Maps, Taps, and Facial Slaps. The IT Privacy and Security Weekly Update for October 28th., 2025.

EP 264 ​ In this week’s update:
​
Microsoft Teams will soon reveal employees' exact building location to managers the moment they join company Wi-Fi, blurring the lines of hybrid work privacy.
Cybercriminals are exploiting Microsoft’s own Copilot Studio platform to deploy convincing phishing agents that silently harvest full Office 365 access tokens.
A sprawling malware network hid Lumma and Rhadamanthys stealers inside fake Adobe, FL Studio, and Roblox cheat downloads promoted across hijacked YouTube channels.
Starting November 3, 2025, every Firefox add-on must explicitly declare in its code whether it collects user data-or confirm it gathers none.
Non-citizens will soon face mandatory biometric capture at every U.S. departure point under a new rule targeting visa overstays and fraud.
A proposed bill would compel researchers and firms to report every vulnerability to Russia’s security service, mirroring China’s state-controlled model.
A new MaaS platform equips attackers with an all-in-one RAT that scans for unpatched software and escalates privileges before stealing credentials and crypto.
An engineer’s iLife robot was remotely disabled by the manufacturer when he firewalled its data uploads exposing hidden kill switches in everyday IoT devices.
​
Let’s go discover!

Find the full transcript here.