When Convenience Meets Surveillance - Inside the Privacy Backlash Over Meta's Smart Glasses
Introduction
Meta's bet that smart glasses will succeed the smartphone as the dominant personal computing device is, commercially, already paying off. EssilorLuxottica, the eyewear manufacturer that builds the Ray-Ban and Oakley Meta product lines, reported selling more than seven million pairs of AI-enabled glasses in 2025 alone, more than tripling the previous year's sales. Chief Executive Mark Zuckerberg has framed the shift as inevitable, comparing it in a recent interview to the transition from flip phones to smartphones and predicting that within a few years, eyewear without embedded AI will put its wearer at a disadvantage.
Yet as adoption accelerates, two features in various stages of internal testing have pulled Meta back into a familiar and uncomfortable position: at the centre of a privacy controversy over exactly how much a camera- and microphone-equipped wearable can quietly learn about the people around it.
NameTag and the return of facial recognition
In June 2026, the technology publication Wired reported that it had found dormant code for a facial-recognition system, internally called NameTag, embedded inside the Meta AI companion app that pairs with the company's smart glasses – an app that had by then been downloaded more than 50 million times. According to that reporting, the system relies on a pipeline of on-device AI models that detect a face, store it locally on the wearer's phone, and match it against previously saved "faceprints", alerting the wearer when it recognises someone they met before. Meta's Chief Technology Officer, Andrew Bosworth, has described the intended design as privacy-conscious: identification data would be encrypted locally, accessible only while the glasses are being worn, and would not populate a centralised company database. He has pitched the feature as a solution to the everyday difficulty of recalling names and past conversations.
Privacy researchers and advocacy groups have been considerably less reassured. One technologist with the Electronic Frontier Foundation’s Threat Lab who analysed the code concluded that despite having been deactivated, it appeared to be near-complete, and more recent reporting connected a portion of Meta’s facial recognition software licensing to Rank One Computing, a vendor that has also licensed similar tech to both U.S. law enforcement and military groups. Meta took the code down immediately after the story’s publication and claims no decision has been made regarding a public rollout.
"Super sensing" and always-on capture
A second, less publicised effort has drawn similar concern. The Financial Times reported in July 2026 that Meta is internally prototyping glasses, under the working concept "super-sensing", designed to capture ambient audio continuously and take still images every few seconds throughout the day, building a searchable log that a wearer's AI assistant could later query to recall where an item was left or what was discussed earlier. Notably, that reporting indicated Meta had discussed shipping the feature without activating the small LED indicator that currently signals when the glasses' camera is capturing photos or video the very light Meta had just reinforced against tampering on its existing hardware. Critics point out that the indicator is already a limited safeguard, since it is easily missed and unfamiliar to most bystanders; removing it during continuous, always-on capture would eliminate the one visible cue currently available to people nearby.
A pattern regulators are watching closely
Both features have emerged against a backdrop of substantial legal exposure. Meta has previously paid roughly two billion dollars combined in biometric-privacy settlements tied to earlier facial-recognition systems on Facebook, including $650 million under Illinois's Biometric Information Privacy Act and $1.4 billion to the state of Texas.
A separate class action filed in early 2026 alleges that footage captured by smart-glasses users, including intimate recordings from inside private homes, was reviewed by outside contractors in Kenya for AI-training purposes, a claim that prompted an inquiry from the United Kingdom's Information Commissioner's Office. The Texas Attorney General has opened its own civil investigation into the glasses' data practices. Because U.S. federal privacy law remains fragmented, enforcement of claims like these is likely to continue playing out state by state through statutes such as BIPA, which allow individuals to sue directly, even as the European Union's AI Act imposes separate restrictions on biometric processing within Europe.
Why this matters beyond Meta
For readers focused on cybersecurity and digital privacy, the common thread running through NameTag and super sensing is consent architecture. The smart glasses take in not just what you’re up to but also the location, face, clothes and conversation patterns of anyone within the glasses’ field of vision – all without their consent. Where raising a smartphone to take a photo leaves no ambiguity to nearby observers, glasses made to look like normal eyewear leaves fewer visual and verbal tells of what is actually occurring behind a set of seemingly average lenses. According to security experts and law professors, wiretap laws and the patchwork of existing statutes addressing biometric data aren't prepared for the kind of invisible monitoring that AI-enabled eyeglasses from Meta, and eventually others, are capable of. It's that imbalance between a technology’s unseen power and the limitations of the average person’s awareness that is sure to be the main source of conflict.
CyberPeace Insights
Wearable AI holds real promise for accessibility and everyday convenience, and Meta's continued investment reflects where personal computing is headed. At the same time, features like NameTag and "super-sensing" show why privacy-by-design must stay foundational, not incidental, as this space matures. The core issue isn't innovation itself but consent — ensuring bystanders retain visible, reliable cues when a device is active. Meta's stated moves toward on-device processing and encryption are worth acknowledging as steps in the right direction. CyberPeace believes continued dialogue between industry, regulators, and researchers, rather than adversarial scrutiny alone, is the surest path to public trust.
Conclusion
Meta maintains that both NameTag and Super Sensing remain unreleased and unconfirmed for commercial launch and are subject to further internal review. Executives have publicly disputed characterisations suggesting either feature is further along than the company has described. Even so, the recurring pattern of infrastructure for sensitive capabilities surfacing through independent reporting rather than company disclosure is what has kept privacy advocates, journalists, and regulators paying close attention. It suggests that as smart glasses move from novelty item to mass-market device, the terms of that transition will be shaped as much by courts, regulators, and public pressure as by Meta's own product roadmap.
References
- https://www.magzter.com/stories/newspaper/Mint-Mumbai/METAS-FLOOD-OF-SMARTGLASSES-HAS-PRIVACY-ADVOCATES-UP-IN-ARMS
- Engadget — Wired found code for an unreleased facial recognition feature in Meta's AI app
- Malwarebytes Labs — Meta's face-recognition code raises new concerns about smart glasses
- Kaspersky Daily — What's wrong with Meta's NameTag feature and why you should be wary of it
- Biometric Update — AI glasses reveal widening gap between Meta's privacy safeguards and AI ambitions
- Fortune — Meta added a privacy-safety feature to its AI glasses but is reportedly testing a 'super-sensing' prototype
- MacRumors — Meta's 'Super Sensing' Prototype Glasses Quietly Record Everything
- TechCrunch — Meta sued over AI smart glasses' privacy concerns, after workers reviewed nudity, sex, and other footage
Related Blogs
Introduction
Phishing as a Service (PhaaS) platform 'LabHost' has been a significant player in cybercrime targeting North American banks, particularly financial institutes in Canada. LabHost offers turnkey phishing kits, infrastructure for hosting pages, email content generation, and campaign overview services to cybercriminals in exchange for a monthly subscription. The platform's popularity surged after introducing custom phishing kits for Canadian banks in the first half of 2023.Fortra reports that LabHost has overtaken Frappo, cybercriminals' previous favorite PhaaS platform, and is now the primary driving force behind most phishing attacks targeting Canadian bank customers.
In the digital realm, where the barriers to entry for nefarious activities are crumbling, and the tools of the trade are being packaged and sold with the same customer service one might expect from a legitimate software company. This is the world of Phishing-as-a-Service (PhaaS), and at the forefront of this ominous trend is LabHost, a platform that has been instrumental in escalating attacks on North American banks, with a particular focus on Canadian financial institutions.
LabHost is not a newcomer to the cybercrime scene, but its ascent to infamy was catalyzed by the introduction of custom phishing kits tailored for Canadian banks in the first half of 2023. The platform operates on a subscription model, offering turnkey solutions that include phishing kits, infrastructure for hosting malicious pages, email content generation, and campaign overview services. For a monthly fee, cybercriminals are handed the keys to a kingdom of deception and theft.
Emergence of Labhost
The rise of LabHost has been meticulously chronicled by various cyber security firms which reports that LabHost has dethroned the previously favored PhaaS platform, Frappo. LabHost has become the primary driving force behind the majority of phishing attacks targeting customers of Canadian banks. Despite suffering a disruptive outage in early October 2023, LabHost has rebounded with vigor, orchestrating several hundreds of attacks per month.
Their investigation into LabHost's operations reveals a tiered membership system: Standard, Premium, and World, with monthly fees of $179, $249, and $300, respectively. Each tier offers an escalating scope of targets, from Canadian banks to 70 institutions worldwide, excluding North America. The phishing templates provided by LabHost are not limited to financial entities; they also encompass online services like Spotify, postal delivery services like DHL, and regional telecommunication service providers.
LabRat
The true ingenuity of LabHost lies in its integration with 'LabRat,' a real-time phishing management tool that enables cybercriminals to monitor and control an active phishing attack. This tool is a linchpin in man-in-the-middle style attacks, designed to capture two-factor authentication codes, validate credentials, and bypass additional security measures. In essence, LabRat is the puppeteer's strings, allowing the phisher to manipulate the attack with precision and evade the safeguards that are the bulwarks of our digital fortresses.
LabSend
In the aftermath of its October disruption, LabHost unveiled 'LabSend,' an SMS spamming tool that embeds links to LabHost phishing pages in text messages. This tool orchestrates a symphony of automated smishing campaigns, randomizing portions of text messages to slip past the vigilant eyes of spam detection systems. Once the SMS lure is cast, LabSend responds to victims with customizable message templates, a Machiavellian touch to an already insidious scheme.
The Proliferation of PhaaS
The proliferation of PhaaS platforms like LabHost, 'Greatness,' and 'RobinBanks' has democratized cybercrime, lowering the threshold for entry and enabling even the most unskilled hackers to launch sophisticated attacks. These platforms are the catalysts for an exponential increase in the pool of threat actors, thereby magnifying the impact of cybersecurity on a global scale.
The ease with which these services can be accessed and utilized belies the complexity and skill traditionally required to execute successful phishing campaigns. Stephanie Carruthers, who leads an IBM X-Force phishing research project, notes that crafting a single phishing email can consume upwards of 16 hours, not accounting for the time and resources needed to establish the infrastructure for sending the email and harvesting credentials.
PhaaS platforms like LabHost have commoditized this process, offering a buffet of malevolent tools that can be customized and deployed with a few clicks. The implications are stark: the security measures that businesses and individuals have come to rely on, such as multi-factor authentication (MFA), are no longer impenetrable. PhaaS platforms have engineered ways to circumvent these defenses, rendering them vulnerable to exploitation.
Emerging Cyber Defense
In the face of this escalating threat, a multi-faceted defense strategy is imperative. Cybersecurity solutions like SpamTitan employ advanced AI and machine learning to identify and block phishing threats, while end-user training platforms like SafeTitan provide ongoing education to help individuals recognize and respond to phishing attempts. However, with phishing kits now capable of bypassing MFA,it is clear that more robust solutions, such as phishing-resistant MFA based on FIDO/WebAuthn authentication or Public Key Infrastructure (PKI), are necessary to thwart these advanced attacks.
Conclusion
The emergence of PhaaS platforms represents a significant shift in the landscape of cybercrime, one that requires a vigilant and sophisticated response. As we navigate this treacherous terrain, it is incumbent upon us to fortify our defenses, educate our users, and remain ever-watchful of the evolving tactics of cyber adversaries.
References
- https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/labhost-cybercrime-service-lets-anyone-phish-canadian-bank-users/amp/
- https://www.techtimes.com/articles/302130/20240228/phishing-platform-labhost-allows-cybercriminals-target-banks-canada.htm
- https://www.spamtitan.com/blog/phishing-as-a-service-threat/
- https://timesofindia.indiatimes.com/gadgets-news/five-government-provided-botnet-and-malware-cleaning-tools/articleshow/107951686.cms
Executive Summary:
A widely circulated claim on social media, including a post from the official X account of Pakistan, alleges that the Pakistan Air Force (PAF) carried out an airstrike on India, supported by a viral video. However, according to our research, the video used in these posts is actually footage from the video game Arma-3 and has no connection to any real-world military operation. The use of such misleading content contributes to the spread of false narratives about a conflict between India and Pakistan and has the potential to create unnecessary fear and confusion among the public.
Claim:
Viral social media posts, including the official Government of Pakistan X handle, claims that the PAF launched a successful airstrike against Indian military targets. The footage accompanying the claim shows jets firing missiles and explosions on the ground. The video is presented as recent and factual evidence of heightened military tensions.
Fact Check:
As per our research using reverse image search, the videos circulating online that claim to show Pakistan launching an attack on India under the name 'Operation Sindoor' are misleading. There is no credible evidence or reliable reporting to support the existence of any such operation. The Press Information Bureau (PIB) has also verified that the video being shared is false and misleading. During our research, we also came across footage from the video game Arma-3 on YouTube, which appears to have been repurposed to create the illusion of a real military conflict. This strongly indicates that fictional content is being used to propagate a false narrative. The likely intention behind this misinformation is to spread fear and confusion by portraying a conflict that never actually took place.
Conclusion:
It is true to say that Pakistan is using the widely shared misinformation videos to attack India with false information. There is no reliable evidence to support the claim, and the videos are misleading and irrelevant. Such false information must be stopped right away because it has the potential to cause needless panic. No such operation is occurring, according to authorities and fact-checking groups.
- Claim: Viral social media posts claim PAF attack on India
- Claimed On: Social Media
- Fact Check: False and Misleading
Executive Summary
A video showing a flyover collapse is going viral on social media. The clip shows a flyover and a road passing beneath it, with vehicles moving normally. Suddenly, a portion of the flyover appears to collapse and fall onto the road below, with some vehicles seemingly coming under its impact. The video has been widely shared by users online. However, research by the CyberPeace found the viral claim to be false. The probe revealed that the video is not real but has been created using artificial intelligence.
Claim:
On X (formerly Twitter), a user shared the viral video on February 13, 2026, claiming it showed the reality of India’s infrastructure development and criticizing ongoing projects. The post quickly gained traction, with several users sharing it as a real incident. Similarly, another user shared the same video on Facebook on February 13, 2026, making a similar claim.
Fact Check:
To verify the claim, key frames from the viral video were extracted and searched using Google Lens. During the search, the video was traced to an account named “sphereofai” on Instagram, where it had been posted on February 9. The post included hashtags such as “AI Creator” and “AI Generated,” clearly indicating that the video was created using AI. Further examination of the account showed that the user identifies themselves as an AI content creator.
To confirm the findings, the viral video was also analysed using Hive Moderation. The tool’s analysis suggested a 99 percent probability that the video was AI-generated.
Conclusion:
The research established that the viral flyover collapse video is not authentic. It is an AI-generated clip being circulated online with misleading claims.
