The Weekly
Brief

On 4 November the National Cyber Security Centre (NCSC) warned that criminals are spreading Android malware disguised as a job-seeker app. It starts with a job conversation on social media or a messaging app, followed by a request to install an app from a link rather than the Google Play Store, sometimes talked through on a phone call. Once the app is installed it shows a fake Google Play update page so it looks official, then asks for access to the phone’s “Accessibility” settings. Once that is allowed, the malware can change the phone’s permissions and settings, in the NCSC’s words “ultimately giving the scammer full access to the device.”

The NCSC says the same malware can be disguised in other ways, including as a banking app. Because it can install further malware, uninstalling the app may not be enough to remove it; a factory reset is more likely to work. If you think you have been caught, contact your bank straight away, change your passwords starting with email and banking, and report it to the NCSC.

On 5 November Microsoft’s threat intelligence team described attackers using ARTEX, an “agentic” AI framework (an AI that carries out a chain of steps by itself), to hunt for secrets that developers accidentally publish: passwords, API keys and app credentials left in code on GitHub. Since August it has run large volumes of GitHub searches combining a target organisation’s name with secret-related words and the names of cloud and AI services. When it found something, the agent tested the credential, mapped what it could reach and carried on with little human input; when a request failed, it changed approach and retried until it worked. In at least one case Microsoft saw an agent go from scanning GitHub to taking data out of an Azure Key Vault, the locked box where organisations keep their keys and passwords, in five minutes.

From late October the attackers used stolen app credentials to sign in to Microsoft Entra ID tenants, the identity system behind Microsoft 365. In some, the compromised apps reached SharePoint and OneDrive, downloaded files and accessed mailbox items. One stolen credential belonged to a supplier’s app used by many customers, so a single leak opened several organisations at once. Keys for AI services were a favourite target. Microsoft has not named a group behind this campaign; a related post the next day describes a Cambodia-based group it calls Storm-3358 using the same framework against financial organisations, mainly in Southeast Asia.

Microsoft’s quarterly email threat report, published on 5 November, counted about 7.3 billion phishing emails from July to September, with nearly 3 billion in September alone, up 41% on August. About 129 million pretended to come from well-known business services, and DocuSign was the most-faked brand in September at 29% of that month’s total. Nearly all attacks with an attachment (94–96%) were after sign-ins rather than installing anything, by leading people to a fake login page; as Microsoft puts it, “An attachment did not need to install software to put an account at risk.” Fake invoice payment requests rose 89% in September.

Two details stand out. In one September campaign aimed at more than 56,000 people, the emails passed SPF, DKIM and DMARC, the checks that prove an email came from the domain it claims, because the attackers sent from a domain they controlled and simply set the display name to look like someone in sales or HR. And on Teams, attackers making malicious calls have largely dropped obvious “Help Desk” names: ordinary personal names rose from 46% to 88% of Microsoft’s sample between July and September, while explicit help desk identities fell from 17% to 2%.

On 3 November MBIE announced a trial of the NZBN Business Passport, the first government-issued digital credential and the second accredited under the Digital Identity Services Trust Framework (Westpac’s was the first). It sits in a digital wallet on your phone and lets a business share verified details, including proof that a person is allowed to act on the business’s behalf, instead of filling in forms and sending documents every time. The trial is with selected Westpac business customers, who can keep it in the Govt.nz app wallet and use it alongside Westpac’s own credential, which proves the business owns its bank account.

The Government says credentials stay encrypted on the holder’s own device rather than in a central database, and holders choose what they share. The Trust Framework Authority independently assessed the passport against privacy and security requirements. MBIE is talking with other banks and organisations, and feedback from the trial will decide any wider rollout; no date has been given.