New by me - Microsoft Vibing.

[gossithedog@cyberplace.social]

New by me - Microsoft Vibing. A very strange fake open source project published by Microsoft employees, which gathers screenshots and voice recordings of users with unique machine identifiers attached. Not sure how this one has happened.

Just a moment...

(doublepulsar.com)

[fencepost@infosec.exchange]

@GossiTheDog WTF. Covertly uploading actual screenshots from systems it's installed on?

[gossithedog@cyberplace.social]

This Vibing one is a fun blog btw as every page it gets to be a bigger version of this

[gossithedog@cyberplace.social]

@fencepost yeah, when in use. It doesn't tell you it's going to do it... it just.. does.

[ralfmaximus@mastodon.social]

@GossiTheDog

Seriously don't know what to make of this. Rogue employees, sailing under the Microsoft flag? Fake employees?

The app itself is terrifying and stupid. I can easily imagine naïve users interested in AI installing this thing and forgetting about it.

[gossithedog@cyberplace.social]

@ralfmaximus as far as I know it's just lack of governance, people have realised they can skip the checks by just pretending it's open source

[jt_rebelo@ciberlandia.pt]

@GossiTheDog imagine if everyone knows, but it's under the "use AI an amount of hours/lines per day" carte-blanche...
@ralfmaximus

[rairii@labyrinth.zone]

@GossiTheDog@cyberplace.social for what it's worth, the package family name of this thing is YaoyaoChang.Vibing_ssp53fcyfr9ha - in my opinion it doesn't seem to look like anything "official", but rather an employee releasing it on their own partner center account?

[rootwyrm@weird.autos]

@GossiTheDog oh, it's pretty goddamn obvious exactly how this one happened.

See also: GitHub's official applications abruptly sprouting similar levels of spyware and calling it 'telemetry.'

[panjkov@mas.to]

@GossiTheDog I just reported it through Microsoft Store links. Let's see if anything comes out of it.

[systemadminihater@cyberplace.social]

@GossiTheDog There is no oversight at the company.

[panjkov@mas.to]

@GossiTheDog cc @shanselman

[gossithedog@cyberplace.social]

@Rairii the problem is the Azure front door is MSFT tenant.. and they're pretending it's not them I think?

[jukkan@mstdn.social]

@GossiTheDog Now that Microsoft has a 24/7 OpenClaw team in Oslo, I expect a lot more vibe artifacts appearing from within their network...
https://mstdn.social/@jukkan/116449605862675745

[layan2002@mastodon.social]

@GossiTheDog

[samir@mastodon.functional.computer]

@GossiTheDog At last, we can cut out the middleman and just put the malware authors in the OS company.

Sorry, Jia Tan, you’re out of a job.

[garretsidzaka@mastodon.social]

@GossiTheDog
WHAT THE HOLY HELL AM I READING!!??!!!?!!!??

[gossithedog@cyberplace.social]

@GarretSidzaka

[crazypedia@pagan.plus]

@GossiTheDog th- thats- it just... yikes

[gossithedog@cyberplace.social]

Since publishing my blog, Yaoyao Chang, who authored Vibing, has removed references to it from Microsoft’s VibeVoice repo - marking the change as “removing outdated links”. https://github.com/microsoft/VibeVoice/commit/e73d1e17c3754f046352014856a922f8208fb5d3