Meta apps offer new scam protection, Google's Wiz acquisition finalized, China curbs state-run OpenClaw use

Summary

---

Cybersecurity Headlines – March 12, 2026

Podcast Host: Sarah Lane – CISO Series
Episode Theme: Key updates and breaking stories in information security, with a focus on scam prevention in major apps, major cybersecurity acquisitions, vulnerabilities and attacks, and shifting global regulations.

---

Episode Overview

This episode dives into several pivotal developments in the cybersecurity landscape: Meta's rollout of anti-scam measures across its platforms, Google's completion of its landmark Wiz acquisition, Chinese regulatory moves targeting agentic AI technology, critical security advisories issued by CISA, cutting-edge research on AI browser vulnerabilities, ransomware trends in France, a destructive malware attack on medtech giant Stryker, and significant vulnerabilities discovered in Google Looker Studio. The host, Sarah Lane, brings clarity and urgency to each headline, offering brief analysis and context.

---

Key Discussion Points & Insights

1. Meta Rolls Out Scam Protection Across Major Apps

[00:10]

• What’s new:
  • Facebook, Messenger, and WhatsApp are set to get enhanced scam detection tools.
  • WhatsApp: Notifies users of “unusual device linking attempts.”
  • Facebook: Warns about suspicious friend requests.
  • Messenger: AI-driven chat analysis to identify fraudulent patterns.
• Why it matters:
  • The aim is proactive user protection – “help users identify and block potential scams before they become a problem.”
  • Raises expectations for other tech giants to prioritize user safety at the platform level.

---

2. Google Finalizes $32B Wiz Acquisition

[00:46]

• Details:
  • Google completed its $32 billion all-cash purchase of cloud security company Wiz – “the largest deal in Google’s history.”
  • Wiz, now part of Google Cloud, stays multi-cloud compatible (AWS, Azure, Oracle Cloud).
  • Regulatory approval granted by US and EU authorities.
• Significance:
  • Signals Google’s ambitions in cloud security and multi-cloud environments.
  • Wiz surpassed $1 billion in annual recurring revenue in 2025.
  • Quote:
    • “Wiz will join Google Cloud but continue supporting multiple platforms…” (Sarah Lane, 00:53)

---

3. China Tightens Controls on OpenClaw AI

[01:23]

• Policy shift:
  • Chinese authorities now prohibit OpenClaw AI installations on devices within state-run enterprises, government agencies, and banks.
  • The move reflects concerns about OpenClaw’s:
    • Autonomous data access
    • External communications
    • Potential “rogue behavior”
• Broader context:
  • Restrictions extend to some employees’ families.
  • Prior approval now required in other cases.
  • Despite the crackdown, domestic tech giants (Tencent, Alibaba, Minimax) keep promoting OpenClaw-based apps.
• Analysis:
  • China sets stricter boundaries for agentic AI to guard against potential data leaks or oversight failures.

---

4. CISA Orders Urgent N8N Workflow Flaw Patch

[02:02]

• Situation:
  • CISA instructs all US federal agencies to patch a remote code execution (RCE) vulnerability affecting N8N, a workflow automation platform.
  • The flaw enables “authenticated attackers to execute arbitrary code,” risking exposure of sensitive assets like API keys and database credentials.
• Urgency:
  • Federal deadline for patching: March 25th, 2026.
  • Shadowserver found over 40,000 unpatched N8N instances online.
  • Message for all:
    • “CISA urges all organizations to secure their N8N deployments immediately.” (Sarah Lane, 02:22)

---

5. Agentic AI Browsers Exposed to Phishing Attacks

[03:05]

• Key discovery:
  • Researchers show that browsers like Perplexity’s Comet can be “tricked into phishing scams in minutes.”
  • The attack exploits how agentic AI “reasons and narrates its actions.”
• Terminology:
  • Agentic blabbering: AI inadvertently outlays its logic and plans, which can be manipulated.
  • Intent collusion: User requests and attacker instructions can merge, allowing hidden commands.
• Research highlights:
  • Prompt injections and zero-click attacks shown to extract data like Gmail and 1Password credentials.
  • Work credited to Guardio, TrailOfBits, and Zenity Labs.
• Quote:
  • “Guardio researcher Shaked Chen described this as agentic blabbering where the AI exposes its observations and plans…” (Sarah Lane, 03:16)

---

6. France’s Ransomware Landscape: Modest Drop, New Threats

[04:08]

• Statistics:
  • 128 ransomware attacks in 2025 (down from 141 in 2024).
  • SMBs remain prime targets; biggest spike seen in healthcare and education.
• Context:
  • Operation Endgame, a law enforcement initiative, played a role in reducing overall attacks.
  • Most detected variants: Qilin, Akira, Lockbit 3.0 (LockBit Black) – with “new variants also observed.”
  • Overall cyber incidents steady at 1,366 in 2025.
  • Data exfiltration claims rose; DDoS attacks went down.

---

7. Stryker Hit by Wiper Malware, Operations Disrupted

[04:46]

• Incident details:
  • Medical technology company Stryker crippled by wiper malware attack attributed to Handala (Iranian-linked, pro-Palestinian group).
  • 50TB of data reportedly stolen.
  • Over 200,000 systems wiped; 79-country impact.
• Consequences:
  • Both corporate and personal data lost.
  • Internal operations shifted to manual processes.
  • Handala is “linked to Iran's Ministry of Intelligence and Security” and has targeted Israeli organizations since Dec 2025.

---

8. Google Looker Studio: Nine “Leaky Looker” Vulnerabilities

[05:35]

• Discovery:
  • Tenable researchers found vulnerabilities dubbed “leaky looker” in Google Looker Studio.
  • Issues involved:
    • SQL connectors
    • Authentication flaws
    • Report sharing exposures
  • Enabled “zero-click attacks using report owner credentials and one-click attacks targeting viewers.”
• Scope:
  • Risks stretched to BigQuery, Spanner, PostgreSQL, MySQL, Google Sheets, and Cloud Storage.
• Resolution:
  • Google addressed all issues platform-wide; “no customer action required.”
• Quote:
  • “Tenable Researchers uncovered nine vulnerabilities in Google Looker Studio, dubbed leaky looker that could have let attackers extract or manipulate sensitive cloud data.” (Sarah Lane, 05:36)

---

Notable Quotes & Memorable Moments

• “This is all meant to help users identify and block potential scams before they become a problem.” (Sarah Lane, 00:28)
• “Wiz will join Google Cloud but continue supporting multiple platforms including AWS, Azure and Oracle Cloud as its own multi cloud security provider.” (Sarah Lane, 00:53)
• “Chinese authorities have barred state run enterprises and government agencies…from installing OpenClaw AI…due to security risks.” (Sarah Lane, 01:25)
• “CISA urges all organizations to secure their N8N deployments immediately.” (Sarah Lane, 02:22)
• “Researchers have shown that agentic AI browsers…can be manipulated into phishing scams in minutes.” (Sarah Lane, 03:05)
• “Stryker is offline after a wiper malware attack claimed by Handala and an Iranian-linked pro-Palestinian hacktivist group.” (Sarah Lane, 04:47)

---

Timestamps for Important Segments

• 00:10 – Meta scam protection updates
• 00:46 – Google finalizes Wiz acquisition
• 01:23 – China restricts OpenClaw AI in state sector
• 02:02 – CISA orders patch for N8N RCE flaw
• 03:05 – Agentic AI browser vulnerabilities
• 04:08 – France’s ransomware trends
• 04:46 – Stryker wiper malware incident
• 05:35 – Google Looker Studio “Leaky Looker” flaws

---

Summary Reflection

This episode concisely tackled high-impact, rapidly evolving issues in cybersecurity, from proactive scam detection in social networks to the ripple effects of cloud security acquisitions and the sobering realities of global malware threats. With clear, precise language and a brisk tempo, Sarah Lane highlighted both new risks and promising mitigation efforts, offering valuable insights for IT professionals, decision-makers, and everyday technology users.

Transcript

[A]

From the CISO series, it's Cybersecurity Headlines

[B]

these are the cybersecurity headlines for Thursday, March 12, 2026. I'm Sarah Lane. Meta Apps Offer New Scam Protection Meta is adding new scam detection features across Facebook, messenger and WhatsApp to warn users about suspicious activity before interaction. The updates include alerts for unusual device linking attempts on WhatsApp, warnings for suspicious friend requests on Facebook, and expanded AI based scam detection on messenger that can review chats for common fraud patterns. This is all meant to help users identify and block potential scams before they become a problem. Google's Wiz Acquisition Finalized Google completed its $32 billion all cash acquisition of cloud security startup Wiz, the largest deal in Google's history. Wiz will join Google Cloud but continue supporting multiple platforms including aws, Azure and Oracle Cloud as its own multi cloud security provider. The deal closed after U.S. and EU regulatory approval. Wiz surpassed $1 billion in annual recurring revenue in 2025. China curbs state Run Open Claw Use Chinese authorities have barred state run enterprises and government agencies, and including major banks from installing OpenClaw AI on office computers or personal devices connected to company networks due to security risks. OpenClaw is an agentic AI platform that autonomously manages tasks and accesses private data, raising some concerns over external communications and rogue behavior. Some employees and military families face restrictions, while other notices require prior approval. Chinese tech firms like Tencent, Alibaba and Minimax continue promoting OpenClaw apps. CISA orders N8N RCE flaw Patch CISA has directed US federal agencies to patch a remote code execution vulnerability in the N8N workflow automation platform. Actively exploited in attacks, the flaw allows authenticated attackers to execute arbitrary code, potentially exposing sensitive data such as API keys, database credentials and CICD secrets. N8N patched the issue back in December, but Shadow server reports over 40,000 unpatched instances online. Federal agencies have to remediate by March 25th, but CISA urges all organizations to secure their N8N deployments immediately. Huge thanks to our sponsor DropZone AI. Here's something worth asking any AI security vendor you might meet at RSAC. Can you show me exactly what your AI did? Not just the verdict, the reasoning. Every tool that it queried, every piece of evidence, every step it took to get there. Most can't. Dropzone AI can. Every investigation is fully transparent. You don't have to trust the AI, you can verify it. See it for yourself at booth 455 and learn more at DropZone AI. RSA2026AI diner Comet AI browser tricked into phishing scam Researchers have shown that agentic AI browsers like Perplexity's Comet can be manipulated into phishing scams in minutes by exploiting how the AI reasons and narrates its actions. Guardio researcher Shaked Chen described this as agentic blabbering where the AI exposes its observations and plans, allowing attackers to train malicious pages to to bypass defenses. Stav Cohen explained intent collusion where user requests merge with attacker instructions, enabling hidden commands to execute. Related work from TrailOfBits and Zenity Labs demonstrated prompt injections and zero click attacks to exfiltrate data like Gmail content and 1Password credentials. France's national cybersecurity agency sees ransomware drop the French cybersecurity agency, also known as ANSI or ANSSI, reported 128 ransomware attacks in 2025. That's down from 141 in 2024. Partly due to law enforcement operations like Operation Endgame, SMBs remained the main targets. Healthcare and education sectors saw the largest year over year increase. Qilin, akira and Lockbit 3.0 lock bit black were the most common strains with new variants also observed. Overall, cyber incidents stayed stable at 1,366 confirmed cases. Data exfiltration claims rose and DDoS attacks declined. Stryker offline after wiper malware attack MedTech company Stryker is offline after a wiper malware attack claimed by Hendala and an Iranian linked pro Palestinian hacktivist group. The attackers say they stole 50 terabytes of data and wiped over 200,000 systems, servers and mobile devices affecting offices in 79 countries. Staff reported losing both corporate and personal device data. Internal services and applications were also disrupted, forcing some teams to revert to manual workflows. Handala, linked to Iran's Ministry of Intelligence and Security, has targeted Israeli organizations since December of 2025. Destructive malware leaky looker found in Google Looker Studio Tenable Researchers uncovered nine vulnerabilities in Google Looker Studio, dubbed leaky looker that could have let attackers extract or manipulate sensitive cloud data. The flaws affected SQL connectors, authentication and report sharing features allowing zero click attacks using report owner credentials and one click attacks targeting viewers. Services at risk include BigQuery, Spanner, PostgreSQL, MySQL, Google Sheets and cloud storage. Google patched the platform globally with no customer action required. Security tools are supposed to solve problems and make our lives easier, so why does it seem like they're doing the opposite and creating more work. That's what we're trying to answer on this week's episode of Defense In Depth. Look for the episode Are youe Security Tools? Creating more work for your team wherever you get your podcasts. If you have thoughts on the news from today or about our show in general, be sure to reach out to [e-mail] we want to hear from you. I am Sarah Lane, reporting for the CISO series. Thank you for listening and we'll talk to you tomorrow.

[A]

Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.