Tag: Cybercrime

Fake error popups are spreading malware fast

[ad_1]

NEWYou can now listen to Fox News articles!

A dangerous cybercrime tool has surfaced in underground forums, making it far easier for attackers to spread malware.

Instead of relying on hidden downloads, this tool pushes fake error messages that pressure you into fixing problems that never existed. Security researchers say this method is spreading quickly because it feels legitimate. The page looks broken. The warning feels urgent. The fix sounds simple.

That combination is proving alarmingly effective for cybercriminals.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

How fake error malware attacks actually work

These attacks begin with a compromised website. When a visitor lands on the page, something looks wrong right away. Text appears broken. Fonts look scrambled. Visual elements seem corrupted. A pop-up then appears claiming the issue can be fixed with a browser update or a missing system font. A button offers to repair the problem instantly.

Clicking that button copies a command to the clipboard and displays instructions to paste it into PowerShell or a system terminal. That single step launches the infection.

MALICIOUS CHROME EXTENSIONS CAUGHT STEALING SENSITIVE DATA

Fake error popups make a website look broken by scrambling text or fonts to create urgency and panic. (Jens Büttner/picture alliance via Getty Images)

Why this new tool changes the threat landscape

The tool behind these attacks is called ErrTraffic. It automates the entire process and removes the technical barriers that once limited cybercrime operations. For about $800, attackers get a full package with a control panel and scripted payload delivery. Analysts at the Hudson Rock Threat Intelligence Team identified the tool after tracking its promotion on Russian-language forums in early December 2025.

ErrTraffic works through a simple JavaScript injection. A single line of code connects a hacked site to the attacker’s dashboard. From there, everything adapts automatically. The script detects the operating system and browser. It then displays a customized fake error message in the correct language. The attack works across Windows, Android, macOS and Linux.

MOST PARKED DOMAINS NOW PUSH SCAMS AND MALWARE

The popups often claim a browser update or missing system font is needed to fix the problem. (Daniel Acker/Bloomberg via Getty Images)

Why security software struggles to stop it

Traditional malware defenses look for suspicious downloads or unauthorized installations. ErrTraffic avoids both. Browsers see normal text copying. Security tools see a legitimate system utility being opened manually. Nothing appears out of place. That design allows the attack to slip through protections that would normally stop malware in its tracks.

The success rate is deeply concerning

Data pulled from active ErrTraffic campaigns shows conversion rates approaching 60%. That means more than half of the visitors who see the fake error message follow the instructions and install malware. Once active, the tool can deliver infostealers like Lumma or Vidar on Windows devices. Android targets often receive banking trojans instead. The control panel even includes geographic filtering, with built-in blocks for Russia and neighboring regions to avoid drawing attention from local authorities.

What happens after infection?

Once malware is installed, credentials and session data are stolen. Those compromised logins are then used to breach additional websites. Each newly hacked site becomes another delivery vehicle for the same attack. That cycle allows the campaign to grow without direct involvement from the original operator.

FAKE WINDOWS UPDATE PUSHES MALWARE IN NEW CLICKFIX ATTACK

Following the on-screen instructions can quietly trigger malware that steals passwords and personal data. (Kurt Knutsson)

Ways to stay safe from fake error malware

A few smart habits can significantly reduce risk when facing fake error pop-ups and browser-based traps.

1) Never run commands suggested by a website

Legitimate websites never ask you to copy and paste commands into PowerShell or a system terminal. Fake error malware relies on convincing messages that pressure you into doing exactly that. If a page instructs you to run code to fix a problem, close it immediately.

2) Close pages that claim your system is corrupted

Fake error campaigns often use broken text, scrambled fonts or warnings about missing files to grab attention. As a result, these visuals create urgency and trigger fear. In reality, a real system problem never announces itself through a random website, so close the page right away.

3) Install updates only through official system settings

Real browser and operating system updates come from built-in update tools, not pop-ups on websites. If an update is needed, your device will notify you directly through system settings or trusted app stores.

4) Install strong antivirus software on every device

Strong antivirus software can help block malicious scripts, detect infostealers and stop suspicious behavior before damage spreads. This is especially important since fake error malware targets Windows, Android, macOS and Linux systems.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

5) Use a data removal service to reduce exposure

Stolen credentials fuel the spread of fake error malware. Removing personal information from data broker sites can reduce the impact if login details are compromised and limit how far an attack can spread.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

6) Treat font and browser update pop-ups with suspicion

Claims about missing fonts or outdated browsers are a hallmark of these attacks. Modern systems manage fonts automatically, and browsers update themselves. A webpage has no reason to request manual fixes.

If a real update is needed, the operating system will request it directly. A random webpage never should.

Kurt’s key takeaways

Fake error malware works because it plays on a very human reaction. When something on a screen suddenly looks broken, most people want to fix it fast and move on. That split-second decision is exactly what attackers are counting on. Tools like ErrTraffic show how polished these scams have become. The messages look professional. The instructions feel routine. Nothing about the moment screams danger. But behind the scenes, one click can quietly hand over passwords, banking access and personal data. The good news is that slowing down makes a real difference. Closing a suspicious page and trusting built-in system updates can stop these attacks cold. When it comes to pop-ups claiming your device is broken, walking away is often the smartest fix.

Have you ever seen a pop-up or error message that made you stop and wonder if it was real? Tell us what it looked like and how you handled it by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

[ad_2]

Source link

January 7, 2026
Browser extension malware infected 8.8M users in DarkSpectre attack
[ad_1]
NEWYou can now listen to Fox News articles!

Browser extensions promise convenience. Many offer simple tools like new tab pages, translators or video helpers.

Researchers, however, uncovered a long-running malware operation that abused that trust on a massive scale. Koi Security analysts identified the threat while analyzing suspicious infrastructure tied to a campaign known as ShadyPanda. What started as one investigation quickly revealed something far larger.

The group behind it is now known as DarkSpectre. According to Koi researchers, it infected more than 8.8 million users across Chrome, Edge and Firefox over seven years. This was not a smash-and-grab attack. It was slow, deliberate and highly organized. Instead of rushing malicious code into marketplaces, the group played the long game.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

MALICIOUS CHROME EXTENSIONS CAUGHT STEALING SENSITIVE DATA

Security researchers say millions of users unknowingly installed browser extensions that later turned malicious after years of appearing legitimate. (Donato Fasano/Getty Images)

One threat actor behind three major campaigns

At first, the activity looked like separate threats. That changed once Koi analysts followed the infrastructure breadcrumbs. By pivoting from domains linked to ShadyPanda, Koi researchers uncovered shared systems powering multiple extension clusters. That analysis confirmed that ShadyPanda, GhostPoster and Zoom Stealer were not separate actors. They were one coordinated operation. Together, these campaigns targeted both everyday users and corporate environments.

ShadyPanda

This campaign focused on mass surveillance and affiliate fraud. Researchers estimate it affected more than 4 million users, with some analyses suggesting the total could reach up to 5.6 million as additional related extensions were linked. In several cases, extensions remained legitimate for more than five years before quietly turning malicious.

GhostPoster

This campaign used a clever trick. It hid malicious code inside image files to bypass security checks. It impacted 1.05 million users.

Zoom Stealer

This operation targeted corporate meeting data across more than 28 conferencing platforms. It affected 2.2 million users.

Different goals. Same operator.

How Koi uncovered DarkSpectre’s hidden network

The breakthrough came when Koi analysts examined two domains tied to ShadyPanda. Those domains powered legitimate extension features like weather widgets and new tab pages. They were not command servers. That was the trick. Those same clean domains appeared again and again across other extensions that quietly connected to entirely different malicious infrastructure.

One domain led to extensions. Those extensions exposed new domains. Those domains were connected to even more extensions. Following that chain allowed Koi to uncover over 100 connected extensions across multiple browser marketplaces. Some extensions even reused infrastructure already flagged in earlier investigations. That overlap confirmed DarkSpectre was operating at a nation-state scale.

How DarkSpectre stayed hidden for years

DarkSpectre succeeded by blending legitimate functionality with hidden malware. Users got what they expected. Meanwhile, the threat ran quietly in the background.

Time-delayed activation fooled reviewers

Some extensions waited days before activating malicious behavior. Others triggered malware on only a small percentage of page loads. This made detection during marketplace reviews extremely difficult.

Malicious code disguised as images

The group hid JavaScript inside PNG image files. The extension loaded its own logo, extracted the hidden code and executed it silently.

No updates required

Instead of pushing new extension versions, DarkSpectre controlled everything from its servers. Operators could change behavior anytime without alerting users or marketplaces. Koi researchers noted this approach gave the attackers long-term flexibility and control.

Why the Zoom Stealer campaign stands out

Most malware focuses on consumer fraud. Zoom Stealer focused on intelligence.

According to Koi analysts, these extensions collected the following:
- Meeting links with embedded passwords
- Meeting IDs, topics and schedules
- Speaker names, titles, bios and photos
- Company affiliations and branding
Worse yet, the data streamed in real time. The moment a user joined or viewed a meeting, the information flowed out. This type of data enables phishing impersonation and corporate espionage at scale.

Why browser extensions remain a weak link

Extension marketplaces typically evaluate code only at submission or update. Koi’s investigation shows how attackers exploit that model. Once an extension earns trust badges and positive reviews, users stop questioning it. That trust becomes a weapon. A clean extension today can become a threat tomorrow.

Ways to stay safe from malicious browser extensions

You do not need to avoid extensions entirely. You do need to stay cautious.

1) Keep your browser up-to-date

Make sure you turn on automatic updates for your browser (e.g., Chrome, Firefox, Edge) so you’re always running the latest version without thinking about it.

2) Review your installed extensions

Remove anything you no longer use. Fewer extensions reduce risk. CyberGuy has step-by-step guides showing how to review and remove browser extensions safely, making it easy to clean up your browser in just a few minutes. In Chrome, Edge and Firefox, open the menu, go to Extensions or Add-ons, and remove anything you do not use or trust.

3) Install extensions only from trusted sources

Official browser stores like the Chrome Web Store have rules and scans to catch bad actors. They’re not perfect, but they are still a better option when compared to a random website on the internet. Extensions from unknown websites or third-party downloads are far more likely to hide malware or spyware.

FAKE AI CHAT RESULTS ARE SPREADING DANGEROUS MAC MALWARE

A long-running malware operation quietly abused trusted browser extensions across Chrome, Edge and Firefox, infecting millions worldwide. (Morteza Nikoubazl/NurPhoto via Getty Images)

4) Have strong antivirus software

Strong antivirus software can warn you before you install malicious software, such as sketchy browser extensions. It can also alert you to phishing emails and ransomware scams, helping keep your personal information and digital assets safe.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

5) Invest in personal data removal services

If your personal data was exposed in this security incident, it’s crucial to act quickly to reduce your risk of identity theft and scams. A data removal service can help you remove all this personal information from the internet.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites.

It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

6) Be skeptical of extensions requesting unnecessary access

Some extensions overreach on purpose. A calculator tool asking for your browsing history or a weather app wanting your login data is a huge red flag. Before installing, ask: “Does this permission match the extension’s job?” If the answer’s no, don’t install it. Watch out for broad permissions like “Read and change all your data on websites you visit” unless it’s clearly justified (e.g., a password manager). If an update suddenly adds new permission requests, dig into why. It might mean the extension’s been sold or hacked.

7) Change your passwords — and do it safely

If you’ve ever saved passwords in your browser (e.g., via the browser’s built-in password manager or the “Save Password” prompt), those credentials could be at risk if a malicious extension was installed. These built-in managers store passwords locally or in your Google, Microsoft or Firefox account, and a compromised browser can give bad actors a way in.

This doesn’t typically apply to dedicated password manager extensions, which encrypt your data independently and don’t rely on browser storage. However, if you’re unsure whether an extension has been compromised, it’s always smart to update your master password and enable two-factor authentication.

For maximum safety, change your most important passwords (email, bank, shopping, cloud services) from a different, secure device, such as your phone or another computer where the questionable extension was never installed. Avoid using the same browser that may have been exposed. Then, consider switching to a password manager to create and store strong, unique logins going forward.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

10 SIMPLE CYBERSECURITY RESOLUTIONS FOR A SAFER 2026

Analysts uncovered a coordinated campaign that hid spyware inside everyday browser tools like new tab pages and translators. (Morteza Nikoubazl/NurPhoto via Getty Images)

8) Watch for behavior changes

Subtle changes often appear before obvious damage. Sudden redirects, new tabs opening on their own, unfamiliar search results, popups, slower browsing or websites asking you to re-log in unexpectedly can all signal a malicious or compromised extension. Pay attention if ads appear where they never did before or if your browser settings change without your input.

Koi’s investigation shows how attackers rely on patience. Once an extension earns trust and sits quietly for years, users stop watching it. That makes small behavior changes easy to miss. If something feels off, do not ignore it. Disable extensions one by one to identify the culprit. If the issue disappears, remove that extension permanently.

When in doubt, trust your instincts. Browsers should not surprise you.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaways

DarkSpectre is a reminder that online threats are getting smarter and quieter. This was not a smash-and-grab attack. It unfolded slowly, over years, and relied on trust most people never think twice about. Koi analysts connected the dots by tracking shared infrastructure across campaigns, but they also warn that some sleeper extensions may still be installed and trusted today. Browser extensions can be helpful, but every extra add-on is another door into your browser. Paying attention, cleaning house now and then, and questioning what you install can make a real difference.

When was the last time you checked what your browser extensions are really doing behind the scenes? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.
[ad_2]

Source link
January 6, 2026
Malicious Chrome extensions caught stealing sensitive data
[ad_1]
NEWYou can now listen to Fox News articles!

Chrome extensions are supposed to make your browser more useful, but they’ve quietly become one of the easiest ways for attackers to spy on what you do online. Security researchers recently uncovered two Chrome extensions that have been doing exactly that for years.

These extensions looked like harmless proxy tools, but behind the scenes, they were hijacking traffic and stealing sensitive data from users who trusted them. What makes this case worse is where these extensions were found. Both were listed on Chrome’s official extension marketplace.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

FAKE AI CHAT RESULTS ARE SPREADING DANGEROUS MAC MALWARE

Security researchers uncovered malicious Chrome extensions that quietly routed users’ web traffic through attacker-controlled servers to steal sensitive data. (Gokhan Balci/Anadolu Agency/Getty Images)

Malicious Chrome extensions hiding in plain sight

Researchers at Socket discovered two Chrome extensions using the same name, “Phantom Shuttle,” that were posing as tools for proxy routing and network speed testing (via Bleeping Computer). According to the researchers, the extensions have been active since at least 2017.

Both extensions were published under the same developer name and marketed towards foreign trade workers who need to test internet connectivity from different regions. They were sold as subscription-based tools, with prices ranging from roughly $1.40 to $13.60.

At a glance, everything looked normal. The descriptions matched the functionality. The pricing seemed reasonable. The problem was what the extensions were doing after installation.

How Phantom Shuttle steals your data

Socket researchers say Phantom Shuttle routes all your web traffic through proxy servers controlled by the attacker. Those proxies use hardcoded credentials embedded directly into the extension’s code. To avoid detection, the malicious logic is hidden inside what appears to be a legitimate jQuery library.

The attackers didn’t just leave credentials sitting in plain text. The extensions hide them using a custom character-index encoding scheme. Once active, the extension listens to web traffic and intercepts HTTP authentication challenges on any site you visit.

To make sure traffic always flows through their infrastructure, the extensions dynamically reconfigure Chrome’s proxy settings using an auto-configuration script. This forces your browser to route requests exactly where the attacker wants them.

In its default “smarty” mode, Phantom Shuttle routes traffic from more than 170 high-value domains through its proxy network. That list includes developer platforms, cloud service dashboards, social media sites and adult content portals. Local networks and the attacker’s own command-and-control domain are excluded, likely to avoid breaking things or raising suspicion.

While acting as a man-in-the-middle, the extension can capture anything you submit through web forms. That includes usernames, passwords, card details, personal information, session cookies from HTTP headers and API tokens pulled directly from network requests.

CyberGuy contacted Google about the extensions, and a spokesperson confirmed that both have been removed from the Chrome Web Store.

10 SIMPLE CYBERSECURITY RESOLUTIONS FOR A SAFER 2026

Two Chrome extensions posing as proxy tools were found spying on users for years while listed on Google’s official Chrome Web Store. (Yui Mok/PA Images via Getty Images)

How to review the extensions installed in your browser (Chrome)

The step-by-step instructions below apply to Windows PCs, Macs and Chromebooks. In other words, desktop Chrome. Chrome extensions cannot be fully reviewed or removed from the mobile app.

Step 1: Open your extensions list
- Open Chrome on your computer.
- Click the three-dot menu in the top-right corner.
- Select Extensions
- Then click Manage Extensions.
You can also type this directly into the address bar and press Enter:
chrome://extensions

Step 2: Look for anything you do not recognize

Go through every extension listed and ask yourself:
- Do I remember installing this?
- Do I still use it?
- Do I know what it actually does?
If the answer is no to any of these, take a closer look.

Step 3: Review permissions and access

Click Details on any extension you are unsure about. Pay attention to:
- Permissions, especially anything that can read or change data on websites you visit
- Site access, such as extensions that run on all sites
- Background access, which allows the extension to stay active even when not in use
Proxy tools, VPNs, downloaders and network-related extensions deserve extra scrutiny.

Step 4: Disable suspicious extensions first

If something feels off, toggle the extension off. This immediately stops it from running without deleting it. If everything still works as expected, the extension was likely not essential.

Step 5: Remove extensions you no longer need

To fully remove an extension:
- Click Remove
- Confirm when prompted
Unused extensions are a common target for abuse and should be cleaned out regularly.

Step 6: Restart Chrome

Close and reopen Chrome after making changes. This ensures disabled or removed extensions are no longer active.

MICROSOFT TYPOSQUATTING SCAM SWAPS LETTERS TO STEAL LOGINS

Cybersecurity experts warn that trusted browser extensions can become powerful surveillance tools once installed. (Gabby Jones/Bloomberg via Getty Images)

6 steps you can take to stay safe from malicious Chrome extensions

You can’t control what slips through app store reviews, but you can reduce your risk by changing how you install and manage extensions.

1) Install extensions only when absolutely necessary

Every extension increases your attack surface. If you don’t genuinely need it, don’t install it. Convenience extensions often come with far more permissions than they deserve.

2) Check the publisher carefully

Reputable developers usually have a history, a website and multiple well-known extensions. Be cautious with tools from unknown publishers, especially those offering network or proxy features.

3) Read multiple user reviews, not just ratings

Star ratings can be faked or manipulated. Look for detailed reviews that mention long-term use. Watch out for sudden waves of generic praise.

4) Review permissions before clicking install

If an extension asks to “read and change all data on websites you visit,” take that seriously. Proxy tools and network extensions can see everything you do.

5) Use a password manager

A password manager won’t stop a malicious extension from spying on traffic, but it can limit damage. Unique passwords mean stolen credentials can’t unlock multiple accounts. Many managers also refuse to autofill on suspicious pages.

Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com/Passwords) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

6) Install strong antivirus software

Strong antivirus software can flag suspicious network activity, proxy abuse and unauthorized changes to browser settings. This adds a layer of defense beyond Chrome’s own protections.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaway

This attack doesn’t rely on phishing emails or fake websites. It works because the extension itself becomes part of your browser. Once installed, it sees nearly everything you do online. Extensions like Phantom Shuttle are dangerous because they blend real functionality with malicious behavior. The extensions deliver the proxy service they promise, which lowers suspicion, while quietly routing user data through attacker-controlled servers.

When was the last time you reviewed the extensions installed in your browser? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.
[ad_2]

Source link
January 5, 2026
OpenAI admits AI browsers face unsolvable prompt attacks

[ad_1]

NEWYou can now listen to Fox News articles!

Cybercriminals don’t always need malware or exploits to break into systems anymore. Sometimes, they just need the right words in the right place. OpenAI is now openly acknowledging that reality. The company says prompt injection attacks against artificial intelligence (AI)-powered browsers are not a bug that can be fully patched, but a long-term risk that comes with letting AI agents roam the open web. This raises uncomfortable questions about how safe these tools really are, especially as they gain more autonomy and access to your data.

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

NEW MALWARE CAN READ YOUR CHATS AND STEAL YOUR MONEY

AI-powered browsers can read and act on web content, which also makes them vulnerable to hidden instructions attackers can slip into pages or documents. (Kurt “CyberGuy” Knutsson)

Why prompt injection isn’t going away

In a recent blog post, OpenAI admitted that prompt injection attacks are unlikely to ever be completely eliminated. Prompt injection works by hiding instructions inside web pages, documents or emails in ways that humans don’t notice, but AI agents do. Once the AI reads that content, it can be tricked into following malicious instructions.

OpenAI compared this problem to scams and social engineering. You can reduce them, but you can’t make them disappear. The company also acknowledged that “agent mode” in its ChatGPT Atlas browser increases risk because it expands the attack surface. The more an AI can do on your behalf, the more damage it can cause when something goes wrong.

OpenAI launched the ChatGPT Atlas browser in October, and security researchers immediately started testing its limits. Within hours, demos appeared showing that a few carefully placed words inside a Google Doc could influence how the browser behaved. That same day, Brave published its own warning, explaining that indirect prompt injection is a structural problem for AI-powered browsers, including tools like Perplexity’s Comet.

This isn’t just OpenAI’s problem. Earlier this month, the National Cyber Security Centre in the U.K. warned that prompt injection attacks against generative AI systems may never be fully mitigated.

FAKE AI CHAT RESULTS ARE SPREADING DANGEROUS MAC MALWARE

Prompt injection attacks exploit trust at scale, allowing malicious instructions to influence what an AI agent does without the user ever seeing it. (Kurt “CyberGuy” Knutsson)

The risk trade-off with AI browsers

OpenAI says it views prompt injection as a long-term security challenge that requires constant pressure, not a one-time fix. Its approach relies on faster patch cycles, continuous testing and layered defenses. That puts it broadly in line with rivals like Anthropic and Google, which have both argued that agentic systems need architectural controls and ongoing stress testing.

Where OpenAI is taking a different approach is with something it calls an “LLM-based automated attacker.” In simple terms, OpenAI trained an AI to act like a hacker. Using reinforcement learning, this attacker bot looks for ways to sneak malicious instructions into an AI agent’s workflow.

The bot runs attacks in simulation first. It predicts how the target AI would reason, what steps it would take and where it might fail. Based on that feedback, it refines the attack and tries again. Because this system has insight into the AI’s internal decision-making, OpenAI believes it can surface weaknesses faster than real-world attackers.

Even with these defenses, AI browsers aren’t safe. They combine two things attackers love: autonomy and access. Unlike regular browsers, they don’t just display information, but also read emails, scan documents, click links and take actions on your behalf. That means a single malicious prompt hidden in a webpage, document or message can influence what the AI does without you ever seeing it. Even when safeguards are in place, these agents operate by trusting content at scale, and that trust can be manipulated.

THIRD-PARTY BREACH EXPOSES CHATGPT ACCOUNT DETAILS

As AI browsers gain more autonomy and access to personal data, limiting permissions and keeping human confirmation in the loop becomes critical for safety. (Kurt “CyberGuy” Knutsson)

7 steps you can take to reduce risk with AI browsers

You may not be able to eliminate prompt injection attacks, but you can significantly limit their impact by changing how you use AI tools.

1) Limit what the AI browser can access

Only give an AI browser access to what it absolutely needs. Avoid connecting your primary email account, cloud storage or payment methods unless there’s a clear reason. The more data an AI can see, the more valuable it becomes to attackers. Limiting access reduces the blast radius if something goes wrong.

2) Require confirmation for every sensitive action

Never allow an AI browser to send emails, make purchases or modify account settings without asking you first. Confirmation breaks long attack chains and gives you a moment to spot suspicious behavior. Many prompt injection attacks rely on the AI acting quietly in the background without user review.

3) Use a password manager for all accounts

A password manager ensures every account has a unique, strong password. If an AI browser or malicious page leaks one credential, attackers can’t reuse it elsewhere. Many password managers also refuse to autofill on unfamiliar or suspicious sites, which can alert you that something isn’t right before you manually enter anything.

Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com

4) Run strong antivirus software on your device

Even if an attack starts inside the browser, antivirus software can still detect suspicious scripts, unauthorized system changes or malicious network activity. Strong antivirus software focuses on behavior, not just files, which is critical when dealing with AI-driven or script-based attacks.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

5) Avoid broad or open-ended instructions

Telling an AI browser to “handle whatever is needed” gives attackers room to manipulate it through hidden prompts. Be specific about what the AI is allowed to do and what it should never do. Narrow instructions make it harder for malicious content to influence the agent.

6) Be careful with AI summaries and automated scans

When an AI browser scans emails, documents or web pages for you, remember that hidden instructions can live inside that content. Treat AI-generated actions as drafts or suggestions, not final decisions. Review anything the AI plans to act on before approving it.

7) Keep your browser, AI tools and operating system updated

Security fixes for AI browsers evolve quickly as new attack techniques emerge. Delaying updates leaves known weaknesses open longer than necessary. Turning on automatic updates ensures you get protection as soon as they’re available, even if you miss the announcement.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaway

There’s been a meteoric rise in AI browsers. We’re now seeing them from major tech companies, including OpenAI’s Atlas, The Browser Company’s Dia and Perplexity’s Comet. Even existing browsers like Chrome and Edge are pushing hard to add AI and agentic features into their current infrastructure. While these browsers can be useful, the technology is still early. It’s best not to fall for the hype and to wait for it to mature.

Do you think AI browsers are worth the risk today, or are they moving faster than security can keep up? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

[ad_2]

Source link

January 4, 2026
University of Phoenix data breach hits 3.5M people
[ad_1]
NEWYou can now listen to Fox News articles!

The University of Phoenix has confirmed a major data breach affecting nearly 3.5 million people. The incident traces back to August when attackers accessed the university’s network and quietly stole sensitive information.

The school detected the intrusion on Nov. 21. That discovery came after the attackers listed the university on a public leak site. In early December, the university disclosed the incident, and its parent company filed an 8-K with regulators.

The scope is large. Notification letters filed with Maine’s Attorney General show 3,489,274 individuals are impacted. Those affected include current and former students, faculty, staff and suppliers.

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

DATA BREACH EXPOSES 400K BANK CUSTOMERS’ INFO

The University of Phoenix data breach exposed sensitive personal and financial information tied to nearly 3.5 million people. (Kurt “CyberGuy” Knutsson)

What happened and how attackers got in

According to the university, hackers exploited a zero-day vulnerability in Oracle E-Business Suite. This application handles financial operations and contains highly sensitive data.

Based on the technical details shared so far, security researchers believe the attack aligns with tactics used by the Clop ransomware gang. Clop has a long track record of stealing data through zero-day flaws rather than encrypting systems.

The vulnerability tied to this campaign is tracked as CVE-2025-61882. Investigators say it has been abused since early August.

What data was exposed

The university says the attackers accessed highly sensitive personal and financial information. That includes:
- Full names
- Contact information
- Dates of birth
- Social security numbers
- Bank account numbers
- Routing numbers
This type of data creates a serious risk. It can fuel identity theft, financial fraud, and targeted phishing scams.

700CREDIT DATA BREACH EXPOSES SSNS OF 5.8M CONSUMERS

Stolen University of Phoenix records could be used by criminals to launch targeted phishing and identity theft attacks. (Kurt “CyberGuy” Knutsson)

Nearly 3.5 million people impacted

In letters sent to affected individuals, the university confirmed the breach affects 3,489,274 people. If you are a current or former student or employee, watch your mail closely.

These notifications often arrive by postal mail, not email. The letter explains what data was exposed and includes instructions for protective services.

We reached out to The University of Phoenix for comment, and a rep provided CyberGuy with the following statement:

“We recently experienced a cybersecurity incident involving the Oracle E-Business Suite software platform. Upon detecting the incident on November 21, 2025, we promptly took steps to investigate and respond with the assistance of leading third-party cybersecurity firms. We are reviewing the impacted data and will provide the required notifications to affected individuals and regulatory entities.”

Free identity protection is now available

The University of Phoenix is offering impacted individuals free identity protection services. These include:
- 12 months of credit monitoring
- Identity theft recovery assistance
- Dark web monitoring
- A $1 million fraud reimbursement policy
To enroll, you must use the redemption code provided in the notification letter. Without that code, you cannot activate the service.

This attack fits a larger Clop campaign

The University of Phoenix breach is not an isolated case. Clop has used similar tactics in past campaigns involving GoAnywhere MFT, Accellion FTA, MOVEit Transfer, Cleo, and Gladinet CentreStack.

Other universities have also reported Oracle EBS-related incidents. These include Harvard University and the University of Pennsylvania.

The U.S. government is taking notice. The U.S. Department of State is now offering a reward of up to $10 million for information linking Clop’s attacks to a foreign government.

Why colleges are prime targets

Universities store massive amounts of personal data. Student records, financial aid files, payroll systems, and donor databases all live under one roof.

Like healthcare organizations, colleges present a high-value target. A single breach can expose years of data tied to millions of people.

MAKE 2026 YOUR MOST PRIVATE YEAR YET BY REMOVING BROKER DATA

Affected University of Phoenix students and staff should act quickly to monitor accounts and protect their identities. (Kurt “CyberGuy” Knutsson)

Steps to stay safe right now

If you believe you may be affected, act quickly. These steps can reduce your risk.

1) Watch for your breach notification letter

Read it carefully. It explains what data was exposed and how to enroll in protection services.

2) Enroll in the free identity protection

First, use the redemption code provided. Because social security and banking data are involved, credit monitoring and recovery services matter. Even if you do not qualify for the free service, an identity theft protection service is still a smart move.

In addition, these services actively monitor sensitive details like your social security number, phone number and email address. If your information appears on the dark web or if someone tries to open a new account, you receive an alert right away. As a result, many services also help you quickly freeze bank and credit card accounts to limit further fraud.

See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com

3) Use a data removal service

Because this breach exposed names, contact details and other identifiers, reducing what is publicly available about you matters. A data removal service can help remove your personal information from data broker sites, which lowers the risk of targeted phishing or fraud tied to the stolen University of Phoenix records.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

4) Monitor financial accounts daily

Check bank statements and credit card activity for unfamiliar charges. Report anything suspicious immediately.

5) Consider freezing your credit

A credit freeze can stop criminals from opening new accounts in your name. It is free and reversible. To learn more about how to do this, go to Cyberguy.com and search “How to freeze your credit.”

6) Be alert for phishing attempts and use strong antivirus software

Expect more scam emails and phone calls. Criminals may reference the breach to sound legitimate.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

7) Secure your devices

Keep your operating systems and apps up to date, as attackers often exploit outdated software to gain access. In addition, enable automatic updates and review app permissions to prevent stolen personal data from being combined with device-level access and causing further harm.

Kurt’s key takeaways

The University of Phoenix data breach highlights a growing problem across higher education. When attackers exploit trusted enterprise software, the fallout spreads fast and wide. While free identity protection helps, long-term vigilance matters most. Staying alert can limit damage long after the headlines fade.

If universities cannot protect this level of sensitive data, should students demand stronger cybersecurity standards before enrolling? Let us know by writing to us at Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.
[ad_2]

Source link
January 3, 2026
Fake AI chat results are spreading dangerous Mac malware

[ad_1]

NEWYou can now listen to Fox News articles!

Cybercriminals have always chased whatever people trust the most. First, it was email. Then search results. Now it’s AI chat answers. Researchers are warning about a new campaign where fake AI conversations are showing up in Google search results and quietly pushing Mac users to install dangerous malware. What makes this especially risky is that everything looks helpful, legitimate and step-by-step, right up until your system is compromised.

The malware being spread is Atomic macOS Stealer, often called AMOS, and the attacks abuse conversations generated by tools people increasingly rely on for everyday help. Investigators have confirmed that both ChatGPT and Grok were misused as part of this campaign.

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

THIRD-PARTY BREACH EXPOSES CHATGPT ACCOUNT DETAILS

One copied terminal command is all it takes for malware like AMOS to quietly install itself on a Mac. (Kurt “CyberGuy” Knutsson)

How fake AI chat results lead to malware

Researchers traced one infection back to a simple Google search: “clear disk space on macOS.” Instead of landing on a normal help article, the user was shown what looked like an AI conversation result embedded directly in search. That conversation offered clear, confident instructions and ended by telling the user to run a command in the macOS Terminal. That command installed AMOS.

When researchers followed the same trail, they found multiple poisoned AI conversations appearing for similar searches. That consistency strongly suggests this was a deliberate operation aimed at Mac users searching for routine maintenance help.

If this feels familiar, it should. A previous campaign used sponsored search results and SEO-poisoned links that pointed to fake macOS software hosted on GitHub. In that case, attackers impersonated legitimate apps and walked users through terminal commands that installed the same AMOS infostealer.

According to researchers, once the terminal command is executed, the infection chain kicks off immediately. The base64 string in the command decodes into a URL that hosts a malicious bash script. That script is designed to harvest credentials, escalate privileges and establish persistence, all without triggering a visible security warning.

The danger here is how clean the process looks. There’s no installer window, obvious permission prompt or any option for you to review what’s about to run. Because everything happens through the command line, normal download protections are sidestepped and the attacker gets to execute whatever they want.

MICROSOFT TYPOSQUATTING SCAM SWAPS LETTERS TO STEAL LOGINS

Fake AI chat results can look polished and trustworthy, even when they are designed to trick you into running harmful commands. (Kurt “CyberGuy” Knutsson)

Why is this attack so effective?

This campaign combines two powerful ideas. Trust in AI answers and trust in search results. Most major chat tools, including Grok on X, let users delete parts of conversations or share only selected snippets. That means an attacker can carefully curate a short, polished exchange that looks genuinely helpful while hiding the manipulative prompts that produced it.

Using prompt engineering, attackers get ChatGPT to generate a step-by-step cleanup or installation guide that actually installs malware. ChatGPT’s sharing feature then creates a public link that lives inside the attacker’s account. From there, criminals either pay for sponsored search placement or use SEO tactics to push that shared conversation high in the results.

Some ads are designed to look almost identical to legitimate links. Unless you check who the advertiser actually is, it’s easy to assume it’s safe. One example documented by researchers showed a sponsored result advertising a fake “Atlas” browser for macOS, complete with professional branding.

Once those links are live, attackers don’t need to do much else. They wait for users to search, click, trust the AI output and follow the instructions exactly as written.

REAL APPLE SUPPORT EMAILS USED IN NEW PHISHING SCAM

Attackers rely on trust in search results and AI answers, knowing most people will not question step-by-step instructions. (Kurt “CyberGuy” Knutsson)

8 steps you can take to stay safe from fake AI chat malware

AI tools are useful, but attackers are now shaping answers that lead you straight into trouble. These steps help you stay protected without giving up search or AI entirely.

1) Never paste terminal commands from search results or AI chats

This is the most important rule. If an AI response or webpage tells you to open Terminal and paste a command, stop. Legitimate macOS fixes almost never require you to blindly run scripts copied from the internet. Once you press Enter, you lose visibility into what happens next. Malware like AMOS relies on this moment of trust to bypass normal security checks.

2) Treat AI instructions as suggestions

AI chats are not authoritative sources. They can be manipulated through prompt engineering to produce dangerous step-by-step guides that look clean and confident. Before acting on any AI-generated fix, cross-check it with Apple’s official documentation or a trusted developer site. If you cannot verify it easily, do not run it.

3) Use a password manager to limit the damage

A password manager creates strong, unique passwords for every account you use. If malware steals one password, it cannot unlock everything else. Many password managers also refuse to autofill credentials on fake or unfamiliar sites, which can alert you that something is wrong before you type anything manually. This single tool dramatically reduces the impact of credential-stealing malware.

Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com/Passwords) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com

4) Keep macOS and browsers fully updated

AMOS and similar malware often rely on known weaknesses after the initial infection. Updates patch these holes. Delaying updates gives attackers more room to escalate privileges or maintain persistence. Turn on automatic updates so you are protected even if you forget.

5) Use a strong antivirus software on macOS

Modern macOS malware often runs through scripts and memory-only techniques. A strong antivirus software doesn’t just scan files. It monitors behavior, flags suspicious scripts, and can stop malicious activity even when nothing obvious is downloaded. This is especially important when malware is delivered through Terminal commands.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

6) Be skeptical of sponsored search results

Paid search ads can look almost identical to legitimate results. Always check who the advertiser is before clicking. If a sponsored result leads to an AI conversation, a download or instructions to run commands, close it immediately.

7) Avoid “cleanup” and “installer” guides from unknown sources

Search results promising quick fixes, disk cleanup or performance boosts are common malware entry points. If a guide is not hosted by Apple or a well-known developer, assume it could be risky, especially if it pushes command-line solutions.

8) Slow down when instructions look unusually polished

Attackers spend time making fake AI conversations look helpful and professional. Clear formatting and confident language are not signs of safety. They are often part of the deception. Slowing down and questioning the source is usually enough to break the attack chain.

Kurt’s key takeaway

This campaign shows how attackers are shifting from breaking systems to manipulating trust. Fake AI conversations work because they sound calm, helpful and authoritative. When those conversations are boosted through search results, they inherit credibility they don’t deserve. The technical tricks behind AMOS are complex, but the entry point is simple. Someone follows instructions without questioning where they came from.

Have you ever followed an AI-generated fix without double-checking it first? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

[ad_2]

Source link

January 2, 2026
Make 2026 your most private year yet by removing broker data
[ad_1]
NEWYou can now listen to Fox News articles!

As you think about New Year’s resolutions, consider one that protects every part of your life in 2026: removing your personal data from the internet. Not your social media posts. Not your email subscriptions. Your personal data, the files companies quietly collect and sell without your consent.

Most people do not realize how much of their life already circulates inside massive databases run by data brokers. These companies exist for one purpose: to collect, package and sell personal information. They do it continuously, often without your knowledge or approval, to anyone willing to pay. As 2026 begins, this is the digital cleanup that matters most.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

10 SIMPLE CYBERSECURITY RESOLUTIONS FOR A SAFER 2026

Data brokers quietly collect and sell personal information, creating detailed profiles that fuel scams, identity theft and privacy risks heading into 2026. (Photo by Kira Hofmann/picture alliance via Getty Images)

What’s in your “digital file” and why it’s a problem in 2026

Data brokers work like factories. They pull information from the apps you use, websites you visit, loyalty cards you scan, public records and even location data from your phone. Then they combine it into a shockingly detailed picture of your life, including:
- Your full name and past addresses
- Your phone numbers and email accounts
- Your shopping history
- Predicted income, political leanings, age and marital status
- Your internet browsing habits
- Where you go daily, down to the GPS coordinates.
This data is packaged and sold to advertisers, insurers, political groups, background-check sites and, most worryingly, scammers. And going into 2026, the threat landscape is completely different:
- AI-powered scams rely on data brokers: Scammers don’t guess anymore-they buy. They use broker data to tailor scams, impersonate companies you interact with and even mimic family members.
- Deepfake phone scams are exploding: When a scammer knows your relatives’ names, phone numbers, travel dates and habits, a deepfake call becomes dangerously believable.
- Data breaches are more frequent than ever: Your info doesn’t get leaked once; it gets leaked again and again because brokers constantly resell it.
- The more data you leave exposed, the easier identity theft becomes: One exposed address or phone number is annoying. Hundreds of exposed data points? That’s a permanent risk until you remove them.
If you want 2026 to be your safest year yet, the best thing you can do is reduce the amount of personal data available about you online, starting with data brokers.

Why data brokers make it so hard to delete your information

Technically, data brokers have to delete your data if you request it. But here’s the part they don’t advertise: They want you to give up. Some brokers hide their opt-out pages behind dozens of clicks. Others require you to fax forms, upload IDs, or repeat the request every 30–90 days because they reactivate your profile without warning. Now multiply that by 180–500+ data brokers, depending on your location. This is why most people never delete their information: it’s just too time-consuming.

The simplest fix: automate the removals

This is where a data removal service helps. These services automatically request the removal of your personal information from hundreds of data brokers on your behalf. That includes people-search websites, marketing databases, background-check services and similar data marketplaces. Instead of tracking down each site yourself, automation handles the process for you. Here’s what it does:
- Identifies which brokers are storing your data
- Sends legal removal requests for you
- Follows up continually until your data is deleted
- Stops brokers from relisting you
- Keeps monitoring throughout 2026.
For most people, that means removing your data from hundreds of databases in just a few minutes of setup. If you want a clean digital slate for 2026, this is the closest thing to hitting “erase.”

Why the New Year is the best time to act

You can remove your data at any time. However, early January is one of the most effective moments to do it. Here’s why.

700CREDIT DATA BREACH EXPOSES SSNS OF 5.8M CONSUMERS

Cybersecurity experts warn that personal data circulating online makes consumers more vulnerable to AI-powered scams and deepfake fraud. (Photo by Nikolas Kokovlis/NurPhoto via Getty Images)

1) Your data footprint is the largest after the holidays

The holiday season creates a surge in data sharing. Retailers, loyalty programs, airlines, travel sites and apps collect huge amounts of personal information in November and December. Shoppers often share email addresses, phone numbers and location data to unlock discounts and faster checkout.

Holiday spending continues to rise year over year. More spending means more data. As a result, your personal information spreads across more databases than at any other time of the year.

2) Data brokers refresh profiles at the start of the year

After the holiday rush, data brokers update and expand their profiles using newly collected information. January is when many of these companies organize, repackage and resell their datasets.

Starting the removal process early helps limit how widely your information gets shared. Since removals can take days or even weeks, acting now reduces exposure before that data circulates further.

3) Scams increase during tax season

From January through April, scammers ramp up activity tied to tax season. Common threats include IRS impersonation scams, fake refund messages and W-2 fraud. Many of these attacks rely on data pulled from broker databases.

When scammers have accurate personal details, their messages feel more convincing. Reducing your data exposure now lowers the risk. Removing your information from major data broker sites is a strong first step. It also helps to check smaller, lesser-known sites that may still list your details.

PORNHUB HIT BY MASSIVE USER DATA LEAK EXPOSING 200 MILLION RECORDS

Removing personal data from data broker sites can reduce exposure to scammers and help protect finances and privacy in the new year. (Photo by Phil Barker/Future Publishing via Getty Images)

How to start 2026 with a clean data slate (3 steps)

Using a reputable data removal service can simplify the entire process. These services automate requests to remove your personal information from data brokers, including many sites that are difficult to handle on your own.

Step 1) Run a quick exposure check

Start by searching for your name on Google. Look for results that show your address, date of birth, phone number, or email address. Sites that display this information often belong to data brokers or businesses that sell personal data for profit.

Make a short list of the pages where your information appears.

Step 2) Automate the removals

Instead of spending weeks contacting each site manually, a data removal service can handle the work for you. You submit the links you found, and the service requests removals on your behalf across hundreds of databases.

This approach is especially helpful if:
- You have moved recently
- You shop online often
- You receive frequent spam or scam messages
- You want stronger privacy protections in 2026
Many people see multiple removals within the first few weeks.

Step 3) Keep it clean all year

Data brokers do not stop collecting information. Even after removals, your data can reappear months later. Ongoing monitoring helps catch new listings and remove them before they spread further.

That long-term protection is what keeps your data footprint smaller throughout the year.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaways

If you want 2026 to be the year you take control of your digital life, start with the one thing that influences your security, your inbox, your finances and your peace of mind: Clearing your personal data from data broker sites. You can spend months trying to do it manually, or sign up once and let a data removal service handle all the hard work. A safer, quieter, more private 2026 is just minutes away.

How much of your personal information do you think is already being bought and sold without your knowledge? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.
[ad_2]

Source link
January 1, 2026
Microsoft typosquatting scam swaps letters to steal logins

[ad_1]

NEWYou can now listen to Fox News articles!

A new phishing campaign is exploiting a visual trick that is easy to miss and hard to unsee once you know it. Attackers are using the domain rnicrosoft.com to impersonate Microsoft and steal login credentials. The trick is simple. Instead of the letter m, scammers place r and n side by side. In many fonts, those letters blur together and look almost identical to an m at a quick glance.

Security experts are sounding the alarm because this tactic works. These emails closely copy Microsoft branding, layout and tone, which makes them feel familiar and trustworthy. That false sense of legitimacy is often all it takes to get a quick click before you realize something is wrong.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

MOST PARKED DOMAINS NOW PUSH SCAMS AND MALWARE

Cybersecurity experts warn of a new phishing scam that uses the fake domain rnicrosoft.com to mimic Microsoft and steal login credentials. (Photo by Oliver Berg/picture alliance via Getty Images)

Why your brain falls for the rn trick

This attack relies on how people read. Your brain predicts words instead of scanning each letter. When something looks familiar, you fill in the gaps automatically. On a large desktop monitor, a careful reader might spot the flaw. On a phone, the risk jumps. The address bar often shortens URLs, and the screen leaves little room for close inspection. That is exactly where attackers want you. Once trust is established, you are more likely to enter passwords, approve fake invoices or download harmful attachments.

Common typosquatting variations to watch for

Attackers rarely rely on a single trick. They mix several visual deceptions to increase their odds.

Letter combinations

rnicrosoft.com
Uses r and n together to mimic m

Number swapping

micros0ft.com
Replaces the letter o with the number 0

Hyphenation

microsoft-support.com
Adds official-sounding words to look legitimate

TLD switching

microsoft.co
Uses a different domain ending to appear real

What attackers do after you click

Typosquatting domains like rnicrosoft.com are rarely used for a single purpose. Criminals reuse them across multiple scams. Common follow-ups include credential phishing, fake HR notices and vendor payment requests. In every case, the attacker benefits from speed. The faster you act, the less likely you are to notice the mistake.

Why these fake domains keep working

Most people do not slow down to read URLs character by character. Familiar logos and language reinforce trust, especially during a busy workday. Mobile use makes this worse. Smaller screens, shortened links and constant notifications create perfect conditions for mistakes. This is not a Microsoft-only problem. Banks, retailers, healthcare portals and government services all face the same risk.

How to stay safe from typosquatting attacks

Typosquatting scams work because they rush you into trusting what looks familiar. These steps slow that moment down and help you spot fake domains before damage is done.

1) Expand the full sender address every time

Before clicking anything, open the full sender address in the email header. Display names and logos are easy to fake, but domains tell the real story. Look closely for swapped letters like rn in place of m, added hyphens or strange domain endings. If the address feels even slightly off, treat the message as hostile.

NETFLIX SUSPENSION SCAM TARGETS YOUR INBOX

Scammers are replacing the letter “m” with “rn” in web addresses, a subtle trick that can fool users at a quick glance. (Photo By Paul Chinn/The San Francisco Chronicle via Getty Images)

2) Preview links before you click

On a desktop, hover your mouse over links to reveal the real destination. On a phone, long-press the link to preview the URL. This simple pause often exposes lookalike domains designed to steal logins. If the link does not match the exact site you expect, do not proceed.

3) Avoid email links for password or security alerts

When an email claims your account needs urgent action, do not use its links. Instead, open a new browser tab and manually go to the official website using a saved bookmark. Legitimate companies do not require you to act through surprise links, and this habit cuts off most typosquatting attempts instantly.

4) Use strong antivirus software for added protection

Strong antivirus software can block known phishing domains, flag malicious downloads and warn you before you enter credentials on risky sites. While it cannot catch every new typo trick, it adds an important safety net when human attention slips.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

5) Check the Reply To field for hidden red flags

Even if the sender’s address looks correct, inspect the Reply To field. Many phishing campaigns route replies to external inboxes that have nothing to do with the real company. A mismatch here is a strong signal that the message is a scam.

HOLIDAY DELIVERIES AND FAKE TRACKING TEXTS: HOW SCAMMERS TRACK YOU

A typosquatting campaign targeting Microsoft users highlights how small visual changes in URLs can lead to major security risks. (Photo by THOMAS SAMSON / AFP) (Photo by THOMAS SAMSON/AFP via Getty Images)

6) Consider a data removal service to reduce targeting

Typosquatting attacks often begin with leaked or scraped contact details. A data removal service can help remove your personal information from data broker sites, reducing the number of scam emails and targeted phishing attempts that reach your inbox.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

7) Rely on saved bookmarks for critical accounts

For email, banking and work portals, use bookmarks you created yourself. This eliminates the risk of mistyping addresses or trusting links in messages. It is one of the simplest and most effective defenses against lookalike domain attacks.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaways

Typosquatting works because it targets human behavior, not software flaws. A single swapped character can bypass filters and fool smart people in seconds. Knowing these tricks slows attackers down and gives you back control. Awareness turns a sophisticated scam into an obvious fake.

If a single letter can decide whether you get hacked, how closely are you really reading the links you trust every day? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

[ad_2]

Source link

December 30, 2025
700Credit data breach exposes SSNs of 5.8M consumers

[ad_1]

NEWYou can now listen to Fox News articles!

Data breaches tied to financial services companies are no longer rare, but they still hit harder when Social Security numbers are involved. In the latest incident, U.S.-based fintech company 700Credit has confirmed that the personal data of more than 5.8 million people was exposed. The breach did not originate from a direct compromise of 700Credit’s internal network, which makes it more concerning. It began with a third-party integration partner and quietly snowballed over several months before it was detected. By the time the issue was contained, hackers had managed to steal a significant amount of sensitive consumer data.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

DATA BREACH EXPOSES 400K BANK CUSTOMERS’ INFO

A data breach at fintech firm 700Credit exposed the personal information of more than 5.8 million people after hackers accessed data through a third-party vendor. (Photo by Philip Dulian/picture alliance via Getty Images)

What went wrong at 700Credit

The company says the breach traces back to July, when a threat actor compromised one of its third-party integration partners, as reported by Bleeping Computer. During that intrusion, the attacker discovered an exposed API that could be used to access customer information linked to 700Credit’s dealership clients. The integration partner failed to inform 700Credit about the compromise, allowing the access to continue unnoticed.

Suspicious activity was only detected on October 25, when 700Credit flagged unusual behavior on its systems and launched an internal investigation. The company says it brought in third-party computer forensic specialists to assess the scope of the incident and determine what data had been affected.

According to the company’s findings, certain records within its web application were copied without authorization. These records are related to customers of auto dealerships that use 700Credit’s services. Managing Director Ken Hill later confirmed that roughly 20% of the consumer data accessible through the affected system was stolen between May and October.

What data was exposed and why it matters

While 700Credit has not published an exhaustive list of every data field involved, the company has confirmed that highly sensitive personal information was exposed. This includes Social Security numbers, which significantly raises the risk of identity theft and financial fraud. When SSNs are compromised, the impact is long-term. You cannot simply change them like a password.

The company has published a dedicated page on its website outlining the breach and the types of information impacted. As part of its response, 700Credit is offering affected individuals 12 months of free identity protection and credit monitoring through TransUnion. You have a 90-day window to enroll in this service after receiving the notification.

Notably, audio streaming platform SoundCloud and adult video sharing platform Pornhub also suffered data breaches tied to third-party vendors. There is no indication that the same vendor was involved in all three incidents, but the cases highlight how risky third-party access can be when vendors handle sensitive consumer data.

CyberGuy reached out to 700Credit for comment but did not receive a response before publication.

PASSWORD MANAGER FINED AFTER MAJOR DATA BREACH

Social Security numbers were among the sensitive data stolen in a monthslong breach involving 700Credit and an outside integration partner. (Photo by Matt Cardy/Getty Images)

6 steps you can take to stay safe after a data breach

When breaches like this happen, the damage is not always immediate. Your data can sit in underground markets for months before it is abused. That is why it helps to lock things down early. Here are six practical steps you can take.

1) Use strong antivirus software

A good antivirus helps block malicious downloads, phishing links and spyware that often follow large data leaks. Attackers know your details are exposed and may try to target you directly with malware-based scams.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

2) Switch to a password manager

If you are still reusing passwords, this is the time to stop. A password manager helps you generate strong, unique passwords for every service and keeps them stored securely. If one site is breached, the rest of your accounts stay protected.

Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

3) Enable two-factor authentication everywhere

Turn on 2FA for email, banking, social media and cloud accounts. Even if someone has your password, they cannot log in without the second factor. App-based authenticators are more secure than SMS, where possible.

4) Sign up for identity theft and credit monitoring

Monitoring services alert you when new accounts, loans or credit checks appear in your name. Early alerts give you a chance to act before serious financial damage is done.

Identity Theft companies can monitor personal information like your Social Security number, phone number and email address, and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

PETCO CONFIRMS MAJOR DATA BREACH INVOLVING CUSTOMER DATA

Hackers quietly accessed consumer data tied to auto dealerships using 700Credit services before the breach was discovered in October. (Photo by Jaque Silva/NurPhoto via Getty Images)

5) Consider a personal data removal service

Your phone number, address and other details are often already scattered across data broker sites. Data removal services help reduce your digital footprint, making it harder for attackers to profile and target you after a breach.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

6) Freeze your credit if SSNs are exposed

If your Social Security number is involved, a credit freeze is one of the strongest defenses. It prevents new credit accounts from being opened without your approval and can be lifted temporarily when needed. To learn more about how to do this, go to Cyberguy.com and search “How to freeze your credit.”

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaway

Third-party APIs and integrations are essential for modern digital services, but they also expand the attack surface. When third-party partners fail to disclose breaches quickly, the downstream impact can be massive, as this case shows. If you receive a notification from 700Credit, take it seriously. Enroll in the credit monitoring service, review your credit reports, and consider locking them down. Even if no fraud has occurred yet, breaches involving SSNs often lead to delayed abuse months or even years later.

Should companies be held accountable when a third-party vendor exposes customer information? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

[ad_2]

Source link

December 29, 2025
Pornhub hit by massive user data leak exposing 200 million records
[ad_1]
NEWYou can now listen to Fox News articles!

Pornhub is dealing with fresh fallout after the hacking group ShinyHunters claimed responsibility for a massive user data leak. The group says it stole 94GB of data tied to more than 200 million records and is now attempting to extort the company for a Bitcoin ransom.

According to reporting from BleepingComputer, the hackers say they will publish the data if their demands are not met. Pornhub has acknowledged the situation but maintains its core systems were not breached.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter

DATA BREACH EXPOSES 400K BANK CUSTOMERS’ INFO

Pornhub is facing new fallout after hackers claimed to steal millions of user records tied to Premium accounts. The group is threatening to release sensitive activity data unless paid in Bitcoin. (Philip Dulian/picture alliance via Getty Images)

What data ShinyHunters claims to have stolen

ShinyHunters says the exposed data focuses on Pornhub Premium users. While no financial information was included, the dataset still contains highly sensitive activity details.

The group claims the stolen records include:
- Email addresses
- Activity type
- Location
- Video URLs and video names
- Keywords linked to videos
- Timestamps showing when the activity occurred
Activity logs reportedly show whether a user watched or downloaded a video or viewed a channel. Search histories are also included, which raises serious privacy concerns if the data is released publicly.

How Mixpanel is connected to the breach

The alleged breach appears linked to a separate November security incident involving Mixpanel, a data analytics vendor that previously worked with Pornhub. That earlier breach occurred after a smishing attack gave threat actors access to Mixpanel systems. However, Mixpanel says it does not believe Pornhub data came from that incident. The company stated it found no evidence that the data was taken during its November 2025 breach. Pornhub has also clarified that it stopped working with Mixpanel in 2021. That means the stolen data would be several years old. Reuters contacted some Pornhub customers to verify the claims. Those users confirmed the data tied to their accounts was accurate but outdated, which aligns with the Mixpanel timeline.

What Pornhub says was not exposed

Pornhub moved quickly to reassure users following the reports. In a security notice, the company said:

“This was not a breach of Pornhub Premium’s systems. Passwords, payment details and financial information remain secure and were not exposed.”

That distinction reduces the immediate risk of financial fraud. However, exposure of viewing habits and search activity still carries long-term privacy risks. We reached out to Pornhub for a comment, but did not hear back before our deadline.

Why ShinyHunters remains a serious threat

ShinyHunters has been linked to some of the most disruptive data breaches this year. The group relies heavily on social engineering tactics such as phishing and smishing to gain access to corporate systems. Once inside, the group typically steals large datasets and uses extortion threats to pressure companies into paying ransoms. This strategy has affected businesses and users worldwide.

PASSWORD MANAGER FINED AFTER MAJOR DATA BREACH

A hacking group says it obtained years-old Pornhub Premium user data, including viewing activity and search history. Pornhub says its core systems were not breached. (Donato Fasano/Getty Images)

Pornhub warns Premium members about direct contact from hackers

Pornhub has updated its online statement to warn Premium members about possible direct contact from cybercriminals. In cases involving adult platforms, this type of outreach often escalates into sextortion attempts, where criminals threaten to expose private activity unless victims pay.

“We are aware that the individuals responsible for this incident have threatened to contact impacted Pornhub Premium users directly. You may therefore receive emails claiming they have your personal information. As a reminder, we will never ask for your password or payment information by email.”

Pornhub remains one of the world’s most visited adult video platforms. People can view content anonymously or create accounts to upload and interact with videos.

PETCO CONFIRMS MAJOR DATA BREACH INVOLVING CUSTOMER DATA

ShinyHunters claims responsibility for a massive Pornhub data leak involving alleged user activity records. The company says passwords and payment details remain secure. (Morteza Nikoubazl/NurPhoto via Getty Images)

Ways to stay safe after a data breach

Even if the data is several years old, users should take this opportunity to strengthen their digital security.

1) Change your passwords

Start by updating your Pornhub password. Next, change the password for any email or payment account linked to it. Using a password manager makes it easier to create and store strong, unique passwords.

Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com/Passwords) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com

2) Stay alert for phishing attempts and install strong antivirus software

Data breaches often lead to follow-up scams. Be cautious of emails, texts or phone calls that reference Pornhub or account issues. Avoid clicking links, downloading attachments or sharing personal information unless you can verify the source. Installing a strong antivirus program adds another layer of defense against malicious links and downloads.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

3) Use a data removal service to limit future exposure

Data removal services work to remove your personal information from data broker websites that collect and sell details such as email addresses, locations and online identifiers. If leaked data from this breach is shared, resold or cross-referenced with broker databases, removing your information can make it much harder for scammers to connect it to you.

This step is especially important after high-profile breaches involving activity data. Shrinking what is publicly available about you reduces the risk of targeted phishing, impersonation and long-term privacy harm.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan

4) Consider identity theft protection

Identity Theft companies can monitor personal information such as your Social Security Number (SSN), phone number, and email address and alert you if it is being sold on the dark web or used to open an account. Early warnings can help limit damage if your data surfaces. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com

5) Add extra privacy protection with a VPN

A VPN helps protect your browsing activity by masking your IP address and encrypting your internet traffic. That is especially relevant in breaches like this one, where exposed activity data may include location signals or usage patterns. While a VPN cannot erase past exposure, it reduces how much new information is visible going forward and makes it harder to link future activity back to you. Using a VPN consistently can also limit tracking across sites, which helps lower your overall digital footprint after a breach.

For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android & iOS devices at Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaways

The Pornhub massive data leak highlights how long stored user information can remain a risk. While passwords and payment details were not exposed, activity data can still be damaging if released. ShinyHunters has shown it is willing to apply pressure through public threats. As a result, you should stay vigilant and proactive about your online security.

Should companies be allowed to store years of user activity data once it is no longer needed? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.
[ad_2]

Source link
December 28, 2025
Apple patches two zero-day flaws used in targeted attacks

[ad_1]

NEWYou can now listen to Fox News articles!

Apple has released emergency security updates to fix two zero-day vulnerabilities that attackers actively exploited in highly targeted attacks.

The company described the activity as an “extremely sophisticated attack” aimed at specific individuals. Although Apple did not identify the attackers or victims, the limited scope strongly suggests spyware-style operations rather than widespread cybercrime.

Both flaws affect WebKit, the browser engine behind Safari and all browsers on iOS. As a result, the risk is significant. In some cases, simply visiting a malicious webpage may be enough to trigger an attack.

Below, we break down what these vulnerabilities mean and explain how you can better protect yourself.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Apple released emergency updates after confirming two zero-day WebKit flaws were actively exploited in targeted attacks. (Reuters/Thomas Peter/File Photo)

NEW IPHONE SCAM TRICKS OWNERS INTO GIVING PHONES AWAY

What Apple says about the zero-day vulnerabilities

The two vulnerabilities are tracked as CVE-2025-43529 and CVE-2025-14174, and Apple confirmed that both were exploited in the same real-world attacks. According to Apple’s security bulletin, the flaws were abused on versions of iOS released before iOS 26, and the attacks were limited to “specific targeted individuals.”

CVE-2025-43529 is a WebKit use-after-free vulnerability that can lead to arbitrary code execution when a device processes maliciously crafted web content. To put it simply, it allows attackers to run their own code on a device by tricking the browser into mishandling memory. Apple credited Google’s Threat Analysis Group with discovering this flaw, which is often a strong indicator of nation-state or commercial spyware activity.

The second flaw, CVE-2025-14174, is also a WebKit issue, this time involving memory corruption. While Apple describes the impact as memory corruption rather than direct code execution, these types of bugs are often chained together with other vulnerabilities to fully compromise a device. Apple says this issue was discovered jointly by Apple and Google’s Threat Analysis Group.

In both cases, Apple acknowledged that it was aware of reports confirming active exploitation in the wild. That language is important because Apple typically reserves it for situations where attacks have already occurred, not just theoretical risks. The company says it addressed the bugs through improved memory management and better validation checks, without sharing deeper technical details that could help attackers replicate the exploits.

Devices affected and signs of coordinated disclosure

Apple has released patches across its supported operating systems, including the latest versions of iOS, iPadOS, macOS, Safari, watchOS, tvOS and visionOS.

According to Apple’s advisory, affected devices include iPhone 11 and newer models, multiple generations of iPad Pro, iPad Air from the third generation onward, the eighth-generation iPad and newer and the iPad mini starting with the fifth generation. This covers the vast majority of iPhones and iPads still in active use today.

Apple has patched the flaws across its entire ecosystem. Fixes are available in iOS 26.2 and iPadOS 26.2, iOS 18.7.3 and iPadOS 18.7.3, macOS Tahoe 26.2, tvOS 26.2, watchOS 26.2, visionOS 26.2 and Safari 26.2. Because Apple requires all iOS browsers to use WebKit under the hood, the same underlying issue also affected Chrome on iOS.

6 steps you can take to protect yourself from such vulnerabilities

Here are six practical steps you can take to stay safe, especially in light of highly targeted zero-day attacks like this.

REAL APPLE SUPPORT EMAILS USED IN NEW PHISHING SCAM

Because WebKit powers Safari and all iOS browsers, even a malicious webpage may be enough to put unpatched devices at risk. (Jakub Porzycki/NurPhoto via Getty Images)

1) Install updates as soon as they drop

This sounds obvious, but it matters more than anything else. Zero-day attacks rely on people running outdated software. If Apple ships an emergency update, install it the same day if you can. Delaying updates is often the only window attackers need. If you tend to forget about updates, let your devices handle them for you. Enable automatic updates for iOS, iPadOS, macOS and Safari. That way, you are protected even if you miss the news or are traveling.

2) Be careful with links, even from people you know

Most WebKit exploits start with malicious web content. Avoid tapping on random links sent over SMS, WhatsApp, Telegram or email unless you are expecting them. If something feels off, open the site later by typing the address yourself.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

3) Use a lockdown-style browsing setup

If you are a journalist, an activist or someone who deals with sensitive information, consider reducing your attack surface. Use Safari only, avoid unnecessary browser extensions, and limit how often you open links inside messaging apps.

4) Turn on Lockdown Mode if you feel at risk

Apple’s Lockdown Mode is designed specifically for targeted attacks. It restricts certain web technologies, blocks most message attachments, and limits attack vectors commonly used by spyware. It is not for everyone, but it exists for situations like this.

5) Reduce your exposed personal data

Targeted attacks often start with profiling. The more personal data about you that is floating around online, the easier it is to pick you as a target. Removing data from broker sites and tightening social media privacy settings can lower your visibility.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services, and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

Apple urges users to install the latest updates, especially those who may face higher-risk, targeted threats. (Cheng Xin/Getty Images)

6) Pay attention to unusual device behavior

Unexpected crashes, overheating, sudden battery drain or Safari closing on its own can sometimes be warning signs. These do not automatically mean your device is compromised. However, if something feels consistently wrong, updating immediately and resetting the device is a smart move.

Kurt’s key takeaway

Apple has not shared details about who was targeted or how the attacks were delivered. However, the pattern fits closely with past spyware campaigns that focused on journalists, activists, political figures and others of interest to surveillance operators. With these patches, Apple has now fixed seven zero-day vulnerabilities that were exploited in the wild in 2025 alone. That includes flaws disclosed earlier this year and a backported fix in September for older devices.

Have you installed the latest iOS or iPadOS update yet, or are you still putting it off? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

[ad_2]

Source link

December 27, 2025
Most parked domains now push scams and malware

[ad_1]

NEWYou can now listen to Fox News articles!

Typing a web address directly into your browser feels harmless. In fact, it feels normal. But new research shows that a simple habit is now one of the riskiest things you can do online. A recent study from cybersecurity firm Infoblox reveals a troubling shift.

Most parked domains now redirect visitors to scams, malware or fake security warnings. In many cases, this happens instantly. You do not have to click anything. That means a single typo can expose your device.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

What are parked domains?

Parked domains are unused or expired web addresses. Many exist because someone forgot to renew a domain. Others are deliberate misspellings of popular sites like Google, Netflix or YouTube. For years, these domains displayed harmless placeholder pages. They showed ads and links to monetize accidental traffic. While annoying, they rarely posed serious danger. That is no longer true. Infoblox found that more than 90 percent of visits to parked domains now lead to malicious content. This includes scareware, fake antivirus offers, phishing pages and malware downloads.

A single mistyped web address can redirect you from a trusted site to a dangerous parked domain in seconds, Kurt Knutsson writes. (PeopleImages/Getty Images)

Why direct navigation has become so risky

Direct navigation means typing a website address by hand instead of using a bookmark or search result. One missing letter can change everything. For example, mistyping gmail.com as gmai.com does not trigger an error. Instead, it can deliver your email straight to criminals. Infoblox found that some of these typo domains actively run mail servers to capture messages. Even worse, many of these domains form part of massive portfolios. One group tracked by Infoblox controlled nearly 3,000 lookalike domains associated with banks, tech companies and government services.

Malicious parked domains often trigger fake security warnings or hidden redirects without requiring any clicks. (CyberGuy.com)

How these domains decide whom to attack

Not everyone sees the same thing when visiting a parked domain. That is intentional. Researchers discovered that parked pages often profile visitors in real time. They analyze IP address, device type, location, cookies and browsing behavior. Based on that data, the domain decides what you see next. Visitors using a VPN or non-residential connection often see harmless placeholder pages. Residential users on phones or home computers get redirected to scams or malware instead. This filtering helps attackers stay hidden while maximizing successful attacks.

Why parked domain scams are increasing

Several trends are fueling the problem. First, traffic from parked domains is often resold multiple times through affiliate networks. By the time it reaches a malicious advertiser, there is no direct relationship with the original parking company. Second, recent ad policy changes may have increased exposure. Google now requires advertisers to opt in before running ads on parked domains. While intended to improve safety, this shift may have pushed bad actors deeper into affiliate networks with weaker oversight. The result is a murky ecosystem where responsibility is difficult to trace.

Even government domains are being targeted

Infoblox also found typosquatting aimed at government services. In one case, a researcher accidentally visited ic3.org instead of ic3.gov while trying to report a crime. The result was a fake warning page claiming a cloud subscription had expired. That page could just as easily have delivered malware. This highlights how easy it is to fall into these traps, even when doing something important.

A screenshot shows how mistyping the FBI’s IC3 web address redirects users to an unrelated parked domain. (Infoblox)

Ways to stay safe from parked domain traps

You can reduce your risk with a few smart habits:

1) Use bookmarks for important sites

Save banks, email providers and government portals. Avoid typing these addresses manually.

2) Double-check URLs before hitting Enter

Slow down when entering web addresses. One extra second can prevent a costly mistake.

3) Install strong antivirus software

Strong antivirus software protects your device if a malicious page loads, blocking malware downloads, scripts and fake security pop-ups.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

4) Consider a data removal service

Data brokers often fuel targeting by selling personal details. Removing your data can reduce exposure to personalized scam redirects.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

5) Be cautious of scare tactics

Fake warnings about expired subscriptions or infected devices are a major red flag. Legitimate companies do not use panic screens.

6) Keep your browser and device updated

Security updates often close the exact loopholes attackers use to exploit malicious redirects.

7) Consider a VPN for added protection

While not a cure-all, VPNs can reduce exposure to targeted redirects tied to residential IP addresses.

For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android and iOS devices at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaways

The web has changed in subtle but dangerous ways. Parked domains are no longer passive placeholders. In many cases, they act as active delivery systems for scams and malware. The most alarming part is how little effort it takes to trigger an attack. A typo is enough. As threats grow quieter and more automated, safe browsing habits matter more than ever.

Have you ever mistyped a web address and ended up somewhere suspicious, or do you rely entirely on bookmarks now? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

[ad_2]

Source link

December 26, 2025
New iPhone scam tricks owners into giving phones away

[ad_1]

NEWYou can now listen to Fox News articles!

Getting a brand-new iPhone should be a moment you enjoy. You open the box. You power it on. Everything feels secure. Unfortunately, scammers know that moment too.

Over the past few weeks, we’ve heard from a number of people who received unexpected phone calls shortly after activating a new iPhone. The callers claimed to be from a major carrier. They said a shipping mistake was made. They insisted the phone needed to be returned right away. One message stood out because it shows exactly how convincing and aggressive this scam can be.

“Somebody called me (the call said it was from Spectrum) and told me they sent the wrong iPhone and needed to replace it. I was to rip off the label on the box, tape it up and set it on my porch steps. FedEx was going to pick it up and they’d put a label on it. And just for my trouble, he’d send me a $100 gift card! However, the guy was just too anxious. He called me again at 7 am to make sure I would follow his instructions. Right after that, I picked up my box on the steps and called Spectrum, who confirmed it was a scam. There are no such things as refurbished i17 phones because they’re brand new. I called the guy back, said a few choice words and hung up on him. Since then, they have called at least twice for the same thing. Spectrum should be warning its customers!”

— Kris L, Columbus, Montana

That second early morning call was the giveaway. Pressure is the scammer’s favorite tool.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

HOLIDAY DELIVERIES AND FAKE TRACKING TEXTS: HOW SCAMMERS TRACK YOU

Scammers often strike right after a new iPhone purchase, using urgency and fake carrier calls to catch you off guard before you have time to verify. (Kurt “CyberGuy” Knutsson)

How the new iPhone replacement scam works

This scam relies on timing and pressure. First, criminals focus on people who recently bought a new iPhone. That information often comes from data-broker sites, leaked purchase data or marketing lists sold online. Next, scammers spoof a carrier phone number. As a result, the call appears legitimate. They sound confident and informed because they already know the device model you ordered.

Once the call begins, the story moves quickly. The scammer claims a shipping mistake occurred. Then they insist the phone must be returned right away. To reinforce urgency, they say a courier is already scheduled. If you follow the instructions, you hand over a brand-new iPhone. At that point, the device is gone. The scammer either resells it or strips it for parts. By the time you realize something is wrong, recovery is unlikely.

Why this scam feels so believable

This scam copies real customer service processes. Carriers do ship replacement phones. FedEx does handle returns. Gift cards are often used as apologies. Scammers blend those facts together and add urgency. They count on you acting before you verify. They also rely on one risky assumption, that a phone call that looks real must be real.

REAL APPLE SUPPORT EMAILS USED IN NEW PHISHING SCAM

By spoofing trusted phone numbers and knowing details about your device, criminals make these calls feel real enough to push you into acting fast. (Kurt “CyberGuy” Knutsson)

Red flags that give this scam away

Once you know what to watch for, the warning signs are clear.

• Unsolicited calls about returns you did not request

• Pressure to act fast

• Instructions to leave a phone outside

• Promises of gift cards for cooperation

• Follow-up calls to rush you

Legitimate carriers do not handle returns this way.

THE FAKE REFUND SCAM: WHY SCAMMERS LOVE HOLIDAY SHOPPERS

Once a phone is handed over, it is usually resold or stripped for parts, leaving victims with no device and little chance of recovery. (Kurt “CyberGuy” Knutsson)

Ways to stay safe from iPhone return scams

Protecting yourself starts with slowing things down. Scammers rely on speed and confusion. You win by pausing and verifying.

1) Never return a device based on a phone call alone

Hang up and contact the carrier using the number on your bill or the official website. If the issue is real, they will confirm it.

2) Do not leave electronics outside for pickup

Legitimate returns use tracked shipping labels tied to your account. Carriers do not ask you to leave phones on porches or doorsteps.

3) Be skeptical of urgency

Scammers rush you on purpose. Pressure shuts down careful thinking. Any demand for immediate action should raise concern.

4) Use a data removal service

Scammers often know what phone you bought because your personal data is widely available online. Data removal services help reduce your exposure by removing your information from data broker sites that criminals rely on. While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

5) Install strong antivirus software

Strong antivirus software adds another layer of protection. Many antivirus tools help block scam calls, warn about phishing links and alert you to suspicious activity before damage is done.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android, & iOS devices at Cyberguy.com.

6) Save messages and call details

Keep voicemails, phone numbers and timestamps. This information helps carriers warn other customers and spot repeat scams.

7) Share this scam with others

Criminals reuse the same script again and again. A quick warning to friends or family could stop the next victim.

Kurt’s key takeaways

Scams aimed at new iPhone owners are getting more targeted and more aggressive. Criminals are timing their calls carefully and copying real carrier language. The simplest defense still works best. Verify before you act. If a call pressures you to rush or hand over a device, pause and contact the company directly. That one step can save you hundreds of dollars and a major headache.

If a carrier called you tomorrow claiming a mistake with your new phone, would you verify first or would urgency take over? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

[ad_2]

Source link

December 25, 2025
New malware can read your chats and steal your money

[ad_1]

NEWYou can now listen to Fox News articles!

A new Android banking trojan called Sturnus is shaping up to be one of the most capable threats we have seen in a while. It is still in early development, but it already behaves like a fully mature operation.

Once it infects a device, it can take over your screen, steal your banking credentials and even read encrypted chats from apps you trust. The worrying part is how quietly it works in the background. You think your messages are safe because they are end-to-end encrypted, but this malware simply waits for the phone to decrypt them before grabbing everything.

It’s important to note, however, that Sturnus does not break encryption; it only captures messages after your apps decrypt them on your device.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Sturnus malware uses deceptive screens that mimic real banking apps to steal your credentials in seconds. (Kurt “CyberGuy” Knutsson )

A closer look at the malware’s capabilities

Sturnus combines several attack layers that give the operator nearly full visibility into the device, as reported by cybersecurity research firm ThreatFabric. It uses HTML overlays that mimic real banking apps to trick you into typing your credentials. Everything you enter goes straight to the attacker through a WebView that forwards the data instantly. It also runs an aggressive keylogging system through the Android Accessibility Service. This lets it capture text as you type, follow which app is open, and map every UI element on the screen. Even when apps block screenshots, the malware keeps tracking the UI tree in real time, which is enough to reconstruct what you are doing.

NEW ANDROID MALWARE CAN EMPTY YOUR BANK ACCOUNT IN SECONDS

On top of overlays and keylogging, the malware monitors WhatsApp, Telegram, Signal and other messaging apps. It waits for these apps to decrypt messages locally, then captures the text right from the screen. This means your chats may remain encrypted over the network, but once the message appears on your display, Sturnus sees the entire conversation. It also includes a full remote control feature with live screen streaming and a more efficient mode that sends only interface data. This allows precise taps, text injection, scrolling and permission approvals without showing any activity to the victim.

How Sturnus stays hidden and steals money

The malware protects itself by grabbing Device Administrator privileges and blocking any attempt to remove it. If you open the settings page that could disable those permissions, Sturnus detects it immediately and moves you away from the screen before you can act. It also monitors battery state, SIM changes, developer mode, network conditions and even signs of forensic investigation to decide how to behave. All this data goes back to the command-and-control server through a mix of WebSocket and HTTP channels protected with RSA and AES encryption.

When it comes to financial theft, the malware has several ways to take over your accounts. It can collect credentials through overlays, keylogging, UI-tree monitoring and direct text injection. If needed, it can black out your screen with a full-screen overlay while the attacker performs fraudulent transactions in the background. Since the screen is hidden, you have no idea anything is happening until it is too late.

7 ways you can stay safe from Android malware like Sturnus

If you want to protect yourself from threats like this, here are a few practical things you can start doing right away.

1) Install apps only from trusted and verified sources

Avoid downloading APKs from forwarded links, shady websites, Telegram groups or third-party app stores. Banking malware spreads most effectively through sideloaded installers disguised as updates, coupons or new features. If you need an app that isn’t in the Play Store, verify the developer’s official site, check hashes if provided and read recent reviews to make sure the app hasn’t been hijacked.

2) Check permission requests carefully before tapping allow

Most dangerous malware relies on accessibility permissions because they allow full visibility into your screen and interactions. Device administrator rights are even more powerful since they can block removal. If a simple utility app suddenly asks for these, stop immediately. These permissions should only be granted to apps that genuinely need them, such as password managers or accessibility tools you trust.

3) Keep your phone updated

Install system updates as soon as they arrive, since many Android banking trojans target older devices that lack the latest security patches. If your phone is no longer receiving updates, you are at a higher risk, especially when using financial apps. Avoid sideloading custom ROMs unless you know how they handle security patches and Google Play Protect.

HOW ANDROID MALWARE LETS THIEVES ACCESS YOUR ATM CASH

4) Use strong antivirus software

The malware quietly captures decrypted messages from apps like WhatsApp, Telegram and Signal right as they appear on your screen. (Kurt Knutsson)

Android phones come with Google Play Protect built in, which catches a large chunk of known malware families and warns you when apps behave suspiciously. But if you want greater security and control, choose a third-party antivirus app. These tools can alert you when an app starts logging your screen or trying to take over your phone.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

5) Use a personal data removal service

A lot of these campaigns rely on data brokers, leaked databases and scraped profiles to build lists of people to target. If your phone number, email, address or social handles are floating around on dozens of broker sites, it becomes much easier for attackers to reach you with malware links or tailored scams. A personal data removal service helps clean up that footprint by deleting your info from data broker listings.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

6) Treat unusual login screens and pop-ups as red flags

Trojan overlays often appear when you open your bank app or a popular service. If the screen layout looks different or asks for credentials in a way you don’t recognize, close the app completely. Reopen it from your app drawer and see if the prompt returns. If it doesn’t, you probably caught an overlay. Never type banking details into screens that appear suddenly or seem out of place.

With remote control tools that stream your screen and automate taps, attackers can move money behind the scenes without you noticing. (Felix Zahn/Photothek via Getty Images)

7) Be cautious with links and attachments you receive

Attackers frequently distribute malware through WhatsApp links, SMS messages and email attachments pretending to be invoices, refunds or delivery updates. If you receive a link you weren’t expecting, open your browser manually and search for the service instead. Avoid installing anything that comes from a message, even if it appears to be from someone you know. Compromised accounts are a common delivery method.

DATA BREACH EXPOSES 400,000 BANK CUSTOMERS’ INFO

Kurt’s key takeaway

Sturnus is still a young malware family, but it already stands out for how much control it gives attackers. It sidesteps encrypted messaging, steals banking credentials with multiple backup methods, and maintains a strong grip on the device through administrator privileges and constant environmental checks. Even if the current campaigns are limited, the level of sophistication here suggests a threat that is being refined for larger operations. If it reaches wide distribution, it could become one of the most damaging Android banking trojans in circulation.

Have scammers ever tried to trick you into installing an app or clicking a link? How did you handle it? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

[ad_2]

Source link

December 24, 2025
Pro-Russian hackers claim cyberattack on French postal service

[ad_1]

PARIS — A pro-Russian hacking group claimed responsibility for a major cyberattack that halted package deliveries by France’s national postal service just days before Christmas, prosecutors said Wednesday.

After the claim by the cybercrime group known as Noname057, French intelligence agency DGSI took over the investigation into the hacking attack, the Paris prosecutor’s office said in a statement to The Associated Press.

The group has been accused of other cyberattacks in Europe, including around a NATO summit in the Netherlands and French government sites. It was the target of a big European police operation earlier this year.

Central computer systems at French national postal service La Poste were knocked offline Monday in a distributed denial of service, or DDoS, cyberattack that still wasn’t fully resolved by Wednesday morning, the company said.

Postal workers couldn’t track package deliveries, and online payments at the company’s banking arm were also disrupted. It was a major blow to La Poste, which delivered 2.6 billion packages last year and employs more than 200,000 people, during the busiest season of the year.

France and other European allies of Ukraine allege that Russia is waging a campaign of “hybrid warfare” to sow division in Western societies and undermine their support for Ukraine. The AP has tracked more than 145 incidents including sabotage, assassinations, cyberattacks, disinformation and other hostile acts that are increasingly draining police resources.

[ad_2]

Source link

December 24, 2025
New SantaStealer malware is after your passwords and crypto

[ad_1]

NEWYou can now listen to Fox News articles!

Christmas is around the corner, and so is the SantaStealer malware. While the name sounds jolly, this malware is more than capable of ruining your happiness this festive season. The worst part is that this new strain is available to almost anyone willing to pay a small fee. It essentially works as malware-as-a-service, letting buyers target people at scale, obviously not for any legitimate use.

SantaStealer is starting to make noise across Telegram channels and underground hacker forums. It is being marketed as a stealthy, memory-only information stealer that can quietly siphon data without leaving obvious traces on disk.

Memory-only does not mean undetectable. It simply reduces disk artifacts, which can delay detection rather than prevent it altogether. That promise alone is enough to attract cybercriminals, especially at a time when browser-stored passwords, session cookies and crypto wallets remain high-value targets.

MALICIOUS BROWSER EXTENSIONS HIT 4.3M USERS

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

SantaStealer malware is spreading ahead of Christmas, with cybercriminals marketing the data-stealing tool for hire across Telegram and underground forums. (Kurt “CyberGuy” Knutsson)

SantaStealer and how it actually works

SantaStealer operates as a malware-as-a-service, charging $175 per month for its basic tier and $300 per month for the premium plan. Researchers at Rapid7 say the operation rebrands an earlier project called BluelineStealer, with a Russian-speaking developer pushing toward a wider launch before the end of the year.

Despite bold claims about evading detection, Rapid7’s analysis paints a more grounded picture. The samples they examined were not particularly difficult to analyze and lacked the advanced anti-analysis techniques being advertised, which is good news for us. If it can be detected, security tools have a better chance of removing it before it can do serious damage.

Functionally, SantaStealer is still dangerous. It uses 14 separate data-collection modules that run in parallel, pulling information from browsers, messaging apps like Telegram and Discord, gaming platforms such as Steam, crypto wallet apps and extensions, and even local documents. The malware can also take screenshots of your desktop. Stolen data is written to memory, compressed into ZIP files and sent out in 10MB chunks to a hardcoded command-and-control server.

One notable capability is its use of an embedded executable to get around Chrome’s App-Bound Encryption, a security feature introduced in mid-2024. This workaround typically requires the malware to be executed at the user level and is not a remote bypass of Chrome’s security model. Similar tricks have already been used by other info-stealers, showing how quickly attackers test and adapt to new browser protections.

What this says about the current threat landscape

SantaStealer is not fully operational yet and has not been distributed at scale, but it reflects a broader trend in cybercrime. Modern info-stealers are modular, configurable and sold much like regular software. The affiliate panel that Rapid7 observed allows buyers to fine-tune exactly what data the malware steals, from full system sweeps to narrowly targeted attacks focused on specific apps or crypto wallets.

The malware also includes options to avoid infecting systems in certain regions and to delay execution, which can throw off both victims and security analysts. As for how SantaStealer might spread, researchers say recent campaigns increasingly rely on ClickFix-style attacks. These tricks push victims into pasting malicious commands directly into the Windows terminal, often disguised as steps to fix an issue or enable a feature.

More traditional methods are still very much in play. Phishing emails, pirated software, torrent downloads, malicious ads and even deceptive YouTube comments remain effective delivery channels. Once malware like this runs on a system, it needs very little time to grab saved passwords, session cookies and wallet data that can later be abused or sold.

7 steps you can take to stay safe from SantaStealer malware

A few sensible habits and the right tools can significantly reduce your risk, even if malware like this continues to evolve. Here are seven practical steps you can take to stay safe:

1) Use strong antivirus software

Modern antivirus tools don’t just look for known malware signatures. They also monitor suspicious behavior, such as programs trying to grab browser data or run hidden processes. Keep real-time protection enabled and take alerts seriously instead of dismissing them.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

A new malware-as-a-service threat known as SantaStealer targets passwords, session cookies and crypto wallets while promoting itself as a stealthy, memory-only attack. (Thomas Trutschel/Photothek via Getty Images)

2) Keep your operating system and apps updated

Updates are not just about new features. They often patch security flaws that malware actively targets. This includes your OS, browser, browser extensions, crypto wallet apps and messaging tools. Delaying updates gives attackers a wider window to exploit known weaknesses.

3) Switch to a password manager

Info-stealers love browser-saved passwords because they are easy to grab. A password manager stores your credentials in an encrypted vault and reduces what your browser keeps locally. It also helps you use strong, unique passwords for every service without having to remember them.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

FAKE WINDOWS UPDATE PUSHES MALWARE IN NEW CLICKFIX ATTACK

4) Turn on two-factor authentication wherever possible

Even if your password is stolen, 2FA can stop attackers from getting in. App-based authenticators are more secure than SMS codes and should be your first choice for email, crypto exchanges, cloud services and social media accounts.

5) Be extremely careful with commands and “quick fixes”

ClickFix-style attacks rely on trust and urgency. If a website, pop-up or video tells you to paste a command into the Windows terminal to fix something, stop. Unless you fully understand what that command does, assume it is dangerous.

6) Use a personal data removal service

When your email, phone number or other personal details are widely available online, attackers can target you more convincingly. Personal data removal services help take your information down from data broker sites, reducing the chances of targeted phishing or malware lures.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

HACKERS PUSH FAKE APPS WITH MALWARE IN GOOGLE SEARCHES

7) Avoid pirated software and unverified extensions

Cracked software, torrents and shady browser extensions remain some of the most reliable malware delivery methods. They often bundle info-stealers that run quietly in the background. Stick to official app stores, trusted developers and verified extensions, even if it means skipping a “free” download.

SantaStealer can quietly siphon sensitive data. (Kurt “CyberGuy” Knutsson)

Kurt’s key takeaway

SantaStealer may not yet live up to its own hype, but that should not make you complacent. Early-stage malware often improves quickly once developers patch obvious mistakes. Be cautious with links and attachments from unfamiliar emails, and think twice before running unverified code or browser extensions pulled from public repositories.

When was the last time you checked which extensions have access to your data? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

[ad_2]

Source link

December 23, 2025
Netflix suspension scam targets your inbox

[ad_1]

NEWYou can now listen to Fox News articles!

Holiday phishing attempts surge every year, and scammers know people juggle subscriptions, gifts and billing changes. That makes a fake alert feel real for a split second. Stacey P. emailed to tell us that he received one of these messages and wrote:

“I thought I should forward this message to you that I received today that was ostensibly from Netflix. Without clicking on any links, I called Netflix and they advised me that my account is in good standing. They asked me to forward this to them.”

— Stacey P.

Stacey’s experience shows how convincing these emails can appear and why taking a moment to verify can make all the difference. These Netflix suspension emails look polished at first glance. When you look closer, however, the warning signs jump out.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

HOLIDAY DELIVERIES AND FAKE TRACKING TEXTS: HOW SCAMMERS TRACK YOU

Holiday phishing scams spike as fake Netflix suspension emails exploit seasonal billing confusion and urgency. (Zeng Hui/Xinhua via Getty Images)

Why scammers use this approach

People expect billing reminders during the holidays. When you see a familiar logo during a busy day, your guard drops for a moment. Scammers build templates that look clean, simple and trustworthy because it increases their odds of success.

Red flags inside the fake Netflix message

The Netflix scam email attempts to mimic Netflix’s branding, but several details reveal it is fraudulent.

Spelling and grammar issues

The email includes mistakes real companies would never send. It uses valldate instead of validate, Communicication instead of communication and even writes “sent to yo” with the u missing from you. Errors like these are major signs of a scam.

Strange tone and pressure tactics

The message claims your billing info failed and says your membership will be suspended within 48 hours unless you act. Criminals rely on urgency because it stops people from thinking clearly.

Fake login buttons

The bold red Restart Membership button aims to lure you into entering your credentials on a phishing page. Once you type your password and payment details, you hand them over to attackers.

Generic greeting

The message uses Dear User instead of your name. Netflix includes your account name in official communications.

Suspicious footer and address

The footer contains off wording about inbox preferences and a Scottsdale address not tied to Netflix. Real subscription providers use consistent company details.

FACEBOOK SETTLEMENT SCAM EMAILS TO AVOID NOW

A reader narrowly avoided a Netflix phishing scam by calling the company instead of clicking the email link. (Luis Boza/NurPhoto via Getty Images)

How to stay safe from the Netflix suspension scam

A few habits can protect your account even when a phishing attempt looks convincing.

1) Check your account on Netflix.com

Open Netflix on your browser or app instead of clicking any link in the email. Your account status there is always accurate.

2) Avoid entering payment details through email links

Phishing pages often copy real sites. Instead of clicking the link in the message, open your browser and type the official website address yourself. This keeps you in control and away from fake pages.

3) Use a data removal service

Scammers often pull email addresses and personal details from data broker sites. These lists fuel subscription scams that look like the Netflix alert Stacey received. A trusted data removal service can pull your information off those sites and cut down on future phishing attempts.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

4) Hover over links to reveal the true URL

On a computer, hovering over a link shows where it really goes. If the address looks strange, delete the message.

5) Report the scam

Forward suspicious Netflix emails to phishing@netflix.com. This helps the fraud team block similar messages.

6) Strengthen your device security

Use two-factor authentication (2FA) for your email and install strong antivirus software to catch malicious pages. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

THE FAKE REFUND SCAM: WHY SCAMMERS LOVE HOLIDAY SHOPPERS

Scammers use polished branding and urgent language to trick users into giving up login and payment details. (Gabby Jones/Bloomberg via Getty Images)

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

7) Consider an identity theft protection service

If you ever enter your billing info into a fake login page, attackers can use that data for much more than streaming fraud. Identity Theft companies can monitor personal information like your Social Security number (SSN), phone number and email address, and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaways

Stacey’s caution prevented him from becoming another victim of this email scam. These messages keep getting more believable, so spotting the red flags and using the steps above can save you time, money and frustration.

Have you seen a fake subscription alert recently that nearly fooled you? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

[ad_2]

Source link

December 22, 2025
Data breach exposes 400,000 bank customers’ info

[ad_1]

NEWYou can now listen to Fox News articles!

A major data breach tied to U.S. fintech firm Marquis is rippling through banks, credit unions and their customers. Hackers broke into Marquis systems by exploiting a known but unpatched vulnerability in a SonicWall firewall, gaining access to deeply sensitive consumer data.

At least 400,000 people are confirmed to be affected so far across multiple states. Texas has been hit the hardest with more than 354,000 residents affected. That number is expected to rise as additional breach notifications are filed.

Marquis operates as a marketing and compliance provider for financial institutions. The company says it serves more than 700 banks and credit unions nationwide. That role gives Marquis access to centralized pools of customer data, which also makes it a high-value target.

PASSWORD MANAGER FINED AFTER MAJOR DATA BREACH

Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

A major data breach tied to fintech firm Marquis exposed sensitive banking and identity data for hundreds of thousands of people. (Kurt “CyberGuy” Knutsson)

What information was stolen in the Marquis cyberattack

According to legally required disclosures filed in Texas, Maine, Iowa, Massachusetts and New Hampshire, hackers accessed a wide range of personal and financial data. Stolen information includes customer names, dates of birth, postal addresses, Social Security numbers and bank account, debit and credit card numbers. The breach dates back to Aug. 14, when attackers gained access through the SonicWall firewall vulnerability. Marquis later confirmed the incident was a ransomware attack.

While Marquis did not publicly name the attackers, the campaign has been widely linked to the Akira ransomware gang. Akira has previously targeted organizations running SonicWall appliances during large-scale exploitation waves. This was not a routine credential leak.

We reached out to Marquis for comment, and a company spokesperson provided CyberGuy with the following statement:

“In August, Marquis Marketing Services experienced a data security incident. Upon discovery, we immediately enacted our response protocols and proactively took the affected systems offline to protect our data and our customers’ information. We engaged leading third-party cybersecurity experts to conduct a comprehensive investigation and notified law enforcement.

“The incident was quickly contained, and our investigation was recently completed. It was determined that an unauthorized third party accessed certain non-public information within our network. However, there is no evidence indicating that any personal information has been used for identity theft or financial fraud. We have notified potentially affected individuals.

“We know our customers place great trust in us, and at Marquis, we take that responsibility seriously by making the protection of their information our highest priority. We are extremely appreciative of the cooperation, understanding, and support of our employees and customers during this time.”

HOW TO STOP IMPOSTOR BANK SCAMS BEFORE THEY DRAIN YOUR WALLET

Why the Marquis data breach creates long-term identity risk

When a data breach exposes your full identity, the danger does not disappear after the news cycle ends. Unlike a stolen password, this kind of information cannot be changed, which means the risk can stick around for a long time.

“With a typical credential leak, you reset passwords, rotate tokens and move on,” Ricardo Amper, CEO and Founder of Incode Technologies, a digital identity verification company, tells CyberGuy. “But core identity data is static. You cannot meaningfully change your date of birth or SSN, and once those are exposed, they can circulate on criminal markets for years. The breach is a moment in time, but the exposure it creates can follow people for the rest of their financial lives.”

That is why identity breaches are so dangerous. Criminals can reuse the same stolen data years later to open new accounts, build fake identities or run highly targeted scams that feel personal and convincing. Many attackers now combine this data with AI tools to scale their efforts. As a result, phishing emails, phone calls and even voice impersonations are harder to spot when they reference real details about your bank or account history.

The most likely scams after identity data is stolen

When criminals obtain verified identity data, fraud becomes targeted rather than opportunistic.

“Once criminals get their hands on rich, verified identity data, fraud stops being a guessing game and becomes a targeted execution,” Amper said.

The first major threat is account takeover. With enough personal details, attackers can bypass knowledge-based checks, reset passwords, change contact information and abuse accounts in ways that often look legitimate. The second risk is new account fraud. This includes credit cards, loans, buy now pay later services and even new bank accounts. High-quality data helps these applications pass automated systems and manual reviews.

The fastest-growing threat is synthetic identity fraud. Real data, like a Social Security number, is blended with fabricated details to create a new identity that matures over time before a large financial bust.

“These attacks are hard to catch early because the data being presented is accurate and often reused across multiple institutions,” Amper noted. “If your defenses can’t reliably tell a real human from an AI-generated impersonation, you are starting every decision from a position of disadvantage,” he added.

Why unpatched firewall flaws pose such a serious threat

Ransomware groups like Akira increasingly focus on widely deployed infrastructure to maximize impact. Firewalls sit at the boundary of trusted networks. When one is compromised, everything behind it becomes reachable.

“What we’re seeing with groups like Akira is a focus on maximizing impact by targeting widely used infrastructure. The strategy remains the same: Find a single weak point that gives access to many downstream victims at once,” Amper said.

This approach exposes a persistent blind spot in traditional cybersecurity thinking. Many organizations still assume traffic passing through a firewall is safe.

“When the perimeter device itself is the entry point, static defenses and outdated controls simply can’t keep up,” Amper explained.

Hackers accessed names, Social Security numbers and bank details by exploiting an unpatched firewall vulnerability. (Kurt “CyberGuy” Knutsson)

How long affected consumers should assume risk remains high

Identity data does not expire. Social Security numbers and birth dates stay the same for life.

“When core identity data reaches criminal markets, the risk does not fade quickly,” Amper emphasized. “Fraud rings treat stolen identity data like inventory. They hold it, bundle it, resell it and combine it with information from new breaches.”

Warning signs of misuse can be subtle. These include credit inquiries you did not authorize, account recovery alerts from unfamiliar services or phone calls that convincingly mimic a bank’s verification process using deepfake voice tools.

“The most damaging fraud often starts long after the breach is no longer in the news,” Amper added.

The overlooked impact of identity theft

Financial losses are only part of the damage. Victims often experience a lasting erosion of trust.

Amper says, “The most overlooked consequence is the psychological toll of knowing that you can no longer trust who is contacting you. Deepfake impersonation turns every phone call, video message or urgent request into a potential attack.”

Ways to stay safe after the Marquis data breach

When a breach exposes Social Security numbers, bank details and birth dates, the risk does not end with a password reset. These steps focus on protections that reduce long-term identity misuse and help you detect fraud early.

1) Freeze your credit with all major bureaus

A credit freeze prevents criminals from opening new accounts in your name using stolen identity data. This is critical after the Marquis breach, where full identity profiles were exposed. Freezing credit does not affect your score and can be lifted temporarily when needed. Place a free credit freeze with Equifax, Experian and TransUnion online or by phone. Each bureau must be contacted separately. Once frozen, new credit cannot be opened unless you temporarily lift or remove the freeze using a PIN or account login.

2) Place a fraud alert on your credit file

A fraud alert tells lenders to take extra steps to verify your identity before approving credit. It adds protection if you are not ready to freeze credit everywhere or want an extra layer on top of a freeze. Fraud alerts last for one year and can be renewed. You only need to contact one credit bureau to place a fraud alert. Equifax, Experian or TransUnion will notify the others for you. Fraud alerts are free and last for one year.

3) Enable transaction and account alerts

Turn on alerts for withdrawal, purchase, login attempts and password changes across all financial accounts. Real-time alerts can help you catch account takeovers or unauthorized activity before serious damage occurs.

4) Review bank statements and credit reports regularly

Check statements and credit reports often, even months or years after the breach. Identity data from incidents like this is frequently reused later for delayed fraud. Watch for unfamiliar accounts, hard inquiries or small test charges.

5) Use phishing-resistant two-factor authentication

Text message codes can be intercepted or socially engineered. Where possible, switch to app-based or hardware-backed two-factor authentication. These options are harder for attackers to bypass, even when they know your personal details.

6) Rely on strong device-based biometrics where available

Biometrics tied to your physical device add a layer that criminals cannot easily replicate. Face and fingerprint authentication help block account takeovers driven by stolen identity data or AI-powered impersonation.

7) Use strong antivirus software

Reputable antivirus software helps detect malicious links, fake login pages and follow-up attacks that target breach victims. This adds protection against phishing and ransomware tied to identity-based scams.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

THIRD-PARTY BREACH EXPOSES CHATGPT ACCOUNT DETAILS

8) Consider a data removal service

Data brokers collect and resell personal information that can be combined with breach data to fuel targeted fraud. A data removal service reduces how much of your personal information is publicly available and lowers your exposure over time.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Experts warn this type of identity exposure can fuel fraud and scams for years after the breach is discovered. (Kurt ‘CyberGuy’ Knutsson)

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

9) Add an identity theft protection service

Identity theft services monitor credit files, dark web markets and account activity for signs that your stolen data is being misused. Many also offer recovery assistance in the event of fraud, which can save time and stress when dealing with banks, credit bureaus and government agencies. This monitoring is especially useful after breaches like Marquis, where identity data can resurface long after the initial incident.

See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

10) Verify unexpected outreach through official channels

Be cautious of urgent calls, emails or texts that reference real banking or personal details. Scammers now use accurate breach data to sound legitimate. Hang up and contact your bank directly using the number on your card or official website.

11) Lock down tax and government accounts

Create or secure online accounts with the IRS, Social Security Administration and your state tax agency. Enable strong authentication and monitor for unexpected notices. Stolen identity data is often used for tax refund fraud or benefit scams long after a breach.

Kurt’s key takeaways

The Marquis data breach highlights how dangerous unpatched infrastructure vulnerabilities have become for the financial sector. When a single vendor holds data for hundreds of institutions, the fallout spreads quickly. For you, identity protection is no longer a one-time response. It is an ongoing necessity that can last years beyond the initial breach.

What questions do you still have about protecting your identity after a major data breach like this one? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

[ad_2]

Source link

December 20, 2025
Holiday deliveries and fake tracking texts: How scammers track you
[ad_1]
NEWYou can now listen to Fox News articles!

As we head into the last stretch of December (and last-minute gift shopping), your doorstep is probably busier than ever. And if you’re anything like me, you’re probably also juggling shipping updates, tracking numbers, and “out for delivery” alerts from half a dozen retailers.

Unfortunately, scammers know this too, and they’ve likely been preparing for it all year. Like clockwork, I’ve already started seeing the usual wave of fake tracking texts hitting people’s phones. They look legit, they show up right when you’re expecting a package, and they rely on one inescapable truth: during the holiday rush, most of us are too overwhelmed to notice when something feels off.

No need to panic, though. You can still come out ahead of the scammers. I’ll show you what to look out for and how you can prevent being targeted in the first place.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

THE FAKE REFUND SCAM: WHY SCAMMERS LOVE HOLIDAY SHOPPERS

Holiday shoppers are being hit with a surge of fake delivery texts designed to steal personal information and account logins. (Photo by Sebastian Kahnert/picture alliance via Getty Images)

What fake delivery text messages look like

Most of these fake shipping texts include a “tracking link” that looks close enough to the real thing that you might tap without thinking twice about it. In some cases, like one Maryland woman found out, you may even receive fake deliveries with a QR code that works in a similar way.

These links usually lead to a spoofed tracking page that looks almost identical to the real thing. It’ll ask you to “confirm” your login or enter your delivery details. The moment you type anything in, scammers capture it and use it to access your real accounts.

Even worse, the “tracking link” may contain malware or spyware, triggering silent installs that can steal passwords, monitor keystrokes, or give scammers remote access to your device.

Red flags that reveal fake shipping and tracking messages

So how can you distinguish between a legitimate message for a delivery you’re actually waiting for and one of these scams? Here are the red flags I look for:
- Weird or slightly altered URLs. Scammers use domains that look almost right. Except there’s usually one extra letter, a swapped character, or a completely unfamiliar extension.
- Requests for additional payment. Real carriers don’t ask you to pay a “small fee” to release a package. That’s an instant giveaway.
- A package you’re not expecting. If the text is vague or you can’t match it to a recent order, pause before you tap anything.
- Delivery attempts at odd hours. “Missed delivery at 6:12 AM” or “late-night attempt” messages are usually fake. Carriers don’t normally operate like that.
- Updates that don’t match what you see in the retailer’s app or email. If Amazon says your package is arriving tomorrow, but a random text says it’s delayed or stuck, trust Amazon, not the text.
- Language that is designed to rush you. Anything screaming “immediate action required!” is designed to make you stop thinking and start tapping.
If a text triggers any one of these, I delete it on the spot. When in doubt, always check directly with the delivery service provider first before opening any links.

WHY YOUR HOLIDAY SHOPPING DATA NEEDS A CLEANUP NOW

Scammers are sending deceptive tracking links that mimic real carriers, hoping rushed shoppers won’t notice red flags. (Silas Stein/picture alliance via Getty Images)

How scammers know your address, phone number, and shopping habits

Scammers don’t magically know where you live or what you’ve ordered — they buy that information. There’s actually an entire industry of data brokers built on collecting and selling personal data. This can include your:
- Phone number
- Home address
- Email
- Purchase history
- Browsing patterns
- Retailers accounts and apps
- Loyalty programs
- Even preferred delivery times.
These data brokers can sell profiles containing hundreds of data points on you. And they aren’t always discerning about who they sell to. In fact, some of them have been caught intentionally selling data to scammers.

Once scammers have those details, creating a convincing delivery scam is no problem.

But scammers can’t target what they can’t find

I’ve been very vocal about the importance of keeping personal information under lock and key. And this is just one of the reasons why.

Criminals rely on your personal information to target you with these types of scams. They also need at least a phone number or email address to reach you in the first place.

So your best bet to avoid delivery scams (and, honestly, most other scams year-round) is removing your info from data brokers and people search sites. Doing this will keep your details out of circulation online and out of the wrong hands.

FBI WARNS EMAIL USERS AS HOLIDAY SCAMS SURGE

Fraudsters use spoofed shipping pages and malware to capture passwords and gain access to victims’ devices. (Martin Ollman/Getty Images)

How to remove your personal information from scammers’ reach

You can start by looking yourself up online. Searching for different combinations of your name, address, email, and phone number should bring up a bunch of people search sites. Just visit the “opt-out” page on each site to request removal of your data.

Private-database data brokers are a bit trickier. They sell data in bulk, usually to marketers and other third parties. So you won’t be able to check if they have your information. But if you look into which data brokers operate in your area, you can just send opt-out requests to them all. There’s a good chance they’ll have your information.

You can also turn to a data removal service. They completely remove the headache from this process and just automatically keep your personal info off data broker sites. If, like me, you don’t have the time to keep manually checking data broker sites and sending removal requests every few months (because your data will keep reappearing), a personal data removal service is the way to go.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

Kurt’s key takeaways

Holiday delivery scams work because they blend perfectly into the chaos of December shopping. A well-timed text and a familiar tracking link are often all it takes to lower your guard. By slowing down, checking messages directly with retailers, and reducing how much of your personal data is circulating online, you can take away the advantage scammers rely on. A little caution now can save you a major headache later.

Have you received a suspicious delivery text or tracking message this holiday season? If so, tell us what it looked like and how you handled it by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.
[ad_2]

Source link
December 19, 2025
Facebook settlement scam emails to avoid now

[ad_1]

NEWYou can now listen to Fox News articles!

Millions of Facebook users filed claims in a recent privacy settlement after the platform was accused of mishandling user data. The approved payouts have been rolling out, which means people are watching their inboxes for updates. Scammers know this and are sending look-alike emails that push you to click a “Redeem Virtual Card” button. Arlene B emailed us to share what landed in her inbox.

“I received an email stating that it was from (Facebook User Privacy Settlement Administrator) and that I needed to click on the button below to “Redeem Virtual Card.” Do you know if this is a scam or not?”

Her question shows how convincing these fake messages appear. A real settlement did happen, and people have been getting payments. Still, criminals are now piggybacking on the rollout with messages that look official but lead to dangerous sites that steal your information. Let’s walk through how to tell real emails from fake ones.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

NEW SCAM SENDS FAKE MICROSOFT 365 LOGIN PAGES

Scammers send fake settlement emails that mimic the real payout notices to trick you into clicking. (Kurt “CyberGuy” Knutsson)

How to check if your Facebook settlement email is legitimate

Scammers rely on confusion and urgency. These steps help you confirm the message before you click anything.

Confirm the sender’s address

Real settlement emails come from facebookuserprivacysettlement@notifications.kroll.com. Kroll is the official administrator.

Look for your claimant ID

Real notices include your unique claimant ID and reference the claim you filed last year. Fake emails skip this personalized detail.

Check where the link leads

Real payout links go to DigitalPay / Veritas or domains tied to krollsettlementadministration. If the link points to a strange or shortened URL, it is likely unsafe.

Watch for common red flags

Pressure to act right away. Clumsy wording or spelling mistakes. A button that goes to a suspicious URL. You never filed a claim in the first place. Any sender address that is not the official Kroll domain.

Remember that you are not required to click anything

If your claim was approved, you have already received a legitimate notice. Emails that say you must “redeem” again or “confirm” payment are signs of a scam.

GEEK SQUAD SCAM EMAIL: HOW TO SPOT AND STOP IT

A quick hover over the “Redeem Virtual Card” button often reveals a suspicious link that gives the scam away. (Kurt “CyberGuy” Knutsson)

Why scammers target large settlements

Whenever a major payout occurs, criminals blend in with legitimate messages because people expect money and may open emails quickly. When fake notices look similar to real ones, it only takes one careless click for scammers to grab your data.

DON’T FALL FOR FAKE SETTLEMENT SITES THAT STEAL YOUR DATA

A person logging onto Facebook (Kurt “CyberGuy” Knutsson)

Ways to stay safe from settlement scams

Use these simple habits to protect yourself from Facebook settlement scams and any future payout scam.

1) Verify the sender every time

Look at the full address. Scammers often change one character in hopes you will not notice.

2) Hover over links before tapping

Check the destination without clicking. A strange URL is your warning sign.

3) Never share sensitive information through email

Real administrators do not ask for banking info or logins.

4) Use a data removal service

Data brokers often collect your email address, phone number and other personal details that scammers use to target victims. A data removal service can pull you out of those databases, which reduces the amount of scam email that reaches you in the first place.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

5) Go directly to the official settlement site

Type in the address yourself instead of using a link from an email.

6) Use strong antivirus software

Good security software blocks dangerous links and pages. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

7) Delete emails that push urgency

Scammers want fast reactions. Slow down and confirm details.

Kurt’s key takeaways

The Facebook settlement payout created the perfect moment for scammers to slip fake messages into inboxes. Once you know the signs, it becomes much easier to separate real notices from dangerous ones. Stay alert, trust your instincts and verify before you click.

Would you open a payout email if you were not expecting money in the first place? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

[ad_2]

Source link

December 18, 2025