We have all opened our emails and seen the message “you have annual security awareness training assigned”. This message is one that usually elicits eye-rolls and groans of frustration. Who wouldn’t be annoyed? After all, these trainings are simplistic, boring and they take time out of your day to get done. They also tend to have little to no effect on user security practices. Running phishing and social engineering tests in an environment will almost certainly yield the same groups of people.

Yesterday Apple released several patches for their different operating systems. One that we have talked about before is a core bug in Apple’s WebKit based Safari. This bug could potentially leak personal information regardless of the privacy settings you had enabled. In macOS you could always change to another browser that was not WebKit based. On iOS, iPadOS, watchOS and other app store locked devices there was no option as Apple requires every browser to use WebKit for its render engine.

Metabook has announced some new security features in their messenger app and platform. Many of these are items that competing SMS/MMS applications and services already have, but Meta knows that they need are now facing some solid competition, so they are finally getting around to these. Of course, this does not mean that people are going to flow back to Meta Messenger. None the less, it is good to see these show up.

Researchers at Morphisec have detailed a new delivery type for AsyncRAT (Remote Access Trojan) used in part of a phishing campaign that has been running since at least September 2021. The phishing part of the campaign is routine, an email with an HTML attachment. The attachment looks like a receipt. When opened, the victim is directed to a webpage that asked them to save a file (an ISO file). On the surface it looks like it would be a regular file download that will go through common security channels. However, things turn out not to be what they expected (read that in Morgan Freeman’s voice).