Amazon’s Ad Auctions Face New Claims, Plus 3 Stories
The Amazon ad auction lawsuit now includes newly unsealed allegations about what advertisers actually paid for sponsored placements. Also today: every Chainalysis user is being told to reset credentials after a breach, a malformed Android app can trap some phones in a crash loop, and fake AI-event invitations are stealing work accounts.
Amazon accused of quietly raising the floor in ad auctions
The Federal Trade Commission and 22 states have unsealed more of their case against Amazon’s sponsored-ad business. The central allegation isn’t that Amazon charged an advertiser more than the maximum bid it entered. It’s that Amazon secretly changed the amount the winner had to pay, while telling advertisers its auction worked differently.
That distinction matters. Amazon describes its sponsored ads as a second-price auction. In the simple version, the winner doesn’t pay its full bid. It pays roughly enough to beat the next-highest qualifying bidder. A reserve price is a floor below which the ad won’t sell. The government alleges Amazon used a system called Project Nessie to set what it called a “soft reserve” after seeing the bids, then charged the winner more than the next-highest bid would have required.
According to the redacted complaint, the change raised prices by as much as 50% on ordinary days and as much as 250% during major shopping events. The FTC says average cost per click rose about 20% in a 2021 test, with some advertisers paying more than twice as much, and that the system produced about $87 million in additional revenue in 2022. Those are allegations, not findings by a court.
Amazon disputes the case. It says advertisers never paid more than their bids, cost per click was roughly flat from 2019 through 2024 after adjusting for inflation, conversion improved 24%, and advertisers saved an estimated $8 billion because relevance controls kept lower-quality ads from winning. Amazon also says reserve prices are normal in ad auctions.
I don’t think “you never paid more than your bid” answers the disclosure question. A maximum bid is a ceiling, not permission to invent any price beneath it. At the same time, a campaign can still deliver acceptable results even if the auction mechanics weren’t explained honestly. Small retailers shouldn’t assume a refund is coming. They should preserve campaign reports, compare holiday cost per click and return on ad spend with ordinary periods, and watch what the evidence shows as the case moves forward.
Ecommerce development
A good ecommerce site has to work in front of the homepage and behind it. Raymond Tec designs and builds ecommerce sites on Shopify, WooCommerce, Magento / Adobe Commerce, BigCommerce, and other major platforms — including the storefront, product catalogs, inventory, navigation, integrations, fulfillment workflows, and the machinery customers hopefully never have to think about.
Chainalysis says every user’s credentials were exposed
Chainalysis has expanded its account of an October 30 security incident. The blockchain-analysis company now says password hashes and active authentication tokens for all users were exposed. Some customers of its Know Your Transaction service may also have had their accounts accessed. Chainalysis says it has found no evidence that investigation data was reached or that anyone altered transaction-attribution data.
A password hash isn’t the password itself. It’s a mathematical result used to check a password without storing the original, but an attacker can still test guesses against a stolen hash offline. A live token can be more immediately useful because it may work like an already-issued visitor badge until the service revokes it. Chainalysis also says an on-path attack exposed a subset of actual passwords, meaning the attacker intercepted data while it was moving between systems.
The company took services offline and began a phased restoration early Friday. Users must reset passwords and rotate API keys as access returns, and affected organizations should revoke old sessions and check for unfamiliar logins or API activity. As with the mSecure exposure covered in Thursday’s brief, the credential type changes the response: changing a password won’t invalidate every API key or session token unless the service does that separately.
Chainalysis called the intrusion an “agentic cyberattack,” but hasn’t explained which automated techniques it means. That phrase may describe useful evidence, or it may be a fashionable label pasted onto ordinary attacker automation. Until the company publishes the mechanism, it shouldn’t be treated as proof that an autonomous AI system carried out the breach.
Business IT goes well beyond the website
Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.
A malformed Android app can cause a persistent crash loop
Bitdefender has documented a flaw it calls GhostMap. A specially malformed Android application package, or APK, can make Android’s core package service repeatedly crash during installation. The app doesn’t need to open, request permission, or run malicious code. Bitdefender reproduced the problem on Android 10 through Android 17.
The damage comes from different parts of Android interpreting the broken ZIP metadata differently. Once the package service gets stuck processing it, even safe mode may not help because the failure is in a system component. Recovery can require a factory reset, although a technically prepared user may sometimes remove the package through Android Debug Bridge during a narrow window.
This is serious, but it isn’t a reason for ordinary Play Store users to panic. Bitdefender hasn’t seen the destructive version used in attacks, and Google told the researchers it didn’t consider the report suitable for a security update, referring it to the product team instead. The practical defense is still plain: don’t install APKs from unknown sources, and keep a current backup if sideloading is part of your work.
Technology is rarely just about the technology
Some of the most important technology stories aren’t product launches at all. They’re about health, privacy, education, law, accessibility, work, and what happens when technology reaches ordinary people. Browse more Raymond Tec News for the stories worth understanding without the hype.
Fake AI events are bypassing familiar MFA habits
Push Security is tracking fake invitations for supposed OpenAI, SpaceX, and Anthropic events. The pages are polished enough to get someone thinking about the event instead of the login. That’s the whole trick.
For Microsoft accounts, one path uses device-code phishing: the victim enters a code on Microsoft’s real site, but the code belongs to a session the attacker started. Another uses an adversary-in-the-middle proxy that relays the real login page and captures the password, MFA response, and resulting session cookie. Google Workspace users are being targeted with the proxy method too.
MFA isn’t broken here. The attacker is persuading the user to authorize the wrong session, or stealing the cookie issued after a correct login. Don’t enter a device code because an invitation tells you to. Find the event through the company’s official site, and use phishing-resistant passkeys or hardware security keys where the account supports them. If someone already completed one of these flows, changing the password is only the start. An administrator should revoke active sessions and review new devices, application permissions, and sign-in records.
Keeping a website running is its own job. Raymond Tec provides website security and maintenance, including updates, backups, monitoring, access cleanup, recovery planning, and help when something has already gone sideways.
Sources and further reading
- FTC: Newly unsealed Amazon Ads allegations
- FTC and states: Redacted complaint against Amazon
- Amazon: Response to the sponsored-ads lawsuit
- Chainalysis: October 30 security incident updates
- The Record: Chainalysis says all users were affected
- Bitdefender Labs: GhostMap Android analysis
- Push Security: Fake AI-event campaign analysis
- BleepingComputer: Fake events target Microsoft and Google accounts
Photo by Diggity Marketing on Unsplash.
