Daily digest

TikTok to Pay $400M to Settle Child Privacy Lawsuit

The DoJ announced TikTok will pay $400 million to settle a 2024 lawsuit alleging violations of U.S. child privacy laws. $300 million is due immediately, with an additional $100 million contingent on vacating a prior consent decree against the company.

Supply-Chain Attack Turns Android Car Head Units Into Proxy Botnet Nodes

Attackers compromised a legitimate device-update app used by Android-based car head units to distribute malware that enrolls infected devices into a proxy botnet, which is used for anonymized traffic relay and ad fraud. The campaign exploits trust in a first-party update mechanism to achieve broad device compromise.

Securing Windows Named Pipes Against Privilege Escalation Abuse

ThreatLocker detailed how Windows named pipes, used for fast interprocess communication, can be abused when access controls are weak, allowing untrusted processes to reach privileged services. Recommended mitigations include endpoint verification, command authorization, strict input validation, and scoped privileges.

Why it matters: Named pipe abuse is a known lateral-movement and privilege-escalation vector on Windows; worth reviewing endpoint hardening policies for your Intune-managed Windows 11 fleet against this technique to stay aligned with NIST 800-171 access control requirements.

Security Teams Urged to Adopt AI-Driven Self-Attack Testing

The Register reports that AI agents are increasingly being used both offensively by attackers and defensively by security teams to probe their own systems for weaknesses. The piece argues that AI agents themselves are becoming a new attack surface that defenders must account for.

Why it matters: If you're running a self-hosted AI stack, this reinforces the need to treat AI agents/pipelines as part of your attack surface and consider automated adversarial testing as part of your security assessment cadence.