grep -rl "china" ./articles
Gen Threat Labs traced a China-linked intrusion to Sogou Input Method, where one click could open an embedded Chromium 80 engine running with its sandbox and same-origin policy switched off. The group used a 2021 Chrome exploit to install the GRAYRABBIT backdoor. Tencent closed the entry point in 12 days, but Gen says the browser component was not changed.
NSA, CISA and the FBI accuse six Chinese AI firms of extracting billions of tokens from Claude, GPT, Gemini and Grok since late 2024. No system was breached — the models were queried through the front door. The recommended countermeasure is to subtly alter what suspected accounts get back.
Microsoft documented a campaign of counterfeit vendor sites whose installers disable four Windows Update services, rename the update DLLs, set Defender exclusions and then lock the ACLs against standard users. The payload hash changes on every download, so there is no hash to block.
A viral explainer says China makes about three times America's electricity, so the AI race comes down to power. China's installed capacity is about 3x. Its actual electricity is 2.3x. The gap between those two figures is wind and solar nameplate, and it is the difference between a number that sounds decisive and a number that runs a training cluster overnight.
Microsoft's Orkney experiment is real and the 1/8th failure rate is Microsoft's own figure. But the cause it gave was a sealed dry-nitrogen atmosphere with nobody walking around inside, which you can build on land. China's $226 million Shanghai project is also real, is running, and raises a question the viral version says nobody has studied. People have studied it.
GTIG's threat tracker names five PRC-nexus groups, six malware families and a 2FA bypass in an open-source admin tool. The interesting part is why an LLM found it: fuzzers look for crashes, and this was a hardcoded trust assumption.
Microsoft attributes StormEncryptor, a new C++ locker, to the China-linked group. Initial access was likely CVE-2026-18577 in N-able N-central, which is itself a bypass of the earlier fix. CISA has both flagged as exploited.