iOS 27 includes a new privacy feature called Impersonation Risk Detection, designed to flag social engineering scams where attackers pose as banks or trusted contacts to pressure victims into transferring money or changing account details. The feature is disabled by default and must be turned on manually through Settings > Privacy & Security > Impersonation Risk Detection. It works by analyzing device and Apple Account signals to generate a risk score that participating apps can use to add warnings, delays, or identity checks.
9to5mac.com
· 2026-09-16
A man identified as Dave says his 9-year-old son unknowingly spent $118,000 on YouTube ad campaigns promoting his Minecraft and Roblox gameplay videos over roughly three weeks. The charges went through a company credit card Dave had saved to a Google account shared with his son, after he had shown the boy how to run a small $20 promotion. Some of the promoted videos gained hundreds of thousands of views before finance staff flagged the spending.
tomshardware.com
· 2026-09-16
Apple has released iOS 27 for iPhone models back to the iPhone 11, and users are advised to create a local, computer-based archive before installing it. This is because iCloud backups only retain the most recent version, so restoring to a prior iOS release becomes impossible once a device has been backed up under iOS 27.
cnet.com
· 2026-09-15
Prophet Security analyzed every alert across customer environments from May to July 2026, rather than only alerts analysts chose to escalate. Of the incidents fully investigated, 93% were benign and 7% were confirmed malicious, with identity-related attacks accounting for roughly half of that malicious activity. The firm identified session hijacking, token replay, MFA bypass, credential stuffing, and phishing as the dominant attack patterns.
bleepingcomputer.com
· 2026-09-10
A technical breakdown explains how Windows XP picked a user's initial account picture: it used the RtlRandomEx function seeded with GetTickCount(), scanning the default pictures folder once rather than twice. This single-pass method is a special case of reservoir sampling, selecting one item fairly as the folder is enumerated.
devblogs.microsoft.com
· 2026-09-10
Security researchers note that as MFA, conditional access and device trust make direct credential theft harder, attackers are shifting focus to account recovery workflows. Instead of stealing a user's second authentication factor, criminals are tricking service desk staff into resetting or reassigning it on their behalf.
bleepingcomputer.com
· 2026-09-09
Instagram creators report losing significant income after scammers filed fraudulent copyright claims against their accounts, then demanded payment to retract them. One creator with 1.5 million followers paid $50 to a scammer to avoid weeks of lost income while waiting for Meta's official appeal process. Meta says it has restored affected content and added new protections after reviewing the reports.
bbc.co.uk
· 2026-09-08
OpenAI has introduced a parental controls system that lets parents link their ChatGPT account to their teen's via an email or phone invitation sent through the Settings menu. Once accepted, parents can view and adjust safety settings for their child's account from a dedicated Family members section.
engadget.com
· 2026-09-06
Google's new Antigravity coding assistant carries terms of service stating that using it through unauthorized third-party integrations may lead to suspension of a user's Google account. A Google representative pushed back publicly on claims mischaracterizing the policy, saying critics were misrepresenting how it actually works and noting internal discussions about eventually allowing the harness and subscription to work with other surfaces.
twitter.com
· 2026-09-03
Dropbox notified users that roughly 5,000 accounts were accessed without authorization between August 4 and 21, 2026, with files downloaded from about 1,500 of them. The breach traces to a single sign-on integration with Lenovo IDs, where a gap in Lenovo's email verification let attackers register accounts under victims' email addresses and log into their Dropbox accounts without needing inbox access.
9to5mac.com
· 2026-09-02
Multiple Samsung account holders report on Reddit and Samsung's own community forum that their accounts were suddenly deactivated, with Samsung citing vague security reasons. Some users regained access after contacting Samsung's phone or chat support, while others remain locked out. One theory ties the suspensions to email aliases using '+' or '.' characters, but Samsung has not confirmed a cause.
androidauthority.com
· 2026-09-02
Dropbox has notified some customers that attackers broke into their accounts by exploiting a flaw in Lenovo's email verification system, which let them register a fraudulent Lenovo ID tied to the victim's email address. Because Dropbox's login integration trusted Lenovo's identity assertions without independently confirming account ownership, attackers could log in without knowing the victim's Dropbox password. Dropbox says the intrusions occurred between August 4 and August 21, and Lenovo has attributed the issue to a legacy integration between its ID system and Dropbox.
bleepingcomputer.com
· 2026-09-02
GoKawiil