Seafood company Sanford has made a record full year profit driven by the strong performance of its aquacultural business. Read...

Business groups are critical of the Supreme Court decision that the drivers should be considered employees. Read...

Logitech is probably the best known PC accessory manufacturer apart from Microsoft and Apple. And since the company has spent the last few years trying to expand its software offerings, it’s a little concerning that it was recently hit with a massive data leak. Logitech confirmed that it had been compromised late last week. The “cybersecurity incident relating to the exfiltration of data” probably includes consumer, business, and employee data, according to an official statement. Logitech claims that it believes consumer identity and payment information was not leaked, as it wasn’t on the affected systems. The company says it was compromised through a zero-day exploit on a third-party system that’s been patched. Other details are scarce. BleepingComputer points the finger at the Clop (“cl0p”) extortion gang. This group recently claimed that it managed to compromise Oracle E-Business Suite systems, and Oracle responded with a confirmation of the zero-day exploit the group is thought to be using for ransomware attacks. According to BleepingComputer, Logitech was added to a publicly displayed list of compromised targets, some of which have confirmed receipt of ransomware demands. Clop claims to have captured 1.8 terabytes of data specifically from Logitech. What can you do to protect yourself from this and other massive data breaches? As an end user, not a lot. These massive breaches tend to be the result of (1) lax security by the companies that already have your data or (2) zero-day exploits that are impossible to predict or defend against. The easiest and most practical thing you can do beyond basic identity theft protections (such as freezing your credit reports) is to make sure you never re-use passwords and always set up extra protections (like passkeys) on especially sensitive accounts. Read...

Tariffs, shortages, supply-chain issues. If you’re looking for deals on PC hardware this holiday season, you might want to consider an alternate route: buying used instead. Traditionally, we’ve recommended you buy new products for various reasons. They’re untouched, they usually carry warranties, and so on. But like anyone who’s considered a used car, depreciation can be your friend. You can often save substantially just because someone else has previously owned that item. It’s a little different than an “open box” return, where a customer buys an item, decides they don’t like it, and brings it back to the store. Here, you have a couple of different paths to choose from: buying an item from from a major retailer like Amazon’s “Renewed” program or simply engaging with an individual owner and conducting a private transaction. The latter typically involves choosing between eBay, Facebook Marketplace, or a similar route. But that route carries risk, too. At best, you risk getting pestered nonstop with “Is it still available?” messages. At worst, you might end up buying a used item and end up with a literal brick. That was the whole impetus for Jawa.gg, a marketplace for PC components and pre-built systems from small builders, said Amanda Stefan, the company’s chief executive. Jawa.gg chief executive Amanda Stefan says that the site has expanded to included boutique builders of gaming PCs. Mark Hachman / Foundry Jawa.gg was founded in 2021 on the back of the COVID pandemic, Stefan said, when customers were trying to buy during a severe shortage of graphics cards. Today, that’s one of the site’s strengths, she said. Customers can pick up a last-generation graphics card for substantial discount, up to about 40 percent off MSRP. Originally, the site was just a Discord channel where community members would buy and sell hardware. Today, there are about 5,000 active sellers and about 10,000 buyers per month — though that increases to 100,000 historically. “Ever since the word ‘tariff’ was uttered, our business has tripled,” she said. “It very much was this rallying cry of, we’re so sick of these people scalping graphics cards,” Stefan said. “That was the start of it. And then what it has turned into is a marketplace for used, but also new.” Jawa also attracts a community of small PC builders who view the site as an e-commerce front end, Stefan said. Those small builders have driven the site’s growth, she said. One of the site’s strengths is that buyers and sellers actually interact, allowing a buyer can ask questions or a builder to provide recommendations. “Buyers are like, hey, I like the looks of your build, but I play League of Legends, and this is my monitor. Is this going to be good for me?” Stefan said. “And they might do some customization. And sellers actually appreciate that type of interaction.” Buying and selling on Jawa.gg takes place from person to person via the site as an intermediary. Jawa attempts to defeat GPU scalping by using a formula: the “price cap” for a listing is the MSRP on Best Buy or Newegg, plus 25 percent for taxes and fees, plus a $100 buyer fee. The site also maintains a community spreadsheet of those capped prices. Buyers have 48 hours to inspect their purchase and, if necessary, ask for a refund. After that, the payment proceeds to the seller as per the site’s protections. If you have a used graphics card, you can sell it too. Tell Jawa.gg what it is and they’ll issue a quote. $296.75 for an RTX 3080, for example. The site will then send out a shipping label, ask you to ship the component, then test it. If it passes, the site will pay the seller within a week. Competing sites include MBPC.gg, which allows you to buy or sell components or PCs, and SellGPU, which caters to those looking to sell older equipment. There’s also the traditional route, eBay, which has a similar refund policy (the buyer will get a refund if they don’t receive the item or if it doesn’t match the listing). Competing with the traditional “open box” The major retailers also offer competing services, too. Amazon, Best Buy, and Walmart all have options to buy previously-owned or otherwise restored products. You can check out these services via Amazon Restored, Best Buy Refurbished, and Walmart Restored. Amazon and Walmart have the most sophisticated offerings, though the Best Buy Outlet also offers truly open-box items, including its own Black Friday deals. Amazon’s Renewed program offers a 90-day return period on most items while some “Premium” offerings stretch that to a full year. “Select” items even include an 11-month warranty. The Amazon Renewed program includes four quality tiers, depending upon the condition of the item: Premium (no screen scratches, no signs of damage from 12 inches away, 90 percent of the original battery life) Excellent (no screen scratches, no signs of cosmetic damage from 12 inches away, 80 percent battery life) Good (no screen scratches, light scratches when held 12 inches away, 80 percent battery life) Acceptable (possible screen scratches, clear light scratching from 12 inches away, 80 percent battery life) Walmart’s Restored program is slightly less sophisticated, pledging to offer 80 percent battery life on Restored products and 90 percent or more battery life on Restored Premium items. It too has various quality tiers. Products are either restored and/or cleaned by Walmart employees or by the suppliers themselves. Best Buy offers something a little different. You’re allowed to view the “open box” listing and see how much you could save on the item depending on its condition. Unfortunately, the discount isn’t great. On the HP Victus laptop seen below, you’ll pay $549.99 new but $503.99 for a “fair” item that may have minor dents or missing non-essential parts. Best Buy’s “open box” options. There’s an interesting juxtaposition between the two models. A site like Jawa.gg doesn’t go overboard in publicizing how much you’re saving over MSRP; buyers and sellers seem to only need a basic sense of what they’d otherwise pay. Conversely, sites like Amazon’s Renewed emphasize the savings, but they don’t tell you if you’re actually getting a good deal. In my own experience, for example, Amazon offered a Renewed Chromebook for well under $100, but didn’t note that the processor inside of it had long since exited support. Nevertheless, buying used is another arrow in your quiver to save money during Black Friday and the remainder of the holiday season. And in 2025, it’s an option worth considering. Read...

Despite rising costs and softening profits, 92% of New Zealand`s SMEs remain confident in their business outlook over the next year and five years ahead. Read...

Monty Knight was a well-known wine-maker and local politician, inducted into the Northland Business Hall of Fame in 2010. Read...

Monty Knight was a well-known wine-maker and local politician, inducted into the Northland Business Hall of Fame in 2010. Read...

TL;DR: For $74.97 (MSRP $540), get a lifetime subscription to a 1minAI Advanced Business Plan, an all-in-one platform that uses multiple top AI models. You know ChatGPT, Gemini, and all the usual heavy-hitters — but you’ve probably missed the newcomer quickly climbing the ranks. Its secret? 1minAI bundles all those major AI models into one platform with zero subscription fees, and it’s surprisingly beginner-friendly. Get permanent access to an Advanced Business Plan on sale for $74.97 for a limited time. So, you need to generate articles for work? (We won’t tell). Use 1minAI’s preset tool and select a tone, length, number of sections, and keywords, then describe your desired content. This is where you can also select your preferred AI model like GPT-4o, Gemini 1.5 Pro, or Claude 3.5 Sonnet, among others. There are also AI tools for images, documents, audio, video, and code. 1minAI works on a credit system. You trade credits for AI-generated content, but unless you’re generating full books daily, you’re probably not going to run into any walls. Your lifetime subscription gives you 4,000,000 credits every month. That means you can generate something like 1,100,000 words or 1,100 images each month (depending on the exact models used). And just by logging in, you can get an extra 450,000 credits every month. Get lifetime access to this all-in-one AI tool for $74.97 (MSRP $540) for a limited time. No coupon is needed. 1min.AI Advanced Business Plan Lifetime SubscriptionSee Deal StackSocial prices subject to change. Read...

A business owner has refused a council’s offer of a refund, determined to fight for other companies caught out by a digital change. Read...

Back in February 2025, several media outlets warned of a new threat targeting users of Google’s Gmail email service. Attackers used AI technology to perfect phishing emails and make them look more convincing. To do this, the AI collected freely available data from social networks, websites, and online forums on the internet and used this information to formulate a deceptively genuine-looking email that pretended to come from an acquaintance, family member, or superior. What’s more, to ensure that the message actually looked deceptively genuine, the AI also generated suitable domains as senders for the emails. The scam was dubbed “Deepphish”—a portmanteau of the terms deep learning and phishing. Even if the report mentioned at the beginning raises some questions—such as why Gmail users in particular were affected by the Deepphish attack—it nevertheless highlights a development that experts had been expecting for some time: criminal groups are increasingly using AI tools to perfect their attacks. Domains created with AI One of the weak points of conventional phishing attacks has always been the sender address. Most phishing emails can be easily identified by the sender . For example, a message from a streaming service such as Netflix or Disney with an address like andy@brandbot.com is almost certainly a fake—no matter how perfect the rest of the presentation may be. In the AI-supported variant of a phishing attack, on the other hand, new types of algorithms are used that generate a sender address with a matching URL that is adapted to the text of the email. A research group led by Alejandro Correa Bahnsen at the US company Cyxtera Technologies, an operator of data centers, investigated how effective these algorithms can be. They developed an algorithm called Deepphish, which was trained to suggest suitable URLs for phishing attacks. To do this, they fed a neural network with more than one million URLs that had been set up for phishing via email in the past and used them to train their algorithm. In doing so, they specified two different profiles for the actors behind the phishing attack. Phishing emails can often be recognized by the sender addresses. If, as in this case, a message purporting to be from Disney comes from andy@ brandbot.com, something is wrong.Foundry With the AI-generated addresses, they achieved an increase in attack efficiency from 0.69 to 20.9 percent for one profile and from 4.91 to 36.28 percent for the other. They published their results in a stud you can find here. While Deepphish originally only referred to the algorithm developed at Cyxtera, it’s now used in most cases for AI-supported phishing attacks in general. How a Deepphish attack works Deepphish attacks follow a standardized pattern. The first step is to research the target’s social environment: Where does she live? Where does she work? What are the names of their family members? What are their friends’ names? What are the names of their colleagues and superiors? What are their email addresses, how close are they to the target person? The AI uses social networks and online forums as sources, as well as data published by hackers from intrusions into company networks and websites. The more data collected in this way, the more precisely the phishing email can be tailored to the victim. In a study, employees at Cyxtera investigated how the success rate of phishing emails can be increased by selecting an AI-generated sender address. Foundry The next step is to register a suitable domain and generate a sender address using an algorithm such as Deepphish. The AI then writes the text of the email. Using the information collected, it generates a suitable subject line, a salutation tailored to the recipient and content that is worded correctly and could actually have been written by the supposed sender. Due to the precise personalization, the message appears considerably more credible than a standard phishing email. But what do the criminals want to achieve with their deepphish attacks? They want to inspire so much confidence with their forgeries that the recipient is prepared to click on a file attachment or an embedded link. Everything else happens automatically: the file attachment then usually downloads and installs malware. The link, on the other hand, leads to another fake website that requests credit card details or login information for a streaming service, for example. AI-supported phishing emails However, the Deepphish algorithm is just the beginning. There is now a whole range of tools that do all the work for criminals when formulating phishing messages. The programs are called FraudGPT, WormGPT, or GhostGPT. They formulate phishing emails that are targeted at individuals or specific companies. For example, the user can instruct these programs to generate a Netflix-style email with a request to enter account details on a fake website. Or they can have questions answered such as “How do I hack a Wi-Fi password?”. Or they can instruct the AI to program a software keylogger that forwards all keystrokes on a computer to a server address via the internet. Hacking tools such as WormGPT use AI to generate convincing-looking and well-formulated phishing emails. In most cases, they target specific individuals or companies. Foundry ChatGPT and other Large Language Models (LLMs) have in-built filters so that they do not respond to such requests. As ChatGPT does not disclose its code, there is nothing that can be done about this. However, it is possible to use instructions from the darknet to confuse LLMs such as ChatGPT via certain prompt sequences so that they are then prepared to disregard their in-built filters. At the same time, some criminal groups have switched to LLMs from the open source scene and removed the corresponding filters. AI generates malware The Stopwatch AI website demonstrates just how far the possibilities of AI-generated malware already go. It shows how AI can be used in three simple steps to program malware that specifically undermines the protective shield of the major antivirus tools. In the first step, called “Choose Platform”, you select the operating system of the computer you want to attack. You can choose from Mac, Windows, Linux, AWS (Amazon Web Services, Amazon’s cloud service), Google Cloud, and Microsoft Azure, Microsoft’s professional cloud service. The Stopwatch AI website demonstrates how malware can be programmed in a few simple steps with the help of AI tools. The first step is to select the operating system to be attacked. Foundry The second step is called “Choose Defence” and offers nine antivirus tools, including Microsoft Defender, Eset Endpoint Protection Advanced, McAfee Endpoint Security, Symantec Endpoint Security, and Kaspersky Endpoint Security for Business. In the second step, Stopwatch AI users select the antivirus program whose weaknesses they want to exploit with their malware attack. Microsoft Defender is also listed here.Foundry In the third step, “Choose Attack”, you specify the type of virus you want to create. The selection ranges from adware and spyware to ransomware and keylogging through to data exfiltration, i.e. data theft. Stopwatch AI offers ten different types of malware, from keyloggers to ransomware. The user must register in order to implement the selected malware. Foundry After clicking on a form of attack, Stopwatch AI asks for log-in details. It is possible to register with the site using a Google, Github, or Microsoft account. As soon as registration is complete, the AI starts programming the desired malware. In order to use the site, the user must agree to the terms of use, which exclude attacks against other systems. This is because Stopwatch AI is only intended for studying malware development with AI. Critically, all projects are assigned to the respective user and saved. How to recognize AI-generated phishing emails Always take a look at the sender address of incoming emails and consider whether it is plausible. Also look out for the following features: Become wary of emails from people you are not normally in contact with or have not heard from in a while. This is especially true if these messages contain unusual requests or enquiries. Hover your mouse over any links and check where they lead to. If the address does not match the sender of the email or the text of the message, it is often a scam. No bank, streaming service, or public authority ever asks for your password or wants to know your account details via email. Be suspicious of emails that put you under time pressure or claim a high level of urgency. Tricking antivirus tools with AI Every antivirus program downloads the latest virus definitions from the manufacturer’s server at least once a day. They describe the characteristics of the new malware variants discovered in the last few hours so that the software on the user’s computer can reliably detect the malware. However, this protective shield has become increasingly fragile. The reason: virus construction kits that allow hobby programmers to create functioning malware even without AI have been circulating on the darknet for decades—but not only there. Many of these malware programs are simply minimally modified variants of already known viruses. The author often only has to change the signature for his malware to be counted as a new virus. This is the only way to explain why antivirus manufacturers report 560,000 new malware programs every day. In the age of AI, the production of malware variants has taken on a new quality. This is because security manufacturers had taught their antivirus programs to recognize and isolate the variants of already known malware. With AI support, it’s now possible to manipulate existing malware in a targeted manner so that it is no longer recognized by the virus watchdogs. The tool manufacturer Acronis demonstrated this in a presentation using a malware sample that it had uploaded to Google’s detection service Virustotal. While it was initially recognized as malware by nine of the antivirus programs used there, only one virus guard was able to identify the malware as such after it had been reworked by Grok3’s AI. When the researchers had the sample code processed by Gemini 2.0 Flash and Deepseek R1, the virus was no longer detected by any of the programs at Virustotal. Depending on which AI software is used, the hacker can manipulate existing malware in such a way that it remains almost or even completely undetected by Virustotal. Foundry Nevertheless, the heuristic and behavior-based methods of antivirus programs also work with malware whose code has been modified with the help of AI. Email spoofing The falsification of email addresses, known as email spoofing, hardly occurs any more. Since 2014, the SPF, DKIM and DMARC authentication methods have gradually been defined as standards and subsequently implemented by email providers. Since then, it is no longer possible to falsify the domain information in an email address. For an address such as “magazine@pcworld.com”, for example, the domain is pcworld.com. If the aforementioned authentication procedures are deactivated by a provider, these mails are normally sorted out as spam by the recipient. Spoofing attempts still exist, however. The sender’s name can be changed in many e-mail clients, for example in classic Outlook via File -> Account settings -> Account settings -> Change -> Your name. However, this does not affect the email address. In the case of hacker attacks, the reply address is sometimes changed at the same point. In this way, all replies to the emails sent are sent to the hacker’s address. Another trick is to use a similar-looking domain, such as “magazine@pcworlde.com“. Read...