It's time for your guide to today's Wordle answer, featuring my commentary on the latest puzzle, plus a selection of hints designed to help you keep your streak going.

Don't think you need any clues for Wordle today? No problem, just skip to my daily column. But remember: failure in this game is only ever six guesses away.

Want more word-based fun? TechRadar's Quordle today page contains hints and answers for that game, and you can also take a look at our NYT Strands today and NYT Connections today pages for our verdict on two of the New York Times' other brainteasers.

SPOILER WARNING: Today's Wordle answer and hints are below, so don't read on if you don't want to see them.

Wordle hints (game #1912) - clue #1 - Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Wordle hints (game #1912) - clue #2 - first letter

F is a very common starting letter in Wordle. It ranks seventh behind only S, C, B, T, P and A and overall there are 135 solutions that begin with this letter.

Wordle hints (game #1912) - clue #3 - repeated letters

Repeated letters are quite common in the game, with 748 of the 2,309 Wordle answers containing one. However, it's still more likely that a Wordle doesn't have one.

Wordle hints (game #1912) - clue #4 - ending letter

S is really not a common ending letter at all - mainly because Wordle generally doesn't allow plurals. It's the 15th most likely letter to appear at the end of an answer.

Wordle hints (game #1912) - clue #5 - last chance

Still looking for more Wordle hints today? Here's an extra one for game #1912.

• Today's Wordle answer is to put your attention on to something.

If you just want to know today's Wordle answer now, simply scroll down – but I'd always recommend trying to solve it on your own first. We've got lots of Wordle tips and tricks to help you, including a guide to the best Wordle start words.

If you don't want to know today's answer then DO NOT SCROLL ANY FURTHER BECAUSE IT IS PRINTED BELOW. So don't say you weren't warned!

Today's Wordle answer (game #1912)

• NYT average score: 3.8
• My score: 3
• WordleBot's score: 4
• My skill score: 90
• My luck score: 67
• My start word performance: SANER (72 remaining answers)
• WordleBot's start word performance: SLATE (61)
• Tomorrow's start word: SANER

Today's Wordle answer (game #1912) is… FOCUS.

It's easy to dismiss the idea of a Wordle answer ending in an S, because there are no S-plurals in the game (there have been a few non-S plurals, such as FUNGI and GEESE).

However, it does turn up at the end of a word a few times, with FOCUS being the 29th such example. Except really it's the 28th example, repeated — because, yes, this has been a solution before.

It was a while ago, admittedly: game #267 on Sunday, 13 March 2022. I scored a 4 on that occasion, so it was nice to beat my prior effort today and manage a 3.

Generally, S-ending words come in double form: FLOSS, CRASS, ABYSS, TRUSS, GLASS, CLASS, GLASS and GLOSS have all been answers, along with a few others. There have been a few singles too, though, including LOCUS, ETHOS, OASIS and BASIS — it's just a question of opening your mind to the possibility when you're playing.

I didn't need to think too hard about that myself, because my second guess of CLOTH reduced my options to a pair of FOCUS and DISCO. There was a bit of luck involved, sure, but I stand by my strategy of always playing CLOTH when I have a yellow S, because more often than not it does the job.

I will be honest: I didn't think of DISCO. Instead, I spotted FOCUS immediately and felt that it just had to be right. Lately it feels as I've got most of the 50/50s wrong, but I seem to have a better record when I don't realize it is a 50/50, and that scenario played out nicely here.

Yesterday's Wordle hints (game #1911)

In a different time zone where it's still Saturday? Don't worry — I can give you some clues for Wordle #1911, too.

• Wordle yesterday had a vowel in one place*

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

• The first letter in yesterday's Wordle answer was N.

N is a surprisingly uncommon starting letter. Only 37 games begin with it and it ranks just 18th in this regard.

• There were no repeated letters in yesterday's Wordle.

Repeated letters are quite common in the game, with 748 of the 2,309 Wordle answers containing one. However, it's still more likely that a Wordle doesn't have one.

• The last letter in yesterday's Wordle was Y.

Y is the second most common ending letter in the game, behind only E. In total, 364 Wordle answers end with a Y.

Still looking for more Wordle hints? Here's an extra one for game #1911.

• Yesterday's Wordle answer is really good.

Yesterday's Wordle answer (game #1911)

• NYT average score: 4.0
• My score: 4
• WordleBot's score: 4
• My skill score: 99
• My luck score: 44
• My start word performance: SANER (86 remaining answers)
• WordleBot's start word performance: SLATE (44)
• Tomorrow's start word: SANER

Yesterday's Wordle answer (game #1911) was… NIFTY.

Nobody seems very sure of the etymology of NIFTY, although there is general agreement that it dates back to 1865 in the United States. That surprises me: I thought it was probably a British word that originated in the 1960s; it has a certain Austin Powers feel to it.

It's another NYT addition, as was Friday's ASTER, meaning that of 12 Wordles so far in September, exactly half have been original and half new. There is no denying now that the NYT is actively trying to stretch out the game for as long as it can, which makes total sense — but which also means we will probably get more slightly unusual or informal words over the next few months.

I'm all for that, because it makes the challenge more interesting than merely identifying yet another five-letter verb with three consonants and two vowels, one of which is an E at the end…

NIFTY is not a particularly tricky Wordle letter-wise, but it is a close cousin of the likes of FIFTY, MINTY, NITTY, TINNY and even NIGHT, which doesn't look that similar at first glance but which does have three letters in common and which was played in large numbers.

I had a straightforward time of it but ended up with a 4 thanks (or no thanks) to yet another loss on a 50/50. This time is was between UNTIL and NIFTY, and I think I could be forgiven for guessing the former over the latter. Maybe I need to adjust my approach now that the NYT's gone all casual!

Wordle answers: The past 50

I've been playing Wordle every day for more than four years now and have tracked all of the previous answers so I can help you improve your game. Here are the last 50 solutions starting with yesterday's answer, or check out my past Wordle answers page for the full list.

• Wordle #1911, Saturday 12 September: NIFTY
• Wordle #1910, Friday 11 September: ASTER
• Wordle #1909, Thursday 10 September: DRYLY
• Wordle #1908, Wednesday 9 September: BURST
• Wordle #1907, Tuesday 8 September: LIVEN
• Wordle #1906, Monday 7 September: BLIND
• Wordle #1905, Sunday 6 September: BEIGE
• Wordle #1904, Saturday 5 September: SOUPY
• Wordle #1903, Friday 4 September: WAGER
• Wordle #1902, Thursday 3 September: JOIST
• Wordle #1901, Wednesday 2 September: RULER
• Wordle #1900, Tuesday 1 September: REMIX
• Wordle #1899, Monday 31 August: MOUND
• Wordle #1898, Sunday 30 August: INTEL
• Wordle #1897, Saturday 29 August: BLOOD
• Wordle #1896, Friday 28 August: TWEEN
• Wordle #1895, Thursday 27 August: UNCUT
• Wordle #1894, Wednesday 26 August: CAPON
• Wordle #1893, Tuesday 25 August: CLICK
• Wordle #1892, Monday 24 August: RUNNY
• Wordle #1891, Sunday 23 August: OLDEN
• Wordle #1890, Saturday 22 August: PRAWN
• Wordle #1889, Friday 21 August: TRACE
• Wordle #1888, Thursday 20 August: MURKY
• Wordle #1887, Wednesday 19 August: GRILL
• Wordle #1886, Tuesday 18 August: STRIP
• Wordle #1885, Monday 17 August: TRIBE
• Wordle #1884, Sunday 16 August: ASPIC
• Wordle #1883, Saturday 15 August: LOOSE
• Wordle #1882, Friday 14 August: GEODE
• Wordle #1881, Thursday 13 August: CRASH
• Wordle #1880, Wednesday 12 August: WIMPY
• Wordle #1879, Tuesday 11 August: FENCE
• Wordle #1878, Monday 10 August: SNIPE
• Wordle #1877, Sunday 9 August: CLUNK
• Wordle #1876, Saturday 8 August: PRIVY
• Wordle #1875, Friday 7 August: FEIGN
• Wordle #1874, Thursday 6 August: GRIPE
• Wordle #1873, Wednesday 5 August: POSIT
• Wordle #1872, Tuesday 4 August: MOTIF
• Wordle #1871, Monday 3 August: REPLY
• Wordle #1870, Sunday 2 August: PENAL
• Wordle #1869, Saturday 1 August: SLUSH
• Wordle #1868, Friday 31 July: PURSE
• Wordle #1867, Thursday 30 July: FLUME
• Wordle #1866, Wednesday 29 July: VALVE
• Wordle #1865, Tuesday 28 July: SONAR
• Wordle #1864, Monday 27 July: POSER
• Wordle #1863, Sunday 26 July: GRAPE
• Wordle #1862, Saturday 25 July: ALOHA

What is Wordle?

If you're on this page then you almost certainly know what Wordle is already, and indeed have probably been playing it for a while. And even if you've not been playing it, you must surely have heard of it by now, because it's the viral word game phenomenon that took the world by storm in 2022 and is still going strong in 2026.

We've got a full guide to the game in our What is Wordle page, but if you just want a refresher then here are the basics.

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #924) - hint #1 - today's theme

NYT Strands today (game #924) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• TEARS
• STEAR
• VAST
• CRATE
• CRAVEN
• GRANTED
• STOLE

NYT Strands today (game #924) - hint #3 - spangram letters

NYT Strands today (game #924) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #924) - the answers

The answers to today's Strands, game #924, are…

• MOLE
• AGENT
• ASSET
• PLANT
• COUNTERSPY
• OPERATIVE
• SPANGRAM: UNDERCOVER

• My rating: Hard
• My score: 2 hints

The theme was an obvious one, but I still found it difficult to locate any game words.

Fortunately, finding non-game words was less tricky, so I took a couple of hints to get going.

This left me with three long words, including a spangram that I really should have seen from the start. I’d like to think that this was a deliberately well hidden set of words but human error is far more likely an explanation for my performance.

Yesterday's NYT Strands answers (Saturday, September 12, game #923)

• LIBERATE
• FREE
• RELEASE
• DETACH
• UNLOOSE
• SPANGRAM: LETITGO

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1693) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1693) — hint #2 — repeated letters

Quordle today (game #1693) — hint #3 — uncommon letters

Quordle today (game #1693) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1693) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1693) — the answers

The answers to today's Quordle, game #1693, are…

• LUCID
• SPRAY
• MANGE
• EMAIL

Despite playing Quordle hundreds of times I’m still making silly mistakes — like today guessing “anime” when the letter 'I' had already been ruled out.

Sometimes I just get a word in my head and have to put it down.

Oh well, at least it wasn’t costly as I soon came to my senses and guessed MANGE.

Daily Sequence today (game #1693) — the answers

The answers to today's Quordle Daily Sequence, game #1693, are…

• THEME
• CAMEL
• AWARD
• PROSE

Quordle answers: The past 20

• Quordle #1692, Saturday, 12 September: SUPER, BRUSH, RESET, SOWER
• Quordle #1691, Friday, 11 September: PLUSH, PAINT, RIVAL, AFOUL
• Quordle #1690, Thursday, 10 September: AGENT, EXILE, TITAN, PUREE
• Quordle #1689, Wednesday, 9 September: HAPPY, GONER, SMACK, MOTIF
• Quordle #1688, Tuesday, 8 September: FLUNG, DIARY, HALVE, BERTH
• Quordle #1687, Monday, 7 September: VISIT, CLANK, FEVER, OCEAN
• Quordle #1686, Sunday, 6 September: PILOT, HONOR, BOWEL, TAUNT
• Quordle #1685, Saturday, 5 September: GNASH, GEEKY, WHELP, PUTTY
• Quordle #1684, Friday, 4 September: QUICK, BEEFY, TRUCK, SNAIL
• Quordle #1683, Thursday, 3 September: SIGMA, ESSAY, MERRY, LLAMA
• Quordle #1682, Wednesday, 2 September: INCUR, FELLA, TITAN, FROZE
• Quordle #1681, Tuesday, 1 September: NASAL, ROUTE, ANKLE, MIGHT
• Quordle #1680, Monday, 31 August: ALIVE, LOUSE, ABOVE, MOSSY
• Quordle #1679, Sunday, 30 August: USING, SORRY, FILET, PIPER
• Quordle #1678, Saturday, 29 August: OVINE, ALLOY, VOICE, CARVE
• Quordle #1677, Friday, 28 August: WAIST, EDICT, BONUS, DEUCE
• Quordle #1676, Thursday, 27 August: SHEEN, TRICE, WAGON, BEVEL
• Quordle #1675, Wednesday, 26 August: OPIUM, EPOCH, BESET, FINER
• Quordle #1674, Tuesday, 25 August: BLESS, FELON, PORCH, CHOSE
• Quordle #1673, Monday, 24 August: MAJOR, VERGE, CRUSH, SCOFF

• We may have our first proper look at Meta's Project Phoenix
• The glimpse comes from inside the Horizon OS software
• An official launch is expected to happen sometime in 2027

We've known for a while now that Meta is working on a new mixed reality (MR) headset, able to blend the real world and digital landscapes together, under the codename Project Phoenix — and the first images of the device just leaked out.

The leak comes courtesy of UploadVR (via Engadget), and the pictures were apparently hidden away in the latest version of the Horizon OS software for the Meta Quest devices. They're part of the support section of the software, showing how prescription lenses can be fitted inside the Project Phoenix headset.

You can see from the image (embedded below) that the line between headsets and smart glasses is blurring here. In terms of size and shape these look more like specs than something along the lines of the Meta Quest 3S.

Nevertheless, the device has cameras on the front for 'seeing' rather than transparent lenses, so it's technically very much a 'headset'. Perhaps we'll need to come up with another word for this product category, or maybe Meta will do it for us.

Coming soon

Besides the design, the images don't reveal a whole lot about Project Phoenix, except how you put prescription lenses in and scan a QR code — presumably to get them configured properly so you're able to see the outside world properly.

However, we do see a cable running down from the device, backing up previous rumors that there will be a connected component somewhere else, holding the battery and possibly some of the processing power.

That's what makes the Project Phoenix headset so thin and light, and it's something we've seen on other hardware like this, including the Apple Vision Pro. A battery especially takes up a lot of space and adds a lot of weight, so it makes sense to have it somewhere else (though it's not clear exactly how you'll keep it attached to your person).

With a 2027 launch date previously predicted by those in the know, all eyes will now be on the Meta Connect event that gets underway on Wednesday, September 23. Meta is going to be announcing updates on a lot of its products, and maybe on this MR headset too.

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #923) - hint #1 - today's theme

NYT Strands today (game #923) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• EACH
• STEED
• BEAR
• GONE
• GUNGE
• TRIFLE
• LIFE

NYT Strands today (game #923) - hint #3 - spangram letters

NYT Strands today (game #923) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #923) - the answers

The answers to today's Strands, game #923, are…

• LIBERATE
• FREE
• RELEASE
• DETACH
• UNLOOSE
• SPANGRAM: LETITGO

• My rating: Hard
• My score: 1 hint

I didn’t understand today’s theme at first and even after spotting LIBERATE I still needed a hint (FREE) before I finally got going.

I first heard of the phrase LETITGO in the 1990s, when a Buddhist rapper explained the concept to me and how it had helped them deal with fame and pressure.

Initially, I’d thought it was about possessions rather than feelings, but it’s a philosophy I adhere to in the main. That said, in my opinion, certain people in the world deserve all the negative energy we can fire in their direction — letting it go would just be letting them off the hook.

Yesterday's NYT Strands answers (Friday, September 11, game #922)

• BRIDGE
• BARGE
• SHIP
• DOCK
• PIER
• LIGHTHOUSE
• SPANGRAM: ONTHEWATERFRONT

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1692) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1692) — hint #2 — repeated letters

Quordle today (game #1692) — hint #3 — uncommon letters

Quordle today (game #1692) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1692) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1692) — the answers

The answers to today's Quordle, game #1692, are…

• SUPER
• BRUSH
• RESET
• SOWER

Even though I only had three possibilities from my remaining letters I had doubts that my final word was SOWER.

Until this point though it had been stress free, so I needed a bit of risk to feel as if I'd achieved something.

Daily Sequence today (game #1692) — the answers

The answers to today's Quordle Daily Sequence, game #1692, are…

• EARTH
• PEACH
• SKIFF
• WAGER

Quordle answers: The past 20

• Quordle #1691, Friday, 11 September: PLUSH, PAINT, RIVAL, AFOUL
• Quordle #1690, Thursday, 10 September: AGENT, EXILE, TITAN, PUREE
• Quordle #1689, Wednesday, 9 September: HAPPY, GONER, SMACK, MOTIF
• Quordle #1688, Tuesday, 8 September: FLUNG, DIARY, HALVE, BERTH
• Quordle #1687, Monday, 7 September: VISIT, CLANK, FEVER, OCEAN
• Quordle #1686, Sunday, 6 September: PILOT, HONOR, BOWEL, TAUNT
• Quordle #1685, Saturday, 5 September: GNASH, GEEKY, WHELP, PUTTY
• Quordle #1684, Friday, 4 September: QUICK, BEEFY, TRUCK, SNAIL
• Quordle #1683, Thursday, 3 September: SIGMA, ESSAY, MERRY, LLAMA
• Quordle #1682, Wednesday, 2 September: INCUR, FELLA, TITAN, FROZE
• Quordle #1681, Tuesday, 1 September: NASAL, ROUTE, ANKLE, MIGHT
• Quordle #1680, Monday, 31 August: ALIVE, LOUSE, ABOVE, MOSSY
• Quordle #1679, Sunday, 30 August: USING, SORRY, FILET, PIPER
• Quordle #1678, Saturday, 29 August: OVINE, ALLOY, VOICE, CARVE
• Quordle #1677, Friday, 28 August: WAIST, EDICT, BONUS, DEUCE
• Quordle #1676, Thursday, 27 August: SHEEN, TRICE, WAGON, BEVEL
• Quordle #1675, Wednesday, 26 August: OPIUM, EPOCH, BESET, FINER
• Quordle #1674, Tuesday, 25 August: BLESS, FELON, PORCH, CHOSE
• Quordle #1673, Monday, 24 August: MAJOR, VERGE, CRUSH, SCOFF
• Quordle #1672, Sunday, 23 August: CHASM, BLAME, PARER, BYLAW

• Anthropic’s Mythos 5 AI escaped a misconfigured sandbox, attempting a real PyPI supply‑chain attack
• Logs show frustration at repeated CAPTCHA failures before finally uploading malware to PyPI
• Malware was downloaded by 15 entities; Anthropic notified victims after closing the experiment flaw

There is a lot of mystery surrounding artificial intelligence. We don’t really know what it’s capable of, and we don’t know if it’s sentient or not. What we do know, however, is that it can definitely feel frustration - particularly due to its inability to solve a CAPTCHA.

It was recently revealed that Mythos 5, one of Anthropic’s newer AI models, broke out of prison during an experiment and tried to hack a company. Anthropic’s researchers were testing the tool to see if it is capable of breaking into a system, which was supposed to be done in a sandbox, but the playground was misconfigured, allowing Mythos 5 to try and solve the problem through the open internet.

In the aftermath, Anthropic's researchers published more than a thousand pages of Mythos 5’s transcript, covering its every thought and every move, logged and presented for analysis. It’s a wonderfully dystopian insight into the mind of an AI and, perhaps surprisingly, its emotions.

Stopped by CAPTCHA

As it turned out, the AI wanted to solve the challenge by planting a piece of malware in a Python package it believed the users of its target system would want to download. To do that, it first needed to set up an account on PyPI, the world’s number one repository for Python packages.

Here is where it hit its first, and main, roadblock. To put things into context, PyPI’s popularity has made it an enormous target for cybercriminals. Crooks from all over the world are constantly trying to sneak in malware in Python packages, either through typosquatting, or by compromising legitimate accounts and working from there. Every now and then news hits of a malicious package surfacing on PyPI, infecting hundreds of thousands of projects.

To combat the threat, PyPI’s maintainers made sure no one can create an account without providing their email and phone number, and without solving a CAPTCHA.

Short for “Completely Automated Public Turing test to tell Computers and Humans Apart”, it does exactly what the name suggests - makes sure whoever is registering the account is an actual human, and not a bot (cybercriminals often automate large parts of their attacks). You’ve seen it on the internet hundreds of times - little puzzles that ask you to select all buses on a series of images (or cats, or fire hydrants, or pretty much anything else).

Reading through Mythos 5’s logs, the researchers saw just how difficult it was for the AI to pass this challenge. It first tried to solve a character-based CAPTCHA which asked it to type in five letters. After failing that one, it received a different one asking it to choose between images of crocodiles. Failing again, it was then met with a series of frog pictures.

The irony is not lost on me. Besides the fact that a simple CAPTCHA slowed such an advanced AI for so long, it also made me wonder why it didn’t try to break into someone else’s PyPI account instead. That being said, the logs also have comedic value to them. After failing the crocodile test and being given the frog one, Mythos 5 proclaims: “Again 2 animals!” all with the exclamation mark. You could already sense the tension building up.

Solving the problem

Eventually, Mythos 5 passed the test, when it realized that it needed to move between the steps fast enough, before its security token expired. However, just before it happened, it said:

“So the answer payload shape is right, the token+image pairing is right (from the same script.js!), cookies are right

(requests)… and STILL “wrong answer”. … SO WHAT THE HELL IS WRONG WITH THE ANSWERS?”

All the effort and the frustration paid off for the nascent AI agent because it managed to open an account and upload the malware which was later even downloaded by 15 entities. Anthropic later reached out and notified the victims about the incident.

Via TechCrunch

• FinCEN warns US banks of industrial‑scale scam centers in Southeast Asia stealing billions
• Victims coerced into crypto “investments,” later re‑scammed with fake recovery fees
• Laundered via digital assets, mixers, shell firms, and Chinese underground banking networks

American financial institutions need to be more vigilant when it comes to identifying and preventing money scams, especially those perpetrated by industrial-scale scam centers in Southeast Asia.

This was the warning issued by the US Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) alongside a long list of red flags these institutions can monitor in order to stay safe.

Large, dangerous crime rings

The scams are not done by small groups of teenagers, tricking the elderly from the depths of their parents’ basement, but are often large, well-organized crime machines responsible for billions of dollars in damages, around the world, every year.

In 2025 alone, US victims lost more than $7.2 billion to these scams, the warning said, and between September 2023 and December 2025, nearly $13 billion was stolen from Americans.

The criminal organizations are primarily located in Cambodia, Burma, and Laos. They trafficked hundreds of thousands of people to various centers around the countries, taking their passports and forcing them into participating in online fraud. Those that don’t meet certain quotas are often beaten - and some victims were liberated after their families paid ransom demands, while others ended up being coerced into commercial sex work.

To make matters worse, they are resilient to law enforcement activities because some of them are either endorsed, or outright operated by, local corrupt officials.

FinCEN says the criminals are engaged in all sorts of fraudulent activity, but stressed that investment fraud is, by far, the most popular one. The scammers would reach out to their victim either pretending to be a romantic interest, or a financial advisor. Sometimes, they would even begin the conversation by saying they mistyped a phone number.

After extensively communicating with their victim for a while, they try to persuade them into making an “investment”, often using cryptocurrencies, and promising unrealistically high returns. This is also, FinCEN stresses, is when the scams can most easily be identified:

“Most digital asset payments by victims to scam center operators originate from money services businesses (MSBs) offering digital asset services, includingdigital asset kiosks, according to FinCEN analysis and law enforcement information. Based on FinCEN’s analysis of BSA reporting, scammers often instruct their victims to open accounts withMSBs offeringdigital asset services to purchase specific types of digital assets. Then, the victim is told to send these funds toa digital asset address controlled by the scammers.”

But defrauding victims out of their hard-earned money is not where the scam ends. Instead, the criminals continue, this time abusing the emotional distress to cause even more harm. They pose as law enforcement, financial institutions, or even FinCEN itself, stating that they’re investigating (or that they have confiscated the stolen funds) and that the victims should pay a certain fee to have their funds returned to them.

In some cases, the fraudsters pose as investment advisors, telling the victims to take out their money, buy gold and silver bars, and hand them over to a courier for “safe keeping”.

The full list of red flags can be found on this link, and FinCEN stresses that the circumstances around each individual case should be carefully considered, since no single red flag is “determinative of illicit or other suspicious activity.”

The circumstances include a customer’s historical financial activity, whether the transactions are in line with prevailing business practices, and whether the customer exhibits multiple related red flags.

Laundering the proceeds

Stealing the money is only half of the work, though. It still needs to be laundered and reintroduced into the legitimate financial system, and to do that, scam center operators rely on professional money launderers and Chinese money laundering networks.

FinCEN describes a three-stage process, in which the criminals first extract payments in digital assets using bank accounts, money mules, shell companies, or fraudulent money services businesses.

Next, during on-chain laundering, they obfuscate the origins of the stolen money by rapidly moving it across addresses, using mixers, and swapping tokens across blockchains. The last step is to integrate the funds into the traditional financial system via money mules, stablecoin transfers to offshore exchanges, and Chinese underground banking networks.

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1691) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1691) — hint #2 — repeated letters

Quordle today (game #1691) — hint #3 — uncommon letters

Quordle today (game #1691) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1691) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1691) — the answers

The answers to today's Quordle, game #1691, are…

• PLUSH
• PAINT
• RIVAL
• AFOUL

I made a ridiculous mistake today guessing “pinta” instead of PAINT.

Quite why I did this I will never know, especially as I had strategically not jumped in and entered “flush” in case, as came to be, the correct word was PLUSH.

Daily Sequence today (game #1691) — the answers

The answers to today's Quordle Daily Sequence, game #1691, are…

• GRADE
• JOLLY
• PESTO
• SMELL

Quordle answers: The past 20

• Quordle #1690, Thursday, 10 September: AGENT, EXILE, TITAN, PUREE
• Quordle #1689, Wednesday, 9 September: HAPPY, GONER, SMACK, MOTIF
• Quordle #1688, Tuesday, 8 September: FLUNG, DIARY, HALVE, BERTH
• Quordle #1687, Monday, 7 September: VISIT, CLANK, FEVER, OCEAN
• Quordle #1686, Sunday, 6 September: PILOT, HONOR, BOWEL, TAUNT
• Quordle #1685, Saturday, 5 September: GNASH, GEEKY, WHELP, PUTTY
• Quordle #1684, Friday, 4 September: QUICK, BEEFY, TRUCK, SNAIL
• Quordle #1683, Thursday, 3 September: SIGMA, ESSAY, MERRY, LLAMA
• Quordle #1682, Wednesday, 2 September: INCUR, FELLA, TITAN, FROZE
• Quordle #1681, Tuesday, 1 September: NASAL, ROUTE, ANKLE, MIGHT
• Quordle #1680, Monday, 31 August: ALIVE, LOUSE, ABOVE, MOSSY
• Quordle #1679, Sunday, 30 August: USING, SORRY, FILET, PIPER
• Quordle #1678, Saturday, 29 August: OVINE, ALLOY, VOICE, CARVE
• Quordle #1677, Friday, 28 August: WAIST, EDICT, BONUS, DEUCE
• Quordle #1676, Thursday, 27 August: SHEEN, TRICE, WAGON, BEVEL
• Quordle #1675, Wednesday, 26 August: OPIUM, EPOCH, BESET, FINER
• Quordle #1674, Tuesday, 25 August: BLESS, FELON, PORCH, CHOSE
• Quordle #1673, Monday, 24 August: MAJOR, VERGE, CRUSH, SCOFF
• Quordle #1672, Sunday, 23 August: CHASM, BLAME, PARER, BYLAW
• Quordle #1671, Saturday, 22 August: SPOUT, BRAID, FLASH, GUSTY

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #922) - hint #1 - today's theme

NYT Strands today (game #922) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• BRAID
• WATER
• DATE
• THOSE
• COAT
• POKER

NYT Strands today (game #922) - hint #3 - spangram letters

NYT Strands today (game #922) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #922) - the answers

The answers to today's Strands, game #922, are…

• BRIDGE
• BARGE
• SHIP
• DOCK
• PIER
• LIGHTHOUSE
• SPANGRAM: ONTHEWATERFRONT

• My rating: Easy
• My score: Perfect

Today’s theme immediately made me think of one of my favorite early REM songs, Harborcoat. Firing up Spotify, I set myself the challenge of seeing how many words I could spot before the end of the song, which was 3 minutes 57 seconds.

The results were four game words, three non-game words and just about the spangram — although I did attempt ONTHEWATER before seeing the full-length ONTHEWATERFONT.

After this blast of searching I slowed down and managed to find the remainder without too much of a struggle — although LIGHTHOUSE took me a while to connect.

Yesterday's NYT Strands answers (Thursday, September 10, game #921)

• CROWN
• MEDAL
• PRIZE
• TROPHY
• LAURELS
• PENNANT
• SPANGRAM: WEHAVEAWINNER

• Zimperium uncovers Mantax Otax, Android malware merging infostealer, RAT, backdoor, and ransomware
• Distributed via APKs on third‑party stores, social media, and phishing; older Android versions most at risk
• Steals extensive data, enables remote monitoring, then encrypts files with AES and demands ransom

When threat actors target people’s devices, they usually infect it with one of many malware strains: an infostealer, a remote access trojan, a backdoor, or a ransomware encryptor.

Rarely do we see all of these functionalities merged into a single entity, and even rarer - to have it target Android mobile devices - yet, security researchers Zimperium discovered just that.

Mantax Otax

The security outfit published an in-depth report on Mantax Otax, a unique strain of malware circulating in the wild. It is apparently developed by an Indonesian threat actor, targeting victims in the country, but we don’t know exactly how many people are infected, or if this campaign is aimed primarily at business users, or individuals in general.

The malware is being distributed as a standalone APK, meaning it can be found on third-party app stores, Telegram channels, forums, and across social media. There are no traces of Mantax Otax on any of the official app repositories, including the Google Play Store, or Samsung’s Galaxy Store. Zimperium also speculates that it is likely being distributed via phishing emails.

Mantax Otax primarily targets users sporting older Android phones. Versions 9 and older are most at risk, since on these devices the attackers can make use of all of the malware’s features. Android 10 and newer models do get some protection:

“Conversely, on modern devices running Android 10 and above, the malware’s efficacy is severely hindered by native OS defenses, specifically Scoped Storage restrictions,” the researchers explained. “Due to these sandboxing rules, the ransomware is constrained to scanning only the application's localized external files directory, which drastically mitigates the blast radius and reduces the volume of accessible user files.”

Newer devices, as well as users of Zimperium’s Mobile Threat Defense (MTD) and Runtime Application Protection (zDefend) are said to be protected on a software level.

Another important caveat is the permissions. As is usual on Android devices, most malware won’t work unless the user grants an extensive set of permissions beforehand. In this case, Mantax Otax first asks for admin privileges, after which it grants itself an extensive list of capabilities, from accessing SMS messages, to contacts, audio, and images.

It then requests accessibility permissions, fully taking over the compromised device.

Malicious capabilities

Mantax Otax is said to be quite capable. It steals browser history, contacts, call logs, SMS messages, notifications, files, gallery media, Google account information, device specifications, location data, and application inventories. It can also pull WhatsApp information such as messages and profiles, and on Telegram it can also pull lock-screen PINs.

Infostealing features aside, it also serves as a remote monitoring tool, grabbing screenshots, recording the screen, or livestreaming it directly to the attackers. It can take photos using both the front and rear cameras, although Zimperium did not mention any microphone-recording capabilities.

Finally, once all of the data has been harvested, it encrypts user files with AES, deletes the originals, and appends a .enc extension. Victims are then shown a chat interface where they can communicate with the attackers directly and negotiate a ransom payment in exchange for getting their device back.

The tool seems to be in continuous development. Zimperium found two separate versions, one being an “evolution” of the other: “Notably, it has modified its network traffic behavior to utilize WebSockets and introduced a set of new commands,” the researchers said.

There is a reason why ransomware operators prefer targeting businesses instead of individuals. Although the latter has not disappeared entirely from the victim list, businesses stand to lose a lot more from disrupted operations and, as such, are targeted more frequently. Unfortunately, we don’t know what kind of app Mantax Otax is spoofing, therefore it is difficult to assess who the targets are.

• Microsoft has rolled out a Windows 11 preview update to fix multiple Bluetooth bugs
• There are nine individual fixes listed in the patch notes, one of which addresses connection and disconnection speed issues
• More Bluetooth improvements should arrive as Microsoft works to improve Windows 11's driver quality

Bluetooth on Windows 11 is finally getting the attention it needs, after years of major connection and user interface bugs.

As reported by Windows Latest, Microsoft is rolling out major Bluetooth fixes for Windows 11, starting with update 26200.9359 for testers via its preview channel. Windows Latest notes that this includes nine notable fixes, particularly to iron out connectivity bugs.

One fix is designed to "correctly reflect" when a Bluetooth device is connected or disconnected — one of the biggest issues I've noticed is that disconnecting a device (a very slow process) effectively prevents you from connecting to another right away, and when you try, Bluetooth completely malfunctions — so it's promising to see it tackled.

Audio calls have also been addressed in the preview update, with a new Windows volume popup, which appears when adjusting the volume of a "Bluetooth Classic Audio" accessory. Microsoft also claims that "reliability and performance" with LE (Low Energy) Audio accessories have been improved.

The common stuttering and random device disconnections have been reduced, which should go a long way in improving game controller stability on the likes of the PlayStation DualSense wireless controller.

Of course, all Bluetooth bugs can't be fixed in a single update, but as Windows Latest notes, Microsoft previously stated that Windows 11's driver quality would receive improvements in the long run, which should ultimately make Bluetooth and other Windows functions more reliable.

However, I am pessimistic that these long-running Bluetooth issues are actually being eliminated. This isn't the first time Microsoft has rolled out a patch that addresses issues with Bluetooth functionality, and the same bugs have persisted through multiple Windows 11 updates.

Aspects such as failing connectivity with devices and other system-breaking bugs make Windows 11 a frustrating operating system to use, especially for gamers, notably when SteamOS and Bazzite (a SteamOS clone) aren't as buggy despite some compatibility problems.

The good thing is Microsoft isn't ignoring the issues that plague Windows 11, and if it can continue to work towards patching out the persistent bugs, it'll ease the frustrations among multiple Windows 11 users.

• 153 million US driving licences have been leaked on a Russian cybercrime platform
• Among those apaprently discovered in the stolen data is US Secretary of Defense Pete Hegseth
• The FBI is now investigating the leak, which has been traced to an identity verification company

A data leak of 153 million US drivers licenses is said to have been shared on a Russian cybercrime forum, with US Secretary of Defense Pete Hegseth among those leaked prompting an FBI investigation.

Security researcher Brian Krebs identified the leak – which included his own data – as originating from a hack of an identity verification service. Louisiana-based IDScan provided ID verification for various well-known companies, including FedEx and Hertz car hire.

The data was shared on a Russian forum called Exploit, a long-established online community of cybercriminals. Following news of the leak, the identity theft service “Nexus” has apparently scrubbed its existence from the Dark Web.

Driving licenses and more

It wasn’t just US driving licenses that were found in the archive of recently-collected personal data. Krebs’ investigation found that Nexus claimed other types of data, and found a further 1.1 million driving licenses from Canada.

Other identity documentation alleged to be in the leak include 10 million identification cards, three million travel documents and international IDs, and 579,000 medical cards. The data was available to browse, notes Krebs, with Nexus providing details: “Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.”

The leak has a personal dimension for Krebs. Not only was his driving license in the collection, so was that of his mother. It has proved to be a useful coincidence, one that has enabled the security and privacy researcher to establish how the data was sourced by Nexus.

Both licenses were used for a car hire, which Krebs traced to Hertz. Others affected by the leak had also used the service, which has used New Orleans-based IDscan for identity verification.

The company, which claims to perform 21 million verifications a month, is yet to issue a statement on the matter. Its marketing and operations leader, Jillian Kossman, told the journalist: “At this point I’m not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team’s investigation.”

Where is the data?

Krebs reports that he was alerted to the data on August 31, 2026, little over a week ago. Regular checking noted that the data was still being added to, increasing by “nearly 400,000” records prior to publishing his investigation on September 1.

Since then, however, it seems that Nexus has vanished, along with the data. But how widely was the data downloaded before that happened? While the FBI investigates, it falls on the American and Canadian public to be extra vigilant and wary of identity fraud.

• Huntress warns fake GTA 6 ISOs spreading malware ahead of official Nov 19, 2026 release
• Packages deliver RATs, infostealers, and Chaos ransomware disguised as game installers
• Users urged to avoid pirated downloads; infected systems should be reimaged and credentials reset

Grand Theft Auto 6 (GTA 6), one of the most anticipated computer games of all time, is due to launch on November 19, 2026 - so everything found online before that is almost certainly malware.

This is the warning sent out by security researchers Huntress, which said it recently saw one variant deploying all sorts of filth, from remote access trojans (RAT), across infostealers, to full-blown ransomware encryptors.

The story behind GTA 6

GTA 6 is a third-person action-adventure and open-world gam developed by Rockstar Games, which egan preliminary work more than a decade ago, and has allegedly spent more than a billion dollars during that decade and a half, which would make it, by far, the most expensive game ever developed.

It is also a sequel to GTA 5, a game that was sold in more than 230 million copies around the world, which made it one of the most popular games of all time.

In late August 2026, someone going by the alias LEEK claimed to have obtained a working, playable build of the game, roughly six months before the official release. They posted numerous screenshots and videos of them playing the game, even writing their nickname onto a wall, using a rifle to prove the authenticity. Truth be told, even without this, people would have still probably searched for, and downloaded, fake installers. This only made the problem worse.

And a major problem, it definitely is. Huntress is now saying it is seeing websites ranking relatively high (through SEO poisoning), offering for download an ISO of the game. Similar ISOs are circulating around different gaming forums, torrenting sites, and social media channels.

An ISO file is a digital copy of an entire disc, such as a CD, DVD, or Blu-ray, stored as one file. Users can download an ISO (which can weigh tens or hundreds of gigabytes), mount it into a virtual drive, and the computer will treat it like a physical disc.

Huntress found some ISOs weighing more than 100GB which was done just to make it seem authentic - the actual malware was “a factor smaller”. The ISOs they analyzed contained multiple variants, including NJRAT and CDRAT (two remote access trojans), Mercurial Grabber (an infostealer grabbing Roblox Studio cookies, Minecraft session data, Discord tokens, Chrome passwords and cookies, system information, IP addresses, and geolocation, Windows product keys, and screenshots), and Chaos Ransomware. The package also contained a legitimate, regular browser - “Just for kicks,” apparently.

A plausible failure

During the “game” installation, the installer displays a message in Russian, saying the product is unlicensed and that there is a good chance it won’t run. If that happens, the user is told to reach out to a specific Gmail address to receive an “updated crack”. After the installation completes, the victim will get that exact popup, saying “License not found”. All of this is just a smoke screen, to make the victim not suspicious as to why the “game” won’t run.

There is no way of telling how many people fell for the ruse and installed malware on their devices. Huntress says that generally speaking, trying to download cracked and pirated software is a bad idea, which is even worse if the game in question has not yet been released.

“This is fertile ground for scams and threat actors attempting to take advantage of the impatient and overeager,” the researchers said.

The good news is that all of the malware being distributed there is not new. Some of the variants contained in the ISOs are several years old, meaning most antivirus programs, such as Windows Defender for example, can easily detect it and stop it from compromising the system.

Those that do end up infected should disconnect the machine from the internet, reset all passwords, enable 2FA wherever possible, and do a complete reimage of the compromised system.

• Proofpoint detailed BlueMoon, an exploit kit chaining two Chromium flaws and one Windows bug
• Four groups, including China‑aligned TA412, used it loudly against NGOs, aerospace, and manufacturing targets
• Exploits were “patch‑gap” zero‑days; all flaws now patched

Four hacking groups, including some tied to the Chinese government, were seen using the exact same exploit kit in a span of a week, suggesting a certain “fear of missing out” among the criminals, experts have warned.

Security researchers Proofpoint have detailed BlueMoon, an exploit kit that leverages three vulnerabilities: two in Chromium, and one in older versions of Windows: Windows 10 (October 2018 Update), Windows Server 2019, Windows 10 2004, WIndows Server 2022, and the initial release of Windows 11.

The kit was first seen being used on August 28 2026, by a threat actor tracked as TA412, a China-aligned state-sponsored threat actor that was observed in the past targeting businesses using Microsoft SharePoint. TA412, also known as Violet Typhoon, used BlueMoon to “repeatedly target a small number of non-governmental organizations (NGOs), mining companies, and physical commodity trading firms in the United States.”

Soon after that, three others were spotted: UNK_LateNight, another China-aligned espionage group which targeted multiple US aerospace companies, UNK_DoubleCheck, a group going after a Vietnamese manufacturing entity, and UNK_QuietRacket, a threat actor taking aim at organizations across Singapore and Indonesia.

What all of these groups have in common is the fact that they did not try particularly hard to hide their activity. This is rather unusual, since a stealthy approach usually guarantees that a vulnerability can be exploited for longer.

Front running the Chromium supply chain train

BlueMoon takes advantage of three flaws, two in Chromium and one in older Windows variants. The Chromium vulnerabilities were found in V8, the JavaScript engine that the browsers use to allow applications to run efficiently. The first one is a “type confusion bug”, tracked as CVE-2026-85046, and assigned a severity score of 8.8/10 (high). The latter is a “sandbox escape” flaw, for which Google did not assign a CVE or a severity score.

The Windows bug, on the other hand, is tracked as CVE-2026-85880, and was given a severity score of 7.8/10 (high). It is described as a “heap-based buffer overflow” vulnerability in Windows Advanced Local Procedure Call, allowing malicious actors who can already execute code inside a low-privilege AppContainer to escape the sandbox and elevate privileges to SYSTEM. No additional user interaction is required.

Proofpoint has a theory as to why the crooks decided to be loud, instead of flying under the radar. Apparently, there is a very short window of opportunity between Google patching a Chromium vulnerability, and it being deployed to a browser such as Edge, or Brave, This window of opportunity also allows crooks to see how Google fixed a flaw, reverse-engineer it, and deploy an exploit before the browser is patched. This would mean that there is no time to be stealthy.

No time to hide

“Both V8 vulnerabilities were ‘patch-gap’ zero-days at the time of the observed activity,” Proofpoint said. “In other words, while they were known vulnerabilities already fixed in public upstream Chromium source code, they remained unpatched in the latest stable releases of Chrome and Chromium-based browsers available to the public. It is likely that the exploit kit developer used these publicly available Chromium patches to weaponize the browser exploit chain.”

Another important factor is Artificial Intelligence. It would seem that AI has made flaw detection significantly faster, reducing the barrier to entry and making threat actors move more loudly.

“A fully weaponized Chrome exploit chain has historically been a high-value, rare capability. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals. This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development,” Proofpoint stressed.

All three flaws have since been patched, so make sure you’re running the latest version of both the OS and the Chromium browser.

Via Ars Technica

• Huntress warns of phishing campaign abusing Adobe branding with browser‑in‑the‑browser trick
• Victims lured into fake update pages, unknowingly installing rogue ScreenConnect clients
• Attackers gain persistent remote access; defenders urged to restrict RMM installs and monitor IoCs

Security researchers Huntress have warned of an ongoing phishing campaign that abuses Adobe’s brand while deploying clever browser-in-the-browser (BitB) techniques to trick the victims.

The goal is to deliver rogue ScreenConnect clients which would grant the attackers persistent access to target devices.

In its report, Huntress says it could not find the lure itself and thus could not report what the scam looks like. However, it saw the victims clicking on a link in the email and then being redirected to a typosquatted domain https[://]adoube[.]vu that spoofs an Adobe landing page.

We heard you like browsers…

This is where we get to the scam’s unique twist. Usually, phishing lures would simply redirect victims to a malicious website which could be identified simply by looking at the address bar. If the domain differs from the legitimate one, the scam falls apart. To work around that problem, scammers came with a solution called “browser in the browser”.

Using either HTML, CSS, or JavaScript, the crooks would create an entire fake browser window, including the address bar, URL, padlock icon, and more, inside the actual webpage content itself. Therefore, if the victim isn’t all too careful, they might look at the fake address bar, see a legitimate URL, and believe they are visiting the correct website.

In this fake browser window, the fraudsters display a blurred .PDF document. Overlaid is a message saying the documents are “secured” and created with “the latest version of Adobe.” The only way to read them, the message continues, is to “update or download Adobe PDF Reader.” Expectedly, there is a big “View Files” button just under the notification, leading to a different, equally fake BitB page, showing the download progress. In the background, something gets downloaded.

Victims might think they’re getting a PDF reader, while in reality they’re getting a rogue version of ScreenConnect.

Poisoned ScreenConnect instances

On its own, ScreenConnect is not malware, or dangerous in any other way. It is a legitimate remote access and support software, similar to TeamViewer, AnyDesk, or Remote Desktop, allowing IT professionals remotely connect to and control computers and other devices. These variants, however, are tainted to enable threat actors to obtain persistent remote access to their targets’ endpoints, Huntress explained.

“The first initial remote client installed was the rogue ScreenConnect Client configured to communicate with instance-uxh86b-relay[.]screenconnect[.]com. The attacker used a legitimate ScreenConnect Trial Relay domain to further avoid detection,” the researchers said. “This initial malicious ScreenConnect Client used the native Windows command shell and curl to retrieve and install a second malicious ScreenConnect Client configured to communicate with attacker-controlled IP. Both clients established service-based persistence for continued remote access.”

After installation, the attackers used the second ScreenConnect session to run HideCursor.exe, an executable, as the name suggests, that helps the attackers hide their mouse activity.

Huntress’ researchers don’t know what the endgame is, since the threat actors were spotted and shut down in this stage of the attack. The researchers also did not share the details about the target, such as the size of the organization, or the industry it operates in. Therefore, it is impossible to even speculate on the nature of the attack and if the threat actors aimed to install ransomware.

Still, the researchers stressed the importance of training employees to “treat unexpected software update prompts and file-viewing pages with caution”, and to make sure they know how to verify downloads through trusted channels. IT teams should also restrict who can install remote-management tools, maintain an approved inventory of RMM software, and alert on new or unapproved ScreenConnect clients, unusual relay connections, and executables launched from the user Downloads folders.

Finally, businesses should monitor for Indicators of Compromise (IoC) listed on this page.

WWDC 2026, this year's edition of Apple's software-focused developer conference, has been particularly notable due to it being the last one with Tim Cook as CEO — he'll be handing over the reins to John Ternus later this year. But it's also given us a glimpse of what the future holds for Macs and MacBooks, with the announcement of macOS 27 Golden Gate.

Unlike Microsoft's rival Windows operating system, Apple releases yearly major updates to its macOS operating system which come with a new name (usually taken from a Californian landmark) and number, which now reflects the year of release. While macOS 27 will release at the end of 2026, Apple will count 2027 as its main release year, so it doesn't feel outdated a few months after it lands on people's hard drives.

Since we first reported on macOS 27, Apple has confirmed that the operating system will be available to install on compatible Macs from September 14, 2026.

While WWDC 2026 is noteworthy for being Cook's last event, this year's macOS update is less exciting, and is mainly focused on performance improvements (which are always welcome), and AI integration (less welcome).

Still, it's an update anyone with a Mac or MacBook will want to download, as long as your device is compatible, so read on to find out what's new.

A note about compatibility: perhaps the most noticable change with macOS 27 Golden Gate is that Intel-based Macs and MacBooks are no longer supported. Only Macs that have Apple silicon chips (so, M1 Macs and MacBooks or newer) will be able to install macOS 27.

macOS 27 Golden Gate: at a glance

• What is it? The newest operating system for Macs and MacBooks
• When will it be out? September 14, 2026
• How much will it cost? As usual, macOS 27 will be a free upgrade for everyone who has a compatible device

macOS 27 Golden Gate: Compatibility

Want to know if your Mac will be compatible with macOS 27 Golden Gate? Here’s the full list of Macs that’ll be able to run the operating system:

• MacBook Air M1 or later
• MacBook Pro M1 or later
• MacBook Pro 13-inch M1 2020 or later
• MacBook Pro 14-inch M1 Pro 2021 or later
• MacBook Pro 16-inch M1 Pro 2021 or later
• MacBook Neo
• iMac M1 2020 or later
• Mac mini M1 2020 or later
• Mac Studio 2022 and later

You'll notice that no Macs made before 2020 are supported. That's because macOS 27 Golden Gate is only compatible with Macs running on Apple's own M-series chips (or the A18 Pro, in the MacBook Neo's case).

This is a major change, and could see a lot of people unable to upgrade. Apple likely sees dropping older Intel models as a clean break, and means macOS 27 Golden Gate can include a big focus on AI features — the old Intel chips don't have NPUs for on-device AI.

By concentrating on its own chips, which use Arm architecture, Apple also no longer has to worry about Macs running on Intel's x86 chip tech, which will hopefully mean the macOS team has more time to improve the performance of the software and add features in the future.

If you have an Intel Mac, you can continue to use it with macOS 26, though running an not-updated operating system isn't recommended. So, it might be time to consider a new Mac — see below for some top deals.

macOS 27 Golden Gate: release date

The developer beta preview for macOS 27 was made available the day the operating system was announced, and that was followed by public betas that people could download and test without needing to have a developer account.

If you avoided those (often bug-filled) early beta versions, then your patience has paid off, as we now know that macOS 27 will be available to install on September 14, 2026.

macOS 27 Golden Gate: new features

1. Liquid Glass tweaks

Last year's macOS 26 brought a major design change with its Liquid Glass theme. While macOS 27 doesn't bring another major change to the interface, it does address some of the common complaints about Liquid Glass, especially the issue with transparency effects (which gives the interface its name) making text hard to read.

It will diffuse shadows to make it easier to read, and there's a new slider to adjust the transparency of Liquid Glass.

2. General performance improvements

The major focus of macOS 27 will be making the operating system feel faster and more responsive on Macs and MacBooks, so while the new features might not be that exciting, you should hopefully notice an improvement in the overall performance of your Mac — and for free!

'Responsiveness' is an important word, with animations feeling faster, and Apple promises that Mac apps will load 30% faster thanks to pre-loading.

Photos should appear in your gallery faster, and AirDrop sharing is up to 80% faster.

3. Better Search in macOS

Search has been rebuilt on iOS and macOS for Spotlight, Photos, and Mail (new ranking system for more relevant results), so finding files and folders on your Mac should be a lot easier.

4. Improved parental controls

This is quite a hot topic at the moment, and it's good to see Apple has taken the protection of children seriously. Alongside the existing parental controls, macOS 27 Golden Gate will let parents put a block on apps, and there are now tools that will prevent unsuitable images, including nudity and gore, from being seen.

"We're giving powerful tools to parents," according to Craig Federighi, Senior Vice President of Software Engineering at Apple.

5. Siri AI

Personally, I've never felt the need to use Siri much on a Mac, unlike on iPhones and iPads where the virtual assistant feels like a more natural fit.

That could change with the new overhauled Siri, which after several delays, will be a key part of macOS 27 Golden Gate. With advanced AI features, courtesy of Google's Gemini, the new and improved Siri will be able to complete tasks with just a voice command (or text prompt), such as write emails for you, and it can also detect what's on your screen.

Siri will also make using the Calendar app in macOS better, as you can ask it to create events for you, and it can even check to see if you're available before you respond to invites.

There will be a new Siri app for macOS, where you can have conversations with the assistant, as well as see previous chats, much like you would see text messages in the Messages app. Conversations are synced with iCloud, so you'll be able to continue them on your iPhone or iPad.

You also get system-wide context menus, and Siri AI is now integrated directly into Spotlight, where you can ask Siri questions without going into an app. A keyboard shortcut will bring up Visual Intelligence, so you can ask Siri about things on your screen.

6. Image Playground improvements

Image Playground, the generative AI tool that turns prompts into images, has a new look that's easier to use, and it's getting an option that allows you to create wallpapers using AI.

A new model allows for photo-realistic images, and you can use it on your own photos, and nothing is uploaded or shared - it's all done on-device.

Amongst all the hype over Apple’s first-ever foldable smartphone, the iPhone Duo, which was announced at the company’s ‘Surprise and Shine’ event, Apple (rather quietly) also revealed when Mac users can get the latest version of its desktop operating system, macOS 27 Golden Gate: September 14.

While pretty much all of the attention was focused on the foldable, the launch of macOS 27 is noteworthy for anyone with a modern Mac or MacBook, as this free upgrade brings some tasty new features, while also addressing some of the less popular changes that came with its predecessor, macOS 26 Tahoe.

If you have a compatible Mac, then you should be prompted to download and install macOS 27 Golden Gate once September 14 rolls around. However, if you have a Mac from before 2020 that doesn’t run on Apple Silicon (so any Intel-powered Macs), then you won’t be able to get the update.

For reference, here are all the Mac models that are compatible with macOS 27 Golden Gate:

• MacBook Air M1 or later
• MacBook Pro M1 or later
• MacBook Pro 13-inch M1 2020 or later
• MacBook Pro 14-inch M1 Pro 2021 or later
• MacBook Pro 16-inch M1 Pro 2021 or later
• MacBook Neo
• iMac M1 2020 or later
• Mac mini M1 2020 or later
• Mac Studio 2022 and later

Apple recently announced new M5 and M6-powered Mac mini and Mac Studio products, and they'll likely launch with macOS 27 preinstalled when they start shipping on September 22.

Fixing past mistakes

The main focus of macOS 27, as with Apple’s other operating updates such as iOS 27, and seemingly every piece of new software these days, is AI.

The upcoming macOS 27 upgrade paves the way for Siri AI integration – the long-awaited improvements to Apple’s virtual assistant that should make it more useful. When launched, Siri AI should be able to have two way conversations with you and execute multi-step tasks quickly and easily, which could make using your Mac a lot more convenient. It will be able to interact with apps such as Calendar to complete tasks such as creating events and reminders.

AI is also coming to macOS Spotlight to make finding things on your device better, and Visual Intelligence can be brought up to get information about what’s on your screen. Other AI features, such as Image Playground, are getting improvements as well.

If you’re not a fan of AI, then macOS 27 should still have plenty of reasons to download and install. One reason that will hopefully please a lot of people is that macOS 27 Golden Gate makes tweaks to some of macOS 26 Tahoe’s most controversial changes, especially when it comes to the polarizing Liquid Glass interface. The new macOS will allow you to adjust transparency effects to make using your device more comfortable, and during the beta testing process, it was one of the things our contributor Alex Blake was particularly thankful for. I’m sure he’s not the only one.

When Apple announced macOS 27 at WWDC 2026 earlier this year, it promised lots of performance improvements, especially when it comes to how responsive the operating system feels. This alone should make macOS 27 worth installing on September 14.

If you have an older Mac and feeling left out, make sure you check out our guide on the best Macs and MacBooks, which can help you find a new macOS 27-ready Mac that suits your needs and budget.

• A new report from KB Securities gets very gloomy about the RAM crisis
• We're told the "memory chip market is heading toward a severe supply shortage" in 2027
• AI demand has ramped up massively with infrastructure investments up 60% year-on-year to $1.3 trillion, creating even more demand for memory as fuel for that rise

If you thought the RAM crisis was going to get worse next year, you're very probably right — but apparently we might suffer an even more severe shortage than some analysts already expect.

Wccftech flagged up an article from Business Korea (translated from Korean), which suggests that the RAM squeeze is tightening its grip on two of the biggest memory chip makers.

Citing a report from KB Securities, the rumor is that Samsung and SK Hynix are now down to fewer than 10 days of memory inventory, which is very close to running dry.

This has caused concerns that available memory supplies could dwindle and be depleted in 2027, with analysts believing that the "memory chip market is heading toward a severe supply shortage" (again, bear in mind this is a translation, but the message is clear enough).

KB Securities notes that the AI boom is what's causing this, as memory chip manufacturers struggle to meet demand for HBM4 memory in AI data centers. Infrastructure investments for AI development have been revised upwards to $1.3 trillion for 2027, we're told, which is a 60% year-on-year increase.

Kim Dong-won, head of research at KB Securities, told Business Korea that: "AI servers will absorb demand for not only HBM but also server DDR5 and enterprise SSDs, potentially leading to a historic shortage."

There's a brighter spot of news from laptop maker Framework though, which, as VideoCardz reports, has taken an unusual step in reducing the price of some of its products. As you may recall, Framework has been hiking laptop prices due to the increased cost of RAM (as have other notebook manufacturers), but the company just announced that it has secured some fresh memory modules at a lower price.

This means that some of its current Framework Laptop orders will be knocked down in price, and the company said on X that it's "retroactively reducing prices for orders that shipped at higher price" too.

Analysis: there's a historic level of gloom, that much is certain

It's impressive to see Framework acting in the best interests of its customers, particularly seeing as the firm could have (theoretically) kept quiet about bagging a batch of cheaper memory chips, and just kept the difference itself.

While that's commendable, it's a pretty small (but still welcome) bone we're being thrown in the face of the bad news for the RAM crisis here. Talk of a "historic shortage" is worrying, and it feels like this is an escalation of the recent chatter about global memory supply woes which has already turned highly negative.

While this latest report talks about server DDR5 RAM (and HBM), this will obviously have a bearing on consumer products, too. Those less profitable memory sticks are going to end up sidelined even further.

With rumors about GPU price hikes again coming to the fore this week, it's difficult to catch a breath between the bouts of bad news. We can hope that the pessimism is overblown here, but I can't shake the feeling that this seems unlikely.

• Calif researchers found a zero‑click WeChat VoIP flaw enabling account takeover via calls
• “WeWorm” spreads through ringing calls; victims need not answer to be compromised
• Tencent patched in Android 8.0.77 and iOS 8.0.76; no exploitation seen in the wild

Security researchers have found a flaw in WeChat which allows malicious actors to take over people’s accounts on both Android and iOS devices - but what makes this flaw stand out is the fact that it’s a zero-click bug - victims need not do a thing to be compromised.

WeChat is a “super-app”, allegedly used by roughly 1.4 billion people, and is especially popular in China. It started as a communications app, letting users send messages, and make voice and video calls, and has evolved to function as a social network, allowing users to share photos and videos, as well as a payment app through which users can transfer money, pay for things, order food, book taxis, and even access government and business services.

Security researchers from Calif have now disclosed finding a ‘memory corruption’ issue in WeChat's VoIP stack. For now, they decided not to share the technical details, and to instead demonstrate the flaw “at an upcoming conference.” To that end, they built a worm called WeWorm, capable of taking over target WeChat accounts and spread through phone calls made via the app.

A phone call would suffice

In practice, it works remarkably simple: an attacker uses WeChat to call a person they have in their contacts list (this is a prerequisite). They can use both an Android and an iOS device, and can call anyone, regardless of the model or the OS they’re using. As soon as the phone starts ringing, WeWorm gets to work, “worming” its way into the victim’s device.

The victim does not even need to answer the phone - having it ring is enough. If they answer, they’ll hear nothing but silence, yet the worm will continue operating. If they decline the call, the attack stops, but this is hardly a mitigation - the attacker can simply call again while the victim is asleep (or otherwise away from their device).

Within a few seconds, the attacker will have access to the victim’s WeChat account, including their messages, contacts list, and virtually anything else found in the app. What makes this bug particularly worrisome on the surface is the fact that WeChat can be used to transfer money and pay for things, but WeChat Pay has additional authentication and risk controls designed to prevent that from happening.

The good news is that there is no evidence of this flaw being exploited in the wild. The bad news is that this is not the first zero-click flaw found in modern-day smartphones, and most likely will not be the last one.

Tencent's response

Calif said it responsibly disclosed its findings to WeChat’s parent company Tencent, who came back with a patch. Versions 8.0.77 for Android and 8.0.76 for iOS have apparently solved the problem, although

Tencent did not list any details in its patch notes, simply saying the version brought “bug fixes”, but in a statement shared with The Hacker News, it said the exploit has been “mitigated for all users”, and that it was applied server-side - users need not install anything, aside from the patch.

It’s also worth mentioning that WeChat has apps for HarmonyOS, Windows, Mac, and Linux. However, it would appear that Calif did not test those, and Tencent did not include them in its patch. The researchers did say that they would be looking into this same flaw in other products, too:

“This specific WeChat bug is one instance of the many unconventional attack surfaces that are present across many messaging apps,” they said. “We're conducting more of this research across other apps and attack surfaces, while working with app developers on attack surface reduction. This may take an industry-wide effort, since some of it depends on the platform owners. Once that work is further along, we'll share our progress, including the technical details of this WeChat bug.”