Modalità di lettura

Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts

The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend, after instructions began circulating on Telegram showing how to trick Meta’s “AI support assistant” bot into resetting account passwords.

A screenshot from a video released on Telegram claiming to show how Meta’s AI customer support bot could be tricked into resetting a target’s password.

On May 31, word began to spread on several Telegram instant message channels that Meta’s AI bot would happily add an email address to an existing account as part of the bot’s standard password reset flow.

A video released on Telegram by pro-Iran hackers claimed to document a remarkably simple exploit that appears to have involved using a VPN connection with an IP address that is in or near the target’s usual hometown, requesting a password reset for the account, and then choosing to chat with Meta’s AI support assistant. From there, the video shows the attacker told the bot to link the account in question to a new email address, after which the bot dutifully sent that address a one-time code that allowed a password reset.

The Telegram account that posted the video also linked to screenshots of pro-Iran images, videos and messages that defaced the hacked Instagram accounts, saying hackers had used the exploit to hijack a number of valuable (read: short) Instagram account names that allegedly have a resale value of more than a half million dollars.

Meta has not responded to requests for comment on the video’s claims, but Meta’s Andy Stone said on Twitter/X that the issue had been resolved and that they were securing impacted accounts. The security blog thecybersecguru.com reports that Meta pushed an emergency patch over the weekend, and clarified that no back end database was breached.

“Instagram has notoriously poor human support infrastructure,” Cybersecguru wrote. “Recovering a locked account – especially a high-value one can take weeks of back-and-forth with an automated ticketing system. Meta’s solution was to deploy a conversational AI layer to handle common recovery workflows: relinking a lost email address, triggering a password reset, verifying account ownership. The assistant, presumably, was supposed to reduce friction for legitimate users stuck in account-access hell.”

Ian Goldin, a threat researcher at Lumen’s Black Lotus Labs, said we’re entering unchartered security territory as more large online platforms start allowing AI chatbots to handle sensitive account recovery requests. Just like human customer support employees can be social engineered into providing unauthorized access to someone’s account, AI bots are equally eager to help and vulnerable to persuasion and trickery, he said.

“AI chatbots create interesting new attack surface, and we’re likely going to see a lot more of these kinds of attacks,” Goldin said.

Securing your various online accounts means taking full advantage of the most secure form of multi-factor authentication (MFA) offered (such as a passkey or security key). In this case, even using the least robust form of MFA that Instagram offers — a one-time code sent via SMS — likely would have blocked the exploit: The hackers who released the video on Telegram said their exploit failed to work against any accounts that had MFA enabled.

  •  

IT Security Guru picks for Infosecurity Europe 2026

With Infosecurity Europe kicking off tomorrow, many of us will be fine tuning our schedules and prepping for the festivities to kick off. The Gurus have been busy collecting a selection of unmissable events to help you plan your trip and ensure you get the most out of your visit. 

Here’s a selection of ones we think you’ll enjoy:

Tuesday Talks

Joanna Mendez, Former CIA Chief of Disguise and author 

The Deception Playbook: Inside the Mind of a CIA Spy

Keynote Stage 

Tuesday, 2nd June @ 10:10 – 10:50 

This keynote explores how the principles of espionage, deception and psychological manipulation underpin many of today’s most effective cyber-attacks. Drawing on her experience as the CIA’s former Chief of Disguise, Jonna Mendez shares compelling real-world lessons on trust, influence and human vulnerability, offering security leaders a fresh perspective on social engineering risks and organisational resilience.

 

Darren Guccione, CEO and Co-Founder, Keeper Security: 

Super-Identities at Machine Speed: Securing the Rise of AI Agents

Cyber Strategies Stage 

Tuesday, 2nd June @10:00 – 10:25

This session explores the growing security risks posed by AI agents as they become increasingly autonomous within enterprise environments. You’ll learn why traditional identity and access controls are no longer sufficient, and gain practical guidance on securing AI agents through least-privilege access, continuous monitoring and governance frameworks that support emerging UK and EU regulations.

 

Nico Hulkenberg, F1 Driver, Audi Revolut F1 Team and Lisa Forte, Partner at Red Goat Cyber Security 

In the Driver’s Seat with Nico Hulkenberg 

Keynote Stage 

12:25-12:45

With around 250 Grand Prix races in his career, Nico Hülkenberg is one of the most experienced drivers in the industry. In cyber security we often draw parallels with the Formula 1 world, as both operate with speed, data, risk and teamwork at extremely high stakes. Join Lisa Forte and Nico as they take to the stage, for this racy unmissable conversation.

 

Mayur Upadhyaya, CEO and Co-founder, APIContext:

Resilience at Machine Speed 

Resilience and Cyber Risk Theatre

Tuesday, 2nd June @ 12:45 – 13:15

This session examines how organisations can improve resilience in increasingly automated, machine-to-machine environments where service failures are often difficult to detect. You’ll learn how to identify modern monitoring blind spots across APIs and third-party services, and how continuous external verification can help spot issues early before they affect customers or business operations. 

 

Matthew Brady, Black Duck: 

Reporting Active Exploits in 24 Hours: Are You Ready for the CRA?

Resilience and Cyber Risk Theatre

Tuesday, 2nd June @ 15:00 – 15:30

This session focuses on how organisations can prepare their vulnerability management and AppSec processes for the Cyber Resilience Act’s strict reporting requirements. Attendees will gain practical insights into the operational, technical and workflow changes needed to detect, verify and report actively exploited vulnerabilities quickly, while improving cross-team collaboration, automation and compliance readiness.

 

Tim Ward, CEO and Co-founder, Redflags, and Daniela Waugh, Head of Information Security, S&W Group:

Intelligent Behaviour Change in the Age of AI

Case Studies Stage

Tuesday, 2nd June @ 14:15 – 14:45

This case study session explores how organisations can drive meaningful, long-term security behaviour change by understanding and influencing how people make decisions in the workplace. You’ll learn practical approaches to reducing human risk, fostering a stronger security culture, and using insights from employee interactions with AI tools to identify emerging risks and shape effective governance strategies.

 

Filigran and Centrica Plc 

From Scattered Insights to Actionable Intelligence: Breaking Team Silos and Turning Indicator Noise to Signal Using AI

Case Studies Stage 

Tuesday, 2nd June @14:40 – 15:05 

This session explores how organisations can make cyber threat intelligence more effective by breaking down security silos and improving the quality of threat data. Through a real-world case study from Centrica, you’ll learn how AI-enhanced intelligence workflows and automated feedback mechanisms can help prioritise threats more effectively, reduce noise, and create a more proactive, intelligence-led security operation.

 

Wednesday Talks

Meera Tamboli, DFIR Analyst at AVEVA

What 500+ Mentoring Calls Taught Me About Confidence in Cybersecurity

Community@Infosec

Wednesday 3rd June, 10:00 – 10:30

This session explores the personal and professional challenges many people face when building a career in cybersecurity, including imposter syndrome, burnout and fear of failure. Through insights gained from mentoring hundreds of cyber professionals, attendees will learn why community, authenticity and support are critical to building confidence, resilience and long-term success in the industry. 

 

Rik Ferguson, Vice President Security Intelligence, Forescout

“Quantum is still far off, we can wait – can’t we?”

Keynote Stage

Wednesday, 3rd June 2026  @ 11:00 – 11:45

This session explains why post-quantum cryptography (PQC) is a migration challenge that organisations need to address today, rather than a future problem to worry about when quantum computers arrive. You’ll learn how long technology refresh cycles can create hidden risks, what steps should be taken now to avoid crypto-agility issues, and how leading industries are preparing for the transition to quantum-safe security.

 

The Cyber Agony Aunts 

The Resiliency Quad: Integrated Framework for Sustaining Human Performance

Community@Infosec

Wednesday, 3rd June @ 13:30 – 14:00

This session introduces the Resiliency Quad, a framework for building sustainable performance through a balanced approach to physical, emotional, technological and developmental resilience. Attendees will gain practical insights into how strengthening these interconnected areas can improve wellbeing, adaptability and long-term effectiveness in both personal and professional settings.

 

Women in Cyber 10 Year Celebrations! 

This year Infosec marks a decade of the Women in Cybersecurity programme with sessions designed to inspire, empower and drive real change. The sessions will explore how women are redefining success in their cybersecurity careers and what’s shifted over the past 10 years. They’ll also highlight how allyship and diverse teams now play a crucial role in strengthening cyber operations. With practical insights, forward looking discussion and a special keynote speaker, this milestone year offers a powerful look at how far the industry has come and what’s next.

 

Cyber Fest 2025 Cyber House Party (Sold Out) | The Fox, Excel | 3rd June | 17:30 – 23:30pm

Cyber House Party is the industry’s biggest fundraising bash, plus you get to hear colleagues, peers, connections show off their DJing skills. Always a blast! AND they’re raising money for the NSPCC. 

 

Thursday Talks

Yemurai Rabvukwa, Senior Cybersecurity Associate and Cyber Careers Influencer, Individual Contributor

Navigating the Imposter Monster as a Cyber Professional

Community@Infosec

Thursday, 4th June 2026 @ 10:00 – 10:30

This keynote explores how cybersecurity professionals can overcome self-doubt by reframing imposter syndrome as the Imposter Monster. Attendees will learn a practical framework for building confidence, managing uncertainty and developing a healthier mindset for personal and professional growth.

 

Peter Coroneos, Founder of Cybermindz 

Human Capability Risk in Cybersecurity: When Defender Burnout Becomes a Control Opportunity

Keynote Stage

Thursday, 4th June 2026 @ 11:00 – 11:35

This session explores the often-overlooked link between human performance and cyber resilience, highlighting how stress, burnout, poor sleep and uncertainty can directly affect the effectiveness of security operations. Attendees will learn how to treat workforce wellbeing as an operational risk factor, using measurable performance data and governance frameworks to strengthen decision-making, improve resilience and maintain the long-term effectiveness of cyber defence teams. 

 

Mo Patel / Phil McGowan, Huntress:

Ditch the Hype on Zero Trust: Take Practical and Actionable Steps to Improve Your Security Posture Today

Deep Dive Stage

Thursday, 4th June 2026 @ 12:30 – 13:15

This session cuts through the hype around Zero Trust, explaining why it is a security strategy rather than a product. You’ll gain a clearer understanding of the core principles behind Zero Trust, how they address modern security challenges, and what organisations should focus on when building a practical Zero Trust architecture based on continuous verification and least-privilege access. 

 

Nasser Arif, Cybersecurity Manager at NHS 

Life Outside of Cyber 

Community@Infosec

Thursday, 4th June 2026 @ 13:30 – 14:00

This session shares the career journey and insights of an award-winning NHS Cyber Security Manager who progressed from volunteer to leading security across multiple NHS Trusts. Attendees will gain perspectives on building positive security cultures, making cybersecurity more accessible and inclusive, and balancing technical expertise with the human side of security. 

 

That’s our take on the hottest line up at Infosec this year, if you do see us at any of the above, say hello!

 

 

The post IT Security Guru picks for Infosecurity Europe 2026 appeared first on IT Security Guru.

  •  

Nine in Ten Security Leaders Concerned About AI-Generated Code Risks as Salt Security Launches New Governance Tool

The rapid adoption of AI coding assistants is creating a new governance challenge for enterprise security teams, according to research released by Salt Security, which found that nine in ten security leaders are concerned about the security risks associated with AI-generated code. The research, AI Coding Assistants and the New Security Challenge, surveyed 100 IT security leaders across the UK and US and highlights the growing tension between software development speed and security oversight.

According to the study, 67% of organisations now report widespread adoption of AI coding assistants across development teams, reflecting how deeply AI has become embedded in modern software engineering practices. However, governance frameworks have struggled to keep pace. While organisations increasingly rely on AI to accelerate development, 38% still depend primarily on manual reviews to assess AI-generated code, a process many security leaders believe is becoming unsustainable.

Among respondents, 29% identified insecure coding patterns as the biggest risk introduced by AI assistants, while 15% cited concerns about generated code failing to align with internal security policies.

The findings mirror wider industry concerns about the quality and security of machine-generated software. According to figures cited by Salt Security, AI coding assistants now generate nearly half of all code written on platforms such as GitHub, while independent research has found that a significant proportion of AI-generated code contains known vulnerabilities.

“AI coding assistants are fundamentally changing how software is built, but governance has not kept pace,” said Roey Eliyahu, CEO and co-founder of Salt Security.

“Most organisations recognise the risks, but many are still trying to manage AI-generated code using security processes designed for a pre-AI world. That approach does not scale. Security leaders need visibility, consistency and embedded governance across the AI-assisted development lifecycle before code volumes become unmanageable.”

The research also revealed that larger enterprises face greater operational complexity as AI adoption grows. Organisations with more than 500 employees were significantly more likely to report challenges around governance consistency, developer overreliance on AI-generated outputs and policy enforcement across distributed development teams.

The findings coincide with the launch of Salt Code, a new addition to the company’s Agentic Security Platform designed to enforce security policies directly within AI coding assistants such as Claude Code, GitHub Copilot, Cursor, Gemini CLI and Codex. Salt Code is designed to move security controls earlier in the software development lifecycle. Rather than relying solely on traditional security testing tools after code has been written, Salt Code applies organisational security policies during code generation itself.

At the heart of the platform is Salt’s Posture Governance Engine, which allows organisations to define security and compliance requirements once and enforce them consistently across code creation, deployment and runtime environments. The platform includes pre-built policy packs covering frameworks such as the OWASP API Top 10, MCP Security Top 10, LLM Security Top 10 and OpenAPI/Swagger compliance.

According to Salt Security, the approach is intended to address what it describes as “security drift”, or the gradual divergence between organisational policies and actual development practices that can occur as AI-generated code volumes increase.

“AI is writing code faster than organisations can govern it, whether that AI is Claude, Gemini, Copilot, or the next tool a developer downloads tomorrow,” Eliyahu said.

“For the first time, security policy travels with the code itself, from the first prompt through every stage of the pipeline and into runtime. Organisations no longer have to choose between the speed AI enables and the security their business requires.”

Industry analysts have argued that governance will become increasingly important as AI-generated code forms a growing share of enterprise software. Salt’s research suggests that organisations are already recognising the challenge, with security leaders expressing concerns that manual review processes are struggling to scale alongside AI-assisted development.

“I regularly point organisations toward Salt because the full Agentic Security Graph is genuinely differentiating. Salt Code is the piece that ties it together,” said Christopher M. Steffen, CISSP, CISA, CCZ, VP of Research, Information Security, Risk and Compliance Management, Enterprise Management Associates. “With code-level context layered onto runtime behaviour, Salt is building a multi-dimensional defence for agentic systems rather than another single-point tool. That is the direction this market needs to move.”

The company is encouraging organisations to focus on improving visibility into AI-generated code, reducing dependence on manual review, standardising secure development practices and treating AI coding assistants as part of the wider software supply chain.

As enterprises continue to embrace AI-assisted development, the findings suggest that the next phase of adoption may be defined less by productivity gains and more by how effectively organisations can govern and secure the code these systems produce.

The post Nine in Ten Security Leaders Concerned About AI-Generated Code Risks as Salt Security Launches New Governance Tool appeared first on IT Security Guru.

  •  

Framapetition Error 500

Bonjour à tous,

Avec mon association, nous souhaitons mettre une pétition en ligne. Nous avons fait un “test” en signant nous-même une fois mais, une fois que nous avons cliqué sur le bouton “signer”, une page d’erreur 500 s’affiche et, dans la finalité, la signature n’est pas comptabilisée.

J’ai cru comprendre que cette erreur est déjà arrivée et je voulais savoir comment les autres internautes l’ont résolue ?

Si jamais il y a besoin de changer de site, quelle alternative conseillez-vous ?

En vous souhaitant une bonne journée !!

3 messages - 2 participant(e)s

Lire le sujet en entier

  •  

Khrys’presso du lundi 1er juin 2026

Comme chaque lundi, un coup d’œil dans le rétroviseur pour découvrir les informations que vous avez peut-être ratées la semaine dernière.


Tous les liens listés ci-dessous sont a priori accessibles librement. Si ce n’est pas le cas, pensez à activer votre bloqueur de javascript favori ou à passer en “mode lecture” (Firefox) ;-)

Brave New World

Spécial IA

Spécial Israël et Palestine

Spécial femmes dans le monde

Spécial France

Spécial femmes en France

RIP

Spécial médias et pouvoir

Spécial emmerdeurs irresponsables gérant comme des pieds (et à la néolibérale)

Spécial recul des droits et libertés, violences policières, montée de l’extrême-droite…

Spécial résistances

Spécial outils de résistance

Spécial MAGAM et cie

Les autres lectures de la semaine

Les BDs/graphiques/photos de la semaine

Les vidéos/podcasts de la semaine

Les trucs chouettes de la semaine

Retrouvez les revues de web précédentes dans la catégorie Libre Veille du Framablog.

Les articles, commentaires et autres images qui composent ces « Khrys’presso » n’engagent que moi (Khrys).

  •  
❌