Britain's national digital ID scheme may be dead, but Whitehall appears to have forgotten to tell the infrastructure. Despite the government scrapping its controversial plans, officials told MPs on Monday that work continues on GOV.UK One Login, digital wallets, and a growing collection of digital credentials designed to help people prove who they are. The abandoned scheme was one of Keir Starmer's flagship policies, originally pitched as a compulsory digital ID card to crack down on illegal working. Privacy campaigners weren't impressed, warning of surveillance and government overreach, and ministers eventually made it voluntary before Andy Burnham, decided to bin the whole thing. But scrapping the scheme hasn't dented Whitehall's digital identity ambitions. Officials told MPs this week that more than 80 types of documents are earmarked for the government's digital wallet, including proof of benefits, driving test certificates, and Disclosure and Barring Service (DBS) certificates. That's quite a lot of paperwork for something that's supposedly dead. The revelations came during a Public Accounts Committee hearing on Monday, where MPs wanted to know what exactly had been scrapped. "But is it not the case, based on the answers you've given us this afternoon, that the infrastructure of digital ID in the public sector is still being pursued?" asked Sarah Green, Liberal Democrat MP for Chesham and Amersham. Susannah Storey, DCMS permanent secretary, was keen to draw a line between the national scheme ministers had scrapped and the digital identity projects Whitehall had no intention of abandoning. One Login already allows people to prove who they are online, she said, but "that is not the same as a national digital identity strategy." Rod Latham, DCMS director for cybersecurity and digital identity, had a convenient explanation for why so much of digital ID was still standing: the government had only scrapped plans for a new identity product. "We already had One Login and the Gov Wallet," he told MPs, adding that work on the digital identity trust framework was also underway before the national scheme was announced. Whitehall isn't wasting time putting that technology to use, with officials confirming that testing is already underway to enable digital credentials to work with private businesses. Natalie Jones, the senior responsible owner for GOV.UK One Login, revealed that the government had opened a testing environment for private sector providers to integrate with its digital wallet technology. This would let people use digital driving licenses to prove their age in pubs, collect parcels, or verify their identity online. "We've got a bit of a chicken and egg situation. A digital driving license is only useful if there are people ready and shops and businesses ready to receive it,” Jones said, noting that further testing is planned for December, with a national rollout of digital driving licenses targeted for 2027. MPs also pressed officials on privacy, particularly whether citizens would have to consent before their information was shared between government departments. "In the confines of digital ID used in digital services, then consent is the model," said Christine Bellamy, interim director general for digital products at the Government Digital Service. There's a catch, of course. Government departments can already share data without asking permission, and officials couldn't quite explain how that squares with their promises about consent. "The strategy needs to be fully finished," Bellamy admitted, which might not be the reassurance MPs were hoping for. Jones insisted that One Login was "not a big data lake," saying it stores identity information separately and cannot see what users do inside government services. "One Login does not issue a single identifier to people," she added. Rupert Lowe MP remained unconvinced, warning that Britain could end up getting digital ID "by the back door rather than the front door." Officials maintained that the canceled national scheme was fundamentally different from the services still being developed, and that people would retain alternatives to digital identification. National digital ID may be officially dead, but between One Login, digital wallets, and dozens of planned credentials, Whitehall still has plenty of identity-related work to keep it busy. ®
The UK government has corralled £7.8 billion of cross-departmental spending into a new space strategy intended to boost growth and national security through to 2030. The package covers orbital collision warnings, low Earth orbit communications, military intelligence, launch capabilities, and space science. The strategy brings together activity across government, including the newly created Department for Business, Innovation, Science and Trade (BIST), the Ministry of Defence (MoD), the Department for Transport, UK Research and Innovation, and the Met Office. The government says the domestic space sector is worth £18.6 billion and supports more than 55,000 skilled jobs. In a prepared statement, BIST Secretary Jonathan Reynolds said space was becoming a new frontier of economic and military competition. "This plan will help keep Britain secure by strengthening our ability to launch satellites, detect threats and protect the services people rely on every day. At the same time, this plan will enable our excellent UK industry to seize the boundless opportunities of this new age in space, creating skilled jobs, driving growth and improving connectivity for all of us." The plans include work to strengthen space domain awareness – tracking and analyzing satellites, rockets, and debris in orbit – backed by £149 million for European Space Agency (ESA) space safety work, including the Vigil mission, and £85 million for the National Space Operations Centre. The funding is intended to improve warnings of potential satellite collisions, hostile activity, and solar storms, helping protect power, communications, and navigation services. The government has also allocated £880 million during this Parliament to space control and space-based intelligence, surveillance, and reconnaissance capabilities. The investment is intended to help track military activity on the ground, identify potential attacks on satellites, and protect British assets in orbit. The strategy also identifies £2.8 billion for satellite connectivity, including the Connectivity in Low Earth Orbit program and the military's SKYNET communications system. Funding of up to £160 million through March 2030 has already been announced for the UK Space Agency's Connectivity in Low Earth Orbit (C-LEO) program, helping British companies and researchers develop satellite communications technology. The strategy also puts £40 million towards technology for servicing, assembling, and manufacturing equipment in orbit. The government says this could support everything from repairing satellites and clearing debris to producing semiconductors and pharmaceuticals in space. Another £148 million is allocated to European rocket programs, while SaxaVord Spaceport in Shetland is set to receive £30 million, subject to due diligence. A further £163 million will go toward space science and exploration missions, including delivery of the UK-built Rosalind Franklin Mars rover. The package also includes £57 million to improve rail connectivity, £190 million for astronomy and space science research, and £9 million to strengthen space weather forecasting. The government also plans to adopt a single approach to buying and developing space technology, beginning with satellite communications, in an effort to steer more work towards British suppliers, accelerate delivery, and secure better value for taxpayers. In July, the government's projects authority sounded the alarm over progress on Skynet 6, the £8.35 billion program to upgrade the military's satellite communications. The National Infrastructure and Service Transformation Authority (NISTA) gave Skynet 6 a red rating, meaning "successful delivery of the project appears to be unachievable" in its current form. Confidence had fallen from last year's amber rating because department-wide recruitment and resourcing constraints had created workforce shortages, while "sub-par supplier performance continues to delay delivery of the first SKYNET 6 satellite," the report said. The new document formally replaces the UK's 2021 National Space Strategy, which a House of Lords report warned last year had failed to turn its ambitions into reality. "The UK space sector lacks the strategic direction necessary for success," it said. ®
For the past week, the massive “Internet of Things” (IoT) botnet known as Kimwolf has been disrupting The Invisible Internet Project (I2P), a decentralized, encrypted communications network designed to anonymize and secure online communications. I2P users started reporting disruptions in the network around the same time the Kimwolf botmasters began relying on it to evade takedown attempts against the botnet’s control servers.
Kimwolf is a botnet that surfaced in late 2025 and quickly infected millions of systems, turning poorly secured IoT devices like TV streaming boxes, digital picture frames and routers into relays for malicious traffic and abnormally large distributed denial-of-service (DDoS) attacks.
I2P is a decentralized, privacy-focused network that allows people to communicate and share information anonymously.
“It works by routing data through multiple encrypted layers across volunteer-operated nodes, hiding both the sender’s and receiver’s locations,” the I2P website explains. “The result is a secure, censorship-resistant network designed for private websites, messaging, and data sharing.”
On February 3, I2P users began complaining on the organization’s GitHub page about tens of thousands of routers suddenly overwhelming the network, preventing existing users from communicating with legitimate nodes. Users reported a rapidly increasing number of new routers joining the network that were unable to transmit data, and that the mass influx of new systems had overwhelmed the network to the point where users could no longer connect.
I2P users complaining about service disruptions from a rapidly increasing number of routers suddenly swamping the network.
When one I2P user asked whether the network was under attack, another user replied, “Looks like it. My physical router freezes when the number of connections exceeds 60,000.”
A graph shared by I2P developers showing a marked drop in successful connections on the I2P network around the time the Kimwolf botnet started trying to use the network for fallback communications.
The same day that I2P users began noticing the outages, the individuals in control of Kimwolf posted to their Discord channel that they had accidentally disrupted I2P after attempting to join 700,000 Kimwolf-infected bots as nodes on the network.
The Kimwolf botmaster openly discusses what they are doing with the botnet in a Discord channel with my name on it.
Although Kimwolf is known as a potent weapon for launching DDoS attacks, the outages caused this week by some portion of the botnet attempting to join I2P are what’s known as a “Sybil attack,” a threat in peer-to-peer networks where a single entity can disrupt the system by creating, controlling, and operating a large number of fake, pseudonymous identities.
Indeed, the number of Kimwolf-infected routers that tried to join I2P this past week was many times the network’s normal size. I2P’s Wikipedia page says the network consists of roughly 55,000 computers distributed throughout the world, with each participant acting as both a router (to relay traffic) and a client.
However, Lance James, founder of the New York City based cybersecurity consultancy Unit 221B and the original founder of I2P, told KrebsOnSecurity the entire I2P network now consists of between 15,000 and 20,000 devices on any given day.
An I2P user posted this graph on Feb. 10, showing tens of thousands of routers — mostly from the United States — suddenly attempting to join the network.
Benjamin Brundage is founder of Synthient, a startup that tracks proxy services and was the first to document Kimwolf’s unique spreading techniques. Brundage said the Kimwolf operator(s) have been trying to build a command and control network that can’t easily be taken down by security companies and network operators that are working together to combat the spread of the botnet.
Brundage said the people in control of Kimwolf have been experimenting with using I2P and a similar anonymity network — Tor — as a backup command and control network, although there have been no reports of widespread disruptions in the Tor network recently.
“I don’t think their goal is to take I2P down,” he said. “It’s more they’re looking for an alternative to keep the botnet stable in the face of takedown attempts.”
The Kimwolf botnet created challenges for Cloudflare late last year when it began instructing millions of infected devices to use Cloudflare’s domain name system (DNS) settings, causing control domains associated with Kimwolf to repeatedly usurp Amazon, Apple, Google and Microsoft in Cloudflare’s public ranking of the most frequently requested websites.
James said the I2P network is still operating at about half of its normal capacity, and that a new release is rolling out which should bring some stability improvements over the next week for users.
Meanwhile, Brundage said the good news is Kimwolf’s overlords appear to have quite recently alienated some of their more competent developers and operators, leading to a rookie mistake this past week that caused the botnet’s overall numbers to drop by more than 600,000 infected systems.
“It seems like they’re just testing stuff, like running experiments in production,” he said. “But the botnet’s numbers are dropping significantly now, and they don’t seem to know what they’re doing.”
In this blog post, we'll have a quick look at fake versions of Steam Desktop Authenticator (SDA), which is a "desktop implementation of Steam's mobile authenticator app".
Lava from SteamRep brought me to the attention of a fake version of SDA floating around, which may be attempting to steal your Steam credentials.
Indeed, there are some fake versions - we'll discuss two of them briefly.
Fake version #1
The first fake version can be found on steamdesktopauthenticator[.]com. Note that the site is live, and appears at the top of Google Search when searching for "Steam Desktop Authenticator".
Figure 1 - Fake SDA website
When downloading the ZIP file from the website, and unzipping it, we notice the exact same structure as you would when fetching the legitimate package - with one difference: the main executable has been modified.
Note that the current and real SDA version is 1.0.8.1, and its original file size is 1,444 KB - 2 bytes of difference can mean a lot. Figures 2 and 3 below show the differences.
Figure 2 - Sending credentials to steamdesktopauthenticator[.]com
Figure 3 - Sending credentials to steamdesktop[.]com
Indeed, it appears it also attempts to upload to another website - while digging a bit further, we can also observe an email address associated with the domains: mark.korolev.1990@bk[.]ru
While I was unable to immediately find a malicious fork with any of these domains, Mark has likely forked the original repository, made the changes - then deleted the fork. Another possibility is that the source was downloaded, and simply modified. However, it is more than likely the former option.
Fake version #2
This fake version was discovered while attempting to locate Mark's fork from the fake version above - here, we have indeed a malicious fork from GitHub, where trades/market actions appear to be intercepted, as shown in Figure 4 below.
Figure 4 - Malicious SDA fork (click to enhance)
Currently, when trying to access the malicious site lightalex[.]ru with a bogus token, a simple "OK" is returned - it is currently unknown whether market modifications would be successful.
Interestingly enough, when digging deeper on this particular domain, which is currently hosted on 91.227.16[.]31, it had hosted other SteamStealer malware before, for example cs-strike[.]ru and csgo-knives[.]net.
The malicious fork has been reported to GitHub.
Disinfection
Neither fake SDA versions reported here appear to implement any persistence, in other words; remove the fake version by deleting it, and perform a scan with your current antivirus and a scan with another, online antivirus, or with Malwarebytes for example.
Additionally, de-authorize all other devices by clicking here and select "Deauthorize all other devices".
Now, change your password for Steam, and enable Steam Guard if you have not yet done so.
Prevention
Prevention advise is the usual, extended advise is provided in a previous blog post here.
You may also want to take a look at SteamRep's Safe Trading Practices here.
SteamStealer malware is alive and well, as seen from my January blog post. This is again another form of attempting to scam users, and variations will continue to emerge.
Follow the prevention tips above or here to stay safe.
Login
