News

Google found Chinese hackers abusing Google CalendarThe service was used to host malicious instructions and to exfiltrate resultsToughProgress campaign was carried out by Chinese state-sponsored hackers APT41Chinese state-sponsored hackers known as APT41 have been seen abusing Google Calendar in their newest attacks, using it as part of the C2 infrastructure.Google’s Threat Intelligence Group (TIG) recently discovered the technique, dismantled the setup, and introduced changes to prevent similar attacks in the future.The attack starts from a previously compromised government website - TIG did not explain how the site was compromised, but said it was used to host a .ZIP archive. This archive is then shared, through phishing emails, with potential targets.Reading the calendarInside the ZIP are three files: a DLL and executable files posing as JPGs, and a Windows shortcut file (LNK) posing as a PDF document.When the victim tries to open the fake PDF, it runs the shortcut which, in turn, activates the DLL.This file, in turn, decrypts and launches the third file, which is the malicious payload dubbed “ToughProgress”.The malware then reads additional instructions shared in two specific events in Google Calendar. The commands are found either in the description field, or hidden events.To share the results, the malware would create a new zero minute calendar event on May 30, and share the data, encrypted, in the calendar event description.Since the malware is never actually installed on the disk, and since the C2 communication happens via a legitimate Google service, most security products will have trouble spotting the attack, Google suggests.To tackle the threat, TIG developed custom detection signatures to identify and block APT41’s malware. It also took down associated Workspace accounts and calendar entries. Furthermore, the team updated file detections and added malicious domains and URLs to the Google Safe Browsing blocklist.Google also confirmed that at least a few companies were targeted: “In partnership with Mandiant Consulting, GTIG notified the compromised organizations,” it said.“We provided the notified organizations with a sample of TOUGHPROGRESS network traffic logs, and information about the threat actor, to aid with detection and incident response.”It did not say how many companies were affected.Via BleepingComputerYou might also likeGoogle warns of legit VPN apps being used to infect devices with malwareTake a look at our guide to the best authenticator appWe've rounded up the best password managers

Sonos is selling a bunch of its speakers at a discount via Amazon. This includes the well-regarded Era 300 smart speaker, which is down to just $359. That's 20 percent off and notable because this particular speaker rarely goes on sale. It's a Sonos miracle!

The deal applies to both the black and white colorways. The Era 300 is a highly capable device that we praised in our official review, saying that it "sounds excellent." We went on to say that it offers a premium experience that far surpasses other products in the company's lineup, like the Era 100. This is also true when compared to rival speakers like Apple's HomePod.

It's simple to set up and offers the company's proprietary Trueplay tuning system. This feature optimizes the sound of the speaker to the unique acoustics of a room by leveraging an internal microphone. It measures how sound reflects off surfaces and adjusts the EQ to match. It's pretty nifty.

As for connectivity, it can pair with another Era 300 speaker for a true stereo experience. It also includes a Bluetooth receiver and line-in options. Of course, the speaker integrates with just about every streaming music service. The built-in mic also allows for voice assistant control, but only with Siri and Alexa. Google Assistant is left out of the party.

This speaker goes all-in on spatial audio, and the results are mixed. Sometimes it's sublime and sometimes it's kind of eh. This is more of a dig on the technology itself. It has serious potential but is still experiencing growing pains. The only real downside of this speaker is the exorbitant asking price, which has been slightly alleviated by this sale.

As previously mentioned, other Sonos products are available at a discount. This includes the Sonos Beam Gen 2 soundbar, which is 26 percent off at $369. These deals are available via Sonos itself. There's also an ongoing sale on portable speakers.

Follow @EngadgetDeals on X for the latest tech deals and buying advice.This article originally appeared on Engadget at https://www.engadget.com/deals/sonos-home-speakers-are-up-to-26-percent-off-right-now-150857008.html?src=rss

World War Z VR, a new first-person, single-player game, is coming to SteamVR and Meta Quest on August 12Saber Interactive's new game will allow players to take on hordes of over 200 zombies at once in VRPre-orders are now available on the Meta Store and SteamSaber Interactive has announced the next game in its World War Z franchise, World War Z VR, and it's launching this summer.World War Z VR is a brand new first-person, single-player game based on the Paramount Pictures 2013 film and Saber’s game franchise, and is set to release on August 12 for SteamVR, Meta Quest 3, Meta Quest 2, and Meta Quest Pro."World War Z VR faithfully reimagines the intense action of the original World War Z game to create the most immersive VR zombie experience ever," Saber said. "Take on hordes of over 200 zombies on screen at a time, an astounding technical feat for VR which will put your skills to the ultimate test."In this new installment, players will find themselves taking on hordes of zombies in three locations: New York, Tokyo, and Marseille. There will be seven playable characters to choose from, and after selecting their operative, players can start missions with a pre-selected AI squad, equipped with a wide variety of weapons and perks.The VR missions will present unique challenges for players and even offer three difficulty modes to choose from. Zombies will also adapt to their surroundings and recognize the players' playstyle to hunt them down, while special infected enemies raise the stakes even higher.Pre-orders are now available on the Meta Store and Steam for $19.99 / £14.99. Those who secure a pre-order will also gain access to the Golden Skin Pack, which features four exclusive gold weapon skins.Steam users can also pre-order a special game bundle that includes both the new World War Z VR and the original World War Z, featuring a 20% discount.You might also like...Sony's Days of Play sale kicks off tomorrow and will bring price cuts to the PS5 Pro, DualSense Edge, the PS5 Call of Duty: Black Ops 6 bundle, and a host of price cuts on accessories and gamesLeaker claims Sony is now working on a new PlayStation handheld consoleGhost of Yotei pre-orders live: Collector's Edition up in the US, Standard Edition retailers, and where to buy in the UK

A new update for the Philips Hue mobile app is rolling out nowThe app now suggests adding new sensors and switches to a zone during the setup processThis avoids a problem where lighting scenes are unavailable later onIf you've ever struggled to set up new sensors and switches for your Philips Hue lights, help is at hand. A new app update is rolling out now that automatically suggests adding accessories to a zone when you connect them for the first time, so you don't miss out on any features later on.A zone is a set of lights and other accessories that you want to control together as a group. They don't necessarily have to be in the same place or include all the lights within a room. For example, you might want to create a zone specifically for your home entertainment lighting, or one that includes all the lights on a particular floor.Previously, assigning new devices to a room or zone was an optional step within the Philips Hue app, which you might miss if you were in a hurry. If you did, you wouldn't be able to use all of the switch or sensor's functions afterwards. For example, you may be unable to view all the available scenes (ready-made lighting profiles).The new app update was spotted by the editor of Hueblog.com, who says he's often contacted by readers stuck in this frustrating 'accessory trap'. From now on, the app will suggest creating at least one zone during the setup process so you don't suffer that problem, and will note that you can always hide zones in the future if you prefer.Simpler setupThere is also a change to the setup process when you're installing a new Philips Hue security camera. As Notebookcheck explains, the app now offers you the chance to set up motion-controlled lighting during the initial setup process.Both of these are relatively minor changes, and there's still no news about the upcoming Philips Hue AI assistant. However, they address some common problems that you might face when extending your Philips Hue setup and make your best smart lights even better.You might also likeNanoleaf's new indoor and outdoor smart lights are its funkiest designs to datePhilips Hue bulb types explained: choose the right lights for your homeIf the Philips Hue Play HDMI Sync Box is too expensive, this new budget-friendly alternative from WiZ could be exactly what you need

NordVPN has launched post-quantum encryption (PQE) across all its applicationsThe provider launched its first iteration of PQE in 2024, but only for its Linux VPN appThis comes as traditional encryption methods are set to become obsolete with the advent of quantum computers NordVPN has just taken an important step forward into its post-quantum transition, extending support for quantum-safe encryption across all its applications.While the provider launched its first iteration of post-quantum encryption (PQE) in September 2024, only Linux users could enjoy this protection. Now, all NordVPN users can enjoy PQE no matter the platform they use.Already rated as the best VPN service on the market by TechRadar's reviewers, NordVPN joins a handful of VPN providers that also include quantum-safe cryptography in their software.Why and how use NordVPN post-quantum encryptionAs quantum computing advances, NordVPN's CTO, Marijus Briedis, explains, RSA-based key exchange encryption methods that most VPN protocols use today will eventually become vulnerable.Experts predict, in fact, that traditional encryption will soon be broken by the ability of quantum computers to perform computations that machines can't handle, within minutes.While this is expected to happen between five to 10 years, cybercriminals have already started to conduct what's known as "store now, decrypt later (SNDL) attacks." The idea is simple – to collect encrypted data now so they can crack it in the future when quantum computing is finally up to the task.This is exactly why the cryptographic world is already catching up. Last August, the National Institute of Standards and Technology (NIST) released the first three quantum-resistant encryption standards to better support software providers in their transition. NordVPN joined the post-quantum revolution a few months after that, adding one of these algorithms (ML-KEM) to its WireGuard-based Nordlynx protocol, which is known for its speed and security."By integrating PQE into our VPN infrastructure, we're taking a proactive step to ensure long-term confidentiality and resilience for our customers' data, both now and in a post-quantum future," said Briedis.TechRadar needs you! We want to know what you think about the world of VPNs. Whether you're a novice or a VPN pro, we want to hear your thoughts. Don't worry, though, your responses are completely anonymous, and it takes less than five minutes to complete!To take part, click the link below: https://futurenet.questionpro.eu/tr-vpnAs mentioned earlier, before the latest release, only the Linux VPN app included PQE support.This choice allowed the NordVPN team to analyze how the new quantum-safe algorithm, which was implemented in a hybrid way alongside classic encryption methods, could affect performance like connection speeds and latency."The gathered data served as a stepping stone in the transition to quantum-resistant encryption for the rest of our platforms," said Briedis. "The Linux case demonstrated that we successfully maintained the highest level of user experience in terms of connection time and speed during the transition."As a result, NordVPN rolled PQE across all its platforms – from Windows and macOS to Android and iOS, even including its Android TV and tvOS apps.Users need to actively enable this extra protection by heading to the Connections tab in the app's Settings and switching on the toggle. The PQE feature will automatically activate whenever the user connects via the NordLynx protocol.Which VPN providers offer post-quantum encryption?NordVPN is not the only virtual private network (VPN) provider currently including PQE support on its service.ExpressVPN added quantum-safe encryption on its proprietary Lightway protocol in October 2023, by default across its Android, iOS, Linux, Mac, and Windows apps. Last January, the team took a further step forward by upgrading to the NIST standards.After pioneering the post-quantum transition in 2017, Mullvad extended PQE support for all platforms when it released post-quantum protection for iPhone in September 2024. The provider now plans to migrate to the new NIST standards, too.AdGuard, Windscribe, and PureVPN are other providers currently offering PQE protection, with Surfshark and NymVPN also expected to join the list soon.You might also likeVPNs need to be ready for the post-quantum world – here's what's being doneIs the internet ready for the "biggest security threat of all time"?NordVPN has now a full GUI Linux VPN app

Doda, a district in India's Jammu and Kashmir region, issued a 2-month VPN ban over national security concerns The ban was enforced on May 2, 2025, with some VPN users reportedly detained after that date Experts are warning against the attack on people's digital rights, while questioning the legality of the banDoda, a district in India's Jammu and Kashmir region, enforced a 2-month VPN ban on May 2, 2025, over national security concerns.Authorities issued the ban under Section 163 of the new BNSS law (the equivalent of the Indian Penal Code), citing individuals and groups misusing virtual private network (VPN) tools "to circumvent lawful cyber restrictions and access prohibited applications," the order reads.Digital rights and legal experts have so far strongly criticized this decision. They warn against the attack on people's digital rights and security, while questioning its legality.Is Doda's VPN ban legal?The Doda's VPN ban aims to "curtail the use of VPNs in the interest of public safety," and it's extended to all individuals, institutions, internet service providers, and cyber cafes operating in the district.This means that all residents are barred from using one of the best VPN services or similar tools for two months, to avoid being liable for legal action.Repercussions for allegedly using VPNs seem to have already begun. In a report published on May 18, Indian publication The Wire reported allegations that an unspecified number of Doda residents under "technical surveillance" have already been arrested as found to be using VPNs.Two days before, Doda's authorities had already confirmed to have "detained several individuals across the district for violating the directive."This is why many experts have been raising concerns about how the ban can impact people's rights, like free speech, free access to information, and privacy.TechRadar needs you! We want to know what you think about the world of VPNs. Whether you're a novice or a VPN pro, we want to hear your thoughts. Don't worry, though, your responses are completely anonymous, and it takes less than a minute to complete!To take part, click the link below: https://futurenet.questionpro.eu/tr-vpnTalking to TechRadar, Senior Policy Counsel and Encryption Policy Lead at Access Now, Namrata Maheshwari, explains that the right to the internet and the right to privacy are protected fundamental rights under the Indian Constitution.Maheshwari also pointed out how the Indian government has already implemented "an onerous mandate" for VPN providers when it enforced a new data retention law in 2022.A host of online services are now required to store users' data for up to five years and share it with authorities on request, in fact, something that led to an exodus of major VPN companies from the country.VPNs are not illegal."Namrata Maheshwari, Access NowYet, "VPNs are not illegal," said Maheshwari, adding that a blanket ban on all VPNs for two months is "unnecessary and disproportionate.""People have a fundamental right to information and freedom of expression, and restrictions on these rights ought to be legal, necessary, and proportionate – a standard this ban does not meet," she added.The ban isn't affecting only individual users, though, but also businesses and institutions that regularly use these services for security purposes.According to Maheshwari, the ban could then end up increasing vulnerabilities in the country's cyberspace, ultimately weakening security as opposed to strengthening it.She said, "Even in an emergency, preventative measures cannot be this vague and overreaching, particularly where less intrusive means are available."You might also likeIndia ordered X to block 8,000 accounts – here's what we know so farProton Mail hit with blocking order in IndiaVPNs are disappearing from India's app stores – and a 2022 law may be the culprit

Elon Musk has left his role as the de facto head of the Department of Government Efficiency (DOGE). “As my scheduled time as a Special Government Employee comes to an end, I would like to thank President @realDonaldTrump for the opportunity to reduce wasteful spending,” Musk wrote on X. “The @DOGE mission will only strengthen over time as it becomes a way of life throughout the government.”

DOGE is a Trump administration initiative with the stated goals of cutting wasteful government spending, modernizing IT systems and maximizing efficiency in various departments — even though DOGE itself was initially set to have two leaders, Musk and Vivek Ramaswamy, who dropped out to focus on a bid to become Ohio's governor. Musk’s tenure there has been an eventful one, to put it mildly, as DOGE has taken a chainsaw to the government over the last four months.

Musk's slash-and-burn approach (similar to the one he adopted in his early days at X) played a role in hundreds of thousands of federal workers being turfed out — reportedly including some working at an agency that regulates Tesla. DOGE officials were involved in firing workers who it turned out had essential roles and had to be quickly hired back. In some cases, federal judges ordered the reinstatement of fired federal employees.

DOGE has inserted staffers into many government agencies. It demanded access to sensitive data including federal employee information and Treasury Department financial records, a request that a judge granted this week despite 19 attorneys general trying to prevent that over privacy and legal concerns.

Elsewhere, DOGE has been using generative AI chatbots to try to automate some government tasks. (A custom version of ChatGPT used by the Department of Veterans Affairs is called, in all seriousness, VAGPT.) The initiative also reportedly monitored government communications for criticisms of Musk and President Donald Trump. It was also reported last month that the Social Security Administration was moving all its official communications with the public to X, the social network that Musk owns.

Given his status as a Special Government Employee, Musk could only legally serve in his position for 130 days in a one-year period. The 130 days are up as of May 30, though DOGE is slated to remain operational until July 4, 2026.

Musk's departure comes at a time of turmoil for some of his higher-profile companies. It emerged this week that, between April 2024 and last month, sales of new Tesla electric vehicles dropped by half in Europe. — despite EV sales in the region rising overall by 28 percent. In Quebec, said to be the most EV-friendly market in Canada, Tesla sales reportedly sank by 87 percent between the first three months of 2024 and the same period this year. Overall, Tesla deliveries dipped by 13 percent in that timeframe.

Tesla’s business is interlocked with Musk and the public persona of its CEO. Its reputation has been damaged in the eyes of many given Musk’s political dealings, personal views, his association with DOGE, the agency’s actions and his efforts to help Donald Trump win the presidency.

Activists have called for boycotts of Musk's companies and staged protests at Tesla showrooms. Many Tesla owners have been trying to distance themselves from Musk by placing stickers on their cars. Others have sold their EVs, even though that meant taking a financial hit amid plummeting resale values. Protestors have targeted Cybertrucks and others have made fun of the vehicle and owners of it on social media. (In fairness, that’s not entirely to do with Musk’s association with DOGE and the president — the Cybertruck is an absolute eyesore).

Meanwhile, SpaceX had mixed results with its latest Starship test flight this week. While the spacecraft reached space, the payload door got stuck and it was unable to deploy its payload of fake satellites. As for the Super Heavy booster, which had been reused after the successful seventh test flight, that was supposed to splash down into the ocean but, six minutes after launch, it experienced a "rapid unscheduled disassembly."

So Musk has plenty to concern himself with as he officially leaves DOGE, but he's been critical of a federal budget bill. As he prepared to depart his government role, he expressed "disappointment" with the Trump spending bill, suggesting in an interview that it "undermines the work that the DOGE team is doing." The One Big Beautiful Bill Act, which the House passed last week, will end most clean energy tax credits, including those on EV purchases. Tesla has claimed that "abruptly ending the energy tax credits would threaten America’s energy independence and the reliability of our grid."

In any case, it's unclear whether DOGE has actually met its mandate of slashing government spending. A tracker on the DOGE website claims to have saved taxpayers some $170 billion by canceling contracts and laying off workers, but reports suggest that the "Wall of Receipts" is full of misleading or inaccurate claims. A fellow at the conservative-leaning American Enterprise Institute think tank suggested to CBS News this month that the figure is more likely to be around $80 billion.

Meanwhile, Bloomberg reported on Thursday that, since Trump took office in January, federal spending has actually increased by 8.7 percent compared with the same period in 2024. That's largely due to spending on Social Security, Medicare and other social insurance programs, as well as interest payments on the federal debt. However, the report notes that the full impact of the DOGE-led cutbacks may not yet been factored into the figures, given the up-front costs involved in ending programs and canning so many workers.This article originally appeared on Engadget at https://www.engadget.com/big-tech/elon-musk-leaves-doge-amid-tanking-tesla-sales-153859407.html?src=rss