Risky Bulletin: Expired credit cards can be used for malicious transactions

0:03Expired credit cards can be used for malicious transactions, Iranian hackers shut down a UK power plant, the Lazarus Group hacks South Korea's presidential office, and an Android malware strain is infecting smart cars. This is the Risky Bulletin, prepared by Katalin Kimpano and read by me, Claire Aird. Today is the 24th of August, and this podcast episode is brought to you by Push Security. In today's top story, a team of academics has developed an attack that can perform transactions using expired Visa cards. The attack exploits the fact that card data is not encrypted when making payments. Attackers used a man-in-the-middle technique to take expired card data, alter the expiration date and make an NFC payment.

0:52The attacks failed against cards from MasterCard, American Express and Discover, but Visa cards and their POS terminals are vulnerable to the technique. The research team from University of Massachusetts Amherst has recommended physically destroying expired cards to prevent abuse. In other news, a small-scale British power plant shut down for four days last month following an Iranian cyber attack. Officials did not disclose which power plant was affected. According to The Telegraph, the attack was carried out by the same hackers who recently breached US water utilities. The North Korean espionage group Lazarus hacked South Korea's presidential office in February.

1:36The hack was part of a broader campaign that had accumulated 100 victims by April, including universities, police departments, media outlets and hospitals. South Korean authorities are still investigating the breaches and have not provided any details about how the hackers gained access. Hackers stole customer data from French Telecom SFR in a security breach last month. More than 2.1 million customers are believed to have been affected. The stolen data includes names, contact details and contract information. Some IP addresses and customer equipment details were also exposed. Hackers have stolen employee data from Toronto-based paediatric hospital Sick Kids The hospital says no patient data was exposed and said the incident was due to a third-party software vulnerability.

2:29The hospital will provide 24 months of credit monitoring and identity protection services to affected employees. Hackers have stolen customer data from private equity company Apollo Global Management. Last week, the company confirmed the data breach in a letter to the California Attorney General. The letter says hackers breached Apollo's cloud systems in early July using a social engineering attack. The breach is part of a broader campaign that began targeting U.S. investment and Wall Street firms last month. Hackers have stolen$1.7 million worth of crypto from the Maya Protocol. The attackers allegedly exploited the protocol's anti-theft defences and tricked the platform into granting fraudulent loans.

3:15Investigators believe an AI tool was used to chain exploits for six small unrelated bugs. The US Justice Department has announced charges against an Indian national for scamming elderly Americans out of almost$7.6 million. Jay Sunalbathi Goswami fled the US after an initial court appearance and was re-arrested in Canada last week. He was detained at the Toronto airport whilst trying to board a flight to Doha, Qatar. Goswami faces up to 20 years in prison for operating phone and online scams. AI tools have contributed to a spike in proof-of-concept exploit code being published online. Around 20 ,000 were published in all of 2025, compared to nearly 18 ,000 so far in 2026.

4:05Security firm Volncheck says that while AI contributed to more published POCs, It also contributed to a spike in the publication of broken exploits. A malware campaign is using FTP server login banners as a command and control channel. Login banners are the text messages shown to users when connecting to an FTP server or host. Threat actors are hiding malicious commands inside the banners, where the malware can retrieve them after a successful infection. Security researchers have discovered a malware strain infecting Android-based head units in modern cars. The malware adds the cars to a botnet that engages in ad fraud and proxy traffic.

4:47Kaspersky attributed this activity to the Moyu Group, which is linked to the Badbox botnet. Microsoft has warned developers that some of their apps could break as the company updates its code signing infrastructure. Microsoft is moving to new service that will use stronger signing algorithms and post-quantum cryptography. The transition is expected to be complete by mid-October. And finally, TikTok has agreed to pay$400 million for breaking U.S. child privacy laws in a settlement with the U.S. Justice Department. The penalty also covers infractions committed by Musical.ly. That company was acquired by ByteDance in 2017 and later merged with TikTok.

5:30The settlement is one of the largest recoveries ever obtained in a copper investigation. And that is all for this podcast edition. Today's show is brought to you by our sponsor, Push Security. Find them at pushsecurity.com. Thanks for your company.