On LinkedIn, a friend running a company in #POland describe a wave of fraud involving their company’s customer in #Italy receiving a perfectly forged invoice with a changed account number, obviously from a fake email address. The Italians transfer money there and complain that they have been defrauded. Of course, they complain to the company whose invoice has been forged. Conclusion from a lengthy discussion: ‘nothing can be done’.

Well, for about 20 years, something can be done: electronic signatures are available in every PDF creation app and every email app. And that is exactly what they are for.

All you need to do is include in the contract with the customer what I have been doing with my invoices for a long time:

1. that invoices are sent only from the specified domain
2. that invoices are sent in PDF format with a digital signature
3. that email communication, at least with the accounting department, is also electronically signed with S/MIME

The cost of an MV (mailbox validated) certificate is a few euros (!) per year. And that’s for a a WebTrust certificate, which can be verified in any browser and operating system, globally.

Video filmed in almost exactly 12 years ago, on 9 December 2013 - hundreds of thousands of people gathered in #Kyiv on #Euromaidan to protest against arbitrary decision by #Yanukovych to cancel the process of signing the EU Association Agreement, which he promised for the whole year, only to backtrack after a covert meeting with #Putin. In total, over a million of people protested over three winter months in the whole country.

video.echelon.pl/w/dpoGaEBfFpa…

Back then Ukrainians faced two choices: keep quiet and continue living under corrupt government, with stagnating economy and lawlessness ruling their daily lives just like Russians do, or take up the fight.

I think the video is also the best illustration to how nonsensical all these theories about “CIA coup” invented by Russians are - you can’t keep a million of people (out of 30m country) protesting for three months in harsh Eastern European winter on salary. They were really desperate and motivated to fight for their freedom.

For comparison, in 2012 when #Putin decided he’s going for his third presidential term in violation of the Constitution, around 160’000 Russians protested across the 130m country… for three days. Respect to those who did, disgrace to the 99.9% who didn’t.

Just added English subtitles to this truly epic video compilation by journalist Denis Kazansky who collected all quotes summarising the epic failure of #Russia in #Kupyansk

video.echelon.pl/w/jzNSxwRLUNC…

What has happened?

• On 20 November 2025 general Valery Gerasimov publicly announced that “Army Group ‘Zapad’ liberated the town of Kupyansk”.
• General Sergey Kuzovlev reiterated the news in the presence of Putin, wearing a quasi-military uniform, who clarified “so that’s it, completed it all?” to Kuzovlev’s confirmation. For the “liberation of Kupyansk” Kuzovlev was awarded Hero of Russia.
• On 21 November Putin himself declared “the events in Kupyansk will unavoidably repeat on other key front line locations; maybe not as fast as we wished, but this is unavoidable - and in general, it works for us”.
• On 27 November while speaking to journalists, Putin once again referred to Kypyansk, saying that “as we know the enemy formations are fully liquidated there”.

And the story, of course, culminates with now famous video of #Ukraine president Zelensky standing right in the middle of the same Kupyansk on 12 December and recording at video at distinctive town sign:

video.echelon.pl/w/u1sDdipjnjp…

Need For Speed Map IRL

When driving around in video games, whether racing games like Mario Kart or open-world games like GTA, the game often displays a mini map in the corner of the screen that shows where the vehicle is in relation to the rest of the playable area. This idea goes back well before the first in-vehicle GPS systems, and although these real-world mini maps are commonplace now, they don’t have the same feel as the mini maps from retro video games. [Garage Tinkering] set out to solve this problem, and do it on minimal hardware.

Before getting to the hardware, though, the map itself needed to be created. [Garage Tinkering] is modeling his mini map on Need For Speed: Underground 2, including layers and waypoints. Through a combination of various open information sources he was able to put together an entire map of the UK and code it for main roads, side roads, waterways, and woodlands, as well as adding in waypoints like car parks, gas/petrol stations, and train stations, and coding their colors and gradients to match that of his favorite retro racing game.

To get this huge and detailed map onto small hardware isn’t an easy task, though. He’s using an ESP32 with a built-in circular screen, which means it can’t store the whole map at once. Instead, the map is split into a grid, each associated with a latitude and longitude, and only the grids that are needed are loaded at any one time. The major concession made for the sake of the hardware was to forgo rotating the grid squares to keep the car icon pointed “up”. Rotating the grids took too much processing power and made the map updates jittery, so instead, the map stays pointed north, and the car icon rotates. This isn’t completely faithful to the game, but it looks much better on this hardware.

The last step was to actually wire it all up, get real GPS data from a receiver, and fit it into the car for real-world use. [Garage Tinkering] has a 350Z that this is going into, which is also period-correct to recreate the aesthetics of this video game. Everything works as expected and loads smoothly, which probably shouldn’t be a surprise given how much time he spent working on the programming. If you’d rather take real-world data into a video game instead of video game data into the real world, we have also seen builds that do things like take Open Street Map data into Minecraft.

Thanks to [Keith] for the tip!

youtube.com/embed/sAp7oCB939c?…

hackaday.com/2025/12/14/need-f…

GhostFrame: il primo framework PhaaS interamente basato su iframe

Barracuda ha pubblicato i dettagli di un nuovo kit di phishing-as-a-service (PhaaS) elusivo e stealth che nasconde i contenuti dannosi all’interno di iframe di pagine web per eludere il rilevamento e massimizzare la flessibilità.

È la prima volta che Barracuda rileva un framework di phishing completo costruito attorno alla tecnica degli iframe.

Gli analisti delle minacce monitorano il nuovo PhaaS da settembre 2025 e lo hanno soprannominato GhostFrame. Ad oggi, a questo kit sono stati attribuiti oltre un milione di attacchi.

L’analisi tecnica di Barracuda dimostra che la funzionalità di GhostFrame è apparentemente semplice, ma molto efficace.

A differenza della maggior parte dei kit di phishing, GhostFrame utilizza un semplice file HTML apparentemente innocuo, in cui tutte le attività dannose si svolgono all’interno di un iframe, una piccola finestra all’interno di una pagina web che può visualizzare contenuti provenienti da un’altra fonte. Questo approccio fa apparire la pagina di phishing autentica, nascondendone però la vera origine e il vero scopo.

Le caratteristiche più importanti di GhostFrame includono:

• Un file HTML esterno dall’aspetto innocuo che non contiene alcun contenuto di phishing che potrebbe attivare il rilevamento e utilizza codice dinamico per generare e manipolare i nomi dei sottodomini, in modo che ne venga generato uno nuovo per ogni destinazione.
• Tuttavia, all’interno di questa pagina sono presenti dei puntatori incorporati che indirizzano gli utenti a una pagina di phishing secondaria tramite un iframe.
• La pagina iframe ospita i componenti di phishing veri e propri. Gli aggressori nascondono i moduli di acquisizione delle credenziali all’interno di una funzione di streaming di immagini progettata per file di grandi dimensioni, rendendo difficile per gli scanner statici, che in genere cercano moduli di phishing hardcoded, rilevare l’attacco.
• Il design dell’iframe consente agli aggressori di modificare facilmente il contenuto di phishing, testare nuovi trucchi o prendere di mira regioni specifiche, il tutto senza modificare la pagina web principale che distribuisce il kit. Semplicemente aggiornando la destinazione dell’iframe, il kit può eludere il rilevamento da parte degli strumenti di sicurezza che controllano solo la pagina esterna.
• Come altri kit di phishing di nuova generazione, GhostFrame impedisce e interrompe in modo aggressivo l’ispezione. Tra le altre cose, blocca il clic destro del mouse, blocca il tasto F12 (utilizzato per gli strumenti di sviluppo) e il tasto Invio, e impedisce l’uso di scorciatoie da tastiera comuni come Ctrl/Cmd e Ctrl/Cmd+Shift. Queste scorciatoie sono spesso utilizzate dagli analisti della sicurezza per visualizzare il codice sorgente, salvare pagine o aprire strumenti di sviluppo.

Le email di phishing di GhostFrame alternano temi tradizionali, come falsi accordi commerciali e falsi aggiornamenti delle risorse umane. Come altre email di phishing, sono progettate per indurre i destinatari a cliccare su link pericolosi o a scaricare file dannosi.

“La scoperta di GhostFrame evidenzia la rapidità e l’intelligenza con cui i kit di phishing si stanno evolvendo. GhostFrame è il primo esempio che abbiamo visto di una piattaforma di phishing basata quasi esclusivamente su iframe, e gli aggressori stanno sfruttando appieno questa funzionalità per aumentare la flessibilità ed eludere il rilevamento” , ha affermato Saravanan Mohankumar, direttore dell’analisi delle minacce di Barracuda.

“Per rimanere protette, le organizzazioni devono andare oltre le difese statiche e adottare strategie multilivello: formazione degli utenti, aggiornamenti regolari del browser, strumenti di sicurezza per rilevare iframe sospetti, monitoraggio continuo e condivisione di informazioni sulle minacce”.

L'articolo GhostFrame: il primo framework PhaaS interamente basato su iframe proviene da Red Hot Cyber.