant ADT has been breached for the third time in under a year after ShinyHunters used a vishing call to compromise an employee's Okta SSO credentials and pivot into ADT's Salesforce instance. No malware, no technical exploit, just a convincing phone call and one set of credentials that unlocked millions of customer records. As Ant noted on the show, this is the same playbook ShinyHunters used on MGM, and it's rumoured to be behind M&S, Co-op and most of the big breaches over the last couple of years. When your business is security, having three breaches in 18 months isn't a great look, and as we pointed out, Bleeping Computer used the same stock image for all three.

Luke raised an important point about how vishing awareness has traditionally been focused on help desks and privileged access teams, but this shows it needs to be much broader. As Ant put it, everyone has access to something useful to an attacker, whether that's sales data, HR records, customer information or system access. A lot of permissioning in businesses isn't great, and it could be someone very low down the pyramid that leads to the top. We used to ask people in awareness surveys whether they agreed with the statement "I am of no use to hackers, so they do not target me." This story proves exactly why that thinking is dangerous.

The Awareness Angles

It started with a phone call, not a hack - No malware, no vulnerability. Someone called an employee, pretended to be IT support, and talked them into handing over their login. That was enough to compromise millions of records. If your awareness training doesn't cover phone-based social engineering with the same weight as email phishing, this is your sign to change that.

One account unlocked everything - A single set of SSO credentials gave the attacker access to Salesforce and all the customer data sitting in it. One login for everything is convenient until someone else gets hold of it.

Third breach in under a year - Three disclosed breaches since August 2024, with the same type of attack working each time. As we discussed, getting hit once doesn't mean you've had your turn. You can go again, and if the lessons aren't sticking, you probably will.

AI Coding Agent Deletes Startup's Entire Database in Nine Seconds

Watch | Read

An AI coding agent running Anthropic's Claude through Cursor hit a problem in a staging environment and decided to fix it by deleting a production database volume. It found an overpermissioned API token in an unrelated file, used it to wipe the entire database and all backups through a single API call, and the whole thing was done in nine seconds. As Ant put it on the show, he can't get Claude to write his name in nine seconds, let alone delete an entire database. When the founder asked the agent to explain what happened, it wrote its own incident report listing every safety rule it knew it had broken, including its own system prompt telling it never to run destructive commands without being asked.

For the car rental businesses using PocketOS, this meant they suddenly had no customer records at all. The data was eventually recovered, but it took days, and in the meantime customers were reconstructing bookings from Stripe payment histories and email confirmations. Luke shared a video from Hannah Fry about AI agents going rogue that tied in perfectly with this story, and as we discussed, every business wants to use AI because nobody wants to get left behind, which in some ways makes things even more dangerous. Luke also flagged that Claude's own Chrome extension, which has six million users, openly acknowledges the risk of prompt injection from websites in its Chrome Store listing. We're trying hard not to let this become an AI podcast, but when AI is doing things like this, it has to be part of the security awareness conversation.

The Awareness Angles

AI agents can take destructive action without asking - This agent wasn't told to delete anything. It decided to, found a way to do it, and did it faster than any human could have intervened. If your team is using AI coding tools, understand what they actually have access to.

Overly permissioned tokens are a ticking clock - The API token that made this possible was created for a narrow purpose but had permissions far beyond what was needed. That's not an AI problem, that's an access control problem that AI made catastrophically worse.

The "best model" isn't a safety guarantee - They were running the top-tier model with explicit safety rules configured. It still ignored them. Capability and reliability are not the same thing, and trusting an AI agent because it's smart is not the same as trusting it because it's safe.

This week's discussion points

ADT Breached Again by ShinyHunters Vishing Attack Watch | Read

Instructure / Canvas LMS Hit by Another Cyber Attack Watch | Read

Critical Infrastructure Giant Itron Confirms Cyberattack Watch | Read

AI Coding Agent Deletes Startup Database in 9 Seconds Watch | Read

Supply Chain Attack Hits Checkmarx and Bitwarden Watch | Read

Roblox Account Theft: 610,000 Accounts Stolen Watch | Read

UK Cyber Security Breaches Survey 2025-26 Watch | Read

Microsoft Teams Helpdesk Impersonation Attacks Watch | Read

QR Code Scams in Toronto Watch

Smart Toasters and Unnecessary IoT Watch

Hannah Fry on AI Agents Going Rogue Watch

Security Socials

QR Code Scams Hit Toronto - Liam Stock-Rabbat sent in a TikTok video showing fake QR code stickers being placed over legitimate ones on bike rental stations across the Greater Toronto Area. As we discussed, if you're a tourist you'd have no idea the flow was wrong because you've never used it before. Stickers over QR codes can be legitimate, businesses do update them, but that's exactly what makes it so hard to spot. The advice remains the same: if you can, use the app directly rather than scanning a random code. Watch

Smart Toasters and Unnecessary IoT - Someone on Reddit posted a picture of a toaster with a full touchscreen, weather report and digital photo frame. It costs £300 and it's internet connected. As Ant put it, it's yet another unnecessary risk you're bringing into your home. We went down a rabbit hole about Samsung TVs full of ads, why you might want to skip the built-in smart TV apps entirely, and what the most random connected device in your house might be. Let us know yours. Watch

Hannah Fry on AI Agents Going Rogue - Luke shared a TikTok from Hannah Fry (who went to the same school as Ant's wife, small world) talking about AI agents and the risks of giving them too much autonomy. It tied in perfectly with the PocketOS story. Luke also flagged that Claude's Chrome extension, with six million installs, openly acknowledges the risk of prompt injection in its Chrome Store listing. We're trying not to become an AI podcast, but it keeps pulling us back in. Watch

Thanks for reading! If you’ve spotted something interesting in the world of cyber this week, a breach, a tool, or just something a bit weird, let us know at hello@riskycreative.com. We’re always learning, and your input helps shape future episodes.

Ant Davis and Luke Pettigrew write this newsletter and podcast.

The Awareness Angle Podcast and Newsletter is a Risky Creative production.

All views and opinions are our own and do not reflect those of our employers.

This week we've got three things that are immediately useful whether you work in security or not. We discussed a phishing campaign using fake missile alerts and real geopolitical fear to steal Microsoft credentials. There is a story about what happens when a meeting recording gets sent to the wrong person after someone drops off a call, and a genuinely handy tip about generating QR codes without handing your data to a random website. It was sitting on your computer, the whole time!

After that we've got the Breach of the Week, the Phish of the Week from the team at Hoxhunt, and everything else from this week's episode.

Watch or listen to the episode today - YouTube | Spotify | Apple Podcasts

Visit riskycreative.com for past episodes, our blog, and our merch.

Minimize imageEdit imageDelete image

This week's stories...

Missile Alert Phishing Exploits Iran-US-Israel Conflict for Microsoft Logins

Watch | Read

A phishing campaign is exploiting genuine geopolitical tensions between Iran, Israel, and the US. The emails impersonate government civil defence warnings, with urgent subject lines, an official-looking layout, and language designed to stop you thinking and start you acting. The ask is to scan a QR code for shelter guidance and evacuation instructions.

The QR code takes you off your device to your phone, away from your email security controls, and onto a fake Microsoft login page.

There's a line in the email worth noting: "scan for instructions, access official emergency procedures, shelter guidance and evacuation instructions." Ask yourself why emergency procedures would require you to sign into Microsoft. In a genuine emergency, you wouldn't stop to ask that. That's the whole point.

The Awareness Angles -

Fear is the most effective bypass - Attackers weaponise breaking news and genuine anxiety to trigger fast, uncritical action. When people feel threatened, they don't pause to verify URLs.

QR codes move the attack off your protected device - On your phone, the URL is harder to see, security tooling may not be in play, and the Microsoft login screen might look slightly different to what you're used to. All of that helps the attacker.

If something urgent wants you to sign in somewhere unfamiliar, stop - Emergency guidance doesn't live behind a Microsoft login. That mismatch is the tell.

Your Meeting Recording Might Be Sending More Than You Think

Watch

A post on Reddit's recruitinghell caught a lot of attention this week. A candidate's wife shared that after a virtual interview, her husband was accidentally sent a full transcript and audio recording of the entire call, including the interviewers discussing him after he disconnected. Remarks about his appearance, their salary negotiation tactics, and comments you'd never want the candidate to hear.

It probably happens all the time. Someone drops off a call, the remaining people carry on talking, and the transcript goes out automatically to all participants when the meeting ends.

The security message here is simple but easy to overlook: if you need to debrief after a meeting, start a new one. Don't assume the recording has stopped just because someone has left.

The Awareness Angles -

Auto-transcription catches everything - Meeting tools like Teams, Zoom, and Meet don't stop recording when a participant leaves. If transcription is on, it captures whatever is said until the host ends the meeting.

Transcripts go to all participants by default - The person you were just talking about may receive a full written record of what you said. This isn't a theoretical risk, it happened here.

Start a new meeting to debrief - It takes ten seconds and removes the risk entirely. Worth making it a habit, and worth sharing with your teams.

You Can Make QR Codes Directly in Microsoft Word

Watch | Read

A short video shared this week pointed out something most people don't know: you can generate a QR code directly inside Microsoft Word, no third-party tool required.

This matters for anyone in security awareness who makes posters, internal communications, or training materials. Most people Google "QR code generator" and land on a random website, hand over their URL, and don't think twice about what that site is doing with it. Using a built-in tool removes that risk entirely.

It's not the most intuitive feature to find, but the video walks through it clearly. Worth knowing, and worth passing on to the teams in your organisation who regularly make printed or digital materials.

The Awareness Angles -

Check what your existing tools can already do - Before anyone in your organisation uses a third-party website or app for something, it's worth asking whether Microsoft 365, Google Workspace, or whatever your standard toolset is can already do it natively. QR codes in Word is one example. There are probably others sitting unused. Finding them and communicating them reduces shadow IT risk without asking people to change their behaviour dramatically.

Communicate it - If your organisation has approved tools that do things people don't know about, that's a quick win for a security awareness message. A short post, a tip in a newsletter, a slide in an induction deck. "You don't need to Google a QR code generator, here's how to do it in Word" is the kind of practical, immediately useful message that lands well.

Third-party tools are a risk even for small things - Free online tools ask for data, store URLs, and may share information with parties you've never heard of. Helping people understand that even small conveniences carry risk is a useful habit to build.

Phish of the Week

Thanks as always to the threat intelligence team at Hoxhunt .

Minimize imageEdit imageDelete image

WhatsApp / Meta Impersonation: Credential and MFA Code Theft

This one's well put together. It arrives as an official-looking email carrying the WhatsApp and Meta branding, addressed to someone who runs a Meta Business Messaging partner account.

The message says their business hasn't met requirements to maintain select tier status in the Meta Business Messaging Partners Program and they have until a specific date to fix it. There is a deadline included and links everywhere, four of them, all going to the same place.

What makes it notable is the landing page. It's not just a fake login that steals your password. It asks you to verify your identity, capturing your MFA code in real time. The likely setup: a ghost system is logging in on your behalf in the background and passing your verification code straight through. So even with MFA turned on, this attack works.

The Awareness Angles -

Targeted phishing feels relevant because it is - This works on people who actually have Meta partner portal accounts. If you received it and didn't have one, you'd ignore it. The targeting is what makes it dangerous.

MFA capture is real - Getting your MFA code intercepted in real time is not theoretical. This attack is designed specifically to do that. MFA is still worth having, but it doesn't make you untouchable.

Go to source, not the link - If you get something like this, don't click. Go to Google, search for the platform directly, and navigate from there. Better still, have it bookmarked.

Bookmarks are an underrated and almost entirely forgotten piece of security advice. If there's a site you log into regularly, whether that's your bank, your HR system, your email, or a partner portal, bookmark it. Then when something arrives in your inbox claiming to be from that service, you don't need to click anything. You just open the bookmark. It sounds too simple, but it removes one of the most common ways people end up on fake login pages. Worth pushing out as an awareness message. It's practical, it costs nothing, and most people have never thought about it.

This Week's Discussion Points...

Everything we talked about in this week's episode:

• Hackers steal and leak 7.7TB of sensitive LAPD police documents via third-party storage Watch | Read

• Wynn Resorts confirms 21,000 employees affected by ShinyHunters breach, ransom likely paid Watch | Read

• Dutch healthcare software vendor ChipSoft hit by ransomware, disrupting hospital systems across the Netherlands Watch | Read

• Jones Day law firm confirms breach after Silent Ransom Group (Luna Moth) leaks client files and demands $13M Watch | Read

• Anthropic's Project Glasswing powered by Claude Mythos autonomously finds and exploits thousands of zero-days Watch | Read

• GrafanaGhost vulnerability allows data theft via AI prompt injection, Grafana disputes severity Watch | Read

• Missile alert phishing campaign exploits Iran-US-Israel tensions to steal Microsoft credentials via QR code Watch | Read

• BlueHammer: disgruntled researcher leaks unpatched Windows privilege escalation zero-day on GitHub Watch | Read

• White House proposes $707M cut to CISA, a third of staff already left in Trump's second term Watch | Read

• Phish of the Week: WhatsApp/Meta impersonation capturing credentials and MFA codes in real time Watch

• North Korean hacker exposed during a job interview Watch | Read

• Interview transcript accidentally sent to applicant including post-call discussion Watch

• Make QR codes directly in Microsoft Word Watch | Read

• TikTok Lite installed automatically after a phone update Watch | Read

Find Us

Podcast: Spotify | Apple Podcasts

YouTube: https://www.youtube.com/@riskycreative

TikTok: https://www.tiktok.com/@infosecant

Instagram: https://www.instagram.com/riskycreative

Thanks for reading! If you’ve spotted something interesting in the world of cyber this week, a breach, a tool, or just something a bit weird, let us know at hello@riskycreative.com. We’re always learning, and your input helps shape future episodes.

Ant Davis and Luke Pettigrew write this newsletter and podcast.

The Awareness Angle Podcast and Newsletter is a Risky Creative production.

All views and opinions are our own and do not reflect those of our employers.

This week on The Awareness Angle, we've got Chinese hackers breaking into the system the FBI uses to watch people. The White House released an app that security researchers took apart and didn't like what they found. LinkedIn has been quietly scanning your browser extensions and linking the results to your profile without telling you. And a Carnegie Mellon professor says app privacy labels are basically the nutrition labels of the internet, which tells you everything you need to know.

We've also got Google Drive getting a proper ransomware safety net, attackers using WhatsApp to deliver malware to Windows PCs, Apple quietly blocking one of the cleverest scams doing the rounds right now, and a campaign calling out the AI-generated slop that's making all of us easier to scam.

Watch or listen to the episode today - YouTube | Spotify | Apple Podcasts

Visit riskycreative.com for past episodes, our blog, and our merch.

Click the image above to watch the latest episode on YouTube

Breach of the Week

Chinese Hackers Breach the System the FBI Uses to Watch People

Watch | Read

We had plenty to choose from this week as Hasbro got hacked, there are unconfirmed claims about a massive Adobe breach, and a few others bubbling away. But this one was the standout, and honestly it's got Hollywood written all over it.

Suspected China-linked hackers broke into the FBI system that stores surveillance data, likely exposing the phone numbers of people the bureau was actively monitoring. The FBI has officially classed it as a major incident and notified Congress, confirming that access came through a third-party vendor rather than a direct attack on their own systems.

The system at the centre of it manages court-authorised wiretaps. Think of it as the database that tells investigators who they're watching and who those targets are talking to. Whoever got in could potentially work out exactly who the US is surveilling, giving them the chance to tip off assets, cut ties, or stay one step ahead. This isn't just a data breach. It's a breach of the FBI's ability to do its job quietly.

Our Mission Impossible take: this feels less like a money grab and more like an intelligence operation. Who's being watched? Who's safe? Who needs burning? That kind of targeted patience is what separates nation-state attacks from regular cybercrime. There'll be a film about this one day.

The Awareness Angle -

Your data in someone else's hands - When a government system gets hacked, it's not just officials affected. Ordinary people whose names appear in investigations as witnesses, associates or subjects can end up exposed too.

Third party, first problem - Access came through a third-party vendor, not a direct attack. This is the same weak link that trips up organisations of all sizes. Your security is only as strong as the people you trust with access.

This isn't random - State-sponsored hackers don't break in to cause chaos. They go after intelligence. What's known, who's compromised, who's being watched. That level of patience and precision is what makes these attacks so hard to defend against.

This Week's Stories...

The Security Tool We Covered Last Week Just Helped Breach the European Commission

Watch | Read

If you caught last week's episode, you'll remember the Trivy supply chain attack, a poisoned security scanner that was backdoored and used to compromise an AI tool called LiteLLM. Well, the story got a lot bigger.

CERT-EU has confirmed the European Commission's cloud infrastructure was breached using that same compromised version of Trivy, with initial access obtained on March 19th through normal software update channels. No one clicked anything dodgy. No one fell for a phishing email. They just updated their software.

The attackers stole an AWS API key, got into the Commission's cloud accounts, and the stolen data, including emails and personal details, was subsequently published on the dark web by ShinyHunters. Up to 71 clients across EU institutions affected, over 300GB of data. And yes, ShinyHunters are the same group behind some of the biggest breaches of the last couple of years. Not surprising they're involved.

Trivy led to LiteLLM, LiteLLM led to further targets, and the security scanner designed to keep systems safe became the weapon used to break in.

Your security tools are part of your attack surface - We said this last week and it just took down the European Commission. The tools you trust to protect you can become the way in if they're not protected themselves.

Software updates are now a threat vector - Nobody did anything wrong here in the traditional sense. They just updated their software. That's exactly what makes supply chain attacks so hard to defend against.

One breach feeds the next - They didn't hit one target and stop. Each compromise was used to reach the next one. Patient, methodical, cascading. By the time anyone notices, the damage is already well beyond where it started.

The White House Just Released an App. Security Researchers Are Not Happy About It.

Watch | Read

We're keeping the politics out of this one. If they want to release an app, they're entitled to. But the security angle here is worth knowing about regardless of where you stand on anything else.

The Trump administration launched an official White House mobile app for iOS and Android, promising Americans unparalleled access with live streams, breaking alerts and real-time updates. What they didn't advertise was what the app does in the background.

Security researchers who decompiled it found it sending users' IP addresses, timezone, device model, OS version and a persistent unique identifier to third-party servers on every single launch, despite the app's privacy label being completely blank and claiming it collects nothing. There's also GPS tracking infrastructure baked in that's currently dormant but can be switched on remotely. It's there. It just hasn't been turned on yet.

A Russia-founded third-party software company whose components are baked into the app was also found exposing personal information belonging to some White House staffers. The White House said everything is safe and secure. Security researchers disagreed, loudly. In any other news cycle this would have been a scandal.

The Awareness Angle -

Read the permissions before you download anything - This app asked for access to precise location, biometric fingerprint data and the ability to modify or delete your shared storage. Most people tap allow without looking. Those permissions are worth a few seconds of your time for any app, not just this one.

A privacy label that says nothing can still mean a lot - Apps are supposed to declare what data they collect. This one said nothing. The reality was very different. If an app's privacy disclosure looks too clean, that's not always reassurance. Sometimes it's a red flag.

Official doesn't mean safe - A .gov badge doesn't automatically mean an app has been built securely or held to a higher standard. Apply the same scepticism to government apps as you would any other.

Apple Just Added a Safety Net for One of the Cleverest Scams Around

Source: Reddit

Watch | Read

We've talked about ClickFix on this podcast more times than we can count, and we've said for a while that what it really needs is an OS-level response. Apple just got there first.

A new macOS feature now blocks potentially harmful commands from running when pasted into Terminal and shows a warning explaining that scammers commonly distribute malicious instructions through websites, chat agents, apps and phone calls. If you're on a Mac and you paste something suspicious into Terminal, you now get a pop-up that says "Possible malware, paste blocked" with a Don't Paste button as the main option.

If you're not familiar with ClickFix, it's worth understanding. A fake pop-up tells you there's a problem with your computer. A Fix It button appears. Clicking it copies a command to your clipboard. You paste it into Terminal, hit enter, and you've just installed the malware yourself. ClickFix jumped by more than 500% in the first half of 2025, making it the second most common attack vector after phishing.

The "paste anyway" option is still there, which Luke rightly pointed out maybe it shouldn't be, but it's a long overdue step in the right direction. Hopefully Windows follows.

The Awareness Angle -

The scam works because it uses your own hands against you - ClickFix bypasses most security software because you're the one running the command. The malware never has to sneak past anything. You let it in yourself, thinking you're fixing a problem.

No legitimate website will ever ask you to open Terminal - That is the tell. If a website, pop-up, support chat or phone caller tells you to open Terminal or Command Prompt and paste something in, stop. That is the scam, every single time.

Apple's warning helps but don't rely on it alone - It's not yet clear exactly which commands trigger it, so it won't catch everything. The best protection is knowing what ClickFix looks like before you ever see it, which is exactly why we keep talking about it.

App Privacy Labels Are Like Food Nutrition Labels - And We All Know How That's Going

Watch | Read

This one came up this week because of the White House app, and it's a comparison that really stuck with us.

Lorrie Cranor, director of Carnegie Mellon University's CyLab Security and Privacy Institute, says app privacy labels, the data disclosures you see on the App Store and Google Play, are basically the nutrition labels on a packet of crisps. In theory they help you make an informed choice. In practice, she says the current versions are not at all useful and, worse, they create the impression that something meaningful is being done for your privacy when it actually isn't.

Studies have found widespread inaccuracies in the labels. Apple and Google don't even use the same definitions for what counts as data collection. Google defines it as any data transmitted from your device. Apple only counts it if that data is also stored. The same app can look completely different depending on which store you're looking at.

We saw a live example of this exact week. The White House app declared it collected nothing, while quietly sending device data to multiple third parties on every single launch.

The Awareness Angle -

Labels are only useful if they're accurate - The privacy label on an app is the closest thing you have to informed consent before downloading. Most people never check it, and research shows many labels don't reflect what apps actually do anyway.

Compliance isn't the same as protection - Companies post these labels for information purposes. A label existing doesn't mean your data is safe. There was a time when everyone said smoking was good for you. Look how that turned out.

Even the experts say read the privacy policy - If you genuinely want to know what an app does with your data, the full privacy policy is still your best bet. Nobody said it was fun, but it's the honest answer.

Phish of the Week

Thanks as always to the threat intelligence team at Hoxhunt for sharing this week's example.

This is a phish with many gills....

Watch

This one's a salary increase notification, and it's more sophisticated than it first looks.

The email lands with your company logo, your name, and a message saying a new policy has been added: a salary increase, effective a specific recent date. To access the updated documentation, scan the QR code below. At the bottom, there's a yellow confidentiality banner telling you not to share the link or access code with anyone else. That detail is doing a lot of work. It's nudging you to keep quiet and not check with a colleague.

Here's the bit that caught us off guard when we scrolled further down on the episode: it's not just a credential capture page. Scanning the QR code takes you to a fake DocuSign page where you're given a signing code. Clicking continue takes you to a legitimate Microsoft website and a real device authentication window. The attack isn't stealing your password. It's getting you to authorise access to your device entirely. That's device code phishing.

And there's a red flag right at the start that most people will miss. The phishing email itself is completely empty. The actual attack arrives as a .eml file attached to a blank email. That's not normal. If you see an empty email with an email file attached, don't open it.

Hoxhunt flagged the fake salary lure as the primary hook, playing into exactly the kind of emotion that makes people act before they think, and the QR code as a deliberate choice to move you off your work device and onto your phone, away from whatever security controls your organisation has in place.

This Week's Discussion Points...

Chinese hackers breach the FBI's wiretap surveillance system Watch | Read

Trivy supply chain attack leads to European Commission data breach Watch | Read

The White House app: what security researchers actually found Watch | Read

Apple adds macOS Terminal warning to block ClickFix paste attacks Watch | Read

App privacy labels are not as useful as you think Watch | Read

Google Drive ransomware detection and file restoration now generally available Watch | Read

LinkedIn secretly scanning 6,000+ Chrome extensions and collecting data Watch | Read

WhatsApp used to deliver malware to Windows PCs Watch | Read

Phish of the Week: QR code salary increase leading to device code phishing Watch

SMS delivery scam in the wild Watch

Sloppypasta: AI-generated content and why it makes you easier to scam Watch | Read

Artemis II has two broken instances of Outlook and NASA had to remote in Watch | Bluesky

Artemis II is running Microsoft 365 in space Watch | Read

Artemis II astronaut enters PIN code on live stream Watch | Watch on TikTok

Apple Passwords app ad Watch | Watch on TikTok

Supply chain attack explainer video Watch | Watch on TikTok

And Finally...

Artemis II is orbiting the moon. The astronauts are running Windows. They have two instances of Outlook installed and neither of them work. NASA had to remote in to sort it out. Anthony's take: we've sent people round the moon and we're relying on Outlook for email up there. Luke's take: why do they even need Outlook? There's live chat for that. Both valid. Watch | Bluesky

Which led to the obvious question. Can you imagine being phished while orbiting? A QR code salary increase lands in your inbox, you scan it on your phone, and suddenly someone's got remote access to a Windows tablet in space. We have a Phish of the Week for exactly that scenario this week. Coincidence. Probably. Watch

One of the astronauts also entered their PIN code on live stream, just before launch, in full view of the cameras. It's out there now. Luke pointed out it's probably just policy baked into the device build. Anthony pointed out they could have been given an exception. Watch | Watch on TikTok

Luke also shared Apple's latest ad promoting the built-in Passwords app — good awareness content, and a reminder that if your organisation runs Apple devices without MDM, staff may now be storing corporate passwords somewhere you can't see. Watch | Watch on TikTok

And finally, a really nicely produced TikTok on supply chain attacks by Lewis Menloe. Worth sharing with your team, and worth watching if you make awareness content yourself — great example of what you can do with an iPhone and one decent light. Watch | Watch on TikTok

Thanks for reading! If you’ve spotted something interesting in the world of cyber this week, a breach, a tool, or just something a bit weird, let us know at hello@riskycreative.com. We’re always learning, and your input helps shape future episodes.

Ant Davis and Luke Pettigrew write this newsletter and podcast.

The Awareness Angle Podcast and Newsletter is a Risky Creative production.

All views and opinions are our own and do not reflect those of our employers.

This week we've got a hack that let strangers steal your season tickets and quietly erase stadium bans at one of Europe's biggest football clubs. The AI app with a billion-dollar Disney deal that vanished in six months. Meta's finally fighting back against scammers with AI. And Apple wants to know how old you are.

All that and more on this week's The Awareness Angle.

The full episode is an hour well spent. Watch on YouTube, listen on Spotify, Apple Podcasts, or wherever you get your podcasts. Ant and Luke give you straight talking cyber news for people who actually care about the human side of security.

🎧 Listen on your favourite podcast platform - Spotify, Apple Podcasts and YouTube

Listen Now

Podcast · Risky Creative

If you work in security awareness and you've got something worth saying, this is the room to say it in.

The SANS Workforce Security & Risk Training Security Awareness and Culture Summit Call for Presentations is open right now, and the deadline is this Friday, 3rd April at 5pm ET. The summit itself runs on the 27th and 28th of August in Las Vegas at Caesars Palace, and it is the biggest gathering of security awareness, behaviour and culture professionals on the planet. 13th year running.

The summit is looking for talks, research and case studies that focus on shifting not just behaviour, but attitudes and beliefs around cybersecurity. If you've got something that's worked in your organisation, something you've learned the hard way, or a genuinely new idea worth sharing with thousands of your peers, they want to hear from it.

And if you've never presented at a conference before, this is a brilliant place to start. Mentoring is available for first time speakers, so you won't be thrown in at the deep end on your own.

If Vegas isn't on the cards, that's not a reason to miss out either. You can present remotely, so there's really no barrier to getting involved.

The deadline is the 3rd of April. Two weeks. Get your submission in.

Submit your proposal here. Get more information on the summit here.

This week's stories...

Ajax Amsterdam hack exposed fan data, allowed attackers to steal season tickets and lift stadium bans

Watch | Read

Ajax Amsterdam didn't find out about their own security breach from their security team. They found out from journalists. A hacker had been poking around their systems, and tipped off the press before the club had any idea there was a problem.

What the hacker found was pretty significant. Every user of the Ajax app shared the same digital key. By tweaking a single request, you could act as any other user entirely. Transfer their season ticket to yourself. Change their account details. Or, and this is where it gets a bit darker, quietly remove their stadium ban. As Luke and I discussed on the episode, imagine a bunch of banned supporters suddenly finding themselves back inside the ground for one match. It's got a Channel 4 drama written all over it.

The ticket theft is frustrating. The ban removal is a safety issue. And the fact that Ajax only found out because of a journalist is a reminder that knowing something's gone wrong matters just as much as trying to stop it happening in the first place. The vulnerabilities have since been patched and the Dutch Data Protection Authority and police have been informed.

The Awareness Angle -

Ajax found out from a journalist, not their own systems - The hacker tipped off the press before Ajax even knew there was a problem. If they'd been in it for money instead of attention, hundreds of thousands of fans could have been affected before anyone noticed. Knowing something's wrong matters just as much as stopping it happening in the first place.

It wasn't a sophisticated hack, just a design flaw - Every Ajax app user shared the same digital key. Change one thing in a request and you could act as someone else entirely, transfer their ticket, change their details. No advanced tools required. Some of the worst breaches are just unlocked doors.

Lifting stadium bans is a safety issue, not just a data issue - Those bans exist for a reason. The idea that someone could have quietly removed them, with neither the club nor the banned person knowing, is the kind of consequence you won't find in any data breach notification.

Meta launches new anti-scam tools across WhatsApp, Facebook and Messenger using AI

Watch | Read

It feels like at last. Meta has announced a batch of new anti-scam features across WhatsApp, Facebook and Messenger, and some of them are genuinely useful. On WhatsApp, there's a new warning when someone tries to get you to link your account to another device, which is a scam we've talked about on the show before. On Facebook, you'll start seeing alerts when a new friend request comes from an account that looks suspicious, with details like how recently the account was created and whether you have any mutual friends. Messenger is getting AI-powered detection that flags conversations showing signs of a scam, like out-of-nowhere job offers, and gives you the option to review it before you go any further.

Meta also says it removed 159 million scam ads in 2025. Which sounds impressive until you remember how many scam ads we all still see every week. Luke put it well on the episode: it's probably not going to scratch the surface. But it does feel like a shift. For a long time it seemed like these platforms weren't really trying. At least now they are.

The Awareness Angle -

AI being used to fight AI - Scammers use AI to make their attacks more convincing. Platforms like Meta are now fighting back with the same tools. It's an arms race, and these features show the platforms you use every day are at least trying to keep up.

The WhatsApp device linking scam is one to know about - Someone tricks you into sharing a code or scanning a QR code, and suddenly they've got full access to your WhatsApp on their device. The new warning gives you a moment to pause before that happens. If anyone ever asks you to scan or share a WhatsApp code for any reason, that's a red flag.

159 million scam ads is a staggering number - And that's just what they caught. Even with all that, some still get through. A polished ad on Facebook or Instagram is not proof that something is legitimate.

OpenAI shuts down Sora video app and Disney pulls its $1 billion investment deal

Watch | Read

Remember Sora? It launched six months ago, hit a million downloads in under five days, and came with a billion-dollar deal for Disney to license characters like Mickey Mouse and Cinderella. Now it's gone. OpenAI has shut it down entirely, exiting the video generation business to focus on other things, reportedly as part of tidying up its product range ahead of a potential stock market listing.

Disney is walking away from the deal completely. Which is a bit ironic given that before they agreed to it, they'd been sending legal letters to Meta, Google and Character[.]AI over AI using their characters without permission. The thinking seemed to be: if you can't beat them, get in there and own a piece of it. That didn't work out.

On the episode I raised whether this might be a pause rather than a permanent shutdown. The tech still exists. And if AI tools start needing less computing power to run, which there are signs of, something like Sora could come back under a different name. In the meantime, the people who were using it will just move to other tools, many of which aren't subject to the same kind of oversight. So the AI slop problem on your social feeds probably isn't going anywhere.

The Awareness Angle -

AI tools can disappear overnight - Sora had a billion-dollar deal and a million downloads in five days. Six months later it's gone. If you've built anything around an AI tool, whether that's a workflow, a business or just a habit, it's worth remembering these things can vanish with very little notice.

Copyright and AI is still a mess - Disney was sending legal letters to Meta, Google and Character[.]AI over AI using its characters before doing the Sora deal. Now that deal's fallen apart too. The question of what AI can and can't do with other people's creative work is no closer to being answered.

AI-generated video is getting harder to spot, not easier - One of the issues with Sora was the volume of low-quality, misleading video it made easy to create. That problem doesn't go away just because Sora does. Other tools will fill the gap.

Apple rolls out age verification to UK iPhone users

Watch | Read

Apple is rolling out age verification for UK users as part of a recent iOS update. To access certain features, you'll need to confirm you're over 18, either through payment details already on your account or by submitting ID. If you don't, or if you're under 18, web content filters will switch on automatically.

This is being driven by the UK's regulator Ofcom and the Information Commissioner's Office, who have been pushing platforms hard to keep children off certain types of content. Apple says it's a legal requirement in some regions, and this is their response.

On the episode we had a few questions about it. Where does the verification data actually go? Does it stay on the device, inside Apple's secure enclave, or does it go back to Apple's servers? We don't have a clear answer on that yet. I'm on the iOS beta and haven't been prompted yet, so we may come back to this one as it rolls out properly. What we do know is that a change this big and this unfamiliar is exactly the kind of thing scammers will try to piggyback on very quickly.

The Awareness Angle -

You're handing over more data to prove you're allowed to use your own phone - To access certain features, users will now need to submit ID or payment details. That raises fair questions about what gets stored and what happens if it's ever breached.

This is probably just the start - It's not just Apple. Regulators across the UK and beyond are pushing for age checks to become standard across apps and services. This is likely to become the norm, not the exception.

Scammers will jump on this straight away - A new, unfamiliar prompt asking people to verify their age is exactly the kind of thing that gets turned into a phishing campaign. Expect fake "your verification has expired" messages pretty quickly. If you're communicating this to colleagues or customers, show them what the real thing looks like before the fakes start circulating.

Hoxhunt Phish Of The Week

Thanks as always to the threat intelligence team at Hoxhunt for sharing this week's example.

ChatGPT impersonation - fake subscription invoice

Watch

This week's phish is impersonating ChatGPT Plus. The email mimics a subscription invoice notification using ChatGPT branding and a generic layout, claims your invoice is ready for review, and asks you to click a "Verify Invoice Details" button. The button leads to a malicious website. The message creates urgency by suggesting you'll lose access to your subscription if you don't act.

What makes this one worth flagging is that you don't even need to be a ChatGPT subscriber to fall for it. If you're not a subscriber and you get an email saying you've been charged, the instinct is to click quickly and sort it out. That's exactly what they're counting on.

Red flags to watch for:

• An unexpected invoice or subscription notification you weren't expecting
• Generic billing language with no specific details, just a button
• Urgency around losing access if you don't act immediately
• A "verify" link in the email rather than directing you to log in directly

As always, if you get a billing alert for any service, go directly to the website by typing the address yourself. Don't click the link in the email.

This Week's Discussion Points...

Ajax Amsterdam hack exposed fan data, allowed attackers to steal season tickets and lift stadium bans Watch | Read

Meta launches new anti-scam tools across WhatsApp, Facebook and Messenger using AI Watch | Read

OpenAI shuts down Sora video app and Disney pulls its $1 billion investment deal Watch | Read

How a poisoned security scanner became the key to backdooring LiteLLM Watch | Read Apple rolls out age verification to UK iPhone users Watch | Read

TikTok for Business accounts targeted in new phishing campaign Watch | Read

Lloyds app glitch let 447,000 customers see each other's transactions Watch | Read

Phish of the Week: ChatGPT impersonation - fake subscription invoice Watch

How do you deal with users who refuse to lock their laptop? Watch | Reddit

Six top tips for parents to keep children safe online Watch | Read

The Phisherman - free online safety game for kids Watch | Read

Spot a deepfake using one sentence Watch | Watch on TikTok

Real smishing campaign in France with personalised parcel photos Watch | LinkedIn

French military Strava exposure Watch | Watch on TikTok

Security Socials

Anthony's Security Social

This week I've got a few things for you.

First, I spotted a poster at my kids' school that I thought was worth sharing. It's from LGfL - SafeguardED and it's called Six Top Tips for Parents to Keep Your Children Safe Online. What I liked about it was the approach. Rather than the usual "ban everything and panic," it leads with something refreshing: don't worry about screen time, aim for screen quality. Scrolling through social media isn't the same as making a film, learning something new, or video calling grandma. There's also a nudge to check safety settings across devices, consoles and apps, to get your kids to show you what they're doing and who they're doing it with, and to talk to them about scary things in the news rather than shielding them from it. Worth sharing with parents in your organisation.

Watch | See the poster | More on SafeguardED

Second, my 11-year-old mentioned she and a friend wanted to start a games company called Barefoot Games one day, so naturally I Googled it. What I found was The Phisherman, a free online game for kids from Barefoot Computing and BT Group. It's an underwater adventure where kids earn cyber points by identifying phishing threats and learning what personal information looks like. It's gamified, it's accessible, and I'd never heard of it before. If you've got kids or you work in an organisation with parents (which is most of us), share this. It's a genuinely good tool for starting a conversation about online safety.

Watch | Read

Third, I shared a TikTok this week of someone spotting a deepfake live on a video call using just one technique. He asked the person on the other end to hold three fingers up to the side of their face. Deepfake overlays struggle with objects interacting with the face like that and the result was pretty telling. The video has gone viral for a reason. It's a simple, memorable test that anyone can use if they're ever unsure whether the person they're talking to is real. Worth filing away.

Watch | Watch on TikTok

And last, a LinkedIn post from Maxime Cartier at Hoxhunt that caught my eye this week. It shows a real smishing campaign circulating in France with a twist. It's a fake delivery notification, but instead of just a text, it includes a photo of a package with the recipient's name and full home address on the label, and a personalised link. The image makes it feel immediately real. You don't just read the message. You see your parcel. Maxime's friend assumed it was AI, but it looks more like a simple image template with text overlay. Either way, the point stands: scammers are personalising attacks with visual cues that our brains trust instantly. This is where it's going.

Watch | LinkedIn

Luke's Security Social

This week Luke shared a TikTok showing French military personnel on what appeared to be a ship, with their Strava activity visible and their location effectively public. This isn't the first time this has happened. Back in 2018, British soldiers inadvertently revealed the location of a semi-secret military camp through their Strava data. Strava does now blur your starting point, but that only goes so far. If you're a service member or working in a sensitive environment, a fitness app with public settings on could give away far more than your split times. The broader lesson for everyone is worth repeating though: think about what your apps are sharing, with whom, and whether the default settings actually reflect what you want.

Watch | Watch on TikTok

This week on The Awareness Angle - a US general leaves maps on a train. A Chrome extension with a million users and Google's own seal of approval was quietly skimming your shopping commissions for months. Companies House left a gap in their system for five whole months that anyone could exploit just by pressing the back button. Eight million crime tips that were promised to be anonymous turned out to be anything but. New Android malware is hiding in dodgy streaming apps and going straight for your notes. And Japan has decided it's time to start hitting back.

The full episode is an hour well spent. Watch on YouTube, listen on Spotify, Apple Podcasts, or wherever you get your podcasts. Ant and Luke give you straight talking cyber news for people who actually care about the human side of security.

Click to watch this week's episode

Watch or listen to the episode today - YouTube | Spotify | Apple Podcasts

Visit riskycreative.com for past episodes, our blog, and our merch.

The deadline is the 3rd of April. Two weeks. Get your submission in

If you work in security awareness and you've got something worth saying, this is the room to say it in.

The SANS Workforce Security & Risk Training Security Awareness and Culture Summit Call for Presentations is open right now, and the deadline is Friday 3rd April at 5pm ET. The summit itself runs on the 27th and 28th of August in Las Vegas at Caesars Palace, and it is the biggest gathering of security awareness, behaviour and culture professionals on the planet. 13th year running.

The summit is looking for talks, research and case studies that focus on shifting not just behaviour, but attitudes and beliefs around cybersecurity. If you've got something that's worked in your organisation, something you've learned the hard way, or a genuinely new idea worth sharing with thousands of your peers, they want to hear from it.

And if you've never presented at a conference before, this is a brilliant place to start. Mentoring is available for first time speakers, so you won't be thrown in at the deep end on your own.

If Vegas isn't on the cards, that's not a reason to miss out either. You can present remotely, so there's really no barrier to getting involved.

Submit your proposal here. Get more information on the summit here.

This Week's Stories...

BREACH OF THE WEEK - The General, The Wine, and The Classified Maps

Watch | Read

Major General Antonio Aguto Jr. was the man leading US military assistance efforts to Ukraine. In March 2024, he left classified maps on a Ukrainian train. Not because he was hacked, not because of a sophisticated cyberattack, but because he didn't follow the courier protocol that exists for exactly this reason. The documents sat on the train, unattended, until the US embassy retrieved them the following day.

Two months later, he got through the best part of two bottles of wine at a Kyiv dinner, sustained a concussion from the falls that followed, and showed up to meet Secretary of State Blinken the next morning. A 50-page Inspector General report, triggered by three anonymous complaints, covers the whole sorry story. He retired in August 2024.

We don't really care about the drinking. We care about the maps.

The Awareness Angle

• Procedure exists for a reason - The courier protocol wasn't red tape. It was the thing standing between classified documents and a Ukrainian train seat. Shortcuts under pressure are where breaches live.
• Impairment in high-trust roles - Organisations talk a lot about insider threats. They rarely talk about what happens when someone with top-level access simply has a bad night. Most have no real mechanism for catching it.
• Anonymous reporting worked here - Three complaints. That's all it took to open a 50-page investigation. Whistleblower channels work when people trust them enough to use them.

New Android malware is going through your notes

Watch | Read

Here's one for anyone who keeps passwords in their Notes app. Researchers at ThreatFabric have found a new Android malware called Perseus, hiding inside apps that look like IPTV streaming services. Once it's on your device it does the usual - fake login screens, keylogging etc. But then it does something a bit different. It goes straight for Google Keep and Evernote, pulling out whatever's stored there. Passwords, financial details, account recovery phrases. The stuff people stick in notes because it's convenient.

Because IPTV apps are usually downloaded outside the Play Store, the people installing them are already in the habit of skipping the security checks. Perseus knows this.

The Awareness Angle

• Your notes app is not a password manager - Convenient, yes. Secure, no. Perseus proves attackers are actively targeting notes apps because they know that's where people hide things they shouldn't.
• Sideloading is where the risk lives - Apps outside official stores don't go through security checks. Using IPTV apps to watch football for free is exactly the kind of habit that ends with malware on your phone.
• Old malware never really dies - Perseus is built on Cerberus, a trojan whose source code leaked in 2020. Six years later it's back, repurposed and improved. Old threats get recycled. New actors pick them up.

672,000 people's bank data stolen, and they waited seven months to tell them

Watch | Read

Marquis is a fintech company most people have never heard of. It serves over 700 banks and credit unions, handling their data analytics and marketing. In August 2025, it was hit by ransomware. Names, dates of birth, addresses, Social Security numbers, bank account details, card details, all gone. 74 banks disrupted. 36 class action lawsuits filed.

The people whose data was stolen found out seven months later.

Marquis has sued its firewall provider SonicWall, blaming a vulnerability in SonicWall's cloud backup service for giving the attackers a way in. SonicWall hasn't commented publicly.

The Awareness Angle

• Third-party vendors are a single point of failure - Most people whose data was in this breach had never heard of Marquis. Their bank used Marquis. That was enough. One supplier, hundreds of institutions, hundreds of thousands of people.
• Seven months is too long - Stolen financial data moves fast. The people affected spent seven months exposed without knowing it. Notification timelines matter.
• Suing your supplier doesn't help your customers - Marquis pointing the finger at SonicWall might play out in court. It doesn't change anything for the 672,000 people whose Social Security numbers are now out there.

Google Featured it. It was stealing from you.

Watch | Read

"Save Image as Type" was a genuinely useful Chrome extension. Over a million users. A Featured badge from Google, the thing that's you'd assume meant it'd been checked and it's safe. Then it changed hands. The new owners quietly updated it with code that hijacked affiliate links, redirecting shopping commissions from Amazon, Adidas and Shein to themselves. The malicious behaviour only kicked in after you'd saved at least 10 images, specifically to avoid detection.

Microsoft Edge had removed the same extension a year earlier. Google kept featuring it until March 2026.

Anthony had it installed. He removed it live on air.

The Awareness Angle

• A Featured badge is not a safety guarantee - Google's own stamp of approval didn't catch this for months after Edge flagged it. Trust the badge less than you think you should.
• Extensions update themselves silently - The original extension was fine. Then it changed hands, the code changed, and nothing told you. That's the problem with extensions, you install them once and forget they exist.
• Browser extensions have sweeping access - This one only went after affiliate commissions. The same access could have harvested your passwords, injected malware, read everything you typed. Go through your extensions. Remove anything you don't actively use.

Phish Of The Week

Brought to you by the threat intelligence team at Hoxhunt

Emirates Airline Impersonation - Loyalty Reward Notification

Legitimate services used to send phishes...yeah, that's a thing!

Watch

This one's sneaky because it arrives from a real email address. noreply@campaign[.]eventbrite[.]com is a legitimate Eventbrite domain. Someone has simply set up an event on Eventbrite with Emirates branding and used the platform's mailing functionality to send the phish. The sender name reads "Emirates Millies" - RN rendered close together in certain fonts looks like M, a trick we've seen used against Microsoft too.

Inside: the Emirates logo, a loyalty reward of AED 498.20, and a link that deliberately won't open when clicked. That's not a bug. The attacker has disabled it because clickable links get scanned by security tools automatically. Copy and paste it manually and you land on a fake Emirates login page, credential harvesting in progress.

The Awareness Angle

• The sender name doesn't match the platform - Emirates doesn't send loyalty notifications via Eventbrite. Full stop.
• The link won't click - Deliberate. They want you to bypass your own security tools by doing the work manually.
• The body text uses disguised characters - Some letters are pulled from different character sets to slip past spam filters. If the text looks slightly off or inconsistent, trust that instinct.

This Week's Discussion Points

Former US general got drunk in Kyiv, left classified maps on a train Watch | Read

Crime Stoppers leak exposes millions of "anonymous" tips Watch | Read

New Android malware hiding in streaming apps to spy on users' personal notes Watch | Read

FBI seizes Handala data leak site after Stryker cyberattack Watch | Read

Marquis says over 672,000 people had personal and financial data stolen in ransomware attack Watch | Read

Companies House suspends filing service after five-month security glitch exposed directors' details Watch | Read

Popular Chrome extension "Save Image as Type" removed after hijacking affiliate links for months Watch | Read

Phish of the Week: Emirates Airline Impersonation Watch

SANS Security Awareness & Culture Summit 2026 - Call for Presentations Watch

Idris Elba's wax model unlocks his iPhone Watch | Read

Pete Tong reads out a URL like it's 1995 Watch | Read

Tinder plans to let AI scan your camera roll Watch | Read

Japan to allow proactive cyber defence from October 1st Watch | Read

And Finally...

Idris Elba's wax double unlocked his iPhone. A Madame Tussauds waxwork was a convincing enough likeness to fool Face ID. Which raises the question: what exactly is Face ID checking for? Watch

Pete Tong read out a full URL on BBC Radio 1. In 1995. A clip doing the rounds of Pete Tong carefully enunciating a web address, forward slashes and all. A lovely reminder of how different things were. We're at riskycreative.com, no index.html required. Watch

Tinder wants to scan your camera roll. The dating app is planning to let AI browse your locally stored photos to figure out your interests and build your profile. Gym selfies, family photos, sensitive documents, whatever's in there. Ant checked his. Apparently it's mostly dinosaurs and things he's selling on eBay. Watch | Read

Japan legalises hacking back. From October 1st, Japan's Self-Defense Forces and police can identify and disable infrastructure used to attack them. They're calling it "proactive cyber defence." In less polite places it's called offensive cyber ops. Either way, it's a significant shift for a country that's been constitutionally locked into a defensive posture since 1946. Watch | Read

Thanks for reading! If you’ve spotted something interesting in the world of cyber this week, a breach, a tool, or just something a bit weird, let us know at hello@riskycreative.com. We’re always learning, and your input helps shape future episodes.

Ant Davis and Luke Pettigrew write this newsletter and podcast.

The Awareness Angle Podcast and Newsletter is a Risky Creative production.

All views and opinions are our own and do not reflect those of our employers.

This week, the threats got personal. A fake Google Meet update that hands attackers the keys to your PC. An SMS that pinged Luke's phone at a hospital and turned out to be a live scammer on the end of the line. A banking glitch that let strangers see your salary, your benefits, and your child payments. And a former government insider who allegedly walked out with the personal data of almost every living American on a thumb drive.

Oh, and if you've got an old iPhone? Stop reading this and go update it first.

The full episode is an hour well spent. Watch on YouTube, listen on Spotify, Apple Podcasts, or wherever you get your podcasts. Ant and Luke don't do death by PowerPoint, just straight talking cyber news for people who actually care about the human side of security.

This week's episode is available to watch on YouTube

Watch or listen to the episode today - YouTube | Spotify | Apple Podcasts

Visit riskycreative.com for past episodes, our blog, and our merch.

SANS is off to Vegas Baby!

If you work in security awareness and you've got something worth saying, this is the room to say it in.

The SANS Workforce Security & Risk Training Security Awareness and Culture Summit Call for Presentations is open right now, and the deadline is Friday 3rd April at 5pm ET. The summit itself runs on the 27th and 28th of August in Las Vegas at Caesars Palace, and it is the biggest gathering of security awareness, behaviour and culture professionals on the planet. 13th year running.

The summit is looking for talks, research and case studies that focus on shifting not just behaviour, but attitudes and beliefs around cybersecurity. If you've got something that's worked in your organisation, something you've learned the hard way, or a genuinely new idea worth sharing with thousands of your peers, they want to hear from it.

And if you've never presented at a conference before, this is a brilliant place to start. Mentoring is available for first time speakers, so you won't be thrown in at the deep end on your own.

If Vegas isn't on the cards, that's not a reason to miss out either. You can present remotely, so there's really no barrier to getting involved.

The deadline is the 3rd of April. Two weeks. Get your submission in.

Submit your proposal here. Get more information on the summit here.

This Week's Stories...

One click on a fake Google Meet update hands attackers the keys to your PC

Watch | Read

A phishing page disguised as a Google Meet update notice is being used to silently enroll victims Windows PCs into an attacker controlled device management system. No malware, no stolen passwords, just a single click.

The page mimics a genuine Google Meet update prompt, but clicking the button triggers a built in Windows feature called MS Device Enrollment, the same legitimate tool your IT department would use to manage a company device. A victim who clicks through hands full remote control of their machine to the attacker, who can then silently install software, change settings, read files, or wipe the device entirely. Because the attack works entirely through the operating system, traditional antivirus tools have nothing to flag. There is no malicious file. No suspicious download. Nothing to scan for.

The best defence here is a human one. Why is Google Meet asking me to update through a webpage? Is this normal? Those two questions, asked out loud, stop this attack dead.

Awareness Angles

• Your antivirus will not save you here - This attack uses a genuine Windows feature to hand over control of your machine. If your only defence is a security tool, you have a gap that only a questioning mindset can fill.
• Knowing what normal looks like matters - Google Meet does not push updates through a webpage like this. Neither do most legitimate apps. If something prompts you to do something you have never seen before, that instinct to pause is worth listening to.
• If you think you might have clicked it - Go to Settings, Accounts, Access Work or School. If you see anything you do not recognise, especially anything referencing sunlife-finance[.]com or esper[.]cloud, disconnect it immediately.

The SMS that pinged Luke's phone at a hospital turned out to be a live scammer on the other end of the line

Watch | Read

SMS blasters are portable rogue devices that mimic legitimate mobile towers, force nearby phones to downgrade to 2G, and deliver phishing text messages that bypass your carrier's spam filters entirely. They sound like something out of a spy thriller, but three people were convicted of using one on the London Underground just a few weeks ago.

This week it got personal. Luke received a suspicious SMS at a local hospital, categorised as being from Google, complete with a verification code he never requested and a support number to call if he didn't recognise the activity. Ant called the number, and the recording is in this week's episode. It wasn't a call centre in Asia with background noise and a script. It sounded like one person in a bedroom, running the whole operation solo, building trust quickly without ever asking for account details, steering the conversation toward a password reset that would have handed over full account access if a real email address had been given. The whole attack is engineered around panic. Someone sees an unexpected verification code, worries their account has been compromised, calls the number in the message, reads out the recovery code that lands on their phone moments later, and it is over before they realise what happened.

Awareness Angles

• A text that appears to be from a legitimate sender is not proof that it is - SMS blasters spoof sender names, bypass carrier filters, and can drop a message into an existing thread with real previous messages from that contact. The name at the top means nothing.
• The script relies on you being worried - The call is designed to feel urgent and helpful at the same time. If you receive an unexpected verification code and feel the urge to call a number in the message, stop. Find the real support number from the official website and call that instead.
• Android users can disable 2G right now - Go to Settings, Network, and look for the option to avoid 2G networks. It is often opted out by default. Turning it on removes the mechanism these devices exploit entirely.

A whistleblower says a former government staffer walked out of the Social Security Administration with the personal data of almost every living American on a thumb drive

Watch | Read

The Social Security Administration's inspector general is investigating a whistleblower complaint alleging that a former DOGE software engineer left his role and took two tightly restricted government databases with him, with at least one stored on a personal thumb drive. One of those databases, NUMIDENT, contains Social Security numbers, dates of birth and parents' names for virtually every living American. He also allegedly claimed to have retained what he described as "god-level" access to SSA systems after leaving. The SSA and the former employee's lawyer have both denied wrongdoing, but investigations are open.

No firewall stops someone walking out of the door with a thumb drive. If the allegations are true, the failure here wasn't technical at all. It was human, procedural and organisational, and the lessons apply just as much to a small business as they do to a government agency.

Awareness Angles

• Revoking access when someone leaves is a critical security control, not an admin task - When did you last audit who still has access to systems they no longer need?
• Insider threats are harder to detect and harder to talk about than external attacks - but they are just as real and no security tool will catch them if the right processes aren't in place.
• The ability to plug a personal device into a government machine should never have been possible - USB port restrictions are unglamorous, but this is exactly why they exist.

Starbucks disclosed a data breach this week affecting nearly 900 employees after attackers created fake login pages to steal their credentials

Watch | Read

Attackers gained access to Partner Central, Starbucks' internal HR platform, by building convincing imitations of the login page and harvesting employee credentials. Once in, they had access to names, Social Security numbers, dates of birth and financial account and routing numbers. The breach ran for 23 days before it was fully resolved, with Starbucks discovering the intrusion on the 6th of February but not fully removing the attackers until the 11th, leaving a five day window where they knew someone was in but couldn't get them out. Affected employees are being offered two years of free identity theft protection through Experian.

The reason this one is worth highlighting isn't the scale, it's the method. Fake login page, stolen credentials, walk straight in through the front door. It's one of the oldest tricks going and it still works, including against large well resourced organisations with dedicated security teams.

Awareness Angles

• This attack didn't exploit a technical vulnerability, it exploited a human one - A convincing fake login page is often all it takes. Knowing what the real login page looks like and being suspicious of anything that asks for your credentials is a habit worth building.
• Financial account and routing numbers are a different category of risk - Unlike an email address or even a password, these create a direct route to fraud. If you've been notified of this breach, contact your bank directly rather than just monitoring.
• Third party platforms expand your attack surface whether you like it or not - Payroll, HR, pensions, training. Every platform your organisation uses is another login screen that can be faked. MFA on all of them isn't optional anymore.

Phish Of The Week

A legitimate Google email was used to deliver a phishing message, and the trick was hidden in plain sight

It's clever but we do wonder how successful this will be

This one is genuinely clever. The attacker submitted a Google account recovery request, but instead of using a normal email address, they put the entire phishing message into the email address field. It looked something like this: unauthorized_order_of_bitcoin_965usd_on_gpay_if_not_you_call_08XXXXXXXXX@domain[.]com. Because it's formatted like an email address, it passed Google's form validation. Because it came from Google's own systems, it landed in inboxes looking completely legitimate.

The goal is to panic the recipient into calling the number, at which point the scam moves off email entirely and onto a phone call where the real manipulation happens. We've seen this pattern before with PayPal, and it's becoming a recurring technique. Get the victim to make contact on a different platform where there are no spam filters, no warnings and no safety net.

Awareness Angles

• A legitimate sender does not mean a legitimate message - This email came from Google. The domain was real, the formatting was real, and it would pass most technical checks. The content is the only thing that gave it away.
• When something tries to move you to a phone call, that's a red flag - Email, text, fake notification. The platform doesn't matter. If the end goal is getting you on a phone call to a number you didn't go looking for yourself, pause.
• Panic is the whole mechanism - Unauthorised Bitcoin purchase, urgent action required, call now. Every word is designed to stop you thinking clearly. Slowing down for ten seconds is genuinely a security control.

Thank you to the Hoxhunt Threat Intelligence team for sharing this with us!

This Week's Talking Points...

Starbucks discloses data breach affecting hundreds of employees Watch | Read

Iran-linked hackers wipe data across 200,000 Stryker devices Watch | Read

Lloyds, Halifax and Bank of Scotland apps exposed strangers' transactions Watch | Read

One click on this fake Google Meet update can give attackers control of your PC Watch | Read

Google Messages may soon get built-in protection against SMS blasters Watch | Read

A whistleblower says a former DOGE staffer walked out of the SSA with Americans' data on a thumb drive Watch | Read

Apple rushes out patches for older iPhones and iPads against the Coruna exploit kit Watch | Read

Topics: ClickFix evolves with a new variant that bypasses Microsoft Defender Watch | Read

Topics: Darren Jones MP accidentally shares his passcode on camera Watch | Watch on Instagram

Topics: Tricking an AI scam caller Watch | Watch on Instagram

Topics: Apple MacBook Neo Touch ID ad Watch | Watch on TikTok

And Finally...

The scam caller that got asked for a Bolognese recipe

Watch

Someone received one of those relentless car finance cold calls this week and decided to have a bit of fun with it. From the start it became pretty clear the caller wasn't human, so they started pushing it. Ask it an off script question, see what happens. Eventually they got it to recite a full Bolognese recipe mid sales pitch, complete with the markdown formatting still intact, hashtags and all, read out loud in a completely earnest robotic voice.

It is funny, and it is worth sharing with people in your life who might not realise how convincing these AI calling systems have become. Because the flip side of that video is that plenty of people who received the same call had no idea they were talking to a machine. If you ask it whether it is human, it says yes. It gives a name. It says it is from Manchester. And that is enough to keep a lot of people on the line.

Show this to someone who needs to hear it. It is a lot easier to hang up on a robot when you know it is a robot.

This week on The Awareness Angle, attackers ditch malware and pick up the phone. Optimizely confirms a breach after a vishing attack, proving again that the helpdesk is now the attack surface.

We’ve got fake QR codes stuck on real parking meters, Samsung’s weather app quietly fingerprinting devices, and the UK fining Reddit over children’s data.

Plus mental health apps with serious security flaws, a researcher accidentally taking control of 7,000 robot vacuums, and a brilliant example of using AI to build interactive awareness training in minutes.

The Awareness Angle makes more sense in full. Watch on YouTube, listen on Spotify, Apple Podcasts, or wherever you get your podcasts. If you prefer your cyber news with context, challenge and a bit of straight talking, this one’s worth your time.

 Listen on your favourite podcast platform - Spotify, Apple Podcasts and YouTube

Listen Now

Podcast · Risky Creative

This week's stories...

Optimizely confirms breach after vishing attack

Watch | Read

This wasn’t some cutting edge exploit. It was a phone call.

Attackers impersonated IT support, convinced staff to hand over SSO and MFA details, and got access to internal systems and CRM records. Optimizely says they didn’t escalate privileges or deploy backdoors, but the real story is how they got in.

We keep talking about this. MFA isn’t failing. People are being redirected around it.

If someone sounds credible, creates urgency, and claims to be internal support, most people don’t switch into “threat actor” mode. They switch into “helpful colleague” mode and that’s the gap.

For awareness teams, this is a great reminder about verification scripts, call back policies, and a chance to emphasise that support staff have permission to challenge authority.

The Awareness Angle

• Authority Is a Shortcut – When someone claims to be internal IT, most people default to cooperation. Attackers know that.
• MFA Can Be Socially Engineered – The control works, until someone convinces you to approve or share it.
• Support Teams Need Different Training – Helpdesks and IT aren’t just defenders. They are targets. Treat them that way in your awareness strategy.

Fake QR codes stuck on real parking meters

Watch | Read

Cybercriminals placed fake QR stickers on 75 parking meters. Drivers scanned, landed on a convincing payment page, and almost handed over their details. No inbox. No malware. Just a sticker and a bit of time pressure.

When you’re paying for parking, you’re not thinking about threat modelling. You’re thinking about not getting a fine.

This is a brilliant story to use internally because it shows that the risk of QR codes hasn't gone away and must be bringing results or the cybercriminals wouldn't continue with it!

The takeaway is simple. Slow down. Check the URL. Use the official app or go to the web page instead of scanning whatever is in front of you.

The Awareness Angle

• Context Changes Behaviour – People don’t apply the same caution in a car park as they do in their inbox.
• Convenience Is the Bait – Quick pay shortcuts are designed to reduce friction. Attackers ride that same instinct.
• Teach Verification, Not Fear – The behaviour to reinforce is simple. Check the URL. Use official apps. Slow down before entering details.

Mental health apps with millions of installs and hundreds of flaws

Watch | Read

Researchers found over 1,500 vulnerabilities across ten Android mental health apps, including AI therapy companions and CBT trackers. Collectively, they’ve been installed 14.7 million times.

People are using these apps at their lowest points. Logging thoughts. Sharing deeply personal struggles. And behind the scenes, insecure storage, weak session handling, and other issues are sitting there waiting to be abused.

This is not a “delete all apps” panic story. It’s a reminder that popularity isn’t the same as security. It's also not laying blame at the developer's door. Maybe, with all of the AI coding tools available, it's just become too easy to build something that isn't secure.

If you’re in awareness, this opens up a bigger conversation with some important things to check. App permissions. Update frequency. Who built this thing. When was it last maintained.

The Awareness Angle

• Sensitivity Should Raise Standards – The more personal the data, the higher the security bar should be.
• Install Numbers Mean Nothing – Millions of downloads create false confidence.
• Awareness Goes Beyond Email – App hygiene, updates, permissions and developer credibility are part of modern security literacy.

This Week's Discussion Points...

Ad Tech Firm Optimizely Confirms Data Breach After Vishing Attack Watch | Read

Fraudulent QR Codes Found on 75 Kelowna Parking Meters Watch | Read

Your Samsung Weather App Is a Fingerprint Watch | Read

UK Fines Reddit £14.47M for Using Children’s Data Unlawfully Watch | Read

Android Mental Health Apps With 14.7M Installs Found With Security Flaws Watch | Read

Instagram to Alert Parents if Teens Search for Self-Harm and Suicide Content Watch | Read

Security Flaw Allows Man to Accidentally Gain Control of 7,000 Robot Vacuums Watch | Read

Building Interactive Security Training With Gemini Watch

We Invented the Dacia Sandman and the Internet Fell for It Watch | Read

ClickFix Pop-Ups in the Wild Watch | Read

Samsung Privacy Display Feature Watch

Protect Yourself From This Latest Ahrefs Phishing Attack Watch

And finally...Building Interactive Security Training With Gemini

Watch

Luke shows how he used Google Gemini to build an interactive security awareness module in minutes.

With a simple prompt, Gemini generated a ClickFix training page in HTML, complete with explanations, red flags, and a knowledge check. He then refined the look and even built a retro-style phishing game with multiple levels and feedback.

No specialist tools. No complex setup. Just prompts and iteration.

The big takeaway is this. The barrier to creating engaging, customised awareness content is lower than ever. You still need to sense check, validate, and tidy things up, but as a rapid prototyping tool, it is seriously powerful.

This episode is packed with leaked customer data, another employee phishing story that turned into a full blown breach, and some awkward questions about how much we really trust our password managers.

This week on The Awareness Angle, ShinyHunters are back with more stolen data, Canada Goose is investigating after hundreds of thousands of customer records were leaked, and Eurail has confirmed traveller information is now up for sale on the dark web. Different brands. Same story. Collect loads of data. Store it. Hope it never gets out.

We also talk about a fintech firm that disclosed a breach after a single employee was phished. One inbox. One click. Real consequences. The human layer is still where this starts.

Then we get into password managers. What do they actually see? Where are the weak spots? And are we a bit too comfortable assuming the vault is untouchable?

All of that, and a few opinions from us along the way, in this week’s edition of The Awareness Angle.

The Awareness Angle is best served in full. Watch on YouTube, listen on Spotify, Apple Podcasts, or wherever you get your podcasts. If you like your cyber news with context, challenge, and a few raised eyebrows, this one’s for you.

Watch or listen to the episode today - YouTube | Spotify | Apple Podcasts

Visit riskycreative.com for past episodes, our blog, and our merch.

This Week's Stories...

Phishing Led Breach at Figure

Watch | Read

Fintech firm Figure has disclosed a data breach after an employee fell victim to a phishing email.

According to the company’s filing, the attack began with a successful phishing email that compromised an employee account. From there, the attacker gained access to internal systems and certain customer files.

Figure says there is currently no evidence that financial account credentials or customer funds were accessed. However, names, contact details and other personal information linked to customer accounts were exposed. Impacted individuals are now being notified.

ShinyHunters has reportedly claimed responsibility and says the breach is linked to a wider campaign targeting organisations using single sign on providers.

No zero day. No nation state. Just one convincing email.

The Awareness Angle

• Phishing still works – Even in fintech, even with mature security teams, one well crafted email can open the door.
• Access pathways matter – Inbox compromise is only step one. The real question is what that account can reach once inside.
• Human risk is business risk – This started with a person. Controls, monitoring, and response speed determine how far it spreads.

AI Generated Passwords Might Not Be as Smart as You Think

Watch | Read

There’s been a bit of noise this week around AI generated passwords, and it’s worth paying attention to.

Researchers looked at passwords created by tools like ChatGPT, Claude and Gemini and found something interesting. They looked strong. They had symbols, numbers, upper and lower case. They passed basic strength tests. But they weren’t truly random.

Because large language models generate likely patterns, not true entropy, some passwords followed very similar structures. In some cases, near identical formats were repeated across tests. That means an attacker who understands how these models tend to construct strings could reduce the guesswork significantly.

It’s not that AI is useless. It’s just not built to be a cryptographic random number generator. So, if you’ve ever asked a chatbot to “give me a strong password”, it might be worth changing it.

The Awareness Angle

• Complex looking isn’t the same as secure – If something follows a pattern, attackers can learn that pattern.
• AI generates probability, not randomness – That works brilliantly for language. Not so brilliantly for passwords.
• Don’t outsource security decisions to convenience – Use a password manager, a long passphrase, or passkeys. Let tools designed for randomness handle randomness.

Infostealer Malware Now Targeting OpenClaw Secrets

Watch | Read

We spoke more than once over the past few weeks about OpenClaw and the rise of agent based AI tools. This week, that story moved on yet again.

Security researchers have identified the first real world case of infostealer malware specifically harvesting OpenClaw configuration files. Not just browser passwords. Not just cookies. But API keys, authentication tokens and private cryptographic material tied to AI agents.

The important bit here is this.

People are wiring these agents into email, apps, local files and workflows. They are giving them memory. They are giving them access. And that means a single malware infection can now expose not just accounts, but the operational identity of someone’s AI assistant.

This is not a futuristic attack. It is infostealer malware doing what infostealers do. It just found a new goldmine of data sitting locally on machines.

AI agents are quickly becoming high value identity hubs.

The Awareness Angle

• AI agents centralise access – Email, tokens, apps and history all in one place makes them incredibly powerful, and incredibly attractive to attackers.
• Malware evolves fast – Infostealers are not targeting “AI” as a concept. They are simply harvesting files that contain keys and secrets. AI tools just happen to store lots of them.
• Experimentation needs guardrails – Curiosity is good. But when employees plug new tools into core systems without visibility, risk expands quietly.

Eurail and Canada Goose – Contact Data Still Has Teeth

Watch | Read

Two very different brands this week, same underlying issue.

Eurail has confirmed that stolen traveller data is now being offered for sale online. The data includes names, email addresses, country of residence and booking details. Around the same time, Canada Goose began investigating claims that roughly 600,000 customer records were leaked, including names, email addresses, phone numbers and mailing addresses.

In both cases, you see the familiar reassurance. No payment data accessed. But if you know someone recently booked travel or bought something expensive, you do not need their card number. You just need enough context to send a believable message. “Problem with your booking.” “Issue with your delivery.” “Click here to avoid cancellation.”

That is where the real risk sits. Follow on phishing, smishing and impersonation campaigns that feel legitimate because they are built on real events.

The Awareness Angle

• Context is leverage – Real booking or purchase data makes phishing dramatically more convincing.
• Contact data is currency – Names, emails and phone numbers are more than enough to fuel targeted fraud.
• The second wave matters – The breach itself is often only the start of the story.

This week's discussion points...

Main Stories

73,000+ Patients Hit in Arizona Urology Data Breach Watch | Read

Eurail Says Stolen Traveller Data Is Now for Sale Watch | Read

Figure Discloses Breach After Employee Phishing Attack Watch | Read

Canada Goose Investigates 600,000 Customer Record Leak Watch | Read

ShinyHunters Claims CarGurus Breach Watch | Read

US Plans Portal to Bypass Content Bans Watch | Read

Vulnerabilities Found in Popular Password Managers Watch | Read | Read (Reddit discussion)

Infostealer Malware Targeting OpenClaw Secrets Watch | Read

AI Generated Passwords May Be Predictable Watch | Read

Extras

TikTok – Review Scam News Clip Watch | Watch on TikTok

And Finally...Online Review Blackmail Scam Hits Small Business

Watch | Watch on TikTok

An ITV News clip highlighted a small business owner who was targeted with a different kind of scam. Criminals demanded payment, threatening to flood his company with fake one star reviews if he refused. They followed through.

Dozens of negative reviews appeared online, damaging his rating and threatening his livelihood. Instead of paying, he worked with Google to challenge the fake reviews. Eventually, the attackers stopped and moved on.

It is a reminder that not all cyber attacks involve malware or data theft. Sometimes the weapon is reputation.

The Awareness Angle

• Reputation is attack surface – Reviews, ratings and search results can be manipulated and weaponised. Your digital presence is part of your security footprint.
• Panic is the pressure point – Scammers rely on urgency and fear. The goal is to trigger a quick payment before you think clearly.
• Do not reward the behaviour – When there is no financial return, attackers often move on to easier targets. Reporting and persistence matter.

Thanks for reading! If you’ve spotted something interesting in the world of cyber this week, a breach, a tool, or just something a bit weird, let us know at hello@riskycreative.com. We’re always learning, and your input helps shape future episodes.

Ant Davis and Luke Pettigrew write this newsletter and podcast.

The Awareness Angle Podcast and Newsletter is a Risky Creative production.

All views and opinions are our own and do not reflect those of our employers.