Cybersecurity researcher Jeremiah Fowler discovered a misconfigured cloud server containing a massive 184 million login credentials, likely collected…

Cybersecurity researcher Jeremiah Fowler discovered a misconfigured cloud server containing a massive 184 million login credentials, likely collected using infostealer malware.

Cybersecurity researcher Jeremiah Fowler has discovered a misconfigured and unprotected database, containing over 184 million unique login names and passwords. According to Fowler’s research, shared with Hackread.com, this exposed collection amounted to approx. 47.42 gigabytes of data.

****A Massive Data Leak****

The database, which was not secured by a password or encryption, stored credentials for numerous online services. These included popular email providers, major tech platforms like Microsoft, and social media sites such as Facebook, Instagram, Snapchat, and Roblox.

Worse, the leak also contained access information for bank accounts, health platforms, and even government portals from various nations, putting unsuspecting individuals at high risk. Fowler confirmed the authenticity of some records by contacting individuals whose emails were found in the database. Several people verified that the listed passwords were indeed accurate and valid ones.

Upon discovery, Fowler quickly notified the hosting provider, and the database was removed from public access. The database’s IP address pointed to two domain names, one of which appeared to be unregistered. Due to private registration details, the true owner of this data cache remains unknown.

It’s also unclear how long this sensitive information was exposed or if other malicious actors had accessed it before its discovery. Since the hosting provider did not reveal customer details, the purpose of the data collection whether for criminal activity or legitimate research with an oversight.

****The Infostealer Connection****

From the looks of it, the database belonged to cybercriminals who were collecting data using infostealers and ended up exposing their own database in the process. Infostealers are widely used and effective tools among criminals. In fact, reports have shown that even the US military and FBI have had their systems compromised by infostealers costing as little as $10.

Infostealer malware is specifically designed to secretly collect sensitive information from infected computers, typically targeting login credentials stored in web browsers, email programs, and messaging apps.

Hackread.com’s reporting of the recent coordinated action by Microsoft and Europol to disrupt Lumma Stealer’s infrastructure, which infected over 394,000 Windows computers worldwide, offers a critical insight into the kind of threat highlighted by Fowler’s discovery.

As analysed by Fowler, the data, often raw credentials and URLs for login pages, aligns perfectly with what infostealers like Lumma are designed to steal. Although Fowler could not definitively name the specific malware responsible for the exposed database, the characteristics of the data strongly suggest such a method.

Cybercriminals exposing their own servers is nothing new. Just a few months ago, reports revealed that the well-known ShinyHunters and Nemesis hacking groups collaborated to target and extract data from exposed AWS buckets, only to accidentally leak their own in the process.

****Protection Against InfoStealers****

The availability of millions of login details presents a major advantage for cybercriminals who can exploit them through methods like “credential stuffing attacks” and “account takeovers.” These attacks allow criminals to access personal data, enabling identity theft or financial fraud.

The exposed data can also include business credentials, posing risks of corporate espionage, and even sensitive state networks. Knowing an email and an old password can make phishing and social engineering attacks more convincing.

Fowler urges users to stop using their emails as cold storage, regularly perform password updates, especially in cases of unknown breaches, never reuse unique passwords across accounts, use Two-Factor Authentication (2FA), and enable login notifications or suspicious activity alerts.

Database Leak Reveals 184 Million Infostealer-Harvested Emails and Passwords

The Lumma infostealer infrastructure has suffered a serious blow by a coordinated action of the DOJ and Microsoft.

The US Department of Justice (DOJ) and Microsoft have disrupted the infrastructure of the Lumma information stealer (infostealer).

Lumma Stealer, also known as LummaC or LummaC2, first emerged in late 2022 and quickly established itself as one of the most prolific infostealers. Infostealers is the name we use for a group of malware that collects sensitive information from infected devices and sends the data to an operator. Depending on the type of infostealer and the goals of the operator, infostealers can be interested in taking anything from usernames and passwords to credit card details, and cryptocurrency wallets.

Lumma operates under a malware-as-a-service (MaaS) model, meaning its creators sell access to the malware on underground marketplaces and platforms like Telegram. This model allows hundreds of cybercriminals worldwide to deploy Lumma for their own malicious campaigns.

What makes Lumma particularly dangerous is its wide range of targets and its evolving sophistication. It doesn’t just grab browser-stored passwords or cookies. It’s also capable of extracting autofill data, email credentials, FTP client data, and even two-factor authentication tokens and backup codes, which enables attackers to bypass additional security layers.

As Matthew R. Galeotti, head of the Justice Department’s Criminal Division put it:

> “Malware like LummaC2 is deployed to steal sensitive information such as user login credentials from millions of victims in order to facilitate a host of crimes, including fraudulent bank transfers and cryptocurrency theft.”

Over the last few months alone, Microsoft identified over 394,000 Windows computers infected with Lumma worldwide. The FBI estimates that Lumma has been involved in around 10 million infections globally.

Using a court order from the US District Court for the Northern District of Georgia, Microsoft’s DCU seized and facilitated a takedown, suspension, and blocking of approximately 2,300 malicious domains that were part of the infostealer’s backbone.

Most of the seized domains served as user panels, where Lumma customers are able to access and deploy the infostealer, so this will stop the criminals from being able to to access Lumma in order to compromise computers and steal victim information.

Government agencies and researchers sometimes alter DNS addresses to lead the traffic to their own servers (called sinkholes). By redirecting the seized domains to Microsoft-controlled sinkholes, investigators can now monitor ongoing attacks and provide intelligence to help defend against similar threats in the future. This takedown slows down cybercriminals, disrupts their revenue streams, and buys time and knowledge for defenders to strengthen security.

**How to protect yourself**

Even with the Lumma infrastructure disrupted, the threat of information stealers remains very real and evolving. Here are some practical steps to reduce your risk:

*   **Use strong, unique passwords** for every account and consider a reputable password manager to keep track of them.
*   **Enable multi-factor authentication (MFA)** wherever possible. Although Lumma tries to bypass 2FA, having it still adds a crucial layer of defense.
*   **Be cautious with emails and downloads.** Lumma often spreads through phishing emails and malicious downloads, sometimes disguised as legitimate CAPTCHAs or antivirus software.
*   **Keep your software and operating system updated** to patch vulnerabilities that malware can exploit.
*   **Regularly monitor your financial and online accounts** for suspicious activity.
*   **Educate yourself about phishing and social engineering tactics** to avoid falling victim to trickery.
*   **Use an up-to-date real-time anti-malware solution** to block install attempts and detect active information stealers.

By understanding how threats like Lumma operate and by taking the necessary steps to protect ourselves, we can reduce the risk of falling prey to these invisible thieves.

You can use Malwarebytes’ free Digital Footprint Portal to see if any of your data has been stolen by a Lumma infostealer. We have many millions of stolen records stemming from Lumma stealers that are being traded on the Dark Web in our database.

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

 Lumma information stealer infrastructure disrupted 

Talos has observed exploitation of CVE-2025-0994 in the wild by UAT-6382, a Chinese-speaking threat actor, who then deployed malware payloads via TetraLoader.

UAT-6382 exploits Cityworks zero-day vulnerability to deliver malware

Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.

CVE-2025-47181: Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability

Microsoft disrupts Lumma Stealer network, seizing 2,000 domains linked to 394,000 infections in global cybercrime crackdown with law enforcement partners.

Microsoft, in a global takedown with support from international law enforcement agencies, has disrupted a major malware distribution network responsible for widespread credential theft, financial fraud, and ransomware attacks. The operation targeted Lumma Stealer, an infostealer malware used by hundreds of threat actors to steal sensitive information from nearly 400,000 infected Windows devices.

This coordinated effort involved Microsoft’s Digital Crimes Unit (DCU), the US Department of Justice, Europol, and cybersecurity partners across the private sector. Together, they seized more than 2,300 domains and dismantled Lumma’s infrastructure, severing the connection between attackers and their victims.

****A Malware-as-a-Service Operation with Global Reach****

Lumma Stealer has been marketed through underground forums since at least 2022 as a plug-and-play solution for cybercriminals looking to steal everything from passwords and credit card numbers to crypto wallets and banking credentials. Its ease of use and adaptability helped it gain traction among threat actors, including high-profile ransomware groups like Octo Tempest.

The tool is often spread through phishing campaigns, malvertising, and malware loaders. In one campaign earlier this year, attackers impersonated Booking.com to lure victims into downloading malware-laced files, a tactic that continues to fool even experienced users.

Microsoft’s Threat Intelligence team has tracked Lumma’s activities closely, identifying widespread infection patterns from March through May 2025. Heat maps shared by the company illustrate the global footprint of this malware, with heavy concentrations of infected devices in North America, Europe, and parts of Asia.

****Legal Action and Infrastructure Seizure****

According to Microsoft’s blog post, on May 13, Microsoft filed legal action in the US District Court for the Northern District of Georgia, securing a court order to block and seize the malicious domains linked to Lumma’s command structure. Simultaneously, the DOJ took control of the central infrastructure, and law enforcement agencies in Europe and Japan shut down local servers supporting the operation.

More than 1,300 domains have already been redirected to Microsoft-controlled servers, known as sinkholes, which now gather intelligence to help protect users and support ongoing investigations. This move cuts off the malware’s ability to transmit stolen data or receive instructions from attackers.

****The Business Behind the Malware****

Lumma wasn’t just malware, it was a business. Sold under a tiered subscription model, it offered services ranging from basic credential theft tools for $250 to full source code access for $20,000. Its creator, known online as “Shamel,” ran the operation like a startup, promoting Lumma with a distinctive bird logo and slogans that downplayed its malicious intent.

In a 2023 interview with a security researcher, Shamel claimed to have 400 active customers. His public presence, despite his involvement in widespread fraud, reflects a broader issue: cybercriminals operating with impunity in jurisdictions that don’t prioritize enforcement or international cooperation.

****Industry Response and Moving Forward****

The effort to dismantle Lumma drew support from a wide range of companies, including ESET, Cloudflare, Lumen, CleanDNS, BitSight, and GMO Registry. Each played a role in identifying infrastructure, sharing threat intelligence, or executing takedowns quickly and efficiently.

Notice on the sites seized by authorities (Via Microsoft)

“This shows how powerful the combination of law enforcement and industry can be,” said Thomas Richards, Infrastructure Security Practice Director at Black Duck, a Massachusetts-based cybersecurity firm. “Dismantling this operation will protect hundreds of thousands of people. But just as important is the follow-up, making sure victims are alerted and supported.”

Richards added that the growth of the Malware-as-a-Service market in recent years requires consistent collaboration across sectors to limit the damage from such tools.

****What You Can Do****

While this operation disrupted one of the most widespread info-stealers online, Lumma is just one of many threats targeting users every day. Microsoft and security professionals advise the public to:

*   Be cautious with email links and attachments
*   Use reputable antivirus and anti-malware tools
*   Keep operating systems and software updated
*   Enable multi-factor authentication wherever possible

Lumma Stealer was a favourite among cybercriminals because it worked, and it worked at scale. By shutting down its infrastructure, Microsoft and its partners have disrupted the ability of malicious actors to operate efficiently. But as long as cybercrime remains profitable, the fight continues.

Microsoft Dismantles Lumma Stealer Network, Seizes 2,000+ Domains

A threat actor known as Hazy Hawk has been observed hijacking abandoned cloud resources of high-profile organizations, including Amazon S3 buckets and Microsoft Azure endpoints, by leveraging misconfigurations in the Domain Name System (DNS) records.
The hijacked domains are then used to host URLs that direct users to scams and malware via traffic distribution systems (TDSes), according to

Hazy Hawk Exploits DNS Records to Hijack CDC, Corporate Domains for Malware Delivery

RVTools installer on its official site was found delivering malware. Research shows it spread Bumblebee loader. Users urged to verify downloads.

A widely used tool for managing VMware systems, RVTools, was recently found delivering harmful software to users. A security researcher, Aidan Leon, sounded the alarm in a blog post on ZeroDayLabs after discovering a compromised installer for RVTools on its official website.

The issue came to light on Thursday, May 15, 2025, when Leon’s security team detected a suspicious file, version.dll, attempting to run from an RVTools installer. This happened during an employee’s attempt to install the utility.

Reportedly, the infected version was first uploaded on Monday, May 12, 2025, suggesting the website was compromised between 8 AM and 11 AM that day. The official website later went offline and then reappeared with a clean version of the download. However, by Friday, May 16, 2025, the site was offline again without explanation.

Microsoft Defender for Endpoint quickly flagged the activity. Further investigation confirmed that the malicious installer originated from the official RVTools website, Robware.net. Also, Leon found that the infected RVTools installer was noticeably larger than its legitimate counterpart. It also contained a file hash that did not match the clean version listed on the official site. 

The file’s analysis on VirusTotal, a service that checks for malicious content, confirmed the severity: 33 out of 71 antivirus engines identified it as a variant of the Bumblebee malware loader– a malware known for its role in gaining initial access for cybercriminals, often paving the way for ransomware or advanced attack frameworks.

The malicious file even featured unusual and deliberately confusing details in its metadata, such as “Hydrarthrus” as the original filename and strange descriptions like “elephanta ungroupable clyfaker gutturalness” for the product. These cryptic terms, as noted in a ZeroDay Labs Report, were used as a distraction from the file’s true harmful purpose.

Within an hour of the malicious file being submitted to VirusTotal, public detections of it surged. This coincided with the RVTools website temporarily going offline. When the site returned, the downloaded file had changed, now being smaller and matching the official, safe file hash. This swift change strongly suggested a brief but targeted compromise of the software’s distribution channel.

The security concerns don’t end with the official website. A warning on the legitimate RVTools site advises against downloading the software from other sources. This advice is critical, as a simple online search for “RVTools download” currently shows a lookalike website, rvtoolsorg, as the top result. This fake site, which claims to be official, also offers a malicious RVTools installer.

The incident shows the need for caution when downloading software, even from legitimate sources. Organizations installing RVTools should verify the installer’s integrity by checking file hashes and detecting unusual activity, especially the execution of “version.dll” from user directories.

Compromised RVTools Installer Spreading Bumblebee Malware

Cisco Talos built on Tenable’s discovery of a Google Cloud Platform vulnerability to uncover how attackers could exploit similar techniques across AWS and Azure.

Tuesday, May 20, 2025 06:00

**Summary and background**

Google Cloud Platform (GCP) Cloud Functions are event-triggered, serverless functions that automatically scale and execute code in response to specific events like Hypertext Transfer Protocol (HTTP) requests or data changes. Tenable Research published an article discussing a vulnerability they discovered within GCP’s Cloud Functions serverless compute service and its Cloud Build continuous integration and continuous delivery or deployment (CI/CD) pipeline service.

“When a GCP user creates or updates a Cloud Function, a multi-step backend process is triggered,” Tenable author Liv Matan writes. “This process, among other things, attaches a default Cloud Build service account to the Cloud Build instance that is created as part of the function’s deployment.” This default Cloud Build Service Account (SA) previously gave users excessive Cloud Function permissions. An attacker who has gained the ability to create or update a cloud function could utilize the function’s deployment process to escalate privileges to the default Cloud Build service account or assign a higher privileged SA. Google has since partially addressed Tenable’s discovery to ensure the default Cloud Build service account no longer provides users with excessive permissions.

Based on Tenable’s research, Cisco Talos conducted a series of offensive tests within Cisco’s Google Cloud Platform (GCP) to identify additional threats that may affect customer environments.

During its research, Talos discovered that the technique Tenable identified could be adapted to perform other malicious activities. By implementing different malicious console commands into the Node Package Manager (NPM) ‘package.json’ file used in this technique, threat actors could execute behaviors such as environment enumeration.

Talos furthered this research by attempting to replicate similar behaviors in Amazon Web Services (AWS) and Microsoft Azure to determine if these techniques could be employed to perform similar malicious activities in other cloud-based environments.

**Research****Prerequisites**

To utilize this attack vector, certain prerequisites must be met. Talos set up a Debian Linux server within the GCP environment with Node Package Manager (NPM) and Ngrok installed. However, the virtual machine for this research can be created in any cloud environment.

After installing NPM and Ngrok, Talos configured both tools to function as intended.

Once NPM and Ngrok were configured, a Python server was created to output the data received from the cloud function.

With NPM, Ngrok, and the Python server set up and configured, the next step was to create and modify the NPM package.

Talos then replaced the content of the package.json file with the following code:

Finally, once all the necessary files are created and configured, Talos set up the environment to visually display the data output from deploying the functions. To achieve this, Talos activated both the Ngrok server and the Python server created earlier.

To replicate the GCP behavior discussed in Tenable’s article, Talos created/updated an SA with function build and cloud build permissions. This SA was then assigned to the GCP Cloud Run Function to allow the code to be executed with privileged access.

Once the servers and service accounts were online and configured to receive and output data, the emulation of the behavior could begin.

**Emulation**

With the package.json file configured to be utilized by the build function, Talos began emulating the technique described in Tenable’s research article.

The first step in Talos’ replication involved the utilizing a misconfigured GCP function to extract the default Cloud Build service account token. To initiate this process, the "malicious" package.json was updated on the virtual machine, ensuring that it contains code similar to that used by Tenable.

Once the package.json file was modified as desired, it needed to be published to the public NPM registry. To do this, Talos executed the following command:

With the package.json file uploaded to the NPM public registry, it was time to deploy the GCP Cloud Run Function so that the package.json can execute the provided code. To do this, the user must to navigate to their GCP Cloud Run Functions page and select or create a Cloud Run Function, ensuring it is assigned a service account with Cloud Build permissions.

Figure 1. Google Cloud Run Function displaying the assigned service account.

As Talos created or selected our existing GCP Cloud Run Function, we navigated to the source page of the cloud function. Here, Talos modified the package.json file to install the malicious package uploaded to NPM.

Figure 2. Google Cloud Run Function’s Source page.

Once Talos updated the package.json file with the correct name and version of the NPM package, we selected "Deploy" or "Save and Redeploy" to initiate the build process. During this process, the function sends the requested data to the Ngrok server, which was then output on the Python server.

Talos confirmed that the exfiltration of GCP service account access tokens can no longer be achieved using this method, due to Google's response and patching of the issue. We further verified this by executing the same command provided to our NPM-uploaded package.json from a separate virtual machine. The command executed successfully, confirming our suspicion that this specific technique for obtaining privileged service account tokens has been patched out.

**Original Research**

Cisco Talos' research extended Tenable’s original behavior concept by applying it to other cloud environments through modifications to their respective cloud services. AWS Lambda and Azure Functions are serverless compute services that allow users to run code without provisioning or managing servers. By creating a Lambda function or an Azure function with a Node.js 20.x runtime, a package.json file can be created with dependencies set to execute a malicious package uploaded to NPM’s public repository. These malicious packages may contain harmful console commands that provide a threat actor with valuable enumeration information.

Although this specific vector of threat actor behavior is no longer possible, other commands have proven useful in providing adversaries with valuable enumeration capabilities. These commands can be used on cloud platforms beyond GCP Cloud Build Function, such as AWS Lambda and Azure Functions.

Some examples of the types of enumeration a threat actor can perform using this method include the following.

**ICMP Discovery**

Internet Control Message Protocol (ICMP) Discovery is utilized to gather information about network devices and their configurations. By analyzing ICMP responses, adversaries can infer the network's structure, including the presence of routers, gateways, and the pathways between devices. This information can be crucial for planning attacks.

**Existence of .dockerenv**

Identifying the presence of a .dockerenv file indicates that a process is running inside a Docker container. By checking for this file, threat actors can confirm whether they are operating within a Docker environment. This information can influence their selection of tools and techniques, as containers often possess different security boundaries compared to host systems.

**CPU Scheduling**

Enumerating CPU Scheduling provides detailed scheduling and status information about the process with process identifier (PID) 1, which is typically the init system or main process in a containerized environment. Threat actors can determine the init system in use, such as systemd or sysvinit. This information helps them understand the system's configuration and identify potential vulnerabilities associated with the specific init system.

CPU Scheduling Data Output Plain Text

**Control Group Container ID**

Enumerating Control Group Container ID provides detailed information about current mount points. Threat actors can use this information to identify critical or sensitive filesystems that might be targeted for data exfiltration. By examining mount options, they can look for insecure configurations, such as filesystems mounted with exec permissions in directories where malicious binaries could be introduced. In containerized environments, understanding mount namespaces can aid in developing container escape techniques, enabling attackers to break out of the container and access the host system.

Control Group Container ID Plain Text 1 & Control Group Container ID Plain Text 2

**Initial Server Overview**

For Initial Server Overview enumeration, combining the following commands provides comprehensive details about the system's kernel, architecture and distribution, which are critical for understanding the environment and planning potential exploits. Knowing the exact OS and kernel version enables threat actors to choose the most effective exploits, as many vulnerabilities are version-specific.

**User and Permission Enumeration**

The following User and Permission commands provides insights into user accounts, privileges and group memberships, which are crucial for planning privilege escalation and lateral movement within a system.

**Network Discovery**

The following Network and Discovery commands help gather detailed insights into the system's operating environment and network setup, which can be used to identify vulnerabilities and plan attacks.

**Detailed System Commands**

The ‘cat /etc/os-release’ command reveals the operating system distribution and version. Knowing the exact OS helps attackers identify specific vulnerabilities and tailor their exploits to the target's environment.

**User Related Commands**

The ‘/etc/shadow’ file contains hashed passwords for user accounts, which, if accessed, can be used to crack passwords and gain elevated access to the system.

User Related Commands Data Output Plain Text

**AWS Lambda Functions**

The following example demonstrates Talos using the same commands previously mentioned within a Google Cloud Platform (GCP) environment, now applied in an Amazon Web Services (AWS) environment using Lambda functions. This illustrates that the method utilized by the Tenable lab can be adapted for other cloud-based environments, such as AWS.

**Azure Functions**

The following example demonstrates the same process performed with an AWS Lambda function, but instead utilizing Azure Functions within the Azure environment. This further proves that the method can be employed across various cloud-based environments.

**Conclusion and Defense Summary****Google’s Response**

As described in Tenable’s article, Google responded to their research by creating a remediation patch. This update altered the default behavior of Cloud Build and the default Cloud Build SA. Additionally, new organization policies were released to give organizations full control over which SA Cloud Build uses by default. While Google has implemented this remediation, Cloud Build services can still be used to execute non-privileged commands as a means of enumerating an environment.

**Mitigation Summary**

The most effective mitigation strategy to protect your environment from similar threat actor behavior is to ensure that all SAs within your cloud environment adhere to the principle of least privilege and that no legacy cloud SAs are still in use. Ensure that all cloud services and dependencies are up to date with the latest security patches. If legacy SAs are present, replace them with least-privilege SAs. 

Additionally, users with access to Cloud Functions should not have IAM permissions to the services included in the function’s orchestration.

**Threat Hunting Recommendations**

1.  **Audit and monitor SA permissions**: Regularly audit and monitor SA permissions, with a particular focus on the default Cloud Build SA. Adhere to the principle of least privilege by removing any excessive permissions that are not essential for the SA’s operations.
2.  **Alert setup for Cloud Functions**: Establish alerts for any unusual or unauthorized creation or modification of Cloud Functions. Identify potentially malicious activities where an attacker may be attempting to exploit function deployments for privilege escalation.
3.  **Inspect network traffic**: Analyze network traffic for unusual patterns or connections that might indicate data exfiltration attempts. Pay attention to data being sent to unknown or unauthorized external endpoints, such as those using Ngrok or similar tunneling services.
4.  **Verify NPM package integrity**: Ensure the integrity and authenticity of NPM packages used within Cloud Functions. Prevent the execution of malicious scripts embedded in package.json files that could facilitate environment enumeration or other malicious activities.
5.  **Detect environment enumeration**: Detect and respond to signs of environment enumeration, such as ICMP discovery or system information gathering.

Duping Cloud Functions: An emerging serverless attack vector

The Take It Down Act requires platforms to remove instances of “intimate visual depiction” within two days. Free speech advocates warn it could be weaponized to fuel censorship.

US President Donald Trump signed into law legislation on Monday nicknamed the Take It Down Act, which requires platforms to remove nonconsensual instances of “intimate visual depiction” within 48 hours of receiving a request. Companies that take longer or don’t comply at all could be subject to penalties of roughly $50,000 per violation.

The law received support from tech firms like Google, Meta, and Microsoft and will go into effect within the next year. Enforcement will be left up to the Federal Trade Commission, which has the power to penalize companies for what it deems unfair and deceptive business practices. Other countries, including India, have enacted similar regulations requiring swift removals of sexually explicit photos or deepfakes. Delays can lead to content spreading uncontrollably across the web; Microsoft, for example, took months to act in one high-profile case.

But free speech advocates are concerned that a lack of guardrails in the Take It Down Act could allow bad actors to weaponize the policy to force tech companies to unjustly censor online content. The new law is modeled on the Digital Millennium Copyright Act, which requires internet service providers to expeditiously remove material that someone claims is infringing on their copyright. Companies can be held financially liable for ignoring valid requests, which has motivated many firms to err on the side of caution and preemptively remove content before a copyright dispute has been resolved.

For years, fraudsters have abused the DMCA takedown process to get content censored for reasons that have nothing to do with copyright infringements. In some cases, the information is unflattering or belongs to industry competitors that they want to harm. The DMCA does include provisions that allow fraudsters to be held financially liable when they make false claims. Last year, for example, Google secured a default judgment against two individuals accused of orchestrating a scheme to suppress competitors in the T-shirt industry by filing frivolous requests to remove hundreds of thousands of search results.

Fraudsters who may have feared the penalties of abusing DMCA could find Take It Down a less risky pathway. The Take It Down Act doesn’t include a robust deterrence provision, requiring only that takedown requestors exercise “good faith,” without specifying penalties for acting in bad faith. Unlike the DMCA, the new law also doesn’t outline an appeals process for alleged perpetrators to challenge what they consider erroneous removals. Critics of the regulation say it should have exempted certain content, including material that can be viewed as being in the public’s interest to remain online.

Another concern is that the 48-hour deadline specified in the Take It Down Act may limit how much companies can vet requests before making a decision about whether to approve them. Free speech groups contend that could lead to the erasure of content well beyond nonconsensual “visually intimate depictions,” and invite abuse by the same kinds of fraudsters who took advantage of the DMCA.

Since it receives millions of DMCA takedown requests annually, Google has said in court papers that it “often must rely” on the “accuracy of the statements submitted by copyright claimants.” It’s difficult to imagine that the process would be any different for Take It Down, says Becca Branum, deputy director of the free expression project at the Center for Democracy and Technology. (CDT receives a minority of its funding from Google and other tech companies.)

“Platforms have no incentive or requirement to make sure what comes through the system is nonconsensual intimate imagery,” Branum says. Because it’s often cheaper and easier for companies to comply with requests than to investigate them, she says, more content may be removed from the internet than deserves to be. Braum points to another set of laws passed by Congress about seven years ago addressing sex trafficking content, which she argues also led to the removal of unrelated information from the web.

Under their existing takedown processes for nonconsensual intimate imagery, some tech companies require requestors to show government-issued identification confirming that they are the person being depicted. But advocates for victims say the rules unfairly burden legitimate requestors and jeopardize their privacy.

Take It Down doesn’t require identity verification, and it’s possible that burdensome processes to request removals could trigger FTC scrutiny. Likewise, critics of Take It Down also may call on the FTC—which is typically aligned with the president’s political party—to investigate companies that allow bogus requests to sail through.

Ted Cruz and Amy Klobuchar, the bipartisan pair of senators who helped shepherd Take It Down through Congress with little opposition, didn’t respond to requests for comment about issues that have been raised with the legislation. For members of Congress, passing the bill was imperative to protecting people, like the teenagers whose experiences helped shape it. The hope is that future victims will get their privacy back without delay.

Trump Signs Controversial Law Targeting Nonconsensual Sexual Content

Amber Scorah and Psst are building a “digital safe” to help people shine a light on the bad things their bosses are doing, without getting found out.

Amber Scorah knows only too well that powerful stories can change society—and that powerful organizations will try to undermine those who tell them. In 2015, her 3-month-old son Karl died on his first day of day care. Heartbroken and furious that she hadn’t been with him, Scorah wrote an op-ed about the poor provision for parental leave in the US; her story helped New York City employees win their fight for improved family leave. In 2019 she wrote a memoir about leaving her tight-knit religion, the Jehovah’s Witnesses, that exposed issues within the secretive organization. The book cost her friends and family members, but she heard from many people who had also been questioning some of the religion’s controversial practices.

Then, while working at a media outlet that connects whistleblowers with journalists, she noticed parallels in the coercive tactics used by groups trying to suppress information. “There is a sort of playbook that powerful entities seem to use over and over again,” she says. “You expose something about the powerful, they try to discredit you, people in your community may ostracize you.”

In September 2024, Scorah cofounded Psst, a nonprofit that helps people in the tech industry or the government share information of public interest with extra protections—with lots of options for specifying how the information gets used and how anonymous a person stays.

Psst’s main offering is a “digital safe”—which users access through an anonymous end-to-end encrypted text box hosted on Psst.org, where they can enter a description of their concerns. (It accepts text entries only and not document uploads, to make it harder for organizations to find the source of leaks.)

To safely share secrets, tech whistleblowers can go to psst.org and enter details in an encrypted text-box.

Photograph: Ali Cherkis

What makes Psst unique is something it calls its “information escrow” system—users have the option to keep their submission private until someone else shares similar concerns about the same company or organization.

As the organization was preparing to launch, members of Psst’s team helped a group of Microsoft employees who were unhappy with how the company was marketing its AI products to fossil-fuel companies. Only one employee was willing to speak publicly, but others provided supporting documents anonymously. With help from Psst’s team of lawyers, the workers filed a complaint with the Securities and Exchange Commission against the company and aired their concerns in a story published by The Atlantic.

Combining reports from multiple sources defends against some of the isolating effects of whistleblowing and makes it harder for companies to write off a story as the grievance of a disgruntled employee, says Psst cofounder Jennifer Gibson. It also helps protect the identity of anonymous whistleblowers by making it harder to pinpoint the source of a leak. And it may allow more information to reach daylight, as it encourages people to share what they know even if they don’t have the full story.

Only members of Psst’s in-house legal team can access information in the safe. In countries including the US and UK, communications between lawyers and their clients usually benefit from legal privilege, meaning the information is kept confidential.

This is one reason tech companies have such large legal departments, says Gibson, who leads Psst’s in-house legal team: “They’re designed to put lawyers in the room so the information isn’t disclosable. To some extent, we’re using their playbook.”

Amber Scorah with Psst co-founders Jennifer Gibson and Rebecca Petras.

Photograph: Ali Cherkis

At the moment, Psst lawyers first manually review the entries in the safe without reading the contents. Users can tag their entries with the company name and the category of their concern—“trust and safety” or “fraud,” for instance. If the lawyers find matches, and the contributor consents, the lawyers decrypt and read the entries to see if they may form part of the same story, while keeping the different contributors’ identities protected from one another.

Psst plans to automate some of this process—in the future an algorithm running in a secure enclave built into the hardware of a computer will decrypt and compare information looking for potential matches while keeping it shielded from human eyes.

What happens next depends on various factors, but often Psst will involve an independent investigative journalist or publish accounts on its own website. Sometimes, whistleblowers might want to alert regulators without going public.

One challenge, Gibson says, is that regulation often lags behind technological advances, as with AI safety. “You’re then in this no-man’s-land,” she says—even if something’s not illegal, reporting it may be in the public interest.

Scorah hopes Psst’s impact on the tech world will be similar to what she experienced when telling her own stories, by using insiders’ accounts to shed light on broader industry issues. “Whether it’s a religion operating off the radar with policies that cause harm or an AI company whose product or policies are causing harm, I have seen the same thing,” she says. “Sunlight has a sanitizing effect.”

Tag

#microsoft