Kaspersky has discovered a new phishing tactic used to evade traditional security controls that exploits Bubble, a platform that allows users to build web and mobile applications through a visual interface without writing code.

Attackers are increasingly adopting innovative tools designed for legitimate software development and repurposing them to boost phishing campaigns.

Traditional phishing attacks often rely on malicious links or obvious redirection techniques, which are typically flagged and blocked by modern security systems.

However, attackers are now leveraging Bubble’s no-code environment to generate intermediary web applications which are hosted on Bubble’s legitimate infrastructure and trusted domains such as *.bubble.io, which improves their credibility and helps them bypass security filters.

These applications function as disguised redirectors, silently forwarding victims to malicious credential-harvesting websites.

In the observed campaign, victims were ultimately redirected to a convincing imitation of a Microsoft login page, protected by a Cloudflare verification layer designed to further obscure malicious intent.

This technique is likely being integrated into broader phishing-as-a-service (PhaaS) platforms and phishing kits. These kits enable a wide range of malicious capabilities with ready-made tools, including real-time interception of session cookies, driving phishing campaigns through legitimate services such as Google Tasks and Google Forms, and carry out adversary-in-the-middle (AiTM) attacks that can bypass multi-factor authentication.

They also support the generation of phishing emails using AI, implement geo-filtering and anti-detection mechanisms to evade security crawlers and are often hosted on reputable cloud services like AWS to avoid blacklisting.

“The use of legitimate platforms like Bubble introduces a new level of trust abuse, making it harder for both users and automated systems to distinguish between safe and malicious content. This significantly increases the likelihood of credential theft, unauthorised access and potential data breaches,” comments Roman Dedenok, Anti-Spam Expert at Kaspersky.

Nigeria has taken a major step toward strengthening its digital governance framework as the National Information Technology Development Agency (NITDA) officially assumes control of the Nigeria Government Enterprise Architecture (NGEA) infrastructure.

The handover ceremony held in Abuja, marks the culmination of a high-level partnership with the Korea International Cooperation Agency (KOICA).

This transition signals a shift from fragmented IT projects to a unified, disciplined approach to national digital investment.

The NGEA initiative forms a core part of the e-Government Masterplan 2.0 (Ne-GMP 2.0), aimed at establishing a unified and structured approach to managing government IT investments and digital resources.

The framework is designed to ensure that technology deployment across public institutions aligns with national priorities while improving efficiency and accountability.

With the system now operational, government agencies are expected to adopt more integrated digital processes, allowing seamless data sharing and interoperability.

This is anticipated to reduce duplication, strengthen risk management, and translate policy objectives into measurable digital outcomes.

Over the past two and a half years, Nigerian technical experts worked closely with their Korean counterparts to develop the architecture framework, create reference models, and execute pilot programmes in key institutions.

These include the National Identity Management Commission, Nigeria Customs Service, Nigeria Immigration Service, and NITDA.

Officials say the NGEA represents a shift from fragmented digital efforts to a more coordinated, citizen-focused system.

The infrastructure is hosted by Galaxy Backbone Limited, providing a secure and reliable platform for nationwide deployment.

Looking ahead, NITDA is expected to work with government stakeholders to expand and sustain the system, while the Federal Ministry of Communications, Innovation and Digital Economy will provide policy guidance to ensure its adoption across the country.

A jury in Los Angeles has found technology companies, Meta and Google liable for contributing to a young woman’s social media addiction, in a case being described as a landmark ruling.

The 20-year-old woman, identified only as Kaley, argued that she became addicted to Google’s YouTube and Meta’s Instagram from an early age due to their attention-driven design features.

According to her testimony, she began using YouTube at the age of six after downloading the app on her iPod Touch to watch videos about lip gloss and online games.

Kaley told the court that she joined Instagram at nine, bypassing parental restrictions put in place by her mother, and spent extended periods on social media.

The trial, which lasted about a month, with arguments and evidence from both sides.

Jurors also heard testimony from Mark Zuckerberg, chief executive, Meta and Adam Mosseri, Instagram head.

However, Neal Mohan, YouTube chief executive, did not testify.

The jury found that the companies were negligent in the design of their platforms and failed to adequately warn users about potential harms. Meta and Google were ordered to pay the woman $3 million in damages.

Jurors also recommended additional punitive damages, including $900,000 against YouTube and $2.1 million against Meta, according to company spokespersons.

The jury apportioned 70 per cent of the responsibility to Meta and 30 per cent to YouTube.

Kaley was present in the courtroom when the verdict was delivered, alongside parents of other teenagers who say they were harmed by social media use. Both companies said they plan to appeal the decision.

“We respectfully disagree with the verdict and will appeal. Teen mental health is profoundly complex and cannot be linked to a single app. We will continue to defend ourselves vigorously as every case is different, and we remain confident in our record of protecting teens online”, a Meta spokesperson said.

José Castañeda, Google spokesperson, said the case misunderstands YouTube, which is a responsibly built streaming platform, not a social media site.