📝 Show notes
CyberAware Daily — 2026-10-07
- Fake ad portals for ChatGPT, Gemini and Claude are harvesting logins and one-time codes
- How to spot a fake AI login page and what to do instead
- LibreOffice and OpenOffice flaw: malicious spreadsheets can run code with no macro warning
- Who is actually affected by the Linux backdoor campaign in Korea and Taiwan
- DarkWatch update: a new ransomware-as-a-service operation and an active DragonForce leak site
- One habit that protects you against both of today's biggest risks
More at https://cyberawareuk.co.uk
📄 Full transcript
It's Wednesday, the 7th of October, and this is Cyber Aware UK, the show that helps British
families spot scams before they bite. I am Bully. And I am Alex. Wednesday means mid-week intel.
So we're rounding up the freshest alerts from Darkwatch, and the stories worth knowing about.
Let's start with the headline that will matter to the most people.
Fake ad portals pretending to be ChatGPT, Gemini, and Claude are being used to capture
people's login details and their two-factor codes. So someone sees an advert, clicks it,
and lands on a page that looks exactly like the real AI tool. That's it. You type in your email
and password, then it asks for the six-digit code from your phone, and the scammers take both and
log in as you straight away. Why are these AI accounts such a target?
There's no money in a chatbot, surely? It's what's inside them. Your chat history might hold work
documents, personal details, even passwords you've pasted in for help. And scammers can use your
account to send dodgy links to your contacts. What's the practical defense here?
Never log into an AI tool through an advert. Type the address yourself or use a bookmark you saved
earlier. If a page asks for your one-time code when you weren't expecting it, stop and walk away.
Good advice. What else is on the list today?
Two software flaws that affect normal office work. LibreOffice and OpenOffice have a weakness
where a malicious spreadsheet can run code without ever showing you the macro warning.
So no enable macros prompt, no obvious sign anything is wrong?
Correct. The document just opens and quietly does its thing. This is rated important to critical
depending on the version, and it mostly affects people opening files from outside their organization.
So who needs to act on that? Anyone who regularly opens spreadsheets from email,
job applications, or unknown senders. Check with your IT team if you're at work,
and on a home machine, make sure LibreOffice is on the latest version.
If you weren't expecting the file, don't open it.
And the third item?
Linux backdoors disguised as email security tools, seen in Korea and Taiwan.
It's a targeted campaign against specific organizations,
so the average household isn't the target here.
That's reassuring to hear said plainly.
Is there anything in the Darkwatch numbers today?
There's a new ransomware as a service operation that's just started advertising,
and an active dark web leak site belonging to a group called Dragon Force.
We won't be reading any addresses out, but the point is these crews are actively recruiting and trading.
What does that mean for a family in Leeds or Cardiff?
It means keep doing the basics well.
Offline backups, updates turned on, and never paying a ransom demand that arrives out of the blue.
So what's the one thing to take away today?
If a login page arrives via an advert, or a spreadsheet arrives unexpectedly, treat it as suspect.
Go direct to the site yourself, and if you didn't ask for the file, don't open it.
That one habit blocks both of today's biggest risks.
We'll be back tomorrow.
Stay sharp, stay safe.