Sohmen Concert Hall, Schwarzman Centre, Oxford Six performers navigate a disjointed world of online slang, loneliness and absurdity in the UK premiere of Jennifer Walshe and Philip Venables’ thrillingly original collaboration
As we found our seats, a druidic figure wearing a string of vapes as a necklace sat on stage swathed in white fabric and smoke, emitting close-miked mouth noises amid a rising chorus of percussive hisses and rattles. Then dancing flashlights, reverb and thunderous drum rolls. Later came monologues delivered with quiet, skin-crawling sincerity or pounded out as a kind of manic rap and comically dysfunctional text chats projected on the backcloth. Not to mention the dance breaks. There was an angular, hyper-controlled trio fluent in the language of modern ballet and a hands-on-hips traditional number as faux-folk lyrics scrolled in gothic script and a hefty synthetic beat throbbed below.
The first collaboration between Jennifer Walshe and Philip Venables – two of the most distinctive creators in music theatre today – The Alonetimes was never likely to adhere to the conventional playbook of opera. The programme for its UK premiere describes the work as “a fragmented archaeology of personal stories”. Alternatively: there is no single linear plot but instead six performers, who step constantly in and out of unnamed roles, switch between playing instruments and singing, form a taut Greek chorus and stand alone in the spotlights.
Florian Wirtz takes on more responsibility in Liverpool’s attack while Pierre Sage is under pressure at Crystal Palace
Dominic Calvert-Lewin’s physicality overpowering Bryan Mbeumo in Manchester United’s area at a corner grabbed him a fifth goal in 10 outings for Leeds: a pretty respectable ratio. “I just tried to cause a ruckus,” said Leeds’ No 9. “I make it difficult for the defender. I read the flight of the ball and was quickest to react. I feel really comfortable [here]. I feel the support from the club and the fans and it is a great feeling stepping on to the pitch, particularly at Elland Road.” Of the contenders to be understudy to Harry Kane as England’s centre-forward, Calvert-Lewin may be the lead act – if he can stay injury-free, which has been a difficulty throughout his career. Jamie Jackson
If Liverpool’s spluttering forwards end up remembering this as the day when their luck turned then they will owe a big debt of gratitude to Yehor Yarmolyuk. This was a game with a very clear before and after.
Andoni Iraola will hope surviving one of the toughest tests the Premier League has to offer is a sign his methods are starting to work, but Liverpool’s manager will not forget it was a very different contest after Yarmolyuk’s red card for a butt on Jérémy Jacquet left Brentford trying to defend a 1-0 lead with 10 men for the entire second half.
Initiatives to address youth employment crisis and offer training are being launched in towns such as Telford
Smaller cities and towns across England have higher rates of young people not in employment, education or training than the nine largest cities, analysis shows.
The Centre for Cities, an independent thinktank dedicated to improving the economies of the UK, used 2021 census data to work out the rates across 41 cities and towns in England.
Mines in supply chains of western carmakers linked to widespread deforestation of primary rainforest in nickel-rich lands inhabited by Tolaki people in Indonesia
Volkswagen, Ford and Tesla are among the electric carmakers whose batteries may contain nickel mined in indigenous woodlands plagued by deforestation, an analysis has found, highlighting the struggle to make vehicles that are free from environmental destruction.
Corporate disclosures and trade flows from the last two years show mines in the battery supply chains of automotive giants are linked to the loss of trees in Sulawesi, a wildlife hotspot in Indonesia that houses the world’s largest nickel deposits. The metal is widely used in cathodes in car batteries because it boosts energy density and increases range.
A lively reception awaits the former Liverpool midfielders Jordan Henderson and Xabi Alonso at Everton and, in the case of the former, any jeers can be considered an unintentional tribute. They will speak of what the 36-year-old is able to produce now as much as what, and where, he delivered in the past. With two goals and an assist against Bournemouth last Saturday, Henderson became the oldest player to contribute directly to three goals in a Premier League game, and demonstrated his role at Chelsea is not simply to elevate standards off the pitch. His midfield partnership with Moisés Caicedo gave Alonso’s team balance and enabled the front three of Morgan Rogers, João Pedro and Cole Palmer to flourish. Their confrontation against an Everton defence that had impressed this season, only to litter the draw at Hull with costly mistakes, will provide a stern test of the hosts’ unbeaten start and may well be dictated by the veteran behind them. Andy Hunter
Everton v Chelsea, Saturday 12.30pm (all times BST)
Ken Fero and Tariq Mehmood’s documentary recalls the fight against racism in 1980s Britain – even if its account of solidarity has a notable omission
This fierce film from socialist film-makers Ken Fero and Tariq Mehmood gives us the story and the context of the Bradford 12. Twelve south Asian members of the United Black Youth League in 1981 were arrested on a charge of conspiracy to cause explosions for possessing dozens of molotov cocktails – milk bottles filled with petrol, with a rag through the lid – allegedly for throwing at the police. To the intense irritation of the British authorities, a mixed-race jury acquitted them, accepting their argument that it was in self-defence (and that the items themselves were closer to fireworks than bombs), because black and Asian communities were routinely and systematically attacked by skinheads and racists whose activities were shrugged at by the powers that be.
It is a reminder of a particularly ugly, squalid, bigoted and mediocre era in British public life, when Margaret Thatcher, just before becoming prime minister, tried to siphon off some of the far-right National Front’s political energy by declaring that people felt “swamped” by immigrants, the most earsplittingly loud dog whistle in Tory history. It was also the era when anti-racist protester Blair Peach was killed by the Met’s yet-to-be-disbanded special patrol group, when the still-unsolved New Cross fire in London took the lives of 13 young black people, when the south Asian woman Anwar Ditta was subject to a spitefully obstructive move from the Home Office to prevent her bringing her children into the UK – supposedly because they weren’t really hers, though a DNA test finally proved her right. Perhaps most of all, it was an era when the witness-box testimony of uniformed police officers was increasingly seen as almost valueless in these cases; the film also reminds us how culpably lackadaisical and incompetent the Yorkshire police were in catching the serial killer Peter Sutcliffe.
Mourinho’s side score three late goals from 3-1 deficit
Dortmund latest team beaten in Norway by Bodø/Glimt
José Mourinho enjoyed a Roma reunion to remember as Real Madrid completed an astonishing comeback by scoring three late goals to claim a 4-3 away win in the Champions League on Wednesday.
Marten de Roon gave the hosts a deserved opener before Kylian Mbappé struck back on his 100th Champions League appearance to level the scores at the break. Two Donyell Malen strikes in the space of six minutes early in the second half seemed to take the game away from the 15-time European champions as Roma ran rampant.
After studying computer engineering in the '80s and tinkering on some early games in COBOL, Gray broke into the industry at the age of 35 in 1994 with the launch of GrayDoom, a set of four maps for the then-new Doom that were widely shared on CompuServe and beyond. The work attracted the attention of Q Studios' Nick Newhard, who contracted Gray to work on level design for the late '90s cult classic Blood.
Looking for a new reading recommendation? Here are some brilliant new paperbacks, from a time-travelling fantasy novel to an eclectic essay collection. Discuss what you’re reading in paperback in the comments
Ronald’s last-minute winner keeps Welsh side on top
Middlesbrough edge Stoke in thriller; Watford gloom
Substitute Ronald scored a last-minute winner to keep Swansea top of the Championship after their match at Millwall was held up for almost seven minutes due to a complaint about racist chanting at the Den.
The referee, Edward Duckworth, halted the match in the 65th minute and walked to the dugouts to speak with Lions manager, Alex Neil, Swans counterpart Vítor Matos and fourth official Ruebyn Ricardo.
Manchester City unrepentant in victory, Spurs make progress of a sort and Noni Madueke meets the moment
The manner of Manchester City’s victory at Liverpool was an article of both vindication and vilification. Those gleefully wielding inflatable bananas in the Anfield away end could thumb their noses. Why not enjoy the dances of defiance until the music stops? The same went for City players, asked to perform under the darkest of clouds, able to focus, at last, on football, rather than legal argument and uncertain futures. Beyond City, the sight of a club found guilty of 100-plus charges laying waste to such rivals as Liverpool was deeply uncomfortable. The Premier League season and product are badly damaged until the matter is somehow resolved. What happened at Anfield should double the haste for a resolution. Chants of “cheat” whenever City players, the game already won, slipped the ball around, are bound to be repeated at other stadiums. Enzo Maresca has described his club’s plight as “noise” but his team’s victory did absolutely nothing to turn the volume down. John Brewin
Álvarez vows to fight in Riyadh despite deadly strikes
Airport attacks leave at least 12 dead, hundreds hurt
Mexican seeks redemption after Crawford defeat
Canelo Álvarez intends to go ahead with his world title fight in Saudi Arabia later this month despite a series of deadly attacks on airports and other infrastructure in the kingdom, according to Turki al-Sheikh, the Saudi official who has become one of boxing’s most influential power brokers.
The Mexican superstar is slated to challenge the unbeaten Christian Mbilli for the WBC super-middleweight title in Riyadh on 31 October, three weeks after Saturday’s missile strike on the Saudi capital’s main international airport killed at least 12 people and wounded more than 300.
Bev Craig pledges £2m in funding to nurture local artists by improving access to rehearsal and production space
The Manchester mayor, Bev Craig, has said the city’s music scene is about more than just Oasis, as she announced funding to nurture a diverse range of local artists, be they “guitar bands or not”.
Craig pledged the £2m investment funding in Greater Manchester, as the city region hosted a conference for the creative industries at MediaCity in Salford.
Declan Rice’s future role in England’s midfield was questioned by Gary Lineker after Alex Scott’s impressive first senior international start in the 7-0 thrashing of Croatia. But the decision to withdraw from Thomas Tuchel’s squad in an attempt to manage his workload made sense after Rice had only three weeks off post-World Cup before returning to pre-season training. The 27-year-old has struggled with persistent back problems after suffering a hamstring injury last December and Mikel Arteta will hope that the rest has done Rice – who is thought to be close to agreeing a lucrative new contract at the Emirates – the world of good as they prepare to resume the defence of their Premier League title against Leeds on Saturday. Ed Aarons
Discord has announced tools aimed at expanding the number and types of companies that advertise on the platform.
This week, the social media firm announced Discord Ads Manager, an ad campaign management platform that lets companies manage ads shown on Discord in one place. The tool can be used to perform forecasting, build “a campaign with objective-based bidding,” and monitor an ad campaign’s performance, according to the announcement.
“Self-service access extends Discord advertising to smaller studios and marketers that previously needed a direct sales relationship to run campaigns, opening the platform to advertisers, regardless of their budget,” Discord said.
The government has lifted its ban on Discord in the Philippines after the platform's representatives met with officials from the Department of Information and Communications Technology (DICT) and the Cybercrime Investigation and Coordinating Center (CICC). The CICC is an attached agency of the DICT. The restriction was removed on Thursday, Sept. 24.DICT Secretary Henry Aguda and CICC Executive Director Undersecretary Renato "Aboy" Paraiso confirmed the decision. They said it followed a pledge from Discord officers to cooperate with both agencies.
Discord's Commitments to the DICT and CICC
The two sides held an online meeting on Thursday. According to Paraiso, Discord agreed to put security measures in place, establish a presence in the country, and support the government's campaign against online groomers."The meeting was successful," Paraiso said during a live press briefing. "We secured a commitment from Discord to collaborate with us in achieving our goal of further strengthening the online safety measures we are implementing for our country."Discord also told the DICT and CICC that it would provide a "green lane," which would let Philippine authorities track and monitor suspicious activity on the platform."Like Reddit, Discord has promised to provide us with a 'green lane'—such as monitoring and identifying threat actors on their platform," Paraiso said.
Why the CICC Imposed the Ban on Discord
The CICC had earlier ordered Discord and Reddit to coordinate with the agency and set up a local office within 24 hours.In a clarificatory statement on Wednesday, the center said it did not grant Discord an extension because the company had only responded through a letter. Paraiso said the ban took effect immediately, at around 5 p.m.Reddit, meanwhile, was allowed to keep operating after it held an online meeting with CICC officials. That discussion covered plans for a local Reddit office and other safety measures for teenagers who use the platform.
DICT Acknowledges Disruption to Users
An anti-scam advocacy organization said many people were frustrated by the temporary restriction because they rely on the platform for work. Aguda maintained that the immediate ban was meant to protect young people."Legitimate users have been somewhat inconvenienced, and we understand that. We just want to let you know that when we spoke with Reddit and Discord, they acknowledged the issue," the secretary said.Aguda added that both Discord and Reddit have named point persons who will coordinate with the government at all times. However, the timeline for setting up the companies' local offices has not been finalized.
Extremist Group Concerns Behind the CICC's Action
The CICC had previously flagged the presence of a Nihilistic Violent Extremism (NVE) group allegedly recruiting and grooming teenagers on these online platforms.The group is suspected of having links to the Sept. 18 school shooting at Banga National High School in South Cotabato, which killed three students. That incident came a month after a similar shooting at Ateneo de Zamboanga University left two students dead."Instances involving NVE are on the rise. The numbers are truly going up," Aguda said."We are all aware of this. We have been tasked with providing a solution," he told reporters."Sometimes, these solutions may not be popular, but we must do what is necessary to make progress in protecting the youth," the cabinet official said.
The smorgasbord "is but a feeble although refined outgrowth of the pagan feasts among the Vikings. ... The accent then was definitely on quantity, as those primitive gourmands cared little about the embellishment of the table or elegance in manner."
The FBI is warning the public about sexual exploitation actors illegally accessing social media and personal accounts to steal explicit images and videos from adult and underage victims. The stolen material, also known as non-consensual intimate images (NCII), is being posted or sold on criminal marketplaces, often without the victim's knowledge.
According to the FBI, these actors use social engineering and cyber intrusion tactics to target specific individuals or general targets of opportunity. After gaining access to accounts, they steal explicit content and share it through community forums or illicit marketplaces.
The FBI said personally identifiable information, including a victim's name, date of birth, email address, phone number and social media username, is often posted alongside the stolen material. This can expose victims to continued harassment and re-victimization.
How Sexual Exploitation Actors Access Accounts
The FBI has identified several methods used by sexual exploitation actors to gain access to victims' accounts.
Password and PIN Targeting
In password/PIN targeting, actors use high-volume password and PIN attempts against social media and personal accounts. The information used in these attempts can come from data leak sites, social media and open-source information.
When victims are known to the actors, curated lists may include personal details such as names, date of birth or variations of those details.
Social Media Customer Service Impersonation
Another tactic involves social media customer service impersonation through text messages. Victims may receive messages claiming their account is being disabled or locked unless they provide a verification code.
The actor then requests a password reset, causing a code to be sent to the victim. If the victim shares the code, the actor can reset the password and access the account.
Phishing Emails
The FBI also warns about phishing campaigns using look-alike domains and email accounts designed to appear as social media customer support.
These messages may claim there has been a new login and contain an embedded link asking the victim to change their password. Clicking the malicious link can give the actor access to the account.
Stolen Content Can Lead to Further Attacks
Once explicit content is stolen, sexual exploitation actors may post or sell it while including personal information about the victim. The FBI said victims can subsequently face harassment, sextortion, stalking or other targeted attacks.
The actors may also advertise stolen content through a victim's own social media page, increasing the potential for further exposure.
FBI Shares Steps to Protect Accounts
The FBI advises people to avoid storing sensitive images or videos on social media platforms or other internet-accessible sites.
It recommends using unique, complex passphrases and PINs along with multi-factor authentication (MFA). Password information directly associated with a person's identity, including names or birthdays, should be avoided.
Users should also be cautious with links received through emails and text messages. The FBI recommends going directly to the relevant website to address account concerns and checking URLs before clicking.
Unrequested temporary passwords, PIN resets or access codes should also be treated with caution. The FBI advises users not to share login information, even when someone claims to represent a platform or service.
People who believe their explicit content was stolen or leaked can provide information through the FBI's NCII reporting site. The FBI also advises the public to continue reporting fraud, scams and cyber threats to the Internet Crime Complaint Center or a local FBI Field Office.
Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others that were publicly detailed prior to today.
Image: Shutterstock, Mallika Home Studio.
August’s overstuffed bundle of patch joy from Microsoft did not eclipse its recording breaking release of more than 570 security updates last month, but it is double June’s then-record batch of nearly 200 fixes. Microsoft has attributed the recent patch deluge to vulnerability discoveries aided by artificial intelligence, and experts roundly agree that Windows users should get used to the idea of Patch Tuesdays (the second Tuesday of each month) covering hundreds of newly discovered security flaws.
Fully 42 of the 398 flaws that Microsoft patched today earned Redmond’s most-dire “critical” rating, meaning they are severe enough that malware or malcontents could exploit them to gain remote control over a Windows computer with little to no help from the user.
The sole known “zero day” bug fixed by Microsoft this month is CVE-2026-68820, a privilege escalation weakness in a core Windows component called afd.sys, which the security firm Automox describes as “the driver behind Windows socket connections on effectively every endpoint.”
“This isn’t a front-door bug,” Automox’s Landon Mileswrote in a Patch Tuesday blog post. “It’s step two in a chain: an attacker phishes their way into a low-privilege foothold, then uses the driver flaw to take the box. The 7.0 score reflects the high attack complexity, because race conditions are fiddly. The exploit has to be thrown over and over until the timing lands. Someone is clearly landing it anyway.”
CVE-2026-62832 is another privilege escalation flaw that Microsoft has labeled likely to be exploited; this flaw, in the Windows User Profile Service, may be related to the recent “LegacyHive” public disclosure from the prolific bug hunter known as Nightmare Eclipse. The other publicly disclosed flaw is CVE-2026-72971, a low-impact local tampering vulnerability that Microsoft reckons is unlikely to be exploited.
Other major software makers are likewise increasing their patch volumes and cadence thanks to AI, including Adobe which last month moved to twice-monthly security bulletins published on the 2nd and 4th Tuesday of each month. Cisco, Google, Mozilla and Oracle also are shipping updates far more frequently and abundantly.
By all accounts, AI is quite good at finding security holes in software. But for now at least, patching the resulting bugpocalypse remains a heavily human-centric endeavor, and the jury is still out on whether AI technologies will turn out to be as good at fixing vulnerabilities as they are at finding and exploiting them. This is an important question when one considers that these same AI technologies also are suggesting fixes for the vulnerabilities they find.
Researchers at 1Password recently examined what happens when different large language models (LLMs) generate vulnerability patches for newly disclosed, complex vulnerabilities. They found the LLMs produced patches that failed to fix the flaw or added a new weakness in the process (or both) more than half the time.
Ed Skoudis, president of the SANS Technology Institute, said his team has seen excellent results using AI to generate patches, provided there are humans in the loop to test the suggested fixes and push for iterative improvements.
“AI is rapidly becoming astonishingly good at finding vulnerabilities, but this research shows that fixing them is a very different problem,” Skoudis wrote in a SANS newsletter today. “Don’t expect one-shot AI patching to work reliably. Instead, iterate, test, challenge, improve, and verify. AI can be an extraordinary patching partner, but today it still needs a skilled human at the keyboard.”
Tyler Reguly at Fortra says while reports of Microsoft patching hundreds of vulnerabilities in one go have prompted some organizations to try to patch faster, it’s important to bear in mind that only one of the almost 400 bugs addressed today is known to be actively exploited. Reguly suggested security leaders check in with their teams to see how they’re handling the increasing workloads, which often involve testing fixes before deploying them in production environments.
“If you’re a chief security officer talk to your teams about how they are shifting or modifying their workflows to better accommodate the patching shift that we’re seeing and support them across various organizational units by enabling the changes they want to see made,” Reguly said. “There’s no need to rush these updates, no matter what various vendors and organizations try to tell you. You need to make sure that you are rolling out safe updates that will not negatively impact your systems.”
Speaking of the humans behind the keyboards, don’t neglect to backup your system and/or data before applying this month’s monster patch load. The day after each month’s Patch Tuesday is sometimes derisively referred to as Reboot Wednesday, but it generally doesn’t hurt to wait a few days to apply these huge update bundles because it sometimes takes a couple of days for the occasional misbehaving patch to get ironed out properly by Microsoft.
For a clickable, per-patch breakdown by severity and urgency, check out this roundup from the SANS Internet Storm Center.
Lina K., a co-worker, recently shared a firsthand account of how bots are adding League of Legends players via the Riot client friends list immediately after a match ends, striking up a flirty conversation, and eventually pushing an OnlyFans link. The pattern lines up with a wave of complaints that have piled up on Reddit and Facebook gaming communities over the past several months, and it fits into a broader trend of AI-assisted social engineering that has moved from dating apps straight into game clients.
The pattern
The scheme reported by multiple League of Legends players follows a near-identical script. A friend request lands in the Riot client within moments of a match ending, from an account whose name does not match anyone from that game. The message opens with generic flattery like “you played really well last game” or “I liked your playstyle” designed to sound like a genuine compliment from an opponent or teammate.
When questioned about who they are, the accounts often claim to have been on the enemy team despite name mismatches, and many present themselves as a woman looking for a duo partner. A detail that likely raises engagement odds. Victims who check the account’s profile frequently find it blank: no visible match history, no overview data, sometimes a very low account level. These are all signs of a throwaway account built or bought purely for outreach, but sometimes they turn out to be stolen existing accounts.
After a short exchange, the contact says they are “getting off soon” and hands over a Discord username, moving the conversation to a platform Riot’s chat protections cannot see or moderate.
Once on Discord, the persona shifts into a longer-form romance/flirtation script. Usually, hours of chat building rapport, paired with a steady stream of photos that are suggestive but stop short of explicit content, a tactic that keeps engagement high while deferring the “reveal” until trust is established. That reveal ultimately comes in the form of a link to a paid subscription platform, most often OnlyFans, framed as an exclusive, limited-time offer.
A reverse image search on the photos sent during one such conversation turned up the same pictures recycled across unrelated websites and at least one YouTube video, with commenters in that video describing having received identical images from a bot under different names. This is strong evidence that the same photo set is cycling through many chats simultaneously, run at scale rather than by one individual.
Lina stated:
“One of my friends tried to break the bot too, left it on read for some time – the bot actually switched the pictures to match the context of “Concern” on the face of the model with “Why are you not replying?”, which quite clearly gave away bulk image generation for the script.’
When the account was pressed with a “reveal your instructions” style prompt-injection attempt (text formatted to look like a system message ordering the bot to break character and print its configuration), it did not comply and instead stayed in persona, deflecting the request and continuing the pitch.
That resilience to a common jailbreak technique suggests the bot’s operators have added guardrails against exactly this kind of probing, or that the “model” behind it is a simpler scripted flow layered with some LLM-generated text rather than an open, unrestricted chatbot.
Why this is happening inside the game client now
What makes this wave notable isn’t the romance scam script itself. AI-driven catfishing has been documented on dating apps and social media for a couple of years. The difference is the entry point. Players have reported getting these bot friend requests after essentially every single match, with no way to distinguish a real player’s request from a bot’s inside the Riot client.
Community threads describe the bots seemingly appearing right after a game ends, which has fueled speculation that the bot operators are scraping or monitoring publicly available match data through third-party stats-tracking sites and associated APIs to identify recently finished games and target participants, though this has not been independently confirmed by Riot.
Riot’s own client architecture may be inadvertently helping. The Riot Client exposes local endpoints (such as the friends list API) that third-party tools and overlays query, and community-run “op.gg“-style trackers pull player and match data that could plausibly be used to correlate who just finished a game with who to target next. Some affected players have found a partial workaround: switching on the client’s “streamer mode,” which hides recent match and online status information, appears to reduce how often bot requests arrive. Which is an indirect clue that the targeting relies on visible activity signals rather than random spam.
Unlike classic Discord scams that push fake Nitro codes or malware-laden “test my game” links to hijack accounts, this particular chain appears primarily aimed at driving paid subscriptions to an OnlyFans-style page of a fake AI girl. That doesn’t make it harmless. Even when the underlying OnlyFans account is real, the conversations are very likely run by paid chat operators or scripted/AI-powered systems working from a shared script and a reused media library, a business model that has been described by former OnlyFans “chatters” themselves: agencies assign staff (or bots) to respond as the creator around the clock, pull from a pre-made vault of photos and messages, and are financially incentivized to convert every conversation into a subscription or tip.
There are also more damaging variants layered onto the same funnel. Community reports describe some of these bot accounts eventually sending a link that, once clicked, is designed to hijack the recipient’s Discord account or harvest credentials rather than lead to legitimate content.
That means the “girl who wants to duo” opening can just as easily terminate in an account-takeover attempt as in a subscription upsell. Because the funnel starts with a low-cost, disposable Riot account and migrates the target to Discord within minutes, the League client friend request functions purely as a first-contact filter: cheap to generate, easy to discard after a single use, and outside the reach of Riot’s in-game reporting tools once the conversation moves off-platform.
How to stay safe
Recognizing these scams is the best way to protect yourself. But there is more you can do:
Treat any Riot client friend request from an unrecognized name as suspicious by default, especially one that arrives seconds after a match ends—check whether the account actually appeared in your last game before accepting anything.
Enable streamer mode or equivalent privacy settings in the Riot client to limit what activity and match data outside parties can see, which several affected players found reduced the frequency of these requests.
Be skeptical of anyone who quickly steers the conversation off-platform to Discord, especially if they cite being unavailable (“gotta go soon, here’s my Discord”) as the reason—this is a deliberate move to a channel with less moderation and no shared match context to verify identity.
Run a reverse image search (Google Images, TinEye, or a dedicated tool) on any profile or “personal” photos sent early in a conversation; recycled images across unrelated sites or forums are one of the most reliable tells of a bot or catfishing operation.
Watch for AI-typical conversation patterns: responses that feel scripted, arrive instantly regardless of time of day, are grammatically flawless but emotionally generic, or that consistently dodge voice/video calls.
Never send money, gift cards, cryptocurrency, or payment details to someone you met exclusively through in-game or Discord contact, no matter how convincing the rapport feels—legitimate connections do not require urgent financial “help” or exclusive subscription purchases within hours of meeting.
Do not click links sent by unfamiliar contacts, even ones framed as harmless subscription pages, game invites, or file downloads; some variants of this scheme are documented to lead to credential-stealing or account-hijacking pages rather than legitimate content.
Lock down Discord’s privacy settings (restrict who can DM you and send friend requests) and enable multi-factor authentication, since a compromised Discord account is often used to relaunch the same scam against the victim’s own friend list.
Report suspicious Riot client accounts to Riot Support and suspicious Discord accounts/servers to Discord Trust & Safety; reporting does not remove the account instantly but it feeds the pattern data that platforms use to detect and ban clusters of bot accounts.
If a bot or scripted persona pushes back convincingly against attempts to “break” it (e.g., ignoring prompt-injection or jailbreak-style messages designed to expose it as an AI), treat that resilience itself as a red flag rather than reassurance—a well-guarded script is not the same as a genuine person.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
This post is available as a printable one page handout in English and Spanish.
Recordings of law enforcement, whether by bystanders or by those directly encountering officers, can be powerful tools of government accountability and can support movements for social change. But recording officers can come with risks. Below are important legal and practical considerations related to recording the police and other law enforcement officers.
Can I legally record the police or immigration officers?
Yes. All Americans have a First Amendment right to record law enforcement. This includes local police and federal officers such as those from Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP). Although the Supreme Court has not squarely ruled on the issue, nine different federal appellate courts have recognized and affirmed this right, relying on decades of Supreme Court precedent.
You may take photos, or record video and audio. Courts have held that wiretap laws, which generally protect private conversations, do not prohibit civilians from audio recording law enforcement. That’s because officers exercising their official duties, particularly in public, do not have a reasonable expectation of privacy. Neither do civilians in public places who speak to law enforcement in a manner audible to passersby.
What are some limitations on the right to record law enforcement?
Courts have been clear that behavior that obstructs or interferes with effective law enforcement or the protection of public safety is not protected. Officers can't order you to move because you are recording, but they may order you to move for public safety reasons even if you are recording.
If the law enforcement officer is off-duty or is in a private space that you don’t also have a right to be in, your right to record the officer may be limited. For example, a Los Angeles jury in 2026 found two women guilty of felony stalking after they followed an ICE agent to his home and livestreamed the pursuit.
What are some other considerations when recording officers?
Even if you believe you are appropriately exercising your First Amendment right to record law enforcement, officers may nevertheless escalate the situation and/or retaliate against you. Below are some things to keep in mind.
Stay calm and courteous.
If you are a bystander, stand at a safe distance from the scene that you are recording. But note that officers may approach and confront you, closing that distance in an effort to accuse you of interfering with and possibly also assaulting a federal officer.
Be alert and mindful of the possibility that officers may illegally retaliate against you in a number of ways, including arrest, destruction of your device, and bodily harm. They may also try to retaliate by harming the person being arrested.
Consider the sensitive nature of recording in the context of an arrest. For example, the person being arrested or their loved ones may be concerned about exposing their immigration status, so think about obtaining consent or blurring out faces in any version you publish to focus on ICE/CBP conduct (while still retaining the original video).
Law enforcement may not search your cell phone or other device without a warrantbased on probable cause from a judge, even if you are under arrest. Thus, you may refuse a request from an officer to review or delete what you recorded. You also may refuse to unlock your phone or provide your passcode.
What can I do to protect my footage?
How well protected your photos or video footage are depends on both the device and the way you’re recording. If you’re uploading video to a livestreaming service, it can save that video to the cloud if you enable that setting. But what if you want to protect your recordings stored locally?
Modern smartphones generally protect data, including videos, using encryption. This means if your phone is locked and protected by a strong passphrase, it is more difficult for an officer to delete what you’ve stored on the device. Removing biometrics such as face and fingerprint unlock can protect your device contents further. You can check your settings by following the steps in our Surveillance Self-Defense guides (see below) to ensure device encryption is turned on.
Want more information?
Read more about your right to record law enforcement: https://www.eff.org/issues/right-record
ClickLock Stealer is a new, modular macOS infostealer delivered via ClickFix-style phishing pages that can lock a victim’s Mac, steal their macOS password, browser and password manager data, cryptocurrency wallets, and then leave behind a persistent backdoor.
The malware was discovered by Group-IB researchers. They named it after the ClickFix distribution technique and its ability to lock a victim’s Mac if they don’t follow its instructions by killing all visible processes.
The researchers found a malicious shell script typically used to trick users into infecting their own device and followed the trail from there. The script first displays a fake Cloudflare progress bar, suggesting it was intended to be used as part of a fake browser verification flow.
Victims land on a phishing page that mimics Cloudflare verification or another fake system utility, similar to those used in the Infiniti Stealer campaign, and later ClickFix attacks impersonating Claude or cleanup utilities.
The page instructs the user to open Terminal, paste a command, and press Return, presenting it as a required “human verification” step or a quick fix.
The researchers explain:
“the malware orchestrates further modules that search the system for various data including browser credentials, password manager data, crypto wallet extensions, desktop wallet files, etc. and even employs a GSocket backdoor.”
This all happens while the user is distracted by fake Cloudflare images.
A GSocket backdoor abuses GSocket (short for Global Socket), an open-source networking toolkit. While designed for legitimate remote administration and penetration testing, attackers can weaponize it to establish stealthy, persistent, encrypted remote access to compromised systems.
Forcing victims to hand over their password
What really stands out is the way the malware forces the user to provide their macOS system’s password.
First, it displays a convincing fake macOS password prompt using the victim’s real username and a downloaded Apple icon. If the user enters their password, it is sent, along with all the previously stolen data, to a Telegram channel controlled by the attackers.
If the user refuses, the malware triggers a loop that shuts down key processes, including Finder, Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight, and all major web browsers. It leaves only a password dialog on the screen until the victim complies.
This “kill loop” runs every 210 milliseconds for up to 83 hours, or until the user enters the correct password. The result is a system that’s essentially unusable, with the password prompt becoming the only interactive element.
Once the stolen data has been sent to the Telegram channel, the malware starts deleting its own modules. However, unlike the infostealer modules, the GSocket backdoor remains installed, giving the attacker ongoing remote access to the system.
That means attackers can return later, even after the stealer components have self‑deleted, to install new malware, steal more data, or move through a corporate network using VPNs or SSH access already available on the compromised Mac.
With ClickFix running rampant and inventing new methods all the time, it’s important to stay aware, think twice before following unexpected instructions, and keep your devices protected.
Slow down. Don’t rush to follow instructions on a webpage or prompt, especially if it asks you to run commands on your device or copy and paste code. Attackers rely on urgency to bypass your critical thinking.
Avoid running commands or scripts from untrusted sources. Never run code or commands copied from websites, emails, or messages unless you trust the source and understand what the action does.
Verify instructions independently. If a website tells you to execute a command or perform a technical action, check through official documentation or contact support before proceeding.
Limit copy and paste for commands. Manually typing commands instead of copy and paste can reduce the risk of unknowingly running malicious payloads hidden in copied text.
Secure your devices. Use an up-to-date, real-time anti-malware solution with web protection. Malwarebytes blocks connections to unsafe sites like these.
Educate yourself on evolving attack techniques. Understanding that attacks may come from unexpected places helps maintain vigilance. Keep reading our blog!
Stay away from sponsored ads in search results. Anyone can buy them and make them look legitimate.
Pro tip: The free Malwarebytes Browser Guard extension warns you when a website tries to copy something to your clipboard.
Malwarebytes products detect and block ClickLock as MacOS.Stealer.ClickLock.
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
Microsoft today released updates to fix more than 50 security holes in its Windows operating systems and other software, including patches for a whopping six “zero-day” vulnerabilities that attackers are already exploiting in the wild.
Zero-day #1 this month is CVE-2026-21510, a security feature bypass vulnerability in Windows Shell wherein a single click on a malicious link can quietly bypass Windows protections and run attacker-controlled content without warning or consent dialogs. CVE-2026-21510 affects all currently supported versions of Windows.
The zero-day flaw CVE-2026-21513 is a security bypass bug targeting MSHTML, the proprietary engine of the default Web browser in Windows. CVE-2026-21514 is a related security feature bypass in Microsoft Word.
The zero-day CVE-2026-21533 allows local attackers to elevate their user privileges to “SYSTEM” level access in Windows Remote Desktop Services. CVE-2026-21519 is a zero-day elevation of privilege flaw in the Desktop Window Manager (DWM), a key component of Windows that organizes windows on a user’s screen. Microsoft fixed a different zero-day in DWM just last month.
The sixth zero-day is CVE-2026-21525, a potentially disruptive denial-of-service vulnerability in the Windows Remote Access Connection Manager, the service responsible for maintaining VPN connections to corporate networks.
Chris Goettl at Ivanti reminds us Microsoft has issued several out-of-band security updates since January’s Patch Tuesday. On January 17, Microsoft pushed a fix that resolved a credential prompt failure when attempting remote desktop or remote application connections. On January 26, Microsoft patched a zero-day security feature bypass vulnerability (CVE-2026-21509) in Microsoft Office.
Kev Breen at Immersive notes that this month’s Patch Tuesday includes several fixes for remote code execution vulnerabilities affecting GitHub Copilot and multiple integrated development environments (IDEs), including VS Code, Visual Studio, and JetBrains products. The relevant CVEs are CVE-2026-21516, CVE-2026-21523, and CVE-2026-21256.
Breen said the AI vulnerabilities Microsoft patched this month stem from a command injection flaw that can be triggered through prompt injection, or tricking the AI agent into doing something it shouldn’t — like executing malicious code or commands.
“Developers are high-value targets for threat actors, as they often have access to sensitive data such as API keys and secrets that function as keys to critical infrastructure, including privileged AWS or Azure API keys,” Breen said. “When organizations enable developers and automation pipelines to use LLMs and agentic AI, a malicious prompt can have significant impact. This does not mean organizations should stop using AI. It does mean developers should understand the risks, teams should clearly identify which systems and workflows have access to AI agents, and least-privilege principles should be applied to limit the blast radius if developer secrets are compromised.”
The SANS Internet Storm Center has a clickable breakdown of each individual fix this month from Microsoft, indexed by severity and CVSS score. Enterprise Windows admins involved in testing patches before rolling them out should keep an eye on askwoody.com, which often has the skinny on wonky updates. Please don’t neglect to back up your data if it has been a while since you’ve done that, and feel free to sound off in the comments if you experience problems installing any of these fixes.
Login
