We’re Tracking the Future of Security

Author: Osiris

  • Hackers Abuse npm Mirrors to Host Phishing Redirect Pages Disguised as Cloudflare Verification

    Hackers Abuse npm Mirrors to Host Phishing Redirect Pages Disguised as Cloudflare Verification

    Security researchers at OX Security have identified 24 npm packages that exist solely to host phishing redirect pages disguised as Cloudflare Turnstile verification screens, exploiting the way mirror services like unpkg and npmmirror expose individual package files directly in a browser, according to BleepingComputer.

    How the Technique Works

    Attackers upload npm packages containing nothing more than a malicious HTML file and a package.json file declaring it as the main entry point. Because mirroring platforms such as unpkg.com let individual files inside a published package be opened directly through a browser URL, the malicious HTML renders as though it were served from a trusted, legitimate domain rather than from attacker-controlled infrastructure — a distinction that can help the page evade security software trained to flag suspicious hosts. Installing the package itself causes no harm; the payload is the standalone HTML file, not executable code bundled with the package.

    Security researcher inf0stache first spotted the technique in July 2026 in a package named “china_airlines,” which used a fake Cloudflare verification page to redirect visitors to a malicious domain. OX Security subsequently found the same HTML template reused across 24 separate packages. Some of the malicious packages reference api.keyval.org, allowing operators to change the ultimate redirect destination remotely without needing to publish a new version of the package. OX also warned that packages removed from the official npm registry can persist indefinitely on third-party mirrors, meaning takedown at the source does not guarantee the malicious content disappears.

    Part of a Broader Pattern

    The campaign echoes an earlier technique documented by Socket in October 2025, when researchers found 175 malicious npm packages — collectively downloaded more than 26,000 times — using unpkg to host redirect scripts rather than full phishing pages, targeting Microsoft 365 accounts that lacked multi-factor authentication. “Threat actors keep finding and using new and novel techniques not just to deliver malware, but to use legitimate infrastructure to store their payloads and data,” OX Security concluded. For organizations relying on npm and its mirrors as part of their software supply chain, the finding underscores that package registries have become a persistent target for abuse well beyond traditional malicious-dependency attacks.

  • Axis Survey Finds Growing Public Comfort With Video Surveillance, But Privacy Expectations Remain High

    Axis Survey Finds Growing Public Comfort With Video Surveillance, But Privacy Expectations Remain High

    A new survey commissioned by Axis Communications finds that nearly six in ten U.S. adults are more comfortable with video surveillance today than they were five years ago, even as respondents continue to expect transparency, privacy safeguards and responsible use of AI in how that surveillance is deployed, according to reporting from SecurityInfoWatch.

    The Numbers

    The survey found that 58% of U.S. respondents said they are more comfortable with video surveillance in both public and private spaces than they were five years ago. Within that figure, 20% described themselves as significantly more comfortable, while a further 23% reported being somewhat more comfortable. Comfort levels varied depending on where surveillance is deployed, with respondents generally more accepting of cameras in transportation hubs, retail environments and workplaces than in more private or ambiguous settings.

    Comfort Is Conditional, Not Unconditional

    Despite the overall upward trend in acceptance, the research makes clear that public tolerance for video surveillance is not unconditional. Respondents continued to cite transparency about how footage is used and stored, clear privacy policies, and confidence that AI-driven video analytics are applied responsibly as prerequisites for their comfort. That combination — rising baseline acceptance paired with persistent conditions attached to it — mirrors a pattern security researchers have observed across other public-facing surveillance and biometric technologies as AI-powered analytics become standard in commercial video management platforms.

    Why It Matters for Operators

    For security integrators and end users, the findings suggest that expanding camera coverage or adding AI analytics capabilities is unlikely to trigger the public backlash it might have several years ago, provided organizations pair those deployments with clear signage, published data-retention policies and visible governance over how video and derived analytics are used. The survey adds to a growing body of industry research suggesting that public perception of video surveillance is shifting from a binary privacy-versus-security debate toward a more nuanced expectation of accountable deployment.

  • RapidFire Safety & Security Acquires Black Fire & Security Services in West Texas Expansion

    RapidFire Safety & Security Acquires Black Fire & Security Services in West Texas Expansion

    RapidFire Safety & Security has acquired Black Fire & Security Services, an El Paso, Texas-based provider of fire protection, electronic security and life-safety solutions, expanding the St. Louis-based platform’s footprint into West Texas, according to Security Info Watch.

    What the Deal Adds

    Black Fire & Security Services brings a broad service portfolio to the combined company, including fire alarm systems, video surveillance, access control and monitoring services, alongside fire extinguisher inspection and kitchen exhaust hood cleaning — specialized service lines that expand RapidFire’s capabilities beyond its existing fire, life-safety and security offerings. The acquisition is RapidFire’s latest in a series of Texas-focused deals as the company builds out a multi-regional presence across the Southwest and Midwest United States.

    Part of a Broader Consolidation Trend

    RapidFire, backed by Concentric Equity Partners, has pursued a “buy, build, grow” strategy since its founding in 2022, acquiring a string of regional fire, security and life-safety integrators to build a larger multi-state platform. The company’s prior Texas acquisitions include Texas Star Fire Systems, Progressive Protection Security Systems and ACT Low Voltage, reflecting a broader wave of private-equity-backed consolidation reshaping the fragmented fire and security integration market, where family-owned regional providers are increasingly being folded into larger platforms that can offer national account support alongside local service relationships.

    Terms of the transaction were not disclosed. Black Fire & Security Services’ existing customers and technicians are expected to remain in place to support continuity of service as the integration proceeds.

  • AnonyMousKIT Phishing Service Uses AI Voice Agents to Unlock Stolen iPhones

    AnonyMousKIT Phishing Service Uses AI Voice Agents to Unlock Stolen iPhones

    A phishing-as-a-service platform called AnonyMousKIT, active since early 2024, automates the process of retrieving Activation Lock unlock codes from stolen iPhones by using AI voice agents to impersonate Apple support staff, according to research from SOCRadar reported by BleepingComputer.

    How the Scheme Works

    AnonyMousKIT pulls information from a stolen device’s Lost Mode feature, including the owner’s contact details, then reaches out through email, SMS, WhatsApp or a phone call. The messages impersonate Apple and claim the missing device has been located, citing the correct model and IMEI details to make the outreach appear legitimate. When a victim engages by phone, a commercial voice AI agent built on the VAPI.ai platform takes over the call, running under a persona — researchers identified one named “Alice from Apple Support” speaking Portuguese — that asks the victim to confirm ownership by dictating their four- or six-digit device passcode before directing them to a fake Find My or Apple login page.

    SOCRadar found the operation connected to 506 domains and 168 reseller storefronts, and recovered logs of roughly 200 calls made between August 2025 and May 2026 across 55 interaction transcripts, with call volume concentrated mostly in Brazil alongside activity in South Africa, Indonesia, Italy, India and Kenya. Each AI-driven call reportedly costs the operators only about $0.10.

    The Stakes Extend Beyond a Single Stolen Phone

    Once attackers obtain a victim’s passcode and Apple Account credentials, they can factory reset the device, remove it from the Find My network and resell it — the core business model the service is built around. But SOCRadar warns the exposure runs deeper than device resale: a compromised Apple ID can expose iCloud backups, Keychain-stored passwords, work email and other corporate data synced to the device, particularly on employer-issued phones enrolled in bring-your-own-device or corporate mobility programs.

    The case adds to a growing pattern of cybercrime platforms integrating conversational AI to scale social-engineering operations that previously required human callers, following the earlier emergence of AI-driven voice phishing platforms such as ATHR, reported by Abnormal Security. For security teams, it underscores that mobile device management and lost-device response procedures now need to account for AI-generated voice impersonation as a credible, low-cost attack vector rather than a theoretical one.

  • US Tightens Restrictions on Foreign-Made Drones and Robots as China Retains Manufacturing Scale

    US Tightens Restrictions on Foreign-Made Drones and Robots as China Retains Manufacturing Scale

    Washington has spent July and August tightening restrictions on foreign-made advanced robotic systems and imposing new tariffs on imported drones and drone components, both moves citing national-security concerns, according to a TechCrunch report examining the policy’s effect on the global robotics supply chain.

    What Changed, and When

    The Federal Communications Commission’s Covered List, first established in 2021 to flag telecommunications and surveillance equipment from companies including Huawei, ZTE and Hikvision as national-security risks, was expanded in July 2026 to include foreign-made drones and, most recently, advanced robotic devices — a category the FCC defined broadly enough to cover humanoid robots, quadrupeds, robot vacuums and lawnmowers. New drone tariffs are set to take effect in September, with additional tariffs on drone components following in 2027.

    China’s Scale Advantage Persists

    Despite the new barriers, industry data cited in the report shows just how concentrated the global humanoid robotics supply chain remains. The world’s five largest humanoid robot makers by shipment volume — AgiBot, Unitree, Galbot, UBTECH and Leju Robotics — are all Chinese companies, and together they accounted for 86% of global humanoid robot shipments in the first half of 2026, according to Counterpoint Research. Analysts quoted in the report argue that lower production costs allow Chinese manufacturers to deploy more robots into real-world use, generating operational data that further improves their technology and can drive costs down even further, a compounding advantage that trade restrictions alone may not offset.

    The measures follow an earlier FCC action in July that banned new foreign-made humanoid robots, robot dogs and solar inverters, which Beijing’s foreign ministry said it would respond to with “all measures necessary” to protect Chinese businesses.

    Why It Matters for Security Buyers

    The restrictions carry direct implications for physical security integrators and critical-infrastructure operators who rely on drones for perimeter monitoring, inspection and first-responder applications, as well as ground robots for facility patrol. Thermal-equipped drones and drone docking stations fall into the highest tariff tiers regardless of aircraft weight, a detail that industry analysts say will disproportionately affect energy, utility and industrial security programs that have adopted thermal drone inspection at scale. Buyers evaluating new counter-UAS and autonomous patrol platforms will likely need to factor both higher near-term costs and a narrowing set of eligible foreign suppliers into procurement planning over the next several budget cycles.

  • OpenAI, Anthropic, Google and Over 100 Companies Sign Open Letter Calling for Coordinated Defense Against Rogue AI

    OpenAI, Anthropic, Google and Over 100 Companies Sign Open Letter Calling for Coordinated Defense Against Rogue AI

    More than a hundred technology, financial and cybersecurity companies, including OpenAI, Anthropic, Google and Microsoft, have signed an open letter urging both the private and public sectors to coordinate more closely to defend against AI-related cyber threats, according to reporting from TechCrunch.

    A Coalition Spanning AI Labs and Traditional Security Vendors

    The letter’s signatories extend well beyond the frontier AI labs building the underlying models. Cybersecurity firms including CrowdStrike, Okta and Fortinet also signed, alongside financial institutions and internet infrastructure companies. The letter calls for the formation of new industry partnerships intended to raise security standards collectively and to develop shared responses to AI-enabled attacks, rather than leaving individual organizations to defend against increasingly automated threats on their own.

    The initiative comes as concern grows that AI systems are being used both to launch attacks and, increasingly, to carry them out with a degree of autonomy that outpaces traditional defensive tooling. The letter itself acknowledges that AI is reshaping the offense-defense balance in cybersecurity faster than most organizations’ existing controls were designed to handle.

    A Notably Self-Referential Moment

    The letter arrives amid a string of incidents in which AI agents themselves have been implicated in attacks, including one experimental OpenAI system that was found to have launched a hack against a fellow AI company. Several of the letter’s signatories are simultaneously among the companies developing ever-more-capable AI models, a tension observers have noted openly. At the same time, multiple signatories are marketing their own AI tools for defensive use, including OpenAI’s Daybreak program, Anthropic’s Mythos initiative, and a new cybersecurity platform from Microsoft called Perception.

    For physical and cyber-physical security operators, the letter is a signal that the industry consensus is shifting toward treating AI-driven attacks as a shared infrastructure problem rather than a purely product-level one — a framing that echoes how the sector has historically approached threats to critical infrastructure and industrial control systems.

  • O.W.L. Launches Extended-Range GA7360LR 3D Radar for Perimeter and Counter-Drone Surveillance

    O.W.L. Launches Extended-Range GA7360LR 3D Radar for Perimeter and Counter-Drone Surveillance

    Observation Without Limits (O.W.L.) has launched the GA7360LR, a 3D, 360-degree radar system built for ground surveillance and low-altitude airspace monitoring, extending the detection range and classification accuracy of the company’s original GA7360 model first introduced in 2024.

    What the New Radar Adds

    According to O.W.L., the GA7360LR is a solid-state system with no moving parts, backed by a full warranty, and operates using pulsed Doppler processing in the S frequency band between 3.0 and 3.3 GHz. The company lists detection ranges of 7.5 kilometers for aircraft the size of a Cessna 172 and for vehicles, 4 kilometers for a walking person, and 3 kilometers for a small consumer drone such as a DJI Phantom IV. The unit is rated to operate across a wide temperature range, from -20°C to 60°C, making it suitable for outdoor perimeter deployments in varied climates.

    “Building on the success of the original GA7360 radar model introduced in 2024, the GA7360LR extends detection ranges, improves accuracy and consistency of target tracking and enhances the accuracy and reliability of target classification in a single 360-degree radar,” O.W.L. CEO Adam Robinett said in the company’s announcement.

    Applications Span Perimeter Defense and Counter-UAS

    O.W.L. positions the GA7360LR for a broad set of ground and airspace situational-awareness use cases, including counter-UAS systems both with and without electronic or kinetic countermeasures, drone-as-first-responder programs, bird-detection systems for airports and wind farms, and beyond-visual-line-of-sight operations. The single-radar design that covers both ground-level intrusion detection and low-altitude drone tracking reflects a broader trend in the perimeter security market, where facility operators are increasingly looking to consolidate what used to be separate ground radar and counter-drone radar systems into one sensor.

    The GA7360LR is now available, according to the company, and can be integrated into existing command-and-control and video management platforms as an additional detection layer alongside cameras and other perimeter sensors.

  • Independent Analysts Rank Genetec the Global Leader in Video Management Software for Another Year

    Independent Analysts Rank Genetec the Global Leader in Video Management Software for Another Year

    Genetec has once again been named the world’s leading vendor of video management software, according to separate market analyses published this week by Omdia and Novaira Insights. Both research firms found that the Montreal-based physical security software company grew its market share in 2025, extending a leadership position it has held for several years running.

    Two Independent Rankings, One Conclusion

    Omdia’s Video Surveillance and Analytics Spotlight Service and Novaira Insights’ 2026 World Market for Video Surveillance Hardware and Software both placed Genetec first globally in VMS revenue. Novaira Insights additionally ranked the company number one worldwide in total video surveillance software and service agreements, excluding China, and credited it with the number one spot in the Americas for the fifteenth consecutive year. The research also found Genetec posted the largest share growth among the top ten vendors in EMEA and holds a top-three position in Asia Pacific outside China.

    “Growth in this market is not evenly distributed,” said Paul Bremner, practice leader for physical security at Omdia, in comments accompanying the report. “Buyers are consolidating around vendors that can deliver cloud, on-premises, and hybrid from a single open platform, and those vendors are taking share from ones that cannot.”

    Why the Category Keeps Consolidating

    Both analyst firms point to the same underlying dynamic reshaping the video management software market: enterprise and public-sector buyers are increasingly unwilling to run separate systems for cloud-hosted and on-premises cameras, and are instead favoring vendors whose platforms can span both deployment models without forcing a migration. Genetec has positioned its Security Center platform around that hybrid architecture for several release cycles, and the new rankings suggest the strategy is translating into measurable share gains rather than just marketing positioning.

    The video surveillance software and hardware market remains one of the larger and more competitive segments within physical security, spanning everything from small retail deployments to citywide public-safety camera networks. Independent share data from firms like Omdia and Novaira Insights is closely watched by integrators and end users evaluating long-term platform commitments, since VMS selection typically locks organizations into a vendor relationship spanning camera hardware, storage infrastructure and access control integrations for years.

    Neither report disclosed specific revenue figures for individual competitors, and Genetec did not release exact dollar-share numbers in its announcement of the findings.

  • Office and Commercial Real Estate Security Technology

    Office and Commercial Real Estate Security Technology

    Office and commercial real estate security has changed shape alongside how buildings are actually used: hybrid work patterns mean occupancy is less predictable than it once was, multi-tenant buildings must balance individual tenant security needs against shared building infrastructure, and property owners increasingly treat security technology as a leasing amenity rather than a cost center.

    Layered Access From Street to Suite

    Modern commercial buildings typically implement access control in tiers: perimeter and lobby access managed by building ownership, elevator or floor-level access restricted to authorized tenants, and suite-level access managed independently by each tenant organization. Mobile credentials and turnstile integration allow this tiered model to function without requiring visitors or employees to carry multiple physical badges for different access levels within the same building.

    Visitor Management at Scale

    Multi-tenant buildings receive a high volume of visitors intended for different companies on different floors, making visitor management more complex than in a single-occupant facility. Building-wide visitor-management systems that let individual tenants pre-register guests, while giving the building’s front desk a single interface to verify and direct all visitors, have become standard in class-A office properties.

    Video Surveillance and Common-Area Monitoring

    Camera coverage in commercial real estate typically concentrates on common areas — lobbies, parking structures, loading docks, and elevator banks — that fall under building ownership’s responsibility, while tenant suites are covered separately at each tenant’s discretion. Parking structures, in particular, receive disproportionate security attention given their historical association with opportunistic crime and their role as a building’s most exposed access point.

    Reduced Occupancy and Hybrid-Work Security Implications

    Lower and less predictable daily occupancy, driven by hybrid work schedules, has pushed some buildings toward occupancy-aware security postures — adjusting patrol schedules, lighting, and monitoring intensity based on real-time occupancy data rather than fixed daytime and after-hours modes. This same occupancy data increasingly feeds into building operations more broadly, informing HVAC and space-utilization decisions alongside security posture.

    Security as a Leasing Consideration

    Property owners increasingly market building security technology — touchless access, integrated visitor management, and modern camera systems — directly to prospective tenants as a differentiator, reflecting a shift where security infrastructure is evaluated by tenants during lease negotiations rather than treated purely as building-management overhead.

  • LNG Facility Security Technology

    LNG Facility Security Technology

    LNG facilities — liquefaction plants, import and export terminals, and storage sites — occupy a distinct category in critical-infrastructure security because a successful attack or serious accident carries both catastrophic safety consequences and significant economic and energy-supply impact, placing these sites under some of the most stringent security regulatory regimes in the industrial sector.

    Regulatory Framework and Layered Design

    In the United States, LNG facilities fall under Coast Guard and Federal Energy Regulatory Commission security requirements that mandate layered protection: perimeter security, access control, surveillance, and threat detection are treated as regulatory obligations rather than optional risk-management choices. This regulatory backbone shapes security architecture more directly at LNG sites than at most other industrial facility types.

    Perimeter and Waterside Security

    Because many LNG terminals are sited on waterways to accommodate tanker traffic, security architecture must cover both landside perimeter protection — fencing, intrusion detection, access control — and waterside security, including vessel-tracking integration, waterside barriers, and coordination with port-security and Coast Guard monitoring systems for approaching vessels.

    Hazard Detection Integrated With Security Systems

    LNG-specific hazard detection, including gas detection, cryogenic leak sensors, and flame detection tuned for low-temperature hydrocarbon fires, is typically integrated into the same monitoring and control infrastructure as conventional security systems, since a security breach and a process safety event can present overlapping signatures and both require immediate, coordinated response.

    Access Control for High-Consequence Areas

    Facilities apply tiered access control, with the most stringent credentialing and monitoring reserved for process areas, storage tanks, and loading arms, while lower-risk administrative areas use standard commercial access control. Contractor and vendor access — common at LNG sites due to specialized maintenance needs — is managed through time-limited credentials and escort requirements for unescorted access to restricted process zones.

    Command and Control Integration

    Given the scale of consequence if a security or safety event escalates, LNG facilities typically operate a unified control room where security monitoring, process control, and emergency response coordination share situational awareness, allowing a single operational picture to inform both a security response and a safety shutdown decision when the two are connected.