Day: October 30, 2026

  • California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment

    The Trump administration is taking direct aim at California state election officials, issuing grand jury subpoenas to election offices statewide ahead of the final day of voting on Nov. 3.

    The investigations, first reported by Bloomberg, center on alleged administration of illegal voting. They are ostensibly tied to demands by the U.S. Justice Department that California and other states use federal voter lists to determine whether a voter is a “potential noncitizen” and should be removed.

    The Los Angeles County Registrar of Voters told CyberScoop it received multiple grand jury subpoenas last week related to the investigation. The office called the federal efforts an attempt to intimidate California election officials into accepting federal supremacy over state voter registration authority.

    “At every step, the U.S. Department of Justice has taken a confrontational, adversarial approach,” said Los Angeles County Registrar Dean Logan in a statement. “Election officials are acting in accordance with state and federal law. Clear court rulings at both the U.S. District Court level and the Court of Appeals have confirmed that. Threats and intimidation have no place in elections. We will take whatever steps necessary to ensure the safety of our employees and to remain focused on serving the voters of Los Angeles County so they can exercise their voting franchise.”

    California Secretary of State Shirley Weber, also reportedly a target of the federal probe, did not respond to a request for comment from CyberScoop.

    One California election official, Clint Curtis, the outgoing registrar of voters in Shasta County, endorsed the federal government’s efforts to remove 20,000 voters from California voter rolls. Curtis, whose term ends in January, was previously part of a failed effort to hire Tina Peters, a felon and former Mesa County, Colorado, election clerk to help with the upcoming midterms. Curtis has long believed in widespread election fraud.

    He told CyberScoop earlier this year that he believed Shasta County elections in 2024 were plagued by suspicious mail-in ballots, saying they looked, felt and “smelled” different from normal mail ballots.

    The U.S. Constitution gives states the authority to administer elections and Congress the power to make election laws, something courts have repeatedly upheld in dozens of legal challenges by the Trump administration.

    The Department of Justice has claimed there are at least 20,000 such potential noncitizens on California’s voter lists, while the Department of Homeland Security told CyberScoop the figure could be as many as 190,000. The administration’s data, drawn from public voter lists, federal databases and commercially purchased personal information, has been repeatedly criticized by election officials, voting experts and federal courts as inaccurate and unreliable for determining voter eligibility.

    Most people identified as “potential noncitizens” turn out to be naturalized citizens who have since gained voting rights, or the result of state administrative errors that mistakenly registered a small number of ineligible voters. Many of those mistakenly registered never cast a ballot.

    State officials have had to defend against attempts at federal coercion as well as third-party activists who are constantly testing and probing election procedures nationwide, sometimes without understanding the laws election officials must follow to verify voters.

    On Wednesday, the Hennepin County Attorney’s Office in Minnesota announced felony charges against a pair of right-wing provocateurs, James O’Keefe and Cam Higby, for unlawful voting and identity theft. According to a statement from Hennepin County Attorney Mary Moriarty, the two showed up at various election offices, provided false identities of real voters to election judges, violating state laws against misrepresenting their identity in applying for a ballot.

    “Elections are the bedrock of democracy and their protection is one of our highest priorities. Individuals engaging in unlawful conduct related to our elections will be held accountable,” said Moriarty. “Our office has had regular meetings with Hennepin County Elections staff in preparation for both the primary and the general elections this year and we are fully prepared.”

    Voting rights and civil society groups are also executing short- and long-term plans to combat potential voter disenfranchisement ahead of Tuesday.

    Jessica Ayoub, deputy political director for the Michigan American Civil Liberties Union, said her organization has “never been more prepared” for any expected fights with the federal government or local officials seeking to disenfranchise voters, saying they first began planning for different scenarios 18 months ago, cultivating relationships with hundreds of clerks and election staff across Michigan.

    “We’ve gamed out 25 potential scenarios and have rapid response strategies that we’ll deploy to ensure our elections are protected and that our democracy remains intact,” said Ayoub, who cited a desire not to publicize further details ahead of next month.

    On Friday, voting rights groups filed a new lawsuit against the Department of Justice and Department of Homeland Security in California, seeking to block the federal government’s efforts against state election officials.

    The groups are asking a judge to declare that the federal government has exceeded its constitutional authority and that state officials are legally carrying out their duties. They also want the court to force the departments to contact all California election officials who received subpoenas and tell them the investigation has halted due to a court order.

    Source: CyberScoop · 2026-10-30

  • Trezor warns of suspected crypto-theft implant in hardware wallet

    Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. […]

    Source: BleepingComputer · 2026-10-30

  • Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach

    Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach

    The state’s Department of Education (FLDOE) said on Thursday it became aware of a data breach involving the Florida Student Financial Aid website on October 19.

    Source: The Record · 2026-10-30

  • New Framework Puts Ransomware Resilience for AI Systems in Focus

    RAID-AI aims to help organizations assess their security preparation for ransomware attacks targeting AI systems

    Source: Infosecurity Magazine · 2026-10-30

  • Behind the Blog: Tech Support

    Behind the Blog: Tech Support


    Behind the Blog: Tech Support

    This is Behind the Blog, where we share our behind-the-scenes thoughts about how a few of our top stories of the week came together. This week, we discuss customer service and Proton fallout.

    JASON: Since I wrote about ChatGPT turning me into tech support for people’s random problems, I have gotten many more AI-generated emails from people asking me to solve their tech support problems. So, mission accomplished I guess. I think and hope it was clear in the article, but I think this phenomenon is happening to a lot of journalists, not just us at 404 Media. A lot of the ChatGPT chats I saw told people to reach out to multiple journalists, and gave them contact info and instructions on how to do so. Some suggested that they reach out to lawyers or academic researchers as well, so I assume it’s all sorts of people who are getting this new type of spam. 

    Source: 404 Media · 2026-10-30

  • L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara

    L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara

    I ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese.

    Source: Dark Reading · 2026-10-30

  • Fake PDF and search tools hijacked searches for 13.4 million Chrome users

    Ads promoted browser extensions as tools to find manuals, convert PDFs, or make searches safer. But many of these extensions sent users’ search queries through servers controlled by their operators.

    Socket researcher John Tuckner identified 319 extensions with an estimated 13.4 million installs over a decade. The extensions hijacked users’ default search settings and routed their searches through servers controlled by the operators before sending them to Yahoo or Bing. This gave the operators access to users’ queries and let them earn referral payments.

    Socket says the extensions were promoted through ads on networks including Google Ads, promoting tools such as “manual finders,” “PDF converters,” “safe search,” and “AI search.”

    The extensions were listed in Google’s official store, but most were unlisted. That means people with a direct link could visit a listing and install an extension, while ordinary searches in the store would not show it. An ad offered help with an immediate task, a landing page encouraged installation, and the official store provided a familiar place to complete it.

    Search hijacking

    The main risk was that operators could see what users searched for. Searches can reveal health worries, financial problems, workplace interests, or other personal matters. Socket says queries were often associated with a unique identifier, which could let the operators link a user’s searches over time.

    The proxy could also choose where to send a search. Socket says this could potentially direct users to phishing or malware pages, but it did not find evidence that the extensions had done so.

    What should users do?

    If your searches start going astray, or you installed a search, PDF-converter, manual-finder, or security extension after clicking an ad, check what’s installed.

    • Review your extensions. Enter chrome://extensions in Chrome’s address bar. Remove extensions you don’t recognize, no longer use, or don’t trust. To remove one, select Remove and confirm. If you’re unsure about an extension, check it against the list at the end of Socket’s blog.
    • Check your search settings. In Chrome, at the top right, select More (the three-dot menu), then Settings > Search engine. If Chrome says an extension is controlling a setting, review or remove that extension. The absence of this notice doesn’t confirm that all your extensions are safe.
    • Run a Malwarebytes scan to check for malicious extensions and other malware that could be affecting your device.

    From reporting threats to removing them.

    Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

    Source: Malwarebytes Labs · 2026-10-30

  • Bloatware in Aftermarket Auto Parts

    This story is interesting:

    One Civic owner purchased a cheap aftermarket head unit off Amazon, and decided to have Claude work its magic on it, like it would a smart TV. What was reportedly discovered isn’t surprising, but is worth knowing about.

    Among the pre-installed bloatware—­or spyware, if you’re being less charitable­—was a voice assistant equipped with WebView, an Android system component that lets apps display content off the web. This apparently always used about a third of processing power, even while idle, which isn’t great. There were also Baidu location services, a call recorder (!), a DAB radio client that is pretty much useless in the U.S., and Adobe Acrobat, presumably so your passenger can entertain themselves with PDFs on the go.

    It’s interesting because it exposes all the insecurities in this piece of IoT software. But I think the real story is that a random person was able to do this reverse-engineering with the help of AI. Expect a lot more stories like this in the future.

    Source: Schneier on Security · 2026-10-30

  • TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them

    TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them

    TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host.

    A malicious or compromised host can exploit the flaw to crash the viewer’s TeamViewer and, depending on the platform, may also run

    Source: The Hacker News · 2026-10-30

  • Defense contractor pleads guilty to aiding North Korean remote worker scheme

    A defense contractor with top secret security clearance pleaded guilty to aiding North Korea’s remote worker scheme by allowing co-conspirators to use his identity to apply for jobs, including positions with national security implications, the Justice Department said Wednesday. 

    John Allen Kurrle Jr. participated in a short-lived but prolific conspiracy that spanned at least 88 job applications at U.S.-based companies, resulting in nine job offers, according to court records.

    The 62-year-old allowed co-conspirators to use his identity and government clearance for prospective sensitive work, often with U.S. government contractors. The nine job offers Kurrle’s co-conspirators received between June and October 2025 had annual salary ranges of $120,000 to $190,000.

    The scheme had a limited success rate. The longest and most lucrative job a co-conspirator landed under Kurrle’s identity lasted about three weeks, netting a total pay of $4,800.

    His identity was also used to gain employment as a software engineer at a Ventura, California-based company to work on a generative AI project for a component of the U.S. military. The company sent a laptop to Kurrle’s residence in Gainesville, Virginia, where he received and hosted laptops shipped by multiple victim companies, enabling co-conspirators to remotely access the devices from outside the United States.

    Yet, during a video call to verify employment eligibility, the company noticed that the person who appeared on the video call did not match Kurrle’s age or physical characteristics, according to court records. The unnamed company terminated the employment of Kurrle’s co-conspirator before he did any work on the military contract and Kurrle shipped the laptop back to the company. 

    The company paid Kurrle’s co-conspirator almost $2,200 for 32 hours of onboarding, which Kurrle is now ordered to pay in restitution along with the $4,800 received from the other company. 

    Kurrle also, as part of his plea agreement, admitted to using the identity of a third person, without their consent, to apply for some remote work positions. He doesn’t dispute that the scheme likely benefitted North Korea, but claims he wasn’t aware of the connections to North Korea during the duration of his involvement in the conspiracy.

    Michael Barnhart, nation state investigator at DTEX, said researchers previously identified Kurrle as a facilitator for North Korea’s remote worker scheme. Yet, until recently, he wasn’t sure if Kurrle was a victim or impersonated. 

    The case underscores North Korea’s efforts to gain access to roles with a strategic intelligence requirement, as it focuses on contractor roles because those present the path of least resistance.

    Kurrle joins a growing list of people who have been charged or jailed for supporting the North Korea regime’s scheme that generates hundreds of millions of dollars annually for the country’s military and organizations involved in its weapons programs.

    Authorities have been cracking down on the malicious insider activity by seizing cryptocurrency linked to the theft, and targeting U.S.-based facilitators who provided forged or stolen identities and hosted laptop farms for North Korean operatives. 

    Some of that money is also funneling through a web of front companies and intermediaries, including sanctioned entities, that partly fund Russia’s war effort against Ukraine, DTEX said in a report in July. This includes manufacturing weapons and supplying them to Russia’s military, according to the security firm.

    The countermeasures are stacking up, but the scheme is widespread and has infiltrated an undetermined number of businesses, including hundreds of Fortune 500 companies.

    Federal judges previously sentenced other people to prison for their involvement in the scheme, including Matthew Issac Knoot and Erick Ntekereze Prince; Keija Wang and Zhenxing Wang; Audricus Phagnasay, Jason Salazar and Alexander Paul Travis; Oleksandr Didenko and Christina Chapman. 

    Kurrle pleaded guilty to conspiracy to commit wire fraud and faces up to 20 years in prison upon sentencing, which is currently scheduled for Jan. 28, 2027.

    Source: CyberScoop · 2026-10-30