❌

Visualização normal

Antes de ontemFirewall Daily – The Cyber Express
  • ✇Firewall Daily – The Cyber Express
  • Fake Reviews, Deceptive Ads: FTC Targets Alleged Passport Scam Samiksha Jain
    The Federal Trade Commission (FTC) has filed a complaint against GovAssist LLC, Entry LLC and Scott Zuckerman over an alleged government impersonation scheme targeting consumers seeking U.S. passport and travel-related services. The case highlights how paid search advertising, misleading service promises and allegedly fake customer reviews can be used to make commercial websites appear connected to official government services. According to the FTC, the defendants allegedly used websites and sp
     

Fake Reviews, Deceptive Ads: FTC Targets Alleged Passport Scam

23 de Outubro de 2026, 07:27

Government impersonation scheme

The Federal Trade Commission (FTC) has filed a complaint against GovAssist LLC, Entry LLC and Scott Zuckerman over an alleged government impersonation scheme targeting consumers seeking U.S. passport and travel-related services. The case highlights how paid search advertising, misleading service promises and allegedly fake customer reviews can be used to make commercial websites appear connected to official government services.

According to the FTC, the defendants allegedly used websites and sponsored search results to attract travelers, collect personal and financial information, and mislead consumers about the services they would receive. The complaint was filed in the U.S. District Court for the District of Puerto Rico.

How the Government Impersonation Scheme Allegedly Worked?

The FTC alleges that, since at least October 2023, GovAssist, Entry and Zuckerman operated websites including GovAssist.com, Entry.com and IVS.us, offering passport applications, passport-related services, visa applications and visa renewals.

The complaint states that the websites presented themselves as affiliated with the U.S. State Department, although the defendants were neither the federal government nor authorized government-affiliated providers of passport-related services.

The alleged operation relied on paid search ads to reach people looking for official passport information. Searches such as “apply for a new passport,” “passport renewal,” and “passport renewal online” routinely returned IVS.us and Entry.com pages among Google’s top sponsored results, according to the FTC.

This approach allegedly placed commercial services in locations where users might expect to find official government resources. The distinction matters because consumers searching for essential documents may not recognize that a sponsored result belongs to a private company rather than a government agency.

Misleading Passport Service Claims and Hidden Costs

The FTC alleges that the defendants made false promises about what their services could deliver, including claims that they could directly issue U.S. passports. In many cases, consumers allegedly received only a completed passport application that was available for free through the State Department’s website.

The complaint also challenges the companies’ pricing disclosures. Although their advertisements or websites reportedly stated that services started at $89, the FTC alleges that the lowest available price was $119, plus a $29 shipping fee, bringing the total to $148.

Consumers also needed to pay the State Department when submitting their passport applications. According to the complaint, the defendants prominently displayed their own prices while omitting or downplaying the additional government fee, potentially leaving customers unaware that they would have to pay again.

Delivery claims are another part of the case. The FTC alleges that the defendants advertised expedited passport services promising delivery in as little as six to 10 business days or three to four business days. The agency contends these promises were false because the timelines were faster than the quickest expedited service available through the State Department, the only source of U.S. passports.

Fake Reviews and Consumer Trust

The complaint further alleges that the defendants used fake positive reviews to make their services appear legitimate. Their websites reportedly highlighted excellent ratings based on consumer feedback published on Trustpilot and other review platforms.

According to the FTC, those ratings relied on high numbers of fake positive reviews. If established, the allegations would show how misleading reviews can reinforce the credibility created by sponsored search placements, making it harder for consumers to distinguish legitimate services from deceptive offerings.

The alleged combination of deceptive ads and fake reviews is central to the case because consumers may rely on both search rankings and customer feedback when deciding which service to trust.

FTC Alleges Violations of Three Federal Laws

The FTC alleges that the defendants violated the FTC Act, the Impersonation Rule and the Gramm-Leach-Bliley Act. The complaint targets the alleged impersonation of government services, misleading representations about passport processing and pricing, and the use of false consumer reviews.

Zuckerman, identified as the owner and sole member of GovAssist and Entry, allegedly operated the scheme while subject to an FTC order in an earlier, unrelated case involving Support King LLC. That case concerned stalkerware and resulted in a final administrative order addressing data privacy.

The FTC said its staff received assistance from the U.S. Postal Inspection Service, the U.S. Attorney’s Office for the District of Puerto Rico and the U.S. Department of State. The Commission authorized the complaint in a 2-0 vote.

What the Case Reveals About Online Consumer Fraud

The allegations illustrate how consumer fraud can exploit the gap between what users expect from an online search and what a website actually provides. A sponsored result may appear prominently, but its placement does not establish that the service is government-operated or officially authorized.

The case also highlights the role of pricing transparency and review authenticity in online trust. Claims about faster processing, low starting prices, and positive customer experiences can influence purchasing decisions, particularly when consumers need time-sensitive travel documents.

The FTC has emphasized that filing a complaint does not establish that the defendants violated the law. The case will be decided by the court.

For consumers, the allegations underscore the importance of distinguishing official government services from third-party providers and checking fees, processing claims, and reviewing credibility before sharing personal or financial information. The FTC also states that it will never demand money, threaten consumers, instruct them to transfer money, or promise them a prize.

Cloudflare
Verify you are human

loading

Checking your browser before accessing this site.
Click to verify →
Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

Cloudflare
Verify you are human
loading
Checking your browser before accessing this site.
Click to verify →
Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

The Essential Eight Is Being Replaced: What Australian Organisations Need to Know

16 de Outubro de 2026, 04:03

ASD Essentials

For years, the Essential Eight has been the go-to checklist for Australian organisations defending against cyber attacks. That is now changing. The Australian Signals Directorate (ASD) has launched ASD Essentials, a new cyber security framework that evolves the Essential Eight into a broader set of guidance covering enterprise IT, operational technology and cloud environments. The shift is more than a rebrand. It changes how organisations measure progress, where they focus effort and how they handle environments the original framework was never designed for.

Why ASD Essentials Is Replacing the Essential Eight

ASD points to its Annual Cyber Threat Report 2024-2025, which shows Australian organisations facing increasingly sophisticated threats. At the same time, modern technology environments have grown more complex, spanning on-premises systems, hybrid cloud and emerging technologies. A fixed list of controls struggles to keep up with that variety. The new framework takes a threat-informed, principles-based approach, giving organisations flexibility to achieve security outcomes without being tied to specific technologies.

5 Key Changes Under ASD Essentials

1. Phased priorities replace maturity levels. Instead of climbing maturity levels, organisations will work through phased priorities, directing effort to their highest-risk assets first. 2. Outcomes over checklists. The framework moves away from prescriptive security requirements toward principles and actions that help organisations assess whether intended security outcomes are actually being achieved. 3. New building blocks. It introduces cyber security principles, actions and domains, focusing uplift efforts on critical business functions and systems. 4. Environment-specific chapters. Each chapter applies the same underlying model but accounts for the threats, risks and operational realities of the environment it covers. 5. Risk-informed decisions. There is a stronger emphasis on decision-making supported by threat intelligence and each organisation's own context.

The First Three ASD Essentials Chapters

The series launches with three chapters:
  • Essentials for enterprise IT is the direct evolution of the Essential Eight.
  • Essentials for operational technology (OT) supports Australian critical infrastructure operators protecting their operational technology environments from cyber threats.
  • Essentials for cloud supports organisations whose technology environment is delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS).
ASD has also made AI-focused guidance available, helping organisations consider AI-enabled systems within their technology environments. The framework includes overview publications and supplemental publications alongside the chapters.

Who Should Pay Attention

The guidance is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations. Small and medium-sized businesses that do not operate at enterprise scale can still apply it where relevant. ASD says the framework remains consistent with its best-practice advice and the Australian Government Information Security Manual. Industry consultation played a central role in its development, and ASD plans to keep engaging with industry, government and critical infrastructure stakeholders as technologies and threats change.

What ASD Essentials Means for Compliance Today

For now, nothing changes on the compliance front. Organisations should continue meeting their current regulatory obligations until regulators communicate any associated changes. ASD is in discussions with regulatory bodies about the impact and expected timeframes of the transition and says it will advise on expectations in due course. During the transition period, both the Essential Eight and ASD Essentials will remain available on cyber.gov.au, along with supporting resources and implementation guidance. For security teams, the practical takeaway is to start reviewing the new chapters now, map current Essential Eight controls against the new principles, and identify which critical business functions and systems would sit at the top of a phased priority plan.
  • ✇Firewall Daily – The Cyber Express
  • Pegasus, New NoviSpy Variant Found on Serbian Students and Opposition Figures Mihir Bagwe
    At least 14 people connected to Serbia's student protest movement and opposition politics have been targeted with mercenary spyware since early 2026, the Belgrade-based digital rights organization SHARE Foundation said, in what it called the largest documented wave of such targeting in the country. The group said the cohort includes student movement members, civil society activists, a member of parliament and a local councilor. Forensic analysis was independently confirmed by the Citizen Lab at
     

Pegasus, New NoviSpy Variant Found on Serbian Students and Opposition Figures

4 de Setembro de 2026, 03:06

Pegasus, Pegasus Spyware, Serbia, Serbia Protests, Smartphone screen forming an eye shape against an abstract protest crowd, illustrating spyware targeting of Serbian student activists.

At least 14 people connected to Serbia's student protest movement and opposition politics have been targeted with mercenary spyware since early 2026, the Belgrade-based digital rights organization SHARE Foundation said, in what it called the largest documented wave of such targeting in the country.

The group said the cohort includes student movement members, civil society activists, a member of parliament and a local councilor. Forensic analysis was independently confirmed by the Citizen Lab at the University of Toronto and by Amnesty International's Security Lab.

Citizen Lab, in its own findings, said it verified an infection with NSO Group's Pegasus on the iPhone of a student activist who asked not to be named. High-confidence infection indicators span December 2025 through January 2026, delivered by a zero-click iMessage exploit that required no interaction from the target. Apple has since patched the underlying flaw; the fix shipped in iOS 18.4.1. Pegasus grants an operator access to notes, photographs and messages decrypted on the device, and can silently activate the microphone and camera.

Amnesty's Security Lab confirmed a new variant of NoviSpy, an Android implant first identified in Serbia in 2024, on two additional devices. SHARE said the rebuilt version was designed to evade the detection methods that exposed its predecessor.

Also read: Investigative Journalists in Serbia Hit by Advanced Spyware Attack

The circumstances of two infections are what elevate the findings beyond routine spyware reporting. SHARE said one NoviSpy infection appeared after police seized a student's phone during questioning, and another after private messages from that device were published by a pro-government media outlet. Donncha Ó Cearbhaill, who heads Amnesty's Security Lab, said the evidence suggests "infections are being carried out during detention by Serbian authorities."

Suspicion centers on Serbia's Security Information Agency, or BIA. Amnesty's December 2024 report "A Digital Prison" found earlier NoviSpy samples configured to send collected data to IP addresses associated with BIA servers, and documented the agency's parallel use of Cellebrite extraction tools on journalists and activists. In March 2025, Amnesty reported that two journalists at the Balkan Investigative Reporting Network were targeted with Pegasus.

The current cases surfaced through Apple's threat notification wave of Aug. 13, which reached users in 110 countries. The timing is politically loaded. The targeting overlaps with protests that followed the November 2024 collapse of a railway station canopy in Novi Sad, spans local elections held March 29 in 10 municipalities, and precedes October parliamentary elections widely read as a test of the ruling Serbian Progressive Party.

Ana Toskic Cvetinovic, a legal expert cited in the reporting, noted that deploying intrusive software without judicial authorization is unlawful under Serbian law. SHARE published an analysis of the domestic legal framework in January arguing the same. Criminal complaints filed over the 2024 cases remain pending before Serbian courts, with no resolution.

Also read: 7 New Pegasus Infections Found on Media and Activists’ Devices in the EU

NSO has been on the U.S. Commerce Department's Entity List since 2021.

Serbia is an accession candidate, the European Parliament has previously questioned the Commission over unlawful spyware use in the country, and the Commission published its 2026 enlargement country report in July. Amnesty's submission for that package raised surveillance directly.

Both groups urged at-risk users to enable Lockdown Mode on iOS or Advanced Protection on Android.

  • ✇Firewall Daily – The Cyber Express
  • FTC Sues Hims & Hers Over Health Data Privacy, Billing Practices Samiksha Jain
    The Hims & Hers lawsuit has put the telehealth provider under scrutiny after the FTC, along with Utah and California authorities, accused the company of deceptive billing practices and unlawfully sharing consumers' sensitive health information with third-party advertising platforms. According to a complaint filed in federal court, regulators allege that Hims & Hers misled consumers about its privacy protections, enrolled users in recurring subscriptions without clear disc
     

FTC Sues Hims & Hers Over Health Data Privacy, Billing Practices

Hims & Hers lawsuit

The Hims & Hers lawsuit has put the telehealth provider under scrutiny after the FTC, along with Utah and California authorities, accused the company of deceptive billing practices and unlawfully sharing consumers' sensitive health information with third-party advertising platforms. According to a complaint filed in federal court, regulators allege that Hims & Hers misled consumers about its privacy protections, enrolled users in recurring subscriptions without clear disclosure, and shared health-related data with companies including Meta and Snap.

The complaint alleges that the San Francisco-based telehealth provider failed to clearly inform consumers that prescription charges could be processed almost immediately after they submitted an online intake form, despite representing that they would first consult with a medical provider to determine an appropriate treatment.

FTC Complaint Alleges Deceptive Billing Practices

According to the FTC complaint, consumers interested in Hims & Hers services are required to complete an online intake form for review by a medical provider before receiving prescription treatment. During this process, users provide billing information after being assured they would not be charged unless medication was prescribed.

However, regulators allege that most consumers were not given a consultation with a provider before being charged. Instead, the complaint states that submitting the intake form automatically enrolled many users in recurring prescription subscriptions and processed charges before consumers had an opportunity to review or approve the treatment.

The complaint also alleges that Hims & Hers did not clearly disclose when prescription refills would occur, making it difficult for consumers to cancel subscriptions before the next billing cycle.

One consumer complaint cited by the FTC stated that they were told they would speak with a doctor within a few days and would not be charged immediately, but their payment was processed before any consultation took place.

Hims & Hers Lawsuit: Privacy Practices Under Investigation

The Hims & Hers lawsuit also centers on allegations involving health data privacy.

According to the complaint, Hims & Hers shared consumers' sensitive health information with advertising platforms such as Meta and Snap, despite assuring users that their medical information would remain private.

The FTC alleges that the company shared customer lists with advertising platforms and also used third-party tracking technologies that automatically transmitted website activity, referred to as "Events," to those companies.

Regulators argue that these practices exposed health-related information while contradicting the company's privacy representations to consumers.

Subscription Cancellation Process Questioned

The complaint further alleges that Hims & Hers created obstacles for consumers attempting to cancel recurring subscriptions.

Before 2023, most users could only cancel by contacting customer service through phone, email, or chat. Even after introducing online cancellation, regulators allege the company continued to make the process difficult by hiding the cancellation option behind multiple navigation steps. According to the complaint, consumers first had to select "add/remove items from order" before eventually reaching the cancellation page.

The FTC alleges these practices violate both the FTC Act and the Restore Online Shoppers' Confidence Act, which governs deceptive billing and subscription practices. Utah and California have also alleged violations under their respective consumer protection laws.

Hims & Hers Rejects Allegations

In a statement posted on X, Hims & Hers rejected the allegations and said the lawsuit ignores evidence provided during the FTC's nearly three-year investigation.

The company described the action as an attempt to generate headlines rather than enforce consumer protection laws and said it intends to defend itself in court vigorously.

Hims & Hers also stated that millions of consumers have relied on its services since 2017 and that its Privacy Policy explains how customer data is used. The company added that patients can choose how their information is handled and maintained that information shared with healthcare providers is used only to deliver care.

The lawsuit was authorized by a 2-0 vote of the Commission and filed in the U.S. District Court for the Northern District of California. The allegations remain claims made by regulators, and the court will ultimately decide the case.

❌
❌