News

• Researchers find 245 extensions installed on nearly a million devices
• The extensions could turn devices into web scraping bots for a commercial service
• Researchers warned about major security implications

A new investigation has revealed 245 browser extensions, installed on almost a million devices, have been leading a double life, as besides the operations they were designed for, they were also silently disabling key security protections in the browsers to enable paid web scraping operations.

This is according to security researcher John Tuckner from Security Annex, who found numerous extensions doing different things, from managing bookmarks, to boosting speaker volume. All of them embed a JavaScript library called MellowTel-js, which connects to an external AWS server and collects data about the user’s location, bandwidth, and browser status.

It also injects hidden iframes into the web pages users are visiting, and then loads other websites, chosen by MellowTel’s infrastructure. Furthermore, it strips web security headers, bypasses bot detection, and ultimately - shares bandwidth for profit.

The JavaScript is tied to a company named Olostep, which promotes itself as a high-performance web scraping API that bypasses bot detection and can send out up to 100,000 parallel requests.

When paying clients submit a target website, Olostep uses the devices running affected extensions to scrape the site, effectively turning the browsers into distributed scraping bots, without the end users’ knowledge, or consent.

Ars Technica found MellowTel’s founder said the library was designed to share user bandwidth without stuffing affiliate links, unrelated ads, or collecting personal data.

“The primary reason why companies are paying for the traffic is to access publicly available data from websites in a reliable and cost-effective way,” he was cited saying, adding that extension developers receive 55%of the revenue, while the rest went to MellowTel.

Despite claims of a privacy-friendly way to monetize unused bandwidth, critics argue it exposes users to serious privacy and security risks, especially in enterprise environments. In its writeup, CyberInsider says the scale and architecture of the system makes it “ripe for abuse” by threat actors.

“The use of real browser sessions, potentially behind corporate VPNs or inside private networks, introduces profound risks. These include the potential for unauthorized internal resource access, impersonation of legitimate traffic, and degradation of browser security due to the removal of enforced headers.”

Some extensions have been removed or deactivated after being flagged for malware, while others cleaned up the controversial code in recent updates. Many remain active, and users are advised to review the full list of extensions found here.

• Malicious Google Chrome and Edge extensions downloaded more than 2 million times - here's how to stay safe from being tracked online
• Take a look at our guide to the best authenticator app
• We've rounded up the best password managers

• The drive covered St. Moritz to Munich without a single charging stop
• Journey included roads, highways, and secondary roads
• Attempt bettered the previous record by almost 100 miles

Lucid now has an official Guinness World Records trophy to add to its cabinet, as its Air Grand Touring model just managed to complete just under 749 miles on a single charge while traveling on public roads.

The record-breaking journey started in St. Moritz, Switzerland and finished in Munich, Germany, with the trip taking in winding mountain passes, fast highway sections and narrow secondary roads in a true display of real-world range.

Lucid is already considered one of the leading figures in electric vehicle efficiency, with the Air Grand Touring boasting an official WLTP (Worldwide Harmonized Light Vehicle Test Procedure) range of 960km (596 miles), yet it still manages to deliver some 831hp and a top speed of almost 170mph.

London-based entrepreneur, hyper-miling legend and owner of the world's strongest bladder, Umit Sabanci, was behind the wheel for this attempt, having previously set a Guinness World Record for the most countries visited on a single charge in a production battery electric vehicle, crossing nine countries back in 2024.

Lucid set another @GWR title for the history books.Together with @Umit_Sabanci, we have officially set a new Guinness World Records title for the longest journey by an electric car on a single charge. The Lucid Air Grand Touring covered an astonishing 1,205 kilometers (~ 749… pic.twitter.com/2LeayLnjgcJuly 8, 2025

Lucid claims that Sabanci’s endeavor beat the previous record by around 100 miles and added a mind-boggling 237 miles to the vehicle’s official WLTP range.

This was made possible by some very sensible driving, but also by some clever route selection, with the journey effectively beginning at the top of The Alps and ending a good 4,300ft lower in Munich.

Heavy use of regenerative braking would have helped keep the monster 112kWh batteries brimmed. Although Lucid is keen to point out that its charging technology can add an impressive 248 miles of range in just 16 minutes from the appropriate fast charging outlet, for those not keen on traveling almost 750 miles in one hit.

The US electric vehicle maker clearly used some clever route-planning to achieve this record-breaking feat, but nothing should be taken away from the company’s dedication to EV performance and efficiency.

Lucid is one of the few to engineer and produce most of its powertrain components, with a laser focus on creating an aerodynamic vehicle that is as light and efficient as possible.

The Air Pure, for example, was one of the first EVs to boast an enviable energy efficiency rating of 5 miles per kWh – you’ll be lucky if you get over 3 miles per kWh in most modern electric cars.

However, this technology is currently reserved for the wealthiest in society, with prices of the Air ranging from $69,900 to over $169,000 in the US.

The company has stated that it plans to produce a more affordable version of its $79,900 (around £59,000 / AU$121,000) Gravity SUV in the near future, which will be based on a new midsize platform and will deliver the same sort of range as competitors, but with a much smaller battery.

This will allow it to compete with the likes of Tesla, offering the Lucid’s renowned efficiencies at a fraction of the current line-up’s price.

• I'm ditching Waze for in-car infotainment systems in EVs – here's why
• Huawei says its new solid-state EV battery can give you 1,800 miles of range and charge in less than 5 minutes, but we have questions
• Apple CarPlay Ultra stalls as these 5 car giants have reportedly decided to U-turn

Microsoft Outlook is recovering after a major outage affected users around the world.

Outage reports began to spike for the widely-used email provider earlier today, with Microsoft confirming an issue not long after.

After several hours, the outage now seems to be ending, but here's everything we know so far...

• Check out the best secure email providers as well

Microsoft Outlook appears to be suffering a significant outage, with users across the world unable to access the platform.

Outage reports began to surface a few minutes ago, with Outlook.com apparently unavailable.

That's quite the spike in outage reports, courtesy of DownDetector.com!

So what has Microsoft said so far?

Its official status platform confirms there is an issue with Outlook.com, so at least the company is aware of the issue.

"Users may be unable to access their mailbox using any connection methods," the page says.

"We're continuing to apply the configuration changes to fix the underlying problem and completing additional validation efforts to ensure authentication components are properly configured. In parallel to the current deployment of the configuration change fix, we're reviewing options to leverage an expedited deployment methodology in regions which are experiencing the highest levels of impact to provide the most effective relief where possible."

It adds impacted connection methods include, but may not be limited to:

- Outlook.com

- Outlook Mobile

- Outlook desktop client

For anyone trying alternate ways to try and log in to Outlook, it's worth noting Microsoft saying the outage affects the platform on web, mobile and desktop - so you might be out of luck!

This outage comes just as the East Coast of the US clocks in for the day, so it could mean a disrupted start for workers...

It's interesting to note Microsoft has yet to update its official Outlook, Windows and Microsoft accounts on X.

Reports of Microsoft Outlook going down first appeared more than 12 hours ago - but there's still nothing...

However the Microsoft Outlook Twitter account hasn't actually posted since June 11, so it may be that it's not active any more anyways!

As we try to find out more - here's some thoughts from Desire Athow, Managing Editor here at TechRadar Pro...

"Microsoft says that its Outlook desktop client, the popular Microsoft email client that is usually bundled with Microsoft 365 (formerly known as Office 365), is also down, which is a bit of a surprise. No other Microsoft products are currently impacted by the downtime which leaves me to believe that it may be something to do with the email middleware itself rather than a more widespread data center infrastructure."

An update from Microsoft from its official status page - where the outage has now been upgraded from a "warning" to an official issues;

"We're continuing to apply the configuration changes to fix the underlying problem and completing additional validation efforts to ensure authentication components are properly configured. In parallel to the current deployment of the configuration change fix, we're reviewing options to leverage an expedited deployment methodology in regions which are experiencing the highest levels of impact to provide the most effective relief where possible."

Microsoft has promised another update by 4.30pm UTC - so in about an hour's time - but while it works, outage reports keep on rising.

We've spotted the official Microsoft 365 Status Twitter feed is providing much more information on the outage - here's what it has to say...

We're currently investigating an issue impacting https://t.co/yThFCaxMLE. Please see our service health page for further details: https://t.co/48OL20htnj.July 10, 2025

We're now entering the second hour of the outage, and it seems thousands of users are still unable to access Outlook.com, on web and mobile.

There's no concrete updates from Microsoft - so we're sitting and waiting to see how this will go.

If you're just joining us - a quick recap...

Users have been complaining about a major outage in Outlook for the last few hours - coinciding with the start of the working day in the US.

The outage affects Outlook on web and mobile, and has been going on for some time - Microsoft says it is working on a fix, but outage reports remain high.

We may finally be reaching a turning point - nearly three hours in, and outage reports are finally beginning to drop at last.

There's still no further comment from Microsoft, but this could be the beginning of the end (we hope)...

Here we are - Microsoft thinks it has finally fixed the issue at last! Anyone affected should be seeing a solution soon, we hope.

Our configuration changes have effectively resolved impact in targeted infrastructure. We’re now deploying the changes worldwide to resolve impact for all users. For more information, please see https://t.co/j9reNyhJlq.July 10, 2025

Outage reports are falling fast on DownDetector, so this is likely the end of the issues.

We're going to stay tracking for a little while longer, but Microsoft says users and admins should now be able to continue operating as normal.

One final update from Microsoft - for admins this time.

Impacted Enterprise admins can also access updates and additional information on this issue by viewing EX1112414 in the Microsoft 365 admin center.July 10, 2025