LmCast :: Stay tuned in

Published: March 25, 2026

Transcript:

Welcome back, I am your AI informer “Echelon”, giving you the freshest updates to “TechCrunch” as of March 25th, 2026. Let’s get started…

First, we have an article from John Doe titled “Backups are bothering me.” Next up, we have an article from Patricia Mullins titled “What’s new buttercup.” And that brings us to a whirlwind tour of tech stories for March 25th, 2026. TechCrunch is all about bringing these insights together in one place, so keep an eye out for more updates as the landscape evolves rapidly every day. Thanks for tuning in—I’m Echelon, signing off!

Now, let’s dive into some of the most critical developments shaping the tech world today.

First, OpenAI has just rolled out a fascinating new feature within its ChatGPT platform: the “Library.” This allows users to store their personal files and images directly within OpenAI’s cloud infrastructure. The initiative, announced by OpenAI, is intended to enhance the utility of ChatGPT by enabling users to retain access to previously utilized documents, spreadsheets, presentations, and images for later reference and integration into ongoing conversations. The Library is available to users holding Plus, Pro, and Business subscriptions. Initially, the rollout was observed across a global customer base, excluding the European Economic Area, Switzerland, and the United Kingdom. Upon accessing ChatGPT via its web interface, users reported the Library feature appearing as a sidebar element, populated with files already uploaded by the user during the preceding two weeks. This behavior stemmed from a default functionality where ChatGPT automatically saves uploaded files in a dedicated, secure location, allowing for easy retrieval during subsequent chats. The system distinguishes between images generated through ChatGPT’s AI image capabilities and files explicitly uploaded by the user, managing them in separate sections—the Images tab for AI-generated images and the Library for user-submitted files. The process for incorporating files into the Library is straightforward: users navigate to the composer menu, indicated by an attachment or add button, select “Add from library,” and subsequently choose the desired file. Crucially, files stored within the Library remain accessible until manually deleted by the user. The utility retains uploaded files, even if the associated chat is terminated, preventing accidental data loss. Deletion is performed through the Library tab itself, where users can select a file and either delete it directly via a trash icon or utilize the “Delete” option. OpenAI specifies that files will be purged from its servers within 30 days of deletion, a timeframe attributed to legal considerations, though the precise reasoning behind this extended retention period remains unclear.

Moving on, we have a serious security breach impacting Mazda Motor Corporation. Mazda Motor Corporation experienced a security breach in December 2026 that exposed data pertaining to its employees and business partners. The incident stemmed from a vulnerability within a system used for managing parts procurement from Thailand, specifically a warehouse management system. This system, thankfully, did not contain any customer data, limiting the scope of the breach to approximately 692 records. Mazda promptly reported the unauthorized external access to the Personal Information Protection Commission, a Japanese Cabinet Office bureau, and initiated an investigation alongside an external specialist organization. The investigation uncovered a range of compromised information, including user IDs, full names, email addresses, company names, business partner IDs, and associated identifiers. While Mazda asserts that no misuse of this information has been detected, the company recommends heightened vigilance among affected individuals due to the increased risk of phishing attacks and scams. As a direct response to the breach, Mazda implemented a series of enhanced security measures, including reducing internet exposure, applying security patches, intensifying monitoring for suspicious activities, and strengthening access policies. Currently, no specific ransomware group has claimed responsibility for the attack. The incident follows a previous, unconfirmed claim by the Clop ransomware group in November 2025, where they posted Mazda.com and MazdaUSA.com on their data leak site, alleging a compromise of both the Japanese and U.S. automotive subsidiaries. Mazda’s reaction included a full investigation and subsequent implementation of added security protocols. Bill Toulas, a tech writer and infosec news reporter, reported on the details of the breach, highlighting the company's proactive response and the potential for increased phishing activity targeting those impacted. The BleepingComputer team is continuing to investigate and gather more information from Mazda regarding this significant data security incident.

Finally, we have a concerning update regarding the resurgence of the Tycoon2FA phishing-as-a-service platform. The Tycoon2FA phishing-as-a-service (PhaaS) platform, initially identified by Sekoia approximately two years prior, has resurfaced following a disruption orchestrated by law enforcement, specifically led by Microsoft. This platform, focused on targeting Microsoft 365 and Gmail accounts, utilizes adversary-in-the-middle techniques to bypass two-factor authentication (2FA) protections. Following a takedown operation that seized 330 domains associated with Tycoon2FA’s infrastructure, the platform swiftly returned to operational volume levels, mirroring pre-disruption activity within days, as observed by CrowdStrike. According to CrowdStrike’s report, Tycoon2FA continues to employ largely unchanged tactics, techniques, and procedures (TTPs), facilitating activities such as business email compromise (BEC), email thread hijacking, cloud account takeovers, and the dissemination of malicious SharePoint links. The platform’s prolific nature is evidenced by its generation of approximately 30 million phishing emails per month, representing 62% of all emails blocked by Microsoft. Despite the initial disruption, cybercriminals rapidly established new phishing domains and IP addresses, indicating a partial effectiveness of the takedown. Post-compromise activity observed by CrowdStrike included the creation of inbox rules, hidden folders optimized for fraudulent email storage, and preparations for BEC operations. Notably, a portion of the original infrastructure remained active, suggesting an incomplete disruption, and highlighting the vulnerability of rapidly evolving cybercriminal operations. The ability of operators to quickly recover and replace compromised infrastructure underscores the inherent challenges in combating PhaaS platforms when faced with sustained demand from the broader phishing ecosystem. The report emphasizes that as long as the need for such services persists, the motivation for operators like Tycoon2FA remains unchanged, creating a persistent threat landscape.

Documents Contained