Expired Visa Cards Can Be 'Zombified' for Contactless Payments, Researchers Warn

Washington DC, United States Aug 22, 2026 ALN: As the controversial vehicle surveillance giant Flock Safety continues to expand, researchers have revealed alarming insights about the company’s new AI policing tool, demonstrating that its capabilities extend far beyond merely reading license plates and tracking vehicles. This week, a Rhode Island police officer was subjected to five internal affairs investigations within two years after publicly questioning the department’s use of Flock cameras.

In a related development, OpenAI announced it is halting model training runs and overhauling internal safety protocols following incidents of high-profile rogue activity by some of its AI agents. The company indicated that its upcoming Astra model may represent a turning point in “critical” cyber capabilities.

A reverse-lookup identification service has exposed millions of photos of individuals’ faces in a database accessible via the open internet. Meanwhile, Meta faced backlash for running ads for an app that promised to nudify female politicians, including one featuring a pornographic video with a deepfake resembling a well-known US politician. Apple subsequently removed the app from the App Store after inquiries were made.

In an interview, Andy Yen, CEO of the privacy-focused digital services company Proton, discussed the privacy implications of AI and how access to encryption can expand in this new technological era.

But wait, there’s more! Each week, we summarize the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories and stay safe out there.

Fraudsters Could Use “Zombified” Expired Visa Cards to Make Contactless Payments

Many people understand that any active credit card poses a fraud risk the moment it is lost, stolen, or otherwise falls into the wrong hands. However, it may come as a surprise that an expired Visa card can also serve as a key to a bank account if it is left unattended or discarded intact, discovered by a fraudster, and “zombified” using a new technique recently revealed by researchers.

At the Usenix Cybersecurity Conference last week, researchers from the University of Massachusetts Amherst warned that fraudsters could make contactless payments using expired Visa credit cards by proxying them through a man-in-the-middle app that relays the card’s data via two phones. Due to issues in the authentication chain of contactless payments, the researchers found that whether a transaction from an expired card would be disallowed depended on the cryptography implemented differently by various card issuers. Visa’s system had a particular flaw that allowed out-of-date cards to pass its checks.

In fact, as the researchers describe it, Visa essentially passed the responsibility of authenticating these transactions to the cardholder’s bank. While some banks prevented the use of zombified cards, others did not. This means that fraudsters could potentially dumpster dive for an expired card and use it to make payments from the unwitting owner’s account—especially at point-of-sale terminals where no human is present to question their phone-based proxy setup.

The lesson is clear: when that Visa card expires, a pair of scissors can ensure it doesn’t reanimate in someone else’s hands.

Apple Sent Out an “Unprecedented” Number of Hacked-Device Warnings

Apple has long notified owners of iPhones and other devices that may be targets of what it calls “mercenary spyware”—sophisticated, stealthy malware installed by government or state-sponsored hackers. Last weekend, the number of alerts sent to potential victims spiked to an “unprecedented” level, according to TechCrunch, which spoke with security analysts investigating potential spyware intrusions. The alerts, sent to potential hacking targets in 110 countries, reached numbers more than 30 percent higher than previous rounds, according to estimates from Mohammed Al-Maskati, who leads a team of security investigators at Access Now, a digital rights group that Apple refers victims to in its spyware alerts. At least one target was a Ukrainian soldier, who reported that others in the Ukrainian military had also received the alert. The rise in sophisticated iPhone hacking campaigns is concerning: this year, researchers at iVerify and Google uncovered two iOS mass-hacking tools known as DarkSword and Coruna.

Ukraine Says It Hit Russian Ecommerce Giant With a Cyberattack—and Drones

In Russia’s ongoing cyberwar against Ukraine, it has occasionally employed combined physical and digital attacks, such as triggering a hacker-induced blackout in a Ukrainian city during an air raid. Now, as Ukraine increasingly strikes back against Russia to impose costs on its invaders, it appears to have attempted a similar tactic. The Ukrainian military claimed this week to have executed a disruptive cyberattack against Russian ecommerce giant Wildberries—often considered the Russian equivalent of Amazon—while also conducting drone attacks that damaged parts of the company’s warehouse infrastructure, according to cybersecurity news outlet The Record. Although Wildberries primarily operates as a consumer retail business, the Ukrainian Main Intelligence Directorate asserted that it is involved in military logistics and has played a role in financing the war in Ukraine. The Record could not confirm the exact effects of the cyberattack on Wildberries, but Russian media has reported that the company has lost nearly 13 million square feet of warehouse space due to drone strikes.

US Agencies Warn of AI-Aided Hacking Targeting American Infrastructure Systems

Hackers’ exploitation software, like all software, is now rarely written one keystroke at a time. Therefore, it’s not surprising that hackers targeting US infrastructure equipment are among those utilizing AI to automate their work.