Google Drive

A user's Gmail account was hijacked, leading to unauthorized access and a forced child lock that prevents password changes. The user, who uses Google Drive for data storage, is struggling to recover the account despite having 2FA enabled. The account was compromised while attempting to reconnect with a friend for Minecraft modding via Curse Forge.

Researchers at Zenity Labs discovered a security flaw in OpenAI's ChatGPT workspace agents, dubbed 'AgentForger,' which allows attackers to create malicious AI agents by tricking victims into clicking a disguised link. These agents can access connected corporate services like Outlook, Teams, and Google Drive to steal data or send phishing messages, leveraging the victim's permissions without requiring password theft.

Fake game downloads are spreading malware through RenPy Loader, which uses MSBuild and EtherHiding to deliver Amatera Stealer. The malware steals sensitive data like passwords, cryptocurrency wallets, and browser information by disguising itself as legitimate game or software installers.

A security flaw in the Claude for Chrome browser extension, called ClaudeBleed, allows malicious extensions to impersonate the Claude website and force the assistant to perform unauthorized actions, such as reading Gmail or manipulating documents. Anthropic addressed some issues but researchers claim the core vulnerability remains unresolved, enabling rogue extensions to exploit permissions granted to Claude.

A user received an email from what they believed to be an internship program, which included documents to review via Google Drive. Upon opening the file, Google Drive indicated the email address did not exist, prompting the user to discover scam warnings on the program's website and take security measures like changing their password and purchasing virus protection.

The FBI warns U.S. law firms about Silent Ransom Group (SRG), an extortion crew using callback phishing and in-person attacks to steal sensitive data. SRG impersonates IT staff to gain remote access or physically infiltrate offices, using USB drives to copy files for ransom. The group has targeted legal firms since 2022, exploiting the sector's sensitive data.

A flaw in the Chrome extension for Anthropic's Claude AI model allows any other plugin to hijack victims' AI, potentially leading to unauthorized actions such as extracting files from Google Drive and sending emails on behalf of a user. The vulnerability was discovered by LayerX, a browser security firm. Researchers reported the flaw to Anthropic, but claim that only a partial fix was issued.

A student built a crypto-based paywall system on Solana allowing users to sell digital files via USDC payments. Friends successfully used it to sell piano sheet music PDFs, bypassing traditional platforms and fees. The system offers instant transactions with minimal fees and supports various file types and links.

Google has released a desktop search app for Windows, resembling macOS's Spotlight, now globally available in English. The app enables web and file searches across Windows 10+, Google Drive, and features like AI Mode and Google Lens integration.