#FactCheck-AI-generated video falsely shared as real footage of Assam floods

Starting in mid-December, 2024, a series of attacks have targeted Chrome browser extensions. A data protection company called Cyberhaven, California, fell victim to one of these attacks. Though identified in the U.S., the geographical extent and potential of the attack are yet to be determined. Assessment of these cases can help us to be better prepared for such instances if they occur in the near future. 

The Attack

Browser extensions are small software applications that add and enable functionality or a capacity (feature) to a web browser. These are written in CSS, HTML, or JavaScript and like other software, can be coded to deliver malware. Also known as plug-ins, they have access to their own set of Application Programming Interface (APIs). They can also be used to remove unwanted elements as per customisation, such as pop-up advertisements and auto-play videos, when one lands on a website. Some examples of browser extensions include Ad-blockers (for blocking ads and content filtering) and StayFocusd (which limits the time of the users on a particular website).

In the aforementioned attack, the publisher of the browser at Cyberhaven received a phishing mail from an attacker posing to be from the Google Chrome Web Store Developer Support. It mentioned that their browser policies were not compatible and encouraged the user to click on the “Go to Policy”action item,  which led the user to a page that enabled permissions for a malicious OAuth called Privacy Policy Extension (Open Authorisation is an adopted standard that is used to authorise secure access for temporary tokens). Once the permission was granted, the attacker was able to inject malicious code into the target’s Chrome browser extension and steal user access tokens and session cookies. Further investigation revealed that logins of certain AI and social media platforms were targeted.

CyberPeace Recommendations

As attacks of such range continue to occur, it is encouraged that companies and developers take active measures that would make their browser extensions less susceptible to such attacks. Google also has a few guidelines on how developers can safeguard their extensions from their end. These include:

1. Minimal Permissions For Extensions- It is encouraged that minimal permissions for extensions barring the required APIs and websites that it depends on are acquired as limiting extension privileges limits the surface area an attacker can exploit.
2. Prioritising Protection Of Developer Accounts- A security breach on this end could lead to compromising all users' data as this would allow attackers to mess with extensions via their malicious codes. A 2FA (2-factor authentication) by setting a security key is endorsed.
3. HTTPS over HTTP- HTTPS should be preferred over HTTP as it requires a Secure Sockets Layer (SSL)/ transport layer security(TLS) certificate from an independent certificate authority (CA). This creates an encrypted connection between the server and the web browser.

Lastly, as was done in the case of the attack at Cyberhaven, it is encouraged to promote the practice of transparency when such incidents take place to better deal with them.

References

1. https://indianexpress.com/article/technology/tech-news-technology/hackers-hijack-companies-chrome-extensions-cyberhaven-9748454/
2. https://indianexpress.com/article/technology/tech-news-technology/google-chrome-extensions-hack-safety-tips-9751656/
3. https://www.techtarget.com/whatis/definition/browser-extension
4. https://www.forbes.com/sites/daveywinder/2024/12/31/google-chrome-2fa-bypass-attack-confirmed-what-you-need-to-know/
5. https://www.cloudflare.com/learning/ssl/why-use-https/

Disclaimer:

The information is based on claims made by threat actors and does not imply confirmation of the breach, by CyberPeace. CyberPeace includes this detail solely to provide factual transparency and does not condone any unlawful activities. This information is shared only for research purposes and to spread awareness. CyberPeace encourages individuals and organizations to adopt proactive cybersecurity measures to protect against potential threats.

🚨 Data Breach Alert ⚠️: 

Recently The Research Wing of CyberPeace and Autobot Infosec have come across a claim on a threat actor’s dark web website alleging a data breach involving 637k+ records from Federal Bank. According to the threat actor’s claim, the data allegedly includes sensitive details such as-

• 🧑‍Customer Name
• 🆔Customer ID
• 🏠 Customer Address
• 🎂 Date of Birth
• 🔢 Age
• 🚻 Gender
• 📞Mobile Number
• 🪪 PAN Number
• 🚘 Driving License Number
• 🛂 Passport Number
• 🔑 UID Number
• 🗳️ Voter ID Information

The alleged data was initially discovered on a dark web website, where the threat actors allegedly claimed to be offering the breached information for sale. Following their announcement of the breach, a portion of the data was reportedly published on December 27, 2024. A few days later, the full dataset was allegedly released on the same forum.

About the Threat Actor Group:

Bashe, a ransomware group that emerged in 2024, is claimed to have evolved from the LockBit ransomware group, previously operating under the names APT73 and Eraleig. The group employs data encryption combined with extortion tactics, threatening to release sensitive information if ransom demands are unmet. Their operations primarily target critical industries, including technology, healthcare, and finance, demonstrating a strategic focus on high-value sectors.

Breakdown of the Alleged Post by the Threat Actor:

• Target: Allegedly involves Customer’s Data of Federal Bank.
• Data Volume: Claimed breach includes 637,894 records.
• Data Fields: Threat actor claims the data contains sensitive information, including Customer name, Customer ID, Date of Birth, PAN Number, Age, Gender, Father Name, Spouse Name, Driving Licence, Passport Number, UID Number, Voter ID, District, Zip Code, Home Address, Mailing Address, State etc.

Analysis:

The analysis of the alleged data breach highlights the states purportedly most impacted, along with insights into the affected age groups, gender distribution, and other key insights associated with the compromised data. This evaluation aims to provide a clearer understanding of the claimed breach's scope and its potential demographic and geographic impact.

Top States Impacted: 

As per the alleged breached data, Tamil Nadu has the highest number of affected customers, accounting for a significant 34.49% of the total breach. Karnataka follows closely with 26.89%, indicating a substantial number of individuals affected in the state. In contrast states such as Uttar Pradesh, Haryana, Delhi, and Rajasthan report minimal impact, with each state having less than 1% of affected customers. Gujarat records 3.70% of the breach, with a sharp drop in affected numbers from other states, highlighting a significant disparity in the extent of the breach across regions.

Impacted Age Range Statistics:

The alleged data breach has predominantly impacted customers in the 31-40 years age group, which constitutes the largest segment at 35.80% of the affected individuals. Following this, the 21-30 years age group also shows significant impact, comprising 27.72% of those affected. The 41-50 years age group accounts for 20.55% of the impacted population, while individuals aged 50 and above represent 12.68%. In contrast, the 0-20 years age group is the least affected, with only 3.24% of customers falling into this category.

Gender Wise Statistics:

The alleged data breach has predominantly impacted male customers, who constitute the majority at 74.05% of the affected individuals. Female customers account for 23.18%, while a smaller segment, categorized as "Others," constitutes 2.77%.

The alleged dataset from the threat actors indicated that a significant portion of customers' personal identification data was compromised. This includes sensitive information such as driving licenses, passport numbers, UID numbers, voter IDs, and PAN numbers.

Significance of the Allegations:

Though the claims have not been independently verified at our end it underscores the rising risks of cyberattacks and data breaches, especially in the financial and banking sectors. If true, the exposure of such sensitive information could lead to financial fraud, identity theft, and severe reputational damage for individuals and organizations alike.

CyberPeace Advisory:

CyberPeace emphasizes the importance of vigilance and proactive measures to address cybersecurity risks:

• Monitor Your Accounts: Keep a close eye on financial and email accounts for any suspicious activity.
• Update Passwords: Change your passwords immediately and enable Multi Factor Authentication(MFA) wherever possible.
• Beware of Phishing Attacks: Threat actors may exploit the leaked data to craft targeted phishing scams. Do not click on unsolicited links or share sensitive details over email or phone.
• For Organizations: Strengthen data protection mechanisms, regularly audit security infrastructure, and respond swiftly to emerging threats.
• Report: For more assistance or to report cyber incidents, visit https://cybercrime.gov.in or contact our helpline team at helpline@cyberpeace.net.

We advise affected parties and the broader public to stay alert and take necessary precautions. CyberPeace remains committed to raising awareness about cybersecurity threats and advocating for better protection mechanisms. We urge all stakeholders to investigate the claims and ensure appropriate steps are taken to protect the impacted data, if the breach is confirmed. Our Research Wing is actively observing the situation and we aim to collaborate with the stakeholders and relevant agencies to mitigate the impact.

Stay Vigilant! Stay CyberPeaceful.

‍

Introduction

‍
You ask an app for directions to a street you've driven down a hundred times. You let autocomplete finish your sentence before you've decided what you meant to say. You take a photo of a document instead of reading it, trusting the summary a model hands back. None of these moments feel like a loss. Each one is, on its own, a reasonable trade of effort for convenience. But add them up across a year, a career, an industry, and you start to wonder what exactly we've been trading away. Every technology wave produces its own founding myth. For AI, the myth is that intelligence can be manufactured at scale, bottled into a model, and dispensed on demand - cheaper, faster, and eventually better than the human original. It's a seductive story, and one we've been telling ourselves so uncritically that we've stopped noticing what it costs.

The casualties of this bet are rarely dramatic. Nobody announces that a skill has quietly atrophied, or that a habit of independent judgement has gone unused long enough to weaken. These losses don't show up as headlines; they show up later, as gaps, when the system that was supposed to think for us turns out not to have been thinking at all. Ford Motor Company's recent decision to rehire around 350 veteran engineers, after leaning heavily on AI-driven quality systems, is a small but telling data point.¹ The lesson isn't that automation failed outright — it's that a process can be automated without the judgement that made the process work ever being captured in the first place. That distinction between automating a task and actually preserving the human expertise behind it is the real subject of this AI moment.

‍

How Organisations Are Using AI in Decision-Making

‍

More organisations are now leaning on AI not just to execute tasks, but to help shape decisions. Deloitte's 2026 Global Human Capital Trends survey found that 60% of executives now regularly use AI to support their decisions, and the same report cites Gartner's projection that by 2027, half of all business decisions will be augmented or automated by AI agents. Companies like Netflix and Amazon are often pointed to as examples of this working well using AI to enhance recommendations and logistics while keeping people involved in the interpretation, generating significant value in the process. Elsewhere, results have been more mixed: MIT's "State of AI in Business 2025" study found that 95% of generative AI pilots showed no measurable P&L impact within six months, often because this initiative failed to integrate feedback or adapt to context rather than because the underlying model was flawed. Critics have noted the study used a narrow definition of success (six-month, bottom-line ROI), so the figure may understate the value AI creates in ways that aren't captured on the P&L. Notably, this is not an argument against using AI. It is an argument about how we use it and why the human-in-the-loop principle, keeping people actively involved in judgement rather than passively rubber-stamping outputs, is not a compliance checkbox but the thing that determines whether automation actually works. That distinction, between automating a task and preserving the human expertise behind it, is the point of contention.

‍

Finding the Balance

‍

The lesson isn't to use AI less, it's to be deliberate about where it sits in the process. The strongest results come from pairing AI's speed with human judgement, not swapping one for the other. That means keeping a clear owner for important decisions, checking that the model is optimising for the right goal, and treating its output as a strong first draft rather than a final answer. Used this way, AI doesn't replace thinking, it gives good judgement more room to work.

‍

Two Framings We Should Retire

‍

Conversations about AI adoption keep falling into two lazy framings. The first is AI versus humans, as if technology and workforce are locked in a zero-sum contest for relevance. The second is AI versus jobs, reducing every discussion to headcount and displacement. Both are legitimate concerns, but they crowd out a more urgent question: as AI gets embedded deeper into how decisions are made, what happens to the quality of the decisions themselves? This is not a question about whether AI is useful and it plainly is. It is a question about what gets quietly outsourced along with the task, and whether anyone notices before it matters.

‍

Why “Wisdom of Crowds” Does Not Automatically Apply to AI

‍

A comforting analogy often gets reached for: surely, with millions of people using the same models, errors will average out, the way independent forecasters tend to converge on accurate estimates.² That analogy breaks down where it matters most. The wisdom-of-crowds effect depends on independent thinking, genuinely diverse information, and an aggregation mechanism that does not distort the signal. When millions of people query the same underlying model, those conditions collapse. Everyone draws from the same statistical engine, trained on overlapping data, tuned toward similar “safe” answers. The apparent agreement is not corroboration, it is an echo. This creates a genuinely new risk: AI can be confidently, fluently, and uniformly wrong across an entire organisation at once, without the friction that would normally surface an error in a single person's judgement.

‍

The Casualties, Named Plainly

‍

Several things erode quietly when organisations are not deliberate about integrating AI into decisions. Independent judgement is the first casualty of the willingness to form a view before checking what the model says. Verification effort follows: generative AI collapses retrieval and generation into one fluent output, and people invest less effort checking something that already sounds complete and well-reasoned. Diversity of thought narrows as more decision-makers lean on the same handful of models for research and drafting, quietly reducing the range of framings available when it matters most. Accountability becomes harder to trace when a recommendation generated by a model and passed along with minimal scrutiny creates a strange vacuum where a decision was made but nobody quite owns it. And informational anchoring sets in, where a signal becomes a coordination point simply because everyone is looking at it, regardless of its accuracy.

‍

Why Human-in-the-Loop Is a Design Requirement

‍

“Human in the loop” often becomes a rubber-stamp step rather than genuine scrutiny. That is a mistake, because the functions humans provide are structural, not decorative. Context that a model cannot infer  history, relationships, unstated constraints  shapes whether a reasonable-sounding answer is right in a specific situation. Domain expertise built over years lets someone recognise when a fluent answer is subtly wrong. Ethical judgement decides trade-offs a model has no standing to make on an organisation's behalf. Accountability means someone can be asked why a decision was made and answer from reasoning, not from “the system recommended it.” And the rarest function of all is the willingness to challenge a convincing answer and resisting the very fluency that makes AI output persuasive.

‍

What This Looks Like in Practice

‍

For organisations, the goal is not slowing AI adoption but being deliberate about where human judgement stays load-bearing. AI output should default to draft status until a qualified person has actively tested its logic against context the model lacks. Teams using the same AI tools for analysis should build in a step that actively seeks disagreement, rather than assuming convergence means correctness. Ford's decision to bring engineers back to lead design reviews is instructive: expertise, once encoded into a system, is not safe to let atrophy in the people who built it.³ Verification should be visible and required for decisions with real financial, legal, safety, or reputational consequences. And organisations should track which decisions were AI-assisted and who owned the final call, so accountability stays traceable rather than quietly disappearing.

‍

Conclusion

‍

Decades ago, management thinkers warned that automating a broken process only helps an organisation fail faster. The AI era raises the stakes on that warning: judgement itself, the hard-won capacity to reason well under uncertainty, can be automated away without anyone deciding to give it up. Machines already process information faster than any team of people. What they cannot yet do is originate the wisdom that comes from human experience, accountability, and the willingness to be told one is wrong. That capacity erodes not because AI is powerful, but because organisations stop deliberately exercising it. The real task ahead is not resisting AI, but ensuring that as it takes on more of the work of deciding, humans deliberately keep hold of the responsibility of deciding.

‍

References

‍

1. https://www.assemblymag.com/articles/100186-ford-rehires-veteran-engineers-to-improve-ai-vehicle-quality
2. https://finance.yahoo.com/technology/ai/articles/ford-rehires-veteran-engineers-ai-144332497.html
3. https://finance.yahoo.com/technology/ai/articles/ford-rehires-more-300-engineers-162210705.html
4. https://www.msn.com/en-us/money/other/ford-rehires-hundreds-of-engineers-after-ai-struggles-to-improve-quality/ar-AA26P4QB?ocid=BingNewsSerp
5. https://www.foxbusiness.com/technology/ford-rehires-experienced-engineers-after-ai-misses-mark
6. https://www.livemint.com/opinion/online-views/artificial-wisdom-of-crowds-jobs-crisis-ai-technology-automation-openai-model-11785009289768.html
7. https://www.deloitte.com/us/en/insights/topics/talent/human-capital-trends/2026/decision-making-with-ai.html
8. https://www.hpcwire.com/aiwire/2026/03/04/deloittes-state-of-ai-2026-why-enterprise-execution-is-falling-behind-adoption/ and Legal.io summary: https://www.legal.io/blog/5719519/MIT-Report-Finds-95-of-AI-Pilots-Fail-to-Deliver-ROI-Exposing-GenAI-Divide
9. https://www.marketingaiinstitute.com/blog/mit-study-ai-pilots

‍