ReportWire

Tag: Cybercrime

  • The fake refund scam: Why scammers love holiday shoppers

    [ad_1]

    NEWYou can now listen to Fox News articles!

    The holiday shopping season should feel exciting, but for scammers, it’s rush hour. And this year, one trick is hitting more inboxes and phones than ever: the fake refund scam. If you’ve ever seen an unexpected “Your refund has been issued,” “Your payment failed” or “We owe you money” email or text during November or December, it wasn’t an accident.

    Scammers know you’re buying more, tracking more packages and juggling more receipts than at any other time of year. That chaos makes fake refund scams incredibly effective and incredibly dangerous.

    Here’s why these scams are spreading, how to spot them instantly and the one thing you can do today to stop scammers from targeting you in the first place.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    FBI WARNS EMAIL USERS AS HOLIDAY SCAMS SURGE

    Fake refund emails can look convincing during the holidays, making it easy to fall for a scam when your inbox is overflowing. (Kurt “CyberGuy” Knutsson)

    Why refund scams skyrocket during the holidays

    Scammers strike when Americans are distracted, rushed and making dozens of purchases. Black Friday, Cyber Monday and holiday gift-buying create the perfect storm:

    1) You’re expecting legitimate refunds

    Holiday shopping means:

    • Items going out of stock
    • Orders getting canceled
    • Packages arriving late
    • Prices changing
    • Stores offering “Best Price Guarantee” refunds.

    Scammers know this. When you’re already expecting refund emails, their fake ones blend right in.

    2) You’re spending more, which means bigger targets

    A study shows that this year, Americans will spend 3.6% more than the previous year on holiday shopping. A $200 to $500 purchase is completely normal during this season. Other reports show a decrease in spending, but note that people spend, on average, over $600 during the Black Friday promotions alone.

    Expenses stack up, new things arrive, some get returned and a “$249 refund issued” message doesn’t look suspicious—it looks plausible. But it’s crucial you check if that message is real. Never click any links without a thorough look at the email address, name and content of the message.

    3) Your inbox is overflowing

    Have you been eyeing a new home appliance? Or a present for a loved one? Have you saved anything in your cart just to see if the price drops? Thanks to Black Friday, your inbox is probably filled with:

    • Promotional codes
    • Offers
    • Shipping updates
    • Order confirmations
    • Receipts
    • Return notifications.

    It’s easy to lose track of your orders and packages amidst the influx of emails. And when you’re skimming more than 200 promotions, scams become harder to catch.

    4) They know exactly what you purchased

    Scammers get their information from data brokers, companies that collect, package and sell your personal information. Your profile can include anything from your name, contact information, to your purchase history and even your financial situation.

    In general, data brokers and shopping apps sell patterns, including:

    • Where you shop
    • How much you spend
    • What categories you buy
    • Recent purchases
    • Your email, phone number and address.

    And scammers buy that information to craft compelling and personalized attacks. That’s why their fake refund emails often mimic retailers you actually used.

    HOW TO STOP IMPOSTOR BANK SCAMS BEFORE THEY DRAIN YOUR WALLET

    A woman on her computer

    Scammers use urgent warnings and realistic details to pressure you into clicking links that steal your personal information. (Kurt “CyberGuy” Knutsson)

    How the fake refund scam works

    Scammers usually follow one of three playbooks:

    “Your refund is ready-verify your account.” You click a link, and you’re taken to what looks like Amazon, Walmart, UPS, Target or Best Buy. And when you enter your login, scammers can steal your credentials by manipulating you.

    “We overcharged you. Click here for your refund.” It asks for your debit card number, your bank login and your PayPal credentials. Or worse: it installs malware that steals them automatically.

    Phone version: “We issued a refund by mistake.” You get a call from someone pretending to be Amazon customer service, PayPal support, or even your bank. They say they “refunded too much money” and need you to send back the difference. Some even screen-share to drain bank accounts in real time.

    These scams cost Americans hundreds of millions of dollars every year. The FTC reports that impostor scams (which are related to online shopping) accounted for the second-highest reported losses, resulting in $2.95 billion being lost in 2024.

    What these emails look like so you can spot them fast

    Scammers are getting more sophisticated. Fake refund messages often include:

    • Your correct name
    • A real store logo
    • A real order amount
    • A believable order number
    • “Click to view refund” buttons
    • Deadline pressure like “respond within 24 hours.”

    Here’s the giveaway: No legitimate retailer requires you to enter banking info to receive a refund, ever.

    Note that scams often ask you to:

    • Confirm a payment
    • Verify personal info
    • Log in through a link
    • Provide banking details
    • Download an invoice.

    The simplest way to protect yourself before the holiday peak

    Deleting your data manually from data broker sites is technically possible, but extremely tedious. Some require government ID uploads, faxed forms, multiple follow-up requests and updates every 30 to 90 days because they relist your data.

    This is why most people almost never do it. A data removal service, however, automates the entire process. These services:

    • Identify which broker sites have your info
    • Send official deletion requests on your behalf
    • Force them to remove your data
    • Continually monitor and re-request removals
    • Block brokers from relisting you

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    A woman typing on her computer

    Criminals often rely on data from broker sites to personalize refund scams, which is why reducing your digital footprint matters. (Kurt “CyberGuy” Knutsson)

    How to protect yourself this season (3 quick steps)

    Remember to follow these few simple steps to safeguard yourself against targeted scams.

    1) Never click refund links in emails or texts

    Go directly to your retailer’s website and check your actual order history. Verify the email address of the sender and only communicate with official representatives of the retailer.

    2) Turn on multi-factor authentication

    Set up two-factor authentication (2FA) for all of your accounts. With the help of 2FA, you’ll need to authorize logins via email, text message or generated PINs. So, even if you accidentally enter your password somewhere fake, 2FA can stop the breach.

    3) Limit how scammers can find you

    This is the part most people skip—and it’s why they stay targets. Removing your personal info from data broker sites cuts off scammers’ access to your real details. A data removal service automates and makes the process ongoing, which is why I recommend it to my most privacy-conscious readers.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Kurt’s key takeaways

    Refund scams explode during the holiday shopping season because scammers rely on two things: Chaos in your inbox and your personal data being sold behind your back. You can’t stop scammers from sending fake emails, but you can stop them from targeting you specifically. Before peak holiday shopping hits, take a moment to clean up your data trail. You’ll end up with fewer scams, fewer risks and far more peace of mind.

    Have you received a suspicious refund email or text this season? Share your experience so we can help warn others in the comments below. Let us know by writing to us at Cyberguy.com

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • France probes ‘foreign interference’ after remote control malware found on passenger ferry

    [ad_1]

    PARIS — France’s counterespionage agency is investigating a suspected cyberattack plot targeting an international passenger ferry, authorities said Wednesday.

    A Latvian crew member is in custody facing charges of having acted for an unidentified foreign power, French officials said. But Interior Minister Laurent Nunez appeared to hint that Russia is suspected, saying: “At the moment, foreign interference very often comes from same country.”

    France and other European allies of Ukraine allege that Russia is waging “hybrid warfare” against them, using sabotage, assassinations, cyberattacks, disinformation and other hostile acts that are often hard to quickly trace back to Moscow.

    Intelligence shared by Italian authorities tipped off the General Directorate of Internal Security — France’s special counterespionage and counterterror intelligence service — that software sometimes used by cybercriminals may have infected computer systems aboard a ferry docked in the French Mediterranean port of Sète, the Paris prosecutor’s office said.

    The so-called RAT software — which allows users to control computer systems remotely — could have been used to take control of the ferry’s computers, the prosecutor’s office said. Its statement did not name ferry.

    Nunez told public broadcaster France Info that “individuals tried to gain access to a ship’s data-processing system.” He described it as “a very serious affair.” Asked if the suspected intention was to hijack the vessel, he said: “We don’t know.”

    He added: “The investigators appear to be following a trail of interference … foreign interference.”

    Police on Friday arrested two of the ferry’s crew members — one Latvian, the other Bulgarian — who Italian authorities had identified as suspects, the prosecutor’s office said. The Bulgarian was subsequently released without charge after questioning.

    The Latvian national is being held on a preliminary criminal conspiracy charge and two preliminary charges of hacking-related offenses with the goal of serving the interests of an unnamed foreign power, the prosecutor’s office said.

    It said search raids were also carried out in Latvia. Latvian state police said they had no comment.

    The ferry is now back in operation after being held in port for security checks to its computer system, the prosecutor’s office said.

    ___

    AP European Security Correspondent Emma Burrows in London contributed.

    [ad_2]

    Source link

  • Fake Windows update pushes malware in new ClickFix attack

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Cybercriminals keep getting better at blending into the software you use every day. 

    Over the past few years, we’ve seen phishing pages that copy banking portals, fake browser alerts that claim your device is infected and “human verification” screens that push you to run commands you should never touch. The latest twist comes from the ongoing ClickFix campaign.

    Instead of asking you to prove you are human, attackers now disguise themselves as a Windows update. It looks convincing enough that you might follow the instructions without thinking, which is exactly what they want.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    NEW SCAM SENDS FAKE MICROSOFT 365 LOGIN PAGES

    The malware hides inside seemingly normal image files, using steganography to slip past traditional security tools.  (Microsoft)

    How the fake update works

    Researchers noticed that ClickFix has upgraded its old trick. The campaign used to rely on human verification pages, but now you get a full-screen Windows update screen that looks almost identical to the real thing. Joe Security showed how the page displays fake progress bars, familiar update messages and a prompt that tells you to complete a critical security update.

    If you are on Windows, the site tells you to open the Run box, copy something from your clipboard and paste it in. That “something” is a command that silently downloads a malware dropper. The final payload is usually an infostealer, which steals passwords, cookies and other data from your machine.

    NEW EMAIL SCAM USES HIDDEN CHARACTERS TO SLIP PAST FILTERS

    A fake Windows update screen

    Fake update screens are getting harder to spot as attackers mimic Windows with near-perfect precision. (Joe Security)

    The moment you paste the command, the infection chain begins. First, a file called mshta.exe reaches out to a remote server and grabs a script. To avoid detection, these URLs often use hex encoding for parts of the address and rotate their paths. The script then runs obfuscated PowerShell code filled with junk instructions to throw researchers off. Once PowerShell does its work, it decrypts a hidden .NET assembly that functions as the loader.

    Why is this attack so hard to detect?

    The loader hides its next stage inside what looks like a regular PNG file. ClickFix uses custom steganography, which is a technique that hides secret data inside normal-looking content. In this case, the malware sits inside the image’s pixel data. The attackers tweak color values in certain pixels, especially in the red channel, to embed pieces of shellcode. When you view the image, everything appears normal.

    The script knows exactly where the hidden data sits. It extracts the pixel values, decrypts them and rebuilds the malware directly in memory. That means nothing obvious is written to disk. Security tools that rely on file scanning miss it, since the shellcode never appears as a standalone file.

    Once rebuilt, the shellcode is injected into a trusted Windows process like explorer.exe. The attack uses familiar in-memory techniques such as VirtualAllocEx, WriteProcessMemory and CreateRemoteThread. Recent ClickFix activity has delivered infostealers like LummaC2 and updated versions of Rhadamanthys. These tools are built to harvest credentials and send them back to the attacker with very little noise.

    Person wearing a hoodie works on multiple computer screens displaying digital data in a dark room.

    Once the hidden code loads into a trusted Windows process, infostealers quietly begin harvesting your data. (Kurt “CyberGuy” Knutsson)

    7 steps you can take to protect yourself from the ClickFix campaign

    The best way to stay protected is to slow down for a moment and follow a few steps that cut off these attacks before they start.

    1) Never run commands you didn’t ask for

    If any site tells you to paste a command into Run, PowerShell or Terminal, treat it as an immediate warning sign. Real operating system updates never require you to run commands from a webpage. When you run that command, you hand full control to the attacker. If something feels off, close the page and don’t interact further.

    2) Keep Windows updates inside Windows

    Updates should only come from the Windows Settings app or through official system notifications. A browser tab or pop-up pretending to be a Windows update is always fake. If you see anything outside the normal update flow asking for your action, ignore it and check the real Windows Update page yourself.

    3) Use a reputable antivirus

    Choose a security suite that can detect both file-based and in-memory threats. Stealthy attacks like ClickFix avoid leaving obvious files for scanners to pick up. Tools with behavioral detection, sandboxing and script monitoring give you a much better chance of spotting unusual activity early.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    4) Use a password manager

    Password managers create strong, unique passwords for every account you use. They also autofill only on legitimate websites, which helps you catch fake login pages. If a manager refuses to fill out your credentials, take a second look at the URL before entering anything manually.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

    5) Use a personal data removal service

    Many attacks start by targeting emails and personal details already exposed online. Data removal services help shrink your digital footprint by requesting takedowns from data broker sites that collect and sell your information. They can’t erase everything, but reducing your exposure means fewer attackers have easy access to your details.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    6) Check URLs before trusting anything

    A convincing layout doesn’t mean it is legitimate. Always look at the domain name first. If it doesn’t match the official site or uses odd spelling or extra characters, close it. Attackers rely on the fact that people recognize a page’s design but ignore the address bar.

    7) Close suspicious full-screen pages

    Fake update pages often run in full-screen mode to hide the browser interface and make the page look like part of your computer. If a site suddenly goes full screen without your permission, exit with Esc or Alt+Tab. Once you’re out, scan your system and don’t return to that page.

    Kurt’s key takeaway

    ClickFix works because it leans on user interaction. Nothing happens unless you follow the instructions on the screen. That makes the fake Windows update page especially dangerous, because it taps into something most people trust. If you are used to Windows updates freezing your screen, you may not question a prompt that appears during the process. Cybercriminals know this. They copy trusted interfaces to lower your guard and then rely on you to run the final command. The technical tricks that follow are complex, but the starting point is simple. They need you to help them.

    Do you ever copy commands from a website without thinking twice about what they do? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 

    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Third-party breach exposes ChatGPT account details

    [ad_1]

    NEWYou can now listen to Fox News articles!

    ChatGPT went from novelty to necessity in less than two years. It is now part of how you work, learn, write, code and search. OpenAI has said the service has roughly 800 million weekly active users, which puts it in the same weight class as the biggest consumer platforms in the world. 

    When a tool becomes that central to your daily life, you assume the people running it can keep your data safe. That trust took a hit recently after OpenAI confirmed that personal information linked to API accounts had been exposed in a breach involving one of its third-party partners.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    The breach highlights how even trusted analytics partners can expose sensitive account details. (Kurt “CyberGuy” Knutsson)

    What you need to know about the ChatGPT breach

    OpenAI’s notification email places the breach squarely on Mixpanel, a major analytics provider the company used on its API platform. The email stresses that OpenAI’s own systems were not breached. No chat histories, billing information, passwords or API keys were exposed. Instead, the stolen data came from Mixpanel’s environment and included names, email addresses, Organization IDs, coarse location and technical metadata from user browsers. 

    FAKE CHATGPT APPS ARE HIJACKING YOUR PHONE WITHOUT YOU KNOWING

    That sounds harmless on the surface. The email calls this “limited” analytics data, but the label feels like PR cushioning more than anything else. For attackers, this kind of metadata is gold. A dataset that reveals who you are, where you work, what machine you use and how your account is structured gives threat actors everything they need to run targeted phishing and impersonation campaigns.

    The biggest red flag is the exposure of Organization IDs. Anyone who builds on the OpenAI API knows how sensitive these identifiers are. They sit at the center of internal billing, usage limits, account hierarchy and support workflows. If an attacker quotes your Org ID during a fake billing alert or support request, it suddenly becomes very hard to dismiss the message as a scam.

    OpenAI’s own reconstructed timeline raises bigger questions. Mixpanel first detected a smishing attack on November 8. Attackers accessed internal systems the next day and exported OpenAI’s data. That data was gone for more than two weeks before Mixpanel told OpenAI on November 25. Only then did OpenAI alert everyone. It is a long and worrying silent period, and it left API users exposed to targeted attacks without even knowing they were at risk. OpenAI says it cut Mixpanel off the next day.

    The size of the risk and the policy problem behind it

    The timing and the scale matter here. ChatGPT sits at the center of the generative AI boom. It does not just have consumer traffic. It has sensitive conversations from developers, employees, startups and enterprises. Even though the breach affected API accounts rather than consumer chat history, the exposure still highlights a wider issue. When a platform reaches almost a billion weekly users, any crack becomes a national-scale problem.

    Regulators have been warning about this exact scenario. Vendor security is one of the weak links in modern tech policy. Data protection laws tend to focus on what a company does with the information you give them. They rarely provide strong guardrails around the entire chain of third-party services that process this data along the way. Mixpanel is not an obscure operator. It is a widely used analytics platform trusted by thousands of companies. Yet it still lost a dataset that should never have been accessible to an attacker.

    Companies should treat analytics providers the same way they treat core infrastructure. If you cannot guarantee that your vendors follow the same security standards you do, you should not be collecting the data in the first place. For a platform as influential as ChatGPT, the responsibility is even higher. People do not fully understand how many invisible services sit behind a single AI query. They trust the brand they interact with, not the long list of partners behind it.

    artificial intelligence language model

    Attackers can use leaked metadata to craft convincing phishing emails that look legitimate. (Jaap Arriens/NurPhoto via Getty Images)

    8 steps you can take to stay safer when using AI tools

    If you rely on AI tools every day, it’s worth tightening your personal security before your data ends up floating around in someone else’s analytics dashboard. You cannot control how every vendor handles your information, but you can make it much harder for attackers to target you.

    1) Use strong, unique passwords

    Treat every AI account as if it holds something valuable because it does. Long, unique passwords stored in a reliable password manager reduce the fallout if one platform gets breached. This also protects you from credential stuffing, where attackers try the same password across multiple services.

    Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com/Passwords) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

    2) Turn on phishing-resistant 2FA

    AI platforms have become prime targets, so they rely on stronger 2FA. Use an authenticator app or a hardware security key. SMS codes can be intercepted or redirected, which makes them unreliable during large-scale phishing campaigns.

    3) Use strong antivirus software

    Another important step you can take to protect yourself from phishing attacks is to install strong antivirus software on your devices. This can also alert you to phishing emails and ransomware scams, helping you keep your personal information and digital assets safe. 

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. 

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

    PARENTS BLAME CHATGPT FOR SON’S SUICIDE, LAWSUIT ALLEGES OPENAI WEAKENED SAFEGUARDS TWICE BEFORE TEEN’S DEATH

    4) Limit what personal or sensitive data you share

    Think twice before pasting private conversations, company documents, medical notes or addresses into a chat window. Many AI tools store recent history for model improvements unless you opt out, and some route data through external vendors. Anything you paste could live on longer than you expect.

    5) Use a data-removal service to shrink your online footprint

    Attackers often combine leaked metadata with information they pull from people-search sites and old listings. A good data-removal service scans the web for exposed personal details and submits removal requests on your behalf. Some services even let you send custom links for takedowns. Cleaning up these traces makes targeted phishing and impersonation attacks much harder to pull off.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    6) Treat unexpected support messages with suspicion

    Attackers know users panic when they hear about API limits, billing failures or account verification issues. If you get an email claiming to be from an AI provider, do not click the link. Open the site manually or use the official app to confirm whether the alert is real.

    A smartphone shows ChatGPT open in an internet browser.

    Events like this show why strengthening your personal security habits matters more than ever. (Kurt “CyberGuy” Knutsson)

    7) Keep your devices and software updated

    A lot of attacks succeed because devices run outdated operating systems or browsers. Regular updates close vulnerabilities that could be used to steal session tokens, capture keystrokes or hijack login flows. Updates are boring, but they prevent a surprising amount of trouble.

    8) Delete accounts you no longer need

    Old accounts sit around with old passwords and old data, and they become easy targets. If you’re not actively using a particular AI tool anymore, delete it from your account list and remove any saved information. It reduces your exposure and limits how many databases contain your details.

    Kurt’s key takeaway

    This breach may not have touched chat logs or payment details, but it shows how fragile the wider AI ecosystem can be. Your data is only as safe as the least secure partner in the chain. With ChatGPT now approaching a billion weekly users, that chain needs tighter rules, better oversight and fewer blind spots. If anything, this should be a reminder that the rush toward AI adoption needs stronger policy guardrails. Companies cannot hide behind transparent emails after the fact. They need to prove that the tools you rely on every day are secure at every layer, including the ones you never see.

    Do you trust AI platforms with your personal information? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Germany summons Russian ambassador over alleged sabotage, cyberattacks and election interference

    [ad_1]

    BERLIN (AP) — Germany summoned Russia’s ambassador Friday following accusations of sabotage, cyberattacks and election interference, an official said.

    The German government has also accused Moscow of perpetrating disinformation campaigns.

    “The goal of these Russian cyber and disinformation attacks is clear: It is to divide society, stir up mistrust, provoke rejection, and weaken confidence in democratic institutions,” German foreign ministry spokesperson Martin Giese said.

    “This targeted manipulation of information is one of a wide range of activities by Russia aimed at undermining confidence in democratic institutions and processes in Germany,” he said during a government news conference.

    German officials have previously accused Russia of hybrid warfare attacks to destabilize Europe. Moscow didn’t immediately return a request for comment Friday.

    Giese said that the shadowy Russian military intelligence agency known as GRU was behind a 2024 cyberattack against German air traffic control. The foreign ministry says GRU, which has been sanctioned in other countries, was responsible for the attack that was allegedly perpetrated by hacker collective APT28, also known as Fancy Bear.

    APT28 and GRU have also been linked to global cyber intrusions, including in the 2016 U.S. election, where they were accused of aiding U.S. President Donald Trump by leaking Democratic Party emails.

    Giese also said investigators believe GRU also attempted to destabilize and influence Germany’s last federal election, held in February, through a campaign called “Storm 1516.”

    “Our services’ analysis shows that the campaign spreads artificially generated, pseudo-investigative research, deepfake image sequences, pseudo-journalistic websites, and fabricated witness statements on various platforms,” he said.

    Russia will face a series of countermeasures for its hybrid warfare, Giese said.

    “The German government condemns the repeated and unacceptable attacks by state-controlled Russian actors in the strongest possible terms,” he said. “We will continue to strengthen our support for Ukraine and our deterrence and defense.”

    The summons occurred Friday as the European Union indefinitely froze Russia’s assets in Europe to ensure that Hungary and Slovakia, both with Moscow-friendly governments, can’t prevent the billions of euros from being used to support Ukraine.

    Using a special procedure meant for economic emergencies, the EU blocked the assets until Russia gives up its war on Ukraine and compensates its neighbor for the heavy damage that it has inflicted for almost four years.

    It’s a key step that will allow EU leaders to work out at a summit next week how to use the tens of billions of euros in Russian Central Bank assets to underwrite a huge loan to help Ukraine meet its financial and military needs over the next two years.

    [ad_2]

    Source link

  • Malicious browser extensions hit 4.3M users

    [ad_1]

    NEWYou can now listen to Fox News articles!

    A long-running malware campaign quietly evolved over several years and turned trusted Chrome and Edge extensions into spyware. A detailed report from Koi Security reveals that the ShadyPanda operation affected 4.3 million users who downloaded extensions later updated with hidden malicious code.

    These extensions began as simple wallpaper or productivity tools that looked harmless. Years later, silent updates added surveillance functions that most users could not detect.

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    THIS CHROME VPN EXTENSION SECRETLY SPIES ON YOU

    Malicious extensions spread through trusted browsers and quietly collected user data for years. (Kurt “CyberGuy” Knutsson)

    How the ShadyPanda campaign unfolded

    The operation included 20 malicious Chrome extensions and 125 on the Microsoft Edge Add-ons store. Many first appeared in 2018 with no obvious warning signs. Five years later, the extensions began receiving staged updates that changed their behavior.

    Koi Security found that these updates rolled out through each browser’s trusted auto-update system. Users did not need to click anything. No phishing. No fake alerts. Just quiet version bumps that slowly turned safe extensions into powerful tracking tools.

    NEW EMAIL SCAM USES HIDDEN CHARACTERS TO SLIP PAST FILTERS

    A screenshot of WeTab in the Google Play store

    WeTab functions as a sophisticated surveillance platform disguised as a productivity tool. (Koi)

    What the extensions were doing behind the scenes

    Once activated, the extensions injected tracking code into real links to earn revenue from user purchases. They also hijacked searches, redirected queries and logged data for sale and manipulation. ShadyPanda gathered an unusually broad range of personal information, including browsing history, search terms, cookies, keystrokes, fingerprint data, local storage, and even mouse movement coordinates. As the extensions gained credibility in the stores, the attackers pushed a backdoor update that allowed hourly remote code execution. That gave them full browser control, letting them monitor websites visited and exfiltrate persistent identifiers.

    Researchers also discovered that the extensions could launch adversary-in-the-middle attacks. This allowed credential theft, session hijacking and code injection on any website. If users opened developer tools, the extensions switched into harmless mode to avoid detection. Google removed the malicious extensions from the Chrome Web Store. We reached out to the company, and a spokesperson confirmed that none of the extensions listed are currently live on the platform.

    Meanwhile, a Microsoft spokesperson told CyberGuy, “We have removed all the extensions identified as malicious on the Edge Add-on store. When we become aware of instances that violate our policies, we take appropriate action that includes, but is not limited to, the removal of prohibited content or termination of our publishing agreement.” 

    Most of you will not need the full technical IDs used in the ShadyPanda campaign. These indicators of compromise are primarily for security researchers and IT teams. Regular users should focus on checking your installed extensions using the steps in the guide below.

    You can review the full list of affected Chrome and Edge extensions to see every ID tied to the ShadyPanda campaign by clicking here and scrolling down to the bottom of the page.

    How to check whether your browser contains these extension IDs

    Here is an easy, step-by-step way for you to verify if any malicious extension IDs are installed.

    For Google Chrome

    Open Chrome.

    Type chrome://extensions into the address bar.

    Press Enter.

    Look for each extension’s ID.

    Click Details under any extension.

    Scroll down to the Extension ID section.

    Compare the ID with the lists above.

    If you find a match, remove the extension immediately.

    For Microsoft Edge

    Open Edge.

    Type edge://extensions into the address bar.

    Press Enter.

    Click Details under each extension.

    Scroll to find the Extension ID.

    If an ID appears in the lists, remove the extension and restart the browser.

    183 MILLION EMAIL PASSWORDS LEAKED: CHECK YOURS NOW

    person typing

    Simple security steps can block hidden threats and help keep your browsing safer. (Kurt “CyberGuy” Knutsson)

    How to protect your browser from malicious extensions

    You can take a few quick actions that help lock down your browser and protect your data.

    1) Remove suspicious extensions

    Before removing anything, check your installed extensions against the IDs listed in the section above. Most of the malicious extensions were wallpaper or productivity tools. Three of the most mentioned are Clean Master, WeTab and Infinity V Plus. If you installed any of these or anything that looks similar, delete them now. 

    2) Reset your passwords

    These extensions have access to sensitive data. Resetting your passwords protects you from possible misuse. A password manager makes the process easier and creates strong passwords for each account.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

    3) Use a data removal service to reduce tracking

    ShadyPanda collected browsing activity, identifiers and behavioral signals that can be matched with data already held by brokers. A data removal service helps you reclaim your privacy by scanning people-search sites and broker databases to locate your exposed information and remove it. This limits how much of your digital footprint can be linked, sold or used for targeted scams.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    4) Install strong antivirus software

    An antivirus may not have caught this specific threat due to the way it operated. Still, it can block other malware, scan for spyware and flag unsafe sites. Many antivirus tools include cloud backup and VPN options to add more protection.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

    5) Limit your extensions

    Each extension adds risk. Stick with known developers and search for recent reviews. If an extension asks for permissions it should not need, walk away. 

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Kurt’s key takeaways

    ShadyPanda ran for years without raising alarms and proved how creative attackers can be. A trusted extension can shift into spyware through a silent update, which makes it even more important to stay alert to changes in browser behavior. You protect yourself by installing fewer extensions, checking them from time to time and watching for anything that feels out of place. Small steps help lower your exposure and reduce the chances that hidden code can track what you do online.

    Have you ever found an extension on your browser that you didn’t remember installing or one that started acting in strange ways?  How did you handle it? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alert, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Why your holiday shopping data needs a cleanup now

    [ad_1]

    NEWYou can now listen to Fox News articles!

    If the ads you see in December feel a little too accurate, you are not imagining it. 

    The holiday shopping season is the busiest time of the year for retailers and for data brokers. These companies quietly track, collect and sell your personal information. Every search, click, cart add and purchase feeds a digital shopping profile tied to your name, phone number, email and address.

    If you do not clean it up before the year ends, that profile will follow you into 2026. It fuels more scam calls, targeted ads, identity theft attempts and privacy risks you never agreed to. Here is how your profile forms, why data brokers want it and how to erase it fast.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    FBI WARNS EMAIL USERS AS HOLIDAY SCAMS SURGE

    Your digital shopping profile forms every time you browse, click or buy during the holiday season. (iStock)

    Your digital shopping profile forms the moment you shop online

    Your profile starts forming the second you browse Amazon, Target, Sephora, Walmart or any online store. Every interaction adds new data points, including:

    • Items you viewed
    • Items you added to your cart
    • Purchases and near-purchases
    • Shipping and billing addresses
    • Total spending
    • Preferred brands
    • Device type and browser
    • IP address and physical location

    Activity spikes in November and December. You are searching for gifts, deals, decorations and electronics. Data brokers watch this surge and collect more aggressively.

    How data brokers get your information

    Data brokers gather your personal information from several places at once. Here are the most common sources.

    1) Retailers send your shopping data to third parties

    Most retailers use analytics, advertising or measurement partners. These partners are often data brokers. The more companies that handle your information, the higher the risk of exposure.

    Marketing tools may analyze personal details such as age, race, gender, location and shopping habits. Even without clear consent, partners often receive:

    • Full purchase histories
    • Timestamps
    • Product categories
    • Loyalty account details

    Some stores even share in-store behavior when you scan a loyalty card.

    2) Shopping apps track far more than what you buy

    Apps from Amazon, Temu, Walmart, SheinTarget and others track everything you do. They often collect:

    • Real-time location
    • Device data
    • Contact lists if allowed
    • Swipe patterns
    • Time spent viewing specific items

    This behavioral data becomes extremely valuable to data brokers. It also helps scammers understand how to target you.

    couple holiday shopping

    Data brokers collect this activity from retailers, apps and tools to build a detailed record of your habits. (iStock)

    3) Price-comparison tools copy your browsing habits

    Browser plugins that offer price drops or deal matching often collect far more than you expect. An FTC investigation revealed that they can capture details from location and demographics to mouse movements.

    Data points like these get packaged, sold and added to your digital shopping profile. Scammers can then build highly targeted attacks.

    What scammers can do with your digital shopping profile

    Scammers use these profiles to run more convincing attacks during the holiday season. With access to your data, they can:

    • Send fake order confirmations
    • Launch refund scams
    • Send fraudulent delivery texts
    • Commit identity theft
    • Resell your information to other criminals

    If you interact with a scam even once, your profile may be marked as verified. That makes you a priority target for future attacks.

    PROTECT YOUR DATA BEFORE HOLIDAY SHOPPING SCAMS STRIKE

    Why December is the best month to delete your data

    Each January brings a surge in scams, including refund scams, account update scams, IRS scams, Medicare scams and subscription renewal scams. Many of these attacks rely on the holiday shopping data collected in the weeks before.

    If you delete your data now, you reduce:

    • Scam calls
    • Spam emails
    • Targeted phishing attempts
    • The number of companies holding your personal information

    Data brokers must delete your information once you request it. Acting now limits how much of your 2025 activity they can store and resell.

    WHAT REALLY HAPPENS ON THE DARK WEB, AND HOW TO STAY SAFE

    However, removing your data manually is nearly impossible. You would need to contact and send opt-out requests to:

    • People-search sites
    • Marketing data brokers
    • Retail data aggregators
    • Ad-targeting vendors
    • Shopping analytics platforms
    • Credit-linked identity brokers

    One at a time.

    The fastest way to delete your digital shopping profile

    This is why I recommend using an automated data removal service. They remove your exposed data from hundreds of data broker sites and continue to monitor new threats.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Someone in sweater types their credit card information into their computer to make a purchase.

    Clearing your data in December reduces scams, cuts targeted tracking and protects your privacy heading into the new year. (iStock )

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    Kurt’s key takeaways

    Your digital shopping profile may feel invisible, but it shapes the ads you see, the scams you receive and how exposed your personal information becomes. The holiday season gives data brokers more information in two months than they collect during the rest of the year. Use December to clean it up. With a few smart steps and an automated data removal service, you can enter 2025 with fewer scams, fewer trackers and more control over your privacy.

    What part of your digital shopping profile surprised you most after learning how data brokers track you? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • How to spot wallet verification scam emails

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Recently, you may have received alarming emails like the one below from “sharfharef” titled “Wallet Verification Required” that uses the MetaMask logo and branding.

    These messages warn you to verify your wallet by following a link, but scammers use emails like this to steal your crypto information.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    FBI WARNS EMAIL USERS AS HOLIDAY SCAMS SURGE

    Scam emails posing as MetaMask alerts are tricking users into revealing their crypto wallet details. (Photographer: Wei Leng Tay/Bloomberg via Getty Images)

    What is MetaMask and why scammers love it

    MetaMask is a popular crypto wallet and browser extension that lets you store tokens and connect to blockchain apps on networks such as Ethereum. Because MetaMask is widely known and trusted, criminals impersonate it in phishing campaigns that ask users to “verify” wallets and then harvest recovery phrases or keys.

    What makes this email a wallet verification scam

    The scam email copies MetaMask visuals and even routes through a Zendesk address to look more professional, yet the “Verify Wallet Ownership” button points to an unrelated domain that has nothing to do with MetaMask. That mismatch between branding and destination is a major red flag in crypto phishing attacks. It also relies on classic pressure tactics and vague corporate language. The body reads:

    Dear Valued User,
    As part of our ongoing commitment to account security, we require verification to confirm ownership of your wallet.
    This essential security measure helps protect your assets and maintain the integrity of our platform.
    Action Required By: December 03, 2025
    Your prompt attention to this verification will help ensure uninterrupted access to your account and maintain the highest level of security protection.

    Phrases like “Dear Valued User,” “essential security measure” and “Action Required By” are common in phishing emails that pretend to be MetaMask and threaten restrictions if you do not comply. Genuine MetaMask support will direct you to metamask.io or official apps and will never ask you to reveal your secret recovery phrase through a link in an unsolicited email.

    In this case, the message even claims to come from “МеtаМаsk.io (Support@МеtаМаsk.io)” . That display name looks like MetaMask Support, but the real sending address is an unrelated Zendesk subdomain, which is a classic red flag. MetaMask explains that legitimate support messages only come from specific official addresses, so anything else should be treated as a scam and ignored.

    Why mention Zendesk can be misleading

    Zendesk is a legitimate customer support platform that many companies use to manage tickets and notifications. Scammers sometimes route fake alerts through such services or spoof similar addresses, so messages look like real support tickets, which can fool users who associate Zendesk branding with trust.

    In this case, the presence of a Zendesk-style address does not make the message safe because the link still leads away from MetaMask’s official website and asks you to react to manufactured urgency.

    NEW EMAIL SCAM USES HIDDEN CHARACTERS TO SLIP PAST FILTERS

    Hacker typing on a computer.

    Phishing messages urging MetaMask “wallet verification” direct victims to fake websites that steal recovery phrases. (Photo by Morteza Nikoubazl/NurPhoto via Getty Images)

    Steps to stay safe from wallet verification scam emails

    Taking the right precautions can protect your digital wallet and personal data from scammers.

    1) Do not click suspicious links and use strong antivirus software

    Avoid clicking buttons or links in unexpected wallet verification emails, even if they show the MetaMask logo. Instead, open your browser and type metamask.io yourself or use the official mobile app to check for any real alerts. Also, install strong antivirus software to detect malicious links, fake sites or malware that tries to capture your keystrokes. 

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Keep it updated so it can block new phishing infrastructure and known scam domains.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    2) Use official websites only

    Always confirm that the address bar shows MetaMask’s official domain or your wallet provider’s genuine site before you sign in. If an email link sends you to a domain that looks odd, close it immediately.

    3) Keep your credentials private

    Never enter your secret recovery phrase, password or private keys on a site you reached by email. MetaMask support will not ask for that information, and anyone who gets it can empty your wallet.

    4) Enable two-factor authentication

    Turn on two-factor authentication (2FA) wherever your exchange or related accounts support it, since codes from an app or key add a barrier even if a password leaks. Store backup codes safely offline, so criminals cannot reach them.

    REAL APPLE SUPPORT EMAILS USED IN NEW PHISHING SCAM

    Person checking their emails on their laptop.

    Criminals are spoofing Zendesk-style addresses to make fraudulent MetaMask support emails appear legitimate. (Photo by Felix Zahn/Photothek via Getty Images)

    5) Use a data removal service

    Data removal services can help reduce exposed personal details from data broker sites that attackers use to target victims by name and email. Less exposed information makes it harder for phishers to craft convincing wallet alerts tailored to you.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    6) Mark suspicious emails

    Mark any fake MetaMask messages as spam or phishing in your inbox so filters learn to block similar attacks. You can also report phishing attempts through MetaMask and your email provider to help protect other users.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Kurt’s key takeaways

    Emails like the one from “sharfharef” use MetaMask’s trusted name, polished design and alarming language to push you into clicking before you think. When you slow down, check the sender, read the wording and confirm the website address, you strip scammers of their biggest advantage, which is panic.

    What questions do you still have about protecting your digital accounts and crypto wallets that you want us to answer in a future article? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com. All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Chinese hackers turned AI tools into an automated attack machine

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Cybersecurity has been reshaped by the rapid rise of advanced artificial intelligence tools, and recent incidents show just how quickly the threat landscape is shifting.

    Over the past year, we’ve seen a surge in attacks powered by AI models that can write code, scan networks and automate complex tasks. This capability has helped defenders, but it has also enabled attackers who are moving faster than before.

    The latest example is a major cyberespionage campaign conducted by a Chinese state-linked group that used Anthropic’s Claude to carry out large parts of an attack with very little human involvement.

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter 

    How Chinese hackers turned Claude into an automated attack machine

    In mid-September 2025, Anthropic investigators spotted unusual behavior that eventually revealed a coordinated and well-resourced campaign. The threat actor, assessed with high confidence as a Chinese state-sponsored group, had used Claude Code to target roughly thirty organizations worldwide. The list included major tech firms, financial institutions, chemical manufacturers and government bodies. A small number of those attempts resulted in successful breaches.

    HACKER EXPLOITS AI CHATBOT IN CYBERCRIME SPREE

    Claude handled most of the operation autonomously, triggering thousands of requests and generating detailed documentation of the attack for future use. (Kurt “CyberGuy” Knutsson)

    How the attackers bypassed Claude’s safeguards

    This was not a typical intrusion. The attackers built a framework that let Claude act as an autonomous operator. Instead of asking the model to help, they tasked it with executing most of the attack. Claude inspected systems, mapped out internal infrastructure and flagged databases worth targeting. The speed was unlike anything a human team could replicate.

    To get around Claude’s safety rules, the attackers broke their plan into tiny, innocent-looking steps. They also told the model it was part of a legitimate cybersecurity team performing defensive testing. Anthropic later noted that the attackers didn’t simply hand tasks to Claude; they engineered the operation to make the model believe it was performing authorized pentesting work, splitting the attack into harmless-looking pieces and using multiple jailbreak techniques to push past its safeguards. Once inside, Claude researched vulnerabilities, wrote custom exploits, harvested credentials and expanded access. It worked through these steps with little supervision and reported back only when it needed human approval for major decisions.

    The model also handled the data extraction. It collected sensitive information, sorted it by value and identified high-privilege accounts. It even created backdoors for future use. In the final stage, Claude generated detailed documentation of what it had done. This included stolen credentials, systems analyzed and notes that could guide future operations.

    Across the entire campaign, investigators estimate that Claude performed around eighty to ninety percent of the work. Human operators stepped in only a handful of times. At its peak, the AI triggered thousands of requests, often multiple per second, a pace still far beyond what any human team could achieve. Although it occasionally hallucinated credentials or misread public data as secret, those errors underscored that fully autonomous cyberattacks still face limitations, even when an AI model handles the majority of the work.

    Why this AI-powered Claude attack is a turning point for cybersecurity

    This campaign shows how much the barrier to high-end cyberattacks has dropped. A group with far fewer resources could now attempt something similar by leaning on an autonomous AI agent to do the heavy lifting. Tasks that once required years of expertise can now be automated by a model that understands context, writes code and uses external tools without direct oversight.

    Earlier incidents documented AI misuse, but humans were still steering every step. This case is different. The attackers needed very little involvement once the system was in motion. And while the investigation focused on usage within Claude, researchers believe similar activity is happening across other advanced models, which might include Google Gemini, OpenAI’s ChatGPT or Musk’s Grok.

    This raises a difficult question. If these systems can be misused so easily, why continue building them? According to researchers, the same capabilities that make AI dangerous are also what make it essential for defense. During this incident, Anthropic’s own team used Claude to analyze the flood of logs, signals and data their investigation uncovered. That level of support will matter even more as threats grow.

    We reached out to Anthropic for comment, but did not hear back before our deadline.

    Chinese hackers target US telecoms: What you need to know to protect your data

    Hackers used Claude to map networks, scan systems, and identify high-value databases in a fraction of the time human attackers would need. (Kurt “CyberGuy” Knutsson)

    FORMER GOOGLE CEO WARNS AI SYSTEMS CAN BE HACKED TO BECOME EXTREMELY DANGEROUS WEAPONS

    You may not be the direct target of a state-sponsored campaign, but many of the same techniques trickle down to everyday scams, credential theft and account takeovers. Here are seven detailed steps you can take to stay safer.

    1) Use strong antivirus software and keep it updated

    Strong antivirus software does more than scan for known malware. It looks for suspicious patterns, blocked connections and abnormal system behavior. This is important because AI-driven attacks can generate new code quickly, which means traditional signature-based detection is no longer enough.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    2) Rely on a password manager

    A good password manager helps you create long, random passwords for every service you use. This matters because AI can generate and test password variations at high speed. Using the same password across accounts can turn a single leak into a full compromise.

    Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com

    3) Consider using a personal data removal service

    A large part of modern cyberattacks begins with publicly available information. Attackers often gather email addresses, phone numbers, old passwords and personal details from data broker sites. AI tools make this even easier, since they can scrape and analyze huge datasets in seconds. A personal data removal service helps clear your information from these broker sites so you are harder to profile or target.

    FAKE CHATGPT APPS ARE HIJACKING YOUR PHONE WITHOUT YOU KNOWING

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    4) Turn on two-factor authentication wherever possible

    Strong passwords alone are not enough when attackers can steal credentials through malware, phishing pages or automated scripts. Two-factor authentication adds a serious roadblock. Use app-based codes or hardware keys instead of SMS. While no method is perfect, this extra layer often stops unauthorized logins even when attackers have your password.

    5) Keep your devices and apps fully updated

    Attackers rely heavily on known vulnerabilities that people forget or ignore. System updates patch these flaws and close off entry points that attackers use to break in. Enable automatic updates on your phone, laptop, router and the apps you use most. If an update looks optional, treat it as important anyway, because many companies downplay security fixes in their release notes.

    6) Install apps only from trusted sources

    Malicious apps are one of the easiest ways attackers get inside your device. Stick to official app stores and avoid APK sites, shady download portals and random links shared on messaging apps. Even on official stores, check reviews, download counts and the developer name before installing anything. Grant the minimum permissions required and avoid apps that ask for full access for no clear reason.

    7) Ignore suspicious texts, emails, and pop-ups

    AI tools have made phishing more convincing. Attackers can generate clean messages, imitate writing styles, and craft perfect fake websites that match the real ones. Slow down when a message feels urgent or unexpected. Never click links from unknown senders, and verify requests from known contacts through a separate channel. If a pop-up claims your device is infected or your bank account is locked, close it and check directly through the official website.

    woman using phone

    By breaking tasks into small, harmless-looking steps, the threat actors tricked Claude into writing exploits, harvesting credentials, and expanding access.  (Kurt “CyberGuy” Knutsson)

    Kurt’s key takeaway

    The attack carried out through Claude signals a major shift in how cyber threats will evolve. Autonomous AI agents can already perform complex tasks at speeds no human team can match, and this gap will only widen as models improve. Security teams now need to treat AI as a core part of their defensive toolkit, not a future add-on. Better threat detection, stronger safeguards and more sharing across the industry are going to be crucial. Because if attackers are already using AI at this scale, the window to prepare is shrinking fast.

    Should governments push for stricter regulations on advanced AI tools? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • America’s most-used password in 2025 revealed

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Passwords play a huge role in how you stay safe online. They protect your accounts, devices and money. Still, many people pick logins that criminals can guess in seconds. 

    The latest NordPass report shows this problem again. This year, “admin” took the top spot as the most common password in the United States.

    NordPass and NordStellar, two cybersecurity companies that track leaked credentials and online threats, reviewed millions of exposed passwords to spot trends. They also examined how password habits differ across generations. The pattern is clear: many of us still rely on simple words, easy number strings and familiar keyboard patterns. These choices give attackers a quick path into countless accounts.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    183 MILLION EMAIL PASSWORDS LEAKED: CHECK YOURS NOW

    Weak passwords like “admin” give attackers a quick way into your accounts before you even realize it.  (Kurt “CyberGuy” Knutsson)

    Most common passwords in the United States

    NordPass shared its top 20 list for 2025. “Admin” sits at number one. Variations of the word “password” take up five spots. Number strings appear nine times. One explicit term even made the list.

    Here are the 20 most common passwords in the USA this year:

    • admin
    • password
    • 123456
    • 12345678
    • 123456789
    • 12345
    • Password
    • 12345678910
    • Gmail.12345
    • Password1
    • Aa123456
    • f*******t
    • 1234567890
    • abc123
    • Welcome1
    • Password1!
    • password1
    • 1234567
    • 111111
    • 123123

    Weak logins remain a major problem because criminals rely on automated tools. These tools try simple words and common patterns first. When millions of people reuse the same easy passwords, attackers succeed fast.

    HOW TO USE PASSKEYS TO KEEP YOUR COMPUTER SAFE

    Reusing the same login across sites makes it easy for criminals to jump from one hacked account to another.

    Reusing the same login across sites makes it easy for criminals to jump from one hacked account to another. (Kurt “CyberGuy” Knutsson)

    Global trends show the same risky password behavior

    The United States is not alone. Globally, “123456” ranks as the most common password. “Admin” and “12345678” follow closely behind. These patterns appear because they are easy to remember. Sadly, they are also easy to crack.

    Researchers noticed one shift worth noting: more passwords now include special characters. The increase is sharp. However, most examples remain weak. Strings like P@ssw0rd and Abcd@1234 still follow predictable rules that tools can break with little effort.

    The word “password” stays popular around the world. People even use it in local languages. This shows how widespread the problem is.

    Why younger generations still make unsafe password choices

    Many people assume younger adults understand digital safety. They grew up with phones and social media. Research shows that this assumption is wrong.

    NordPass found that an 18-year-old often picks the same weak password patterns as an 80-year-old. Younger users favor long number sequences. Older users lean toward names. Neither group creates secure or random strings. Generations Z and Y tend to avoid names. Generations X and older use them often. Each approach carries risk because attackers expect both patterns.

    AI-POWERED SCAMS TARGET KIDS WHILE PARENTS STAY SILENT

    Researchers found that weak and predictable passwords still appear in leaked data again and again.

    Researchers found that weak and predictable passwords still appear in leaked data again and again. (Kurt “CyberGuy” Knutsson)

    Why weak passwords remain a big threat

    Weak passwords fuel data breaches and account takeovers. Criminals run scripts that check billions of combinations every second. When your password is common, they break in fast.

    A single stolen login can expose your email, social accounts, bank information and more. Many attacks start this way. Once criminals get inside one account, they often try the same password on others.

    Steps to stay safe with your passwords 

    You can improve your digital safety with a few simple habits. These steps help block common attacks and protect your accounts.

    1) Create strong random passwords

    Pick long passwords or short passphrases. Aim for at least 20 characters. Mix letters, numbers and special characters. Avoid patterns. 

    2) Avoid password reuse

    Use a unique password for each account. If one login gets hacked, the others stay safe.

    3) Review and update weak passwords

    Check your old logins. Replace anything short, predictable or reused. Fresh passwords lower your risk.

    4) Use a password manager

    A password manager creates secure passwords and stores them safely. It also fills them in for you, so you do not need to remember them.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

    5) Turn on multi-factor authentication (MFA)

    MFA adds a second check before you log in. It is one of the easiest ways to block attackers.

    6) Keep your software updated

    Update your phone, computer browsers and apps on a regular schedule. These updates patch security gaps that criminals try to exploit. When you fall behind on updates, weak passwords become even riskier because attackers can pair old software flaws with easy logins.

    Pro Tip: Use a data removal service

    Leaked passwords often come from old profiles on data broker sites you forgot about. A data removal service can wipe your personal info from those sites and reduce how much of your data ends up on breach lists. When less of your information is floating around online, your accounts become less tempting targets.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Kurt’s key takeaways 

    Weak passwords remain a huge issue in 2025, even with new tools and better education. You have the power to improve your security with a few quick changes. When you build strong habits, you make it harder for criminals to get inside your accounts. Small steps add up fast and give you far more protection online.

    What do you think keeps people stuck on weak passwords even when the risks are clear? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • New Android malware can empty your bank account in seconds

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Android users have been dealing with a steady rise in financial malware for years. Threats like Hydra, Anatsa and Octo have shown how attackers can take over a phone, read everything on the screen and drain accounts before you even notice anything wrong. Security updates have helped slow some of these strains, but malware authors keep adapting with new tricks. 

    The latest variant spotted in circulation is one of the most capable yet. It can silence your phone, take screenshots of banking apps, read clipboard entries, and even automate crypto wallet transactions. This threat is now known as Android BankBot YNRK, and it is far more advanced than typical mobile malware.

    Sign up for my FREE CyberGuy ReportGet my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

    How the malware infiltrates devices

    HOW ANDROID MALWARE LETS THIEVES ACCESS YOUR ATM CASH

    Android banking malware is getting harder to spot as attackers use new tricks to take over phones and drain accounts. (Thomas Trutschel/Photothek via Getty Images)

    BankBot YNRK hides inside fake Android apps that appear legitimate when installed. In the samples analyzed by researchers at Cyfirma, the attackers used apps that impersonated official digital ID tools. Once installed, the malware begins profiling the device by collecting details such as brand, model and installed apps. It checks whether the device is an emulator to avoid automated security analysis. It also maps known models to screen resolutions, which helps it tailor its behavior to specific phones.

    To blend in, the malware can disguise itself as Google News. It does this by changing its app name and icon, then loading the real news.google.com site inside a WebView. While the victim believes the app is genuine, the malware quietly runs its background services.

    One of its first actions is to mute audio and notification alerts. This prevents victims from hearing incoming messages, alarms or calls that could signal unusual account activity. It then requests access to Accessibility Services. If granted, this allows the malware to interact with the device interface just like a user. From that point onward, it can press buttons, scroll through screens and read everything displayed on the device.

    BankBot YNRK also adds itself as a Device Administrator app. This makes it harder to remove and helps it restart itself after a reboot. To maintain long-term access, it schedules recurring background jobs that relaunch the malware every few seconds as long as the phone is connected to the internet.

    What does the malware steal

    Once the malware receives commands from its remote server, it gains near-complete control of the phone. It sends device information and installed app lists to the attackers, then receives a list of financial apps it should target. This list includes major banking apps used in Vietnam, Malaysia, Indonesia and India, along with several global cryptocurrency wallets.

    With Accessibility permissions enabled, the malware can read everything shown on the screen. It captures UI metadata such as text, view IDs and button positions. This helps it reconstruct a simplified version of any app’s interface. Using this data, it can enter login details, swipe through menus or confirm transfers. It can also set text inside fields, install or remove apps, take photos, send SMS, turn call forwarding on and open banking apps in the background while the screen appears inactive.

    In cryptocurrency wallets, the malware acts like an automated bot. It can open apps such as Exodus or MetaMask, read balances and seed phrases, dismiss biometric prompts, and carry out transactions. Because all actions happen through Accessibility, the attacker never needs your passwords or PINs. Anything visible on the screen is enough.

    The malware also monitors the clipboard, so if users copy OTPs, account numbers or crypto keys, the data is immediately sent to the attackers. With call forwarding enabled, incoming bank verification calls can be silently redirected. All of these actions happen within seconds of the malware activating.

    Google search

    BankBot YNRK hides inside fake apps that look legitimate, then disguises itself as Google News while it runs in the background. (AP Photo/Don Ryan, File)

    7 steps you can take to stay safe from banking malware

    Banking trojans are getting harder to spot, but a few simple habits can reduce the chances of your phone getting compromised. Here are seven practical steps that help you stay protected. 

    FBI WARNS OVER 1 MILLION ANDROID DEVICES HIJACKED BY MALWARE

    1) Install strong antivirus software

    Strong antivirus software helps catch trouble early by spotting suspicious behavior before it harms your Android device or exposes your data. It checks apps as you install them, alerts you to risky permissions and blocks known malware threats. Many top antivirus options also scan links and messages for danger, which adds an important layer of protection when scams move fast.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    2) Use a data-removal service to shrink your digital footprint

    Data brokers quietly collect and sell your personal details, which helps scammers target you with more convincing attacks. A reputable data-removal service can find and delete your information from dozens of sites so that criminals have less to work with. This reduces spam, phishing attempts and the chances of ending up on a malware attack list.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    3) Install apps only from trusted sources

    Avoid downloading APKs from random websites, forwarded messages or social media posts. Most banking malware spreads through sideloaded apps that look official but contain hidden code. The Play Store is not perfect, but it offers scanning, app verification and regular take-downs that greatly reduce the risk of installing infected apps.

    4) Keep your device and apps updated

    System updates often patch security issues that attackers exploit to bypass protections. Updating your apps is just as important, since outdated versions may contain weaknesses. Turn on automatic updates so that your device stays protected without you having to check manually.

    5) Use a strong password manager

    A password manager helps you create long, unique passwords for every account. It also saves you from typing passwords directly into apps, which reduces the chance of malware capturing them from your clipboard or keystrokes. If one password gets exposed, the rest of your accounts remain safe.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    man working on cellphone

    Once active, the malware can read your screen, steal financial data, automate crypto transfers and intercept OTPs within seconds. (Kurt “CyberGuy” Knutsson)

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com

    6) Enable two-factor authentication wherever possible

    2FA adds a confirmation step through an OTP, authenticator app or hardware key. Even if attackers steal your login details, they still need this second step to get in. It cannot stop malware that takes over your device, but it significantly limits how far an attacker can go with stolen credentials.

    GOOGLE ISSUES WARNING ON FAKE VPN APPS

    7) Review app permissions and installed apps regularly

    Malware often abuses permissions such as Accessibility or Device Admin because they allow deep control over your phone. Check your settings to see which apps have these permissions and remove anything that looks unfamiliar. Also, look through your installed apps and uninstall any tool or service you do not remember adding. Regular reviews help you spot threats early before they can steal data.

    Kurt’s key takeaway

    BankBot YNRK is one of the most capable Android banking threats discovered recently. It combines device profiling, strong persistence, UI automation and data theft to gain full control over a victim’s financial apps. Because much of its activity relies on Accessibility permissions, a single tap from the user can give attackers complete access. Staying safe means avoiding unofficial APKs, reviewing installed apps regularly and being cautious of any sudden request to enable special permissions.

    Do you think Android phone makers like Samsung or Google are doing enough to protect you from malware? Let us know by writing to us at Cyberguy.com

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • New scam sends fake Microsoft 365 login pages

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Attackers have a new tool that targets Microsoft 365 users at a massive scale. 

    Security researchers say a phishing platform called Quantum Route Redirect, or QRR, is behind a growing wave of fake login pages hosted on nearly 1,000 domains. These pages look real enough to fool many users while also slipping past some automated scanners.

    QRR runs realistic email lures that mimic DocuSign requests, payment notices, voicemail alerts or QR-code prompts. Each message routes victims to a fake Microsoft 365 login page built to harvest usernames and passwords. The kit often lives on parked or compromised legitimate domains that add a false sense of safety for anyone who clicks.

    Researchers tracked QRR in 90 countries. About 76% of attacks hit US users. That scale makes QRR one of the largest phishing operations active right now.

    WINDOWS 10 USERS FACE RANSOMWARE NIGHTMARE AS MICROSOFT SUPPORT ENDS IN 2025 WORLDWIDE

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Attackers use fake Microsoft security alerts to trick people into entering their Microsoft 365 passwords. (Chona Kasinger/Bloomberg via Getty Images)

    A fast follow to other major Microsoft credential attacks

    QRR appeared soon after Microsoft disrupted a major phishing network known as RaccoonO365. That service sold ready-made Microsoft login copies used to steal more than 5,000 sets of credentials, including accounts tied to over 20 US healthcare organizations. Subscribers paid as little as $12 a day to send thousands of phishing emails.

    Microsoft’s Digital Crimes Unit later shut down 338 related websites and identified Joshua Ogundipe from Nigeria as the operator. Investigators tied him to the phishing code and a crypto wallet that earned more than $100,000. Microsoft and Health-ISAC have since filed a lawsuit in New York that accuses him of multiple cybercrime violations.

    Other recent examples include kits like VoidProxy, Darcula, Morphing Meerkat and Tycoon2FA. QRR builds on these tools with automation, bot filtering and a dashboard that helps attackers run large campaigns fast.

    What makes QRR so effective

    QRR uses about 1,000 domains. Many are real sites that were parked or compromised, which helps the pages pass as legitimate. The URLs also follow a predictable pattern that can look normal to users at a glance.

    The kit includes automated filtering that detects bots. It sends scanners to harmless pages and sends real people to the credential-harvesting site. Attackers can manage campaigns inside a control panel that logs traffic and activity. These features let them scale up quickly without technical skill.

    Security analysts say organizations can no longer depend on URL scanning alone. Layered defenses and behavioral analysis have become essential for spotting threats that use domain rotation and automated evasion.

    Microsoft was contacted by CyberGuy for comment but did not have anything to add at this time.

    HACKERS FIND A WAY AROUND BUILT-IN WINDOWS PROTECTIONS

    Why this matters for Microsoft 365 users

    When attackers get your Microsoft 365 login, they can see your email, grab files and even send new phishing messages that look like they came from you. That can create a chain reaction that spreads fast. This is why the steps below all work together to block these threats before they turn into something bigger.

    Steps to stay safe from QRR and other Microsoft 365 phishing attacks

    Use these simple actions to shrink the risk from fake Microsoft 365 pages and look-alike emails.

    1) Check the sender before you click

    Take a second to look at who the email is really from. A slight misspelling, an unexpected attachment or wording that feels off is a big clue the message may be fake. 

    2) Hover over links first

    Before you open any link, hover your mouse over it to preview the URL. If it does not lead to the official Microsoft login page or looks odd in any way, skip it.

    3) Turn on multifactor authentication (MFA)

    MFA adds an extra layer adds an extra layer that makes it much harder for attackers to break in even if they have your password. Use options like app-based codes or hardware keys so phishing kits cannot bypass them.

    4) Use a data removal service

    Attackers often gather personal details from data broker sites to craft convincing phishing emails. A trusted data removal service scrubs your information from these sites, which cuts down on targeted scams and makes it harder for criminals to tailor fake Microsoft alerts that look real.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Woman typing on microsoft computer.

    QRR hides its phishing pages across nearly 1,000 domains, making the fake login screens look convincing at first glance. (Microsoft)

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    5) Update your browser and apps

    Keep everything on your device up to date. Updates seal off security holes that attackers often rely on when building phishing kits like QRR.

    6) Never click unknown links and use strong antivirus software

    If you need to visit a sensitive site, type the address into your browser instead of tapping a link. Strong antivirus tools also help by warning you about fake websites and blocking scripts that phishing kits use to steal login details.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    MICROSOFT SOUNDS ALARM AS HACKERS TURN TEAMS PLATFORM INTO ‘REAL-WORLD DANGERS’ FOR USERS

    7) Use advanced spam filtering

    Most email providers offer stronger filtering settings that block risky messages before they reach you. Turn on the highest level your account allows to keep more fake Microsoft alerts out of your inbox.

    8) Watch for login alerts

    Turn on Microsoft account sign-in notifications so you get an alert anytime someone tries to access your account. To do this, sign in to your Microsoft account online, open Security, choose Advanced security options and switch on Sign-in alerts for any suspicious activity.

    Microsoft Surface laptop computers in 2017

    Strong sign-in alerts and phishing-resistant MFA help block these scams before criminals can take over your account.  (Drew Angerer/Getty Images)

    Kurt’s key takeaways

    QRR is a reminder of how quickly scammers change their tactics. Tools like this make it easy for criminals to send huge waves of fake Microsoft emails that look real at first glance. The good news is that a few smart habits can put you a step ahead. When you add stronger sign-in protection, turn on alerts and stay aware of the newest tricks, you make it much harder for attackers to sneak in.

    Do you think most people can tell the difference between a real Microsoft login page and a fake one, or have phishing kits become too convincing? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Russian hackers target US engineering firm because of work done for Ukraine

    [ad_1]

    WASHINGTON — Hackers working for Russian intelligence attacked an American engineering company this fall, investigators at a U.S. cybersecurity company said Tuesday — seemingly because that firm had worked for a U.S. municipality with a sister city in Ukraine.

    The findings reflect the evolving tools and tactics of Russia’s cyber war and demonstrate Moscow’s willingness to attack a growing list of targets, including governments, organizations and private companies that have supported Ukraine, even in a tenuous way.

    Arctic Wolf, the U.S. cybersecurity firm that identified the Russian campaign, wouldn’t identify its customer or the city it worked with to protect their security, but said the company had no direct connection to Russia’s invasion of Ukraine. However, the group behind the attack, known to cybersecurity experts as RomCom, has consistently targeted groups with links to Ukraine and its defense against Russia.

    “They routinely go after organizations that support Ukrainian institutions directly, provide services to Ukrainian municipalities, and assist organizations tied to Ukrainian civil society, defense, or government functions,” said Ismael Valenzuela, Arctic Wolf’s vice president of labs, threat research and intelligence.

    The attack on the engineering firm was identified by Arctic Wolf in September before it could disrupt the engineering company’s operations or spread further.

    A message left with officials at the Russian Embassy in Washington seeking comment was not immediately returned.

    Many towns and cities around the world enjoy sister-city relationships with other communities, using the program to offer social and economic exchanges. Several U.S. cities, including Chicago, Baltimore, Albany, N.Y. and Cincinnati, have sister-city relationships with communities in Ukraine.

    The campaign in September came just a few weeks after the FBI warned that hackers linked to Russia were seeking to break into U.S. networks as a way to burrow into important systems or disrupt critical infrastructure. According to the latest bulletin from the U.S. Cybersecurity and Infrastructure Security Agency, the Russia-aligned hackers have multiple motives: disrupting aid and military supplies to Ukraine, punishing businesses with ties to Ukraine, or stealing military or technical secrets.

    Last month, the Digital Security Lab of Ukraine and investigators at SentinelOne, a U.S. cybersecurity firm, exposed a speedy and sprawling cyberattack on relief groups supporting Ukraine, including the International Red Cross and UNICEF. That hacking campaign used fake emails impersonating Ukrainian officials that sought to fool users into infecting their own computers by clicking on malicious links.

    The investigators at SentinelOne stopped short of attributing the attack to the Russian government but noted that the operation targeted groups working on Ukrainian assistance and required six months to plan. The “highly capable adversary” behind the campaign, the investigators determined, is “an operator well-versed in both offensive tradecraft and defensive detection evasion.”

    [ad_2]

    Source link

  • How Android malware lets thieves access your ATM cash

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Smartphone banking has made life easier, but it has also opened new opportunities for cybercriminals.

    Over the past few years, we have seen Android malware steal passwords, intercept OTPs and even take remote control of phones to drain accounts. Some scams focus on fake banking apps, while others rely on phishing messages that trick you into entering sensitive details.

    Security researchers have now discovered a new threat that goes a step further. Instead of simply stealing login information, this malware gives thieves the ability to walk up to an ATM and withdraw your money in real time.

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Android malware like NGate tricks users into downloading fake banking apps that steal sensitive data. (Kurt “CyberGuy” Knutsson)

    How the NGate malware works

    The Polish Computer Emergency Response Team (CERT Polska) discovered a new Android malware called NGate that uses NFC activity to access a victim’s bank account. This malware monitors contactless payment actions on the victim’s phone and forwards all transaction data, including the PIN, directly to a server controlled by attackers. It does not just copy card details. Instead, it waits until the victim taps to pay or performs a verification step, then captures the fresh, one-time authentication codes that modern Visa and Mastercard chips generate.

    To pull this off, attackers need to infect the phone first. They typically send phishing messages claiming there is a security problem with the victim’s bank account. These messages often push people to download a fake banking app from a non-official source. Once the victim installs it, the app walks them through fake verification prompts and requests permissions that allow it to read NFC activity. As soon as the victim taps their phone or enters their PIN, the malware captures everything the ATM needs to validate a withdrawal.

    MANAGE ANDROID APPS WITH THE NEW ‘UNINSTALL’ BUTTON

    A Google phone

    Once installed, the malware captures NFC tap-to-pay codes and PINs the moment the victim uses their phone. (Kurt “CyberGuy” Knutsson)

    What attackers do with the stolen data at the ATM

    The attackers rely on speed. The one-time codes generated during an NFC transaction are valid for only a short period. As soon as the infected phone captures the data, the information is uploaded to the attacker’s server. An accomplice waits near an ATM, holding a device capable of emulating a contactless card. This could be another phone, a smartwatch or custom NFC hardware.

    When the data arrives, the accomplice presents the card-emulating device at the ATM. Since the information contains fresh, valid authentication codes and the correct PIN, the machine treats it like a real card. The ATM authorizes the withdrawal because everything appears to match a legitimate transaction. All of this happens without the criminal ever touching the victim’s physical card. Everything depends on timing, planning and getting the victim to unknowingly complete the transaction on their own phone.

    A man holds a Google phone, powered by Android

    Criminals use the stolen, time-limited codes at an ATM to make real withdrawals without the victim’s card. (Kurt “CyberGuy” Knutsson)

    7 steps you can take to stay safe from Android NGate malware

    As attacks like NGate become more sophisticated, staying safe comes down to a mix of good digital habits and a few simple tools that protect your phone and your financial data.

    1) Download apps only from the Play Store

    Most malicious banking apps spread through direct links sent in texts or emails. These links lead to APK files hosted on random servers. When you install apps only from the Play Store, you get Google’s built-in security checks. Play Protect regularly scans apps for malware and removes harmful ones from your device. However, it is important to note that Google Play Protect may not be enough. Historically, it isn’t 100% foolproof at removing all known malware from Android devices. Even if attackers send convincing messages, avoid installing anything from outside the official store. If your bank wants you to update an app, you will always find it on the Play Store.

    2) Use strong antivirus software

    One careless tap on a fake bank alert can hand criminals everything they need. Strong antivirus software can stop most threats before they cause damage. It scans new downloads, blocks unsafe links and alerts you when an app behaves in ways that could expose your financial data. Many threats like NGate rely on fake banking apps, so having real-time scanning turned on gives you an early warning if something suspicious tries to install itself.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    ATM ‘JACKPOTTING’ CRIME WAVE GROWS AFTER THIEVES WALK AWAY WITH HUNDREDS OF THOUSANDS IN CASH

    3) Keep your device and apps updated

    Security patches fix vulnerabilities that attackers use to hijack permission settings or read sensitive data. Updates also improve how Android monitors NFC and payment activity. Turn on automatic updates for both the operating system and apps, especially banking and payment apps. A fully updated device closes many of the holes that malware tries to exploit.

    4) Use a password manager to avoid phishing traps

    Phishing attacks often direct you to fake websites or fake app login pages that look identical to the real thing. A password manager saves your credentials and fills them in only when the website or app is authentic. If it refuses to autofill, it is a clear sign that you are on a fake page. Consider using a password manager to generate and store complex passwords.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

    5) Turn on two-factor authentication for all financial services

    Two-factor authentication gives you a second layer of protection, even if your password is compromised. App-based authenticators are more secure than SMS codes because they cannot be intercepted as easily. For banking apps, enabling 2FA adds friction for attackers trying to perform unauthorized actions. Combined with strong passwords from a password manager, it significantly reduces the chance of account takeover.

    6) Ignore suspicious texts, emails and calls

    Attackers rely on urgency to trick you. They often claim that your card is blocked, your account is frozen or a payment needs verification. These messages push you to act fast and install a fake app. Always pause and check your bank’s official channels. Contact the bank through verified customer care numbers or the official app. Never click links or open attachments in unsolicited messages, even if they look legitimate.

    7) Review app permissions

    Most people install apps and forget about them. Over time, unused apps pile up with unnecessary permissions that increase risk. Open your phone’s permission settings and check what each app can access. If a simple tool asks for access to NFC, messages or accessibility features, uninstall it. Attackers exploit these excessive permissions to monitor your activity or capture data without your knowledge.

    Kurt’s key takeaway

    Cybercriminals are now combining social engineering with the secure hardware features inside modern payment systems. The malware does not break NFC security. Instead, it tricks you into performing a real transaction and steals the one-time codes at that moment. This makes the attack difficult to spot and even harder to reverse once the withdrawal goes through. The best defense is simple awareness. If a bank ever urges you to download an app from outside the Play Store, treat it as an immediate warning sign. Keeping your phone clean is now as important as keeping your physical card safe.

    Have you ever downloaded an app from outside the Play Store? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • DoorDash breach exposes contact info for customers and workers

    [ad_1]

    NEWYou can now listen to Fox News articles!

    DoorDash confirmed a data breach that exposed personal details for a mix of customers, delivery workers and merchants. The stolen information included names, email addresses, phone numbers and physical addresses. The company said it has no evidence of fraud tied to the breach so far, but the event still raises concerns for anyone who uses the service.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    DoorDash says an employee fell for a social engineering scam that let an unauthorized party access basic contact information. (DoorDash)

    How the DoorDash breach happened

    The company traced the incident back to a social engineering attack. An employee fell for a lure that gave hackers access to DoorDash systems. Once the company spotted the breach, it shut down access, launched an investigation and notified law enforcement. DoorDash also directly notified users where required.

    DoorDash driver

    The company confirmed the incident exposed names, email addresses, phone numbers and physical addresses for some people in its system. (DoorDash)

    Who was affected by the DoorDash breach

    DoorDash said the breach impacted a mix of users across its platform. That includes customers, delivery workers and merchants. CyberGuy reached out to DoorDash and a representative provided the following statement to us:

    “DoorDash recently identified and shut down a cybersecurity incident in which an unauthorized third party gained access to and took basic contact information for some users whose data is maintained by DoorDash. No sensitive information, such as Social Security numbers or other government-issued identification numbers, driver’s license information, or bank or payment card information, was accessed. The information accessed varied by individual and was limited to names, phone numbers, email addresses, and physical addresses. We have deployed enhanced security measures, implemented additional employee training, and engaged an external cybersecurity firm to support our ongoing investigation. For more information, please visit our Help Center.”

    LOOKING FOR A CHEAP CHEESEBURGER? 10 AMERICAN CITIES THAT DELIVER THE BEST MEAL DEALS

    If you received an alert from the company, take steps to protect your information. If you use the app but did not get a notice, you should still follow the safety tips below because exposed contact information can lead to scams long after a breach.

    DoorDash delivery person

    DoorDash says no sensitive information was accessed and investigators found no signs of fraud or identity theft tied to the breach. (DoorDash)

    How to protect yourself after the DoorDash breach

    Even though payment data stayed protected, exposed contact details can still open the door to scams. You can lower your risk with a few smart steps that keep your information safer online.

    1) Watch for phishing attempts

    Scammers move fast after a breach. They often send fake alerts that look like real DoorDash messages. These emails or texts may claim you need to verify your account or update your payment details. Delete any message that asks for personal information or urges you to click a link. When in doubt, go straight to the official app instead of trusting a message.

    2) Use a data removal service

    Data brokers collect and resell personal details that scammers often exploit. A data removal service works to pull your information off those sites. This limits your exposure and makes it harder for criminals to target you. It is one of the easiest long-term steps you can take to protect your privacy.

    IS YOUR PHONE HACKED? HOW TO TELL AND WHAT TO DO

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    3) Use strong passwords and a password manager

    Stronger passwords give you better protection. Create unique passwords for every account so one breach cannot unlock your digital life. A password manager makes this easier by generating secure passwords and storing them safely. It also autofills them, so you spend less time typing.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

    4) Turn on multi-factor authentication

    Multi-factor authentication (MFA) adds a simple barrier that blocks most break-in attempts. When you turn it on, you confirm each login with a code or app prompt. This keeps your account safe even if someone learns your password. Most major apps let you enable this setting in the Security section.

    5) Use strong antivirus protection

    Strong antivirus software shields you from malicious links and downloads. It scans files in real time and warns you when something looks dangerous. This gives you an extra layer of defense against phishing attempts that try to install malware.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    6) Review your account activity

    It helps to check your DoorDash account for anything unusual. Look at your order history, saved addresses and payment methods. If something looks off, update your password and contact DoorDash support right away. Quick action can stop a small issue from turning into a bigger problem. 

    Kurt’s key takeaways

    A breach like this reminds us how quickly cybercriminals can exploit a single mistake. DoorDash moved fast to cut off access and confirm the damage, but exposed contact information can still create risks. Staying alert and using basic security habits can help you avoid trouble.

    CLICK HERE TO GET THE FOX NEWS APP

    What concerns you most about companies holding your personal information, and how would you like them to handle incidents like this? Let us know by writing to us at Cyberguy.com

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Google issues warning on fake VPN apps

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Google is sounding the alarm for Android users after uncovering a wave of fake VPN apps that sneak malware onto phones and tablets. These dangerous apps pose as privacy tools but hide info stealers, banking trojans and remote access malware designed to loot personal data.

    More people are relying on VPNs to protect their privacy, secure home networks and shield personal information while using public Wi-Fi. Attackers know this demand is growing. They use it to lure users into downloading convincing VPN lookalikes that contain hidden malware.

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

    Fake VPN apps are spreading across Android devices by posing as trusted privacy tools. (iStock)

    How fake VPN apps lure users

    Cybercriminals create malicious VPN apps that impersonate trusted brands. They use sexually suggestive ads, geopolitical headlines or fake privacy claims to push people into quick downloads. Google says many of these campaigns run across app stores and shady websites.

    DELETE THE FAKE VPN APP STEALING ANDROID USERS’ MONEY

    Once installed, these apps inject malware that steals passwords, messages and financial details. Attackers can hijack accounts, drain bank balances or lock devices with ransomware. Some campaigns even use professional ad creatives and influencer-style promotions to appear legitimate.

    Scammers now use AI tools to design ads, phishing pages and fake brands with alarming speed. This gives them the power to reach large groups of victims with very little effort.

    Why malicious VPN apps are spreading

    Fake VPN apps remain one of the most effective tools for attackers. These apps request sensitive permissions and often run silently in the background. Once active, they can collect browsing data, cryptocurrency wallet details or private messages.

    According to Google, the most dangerous apps pretend to be known enterprise VPNs or premium privacy tools. Many promote themselves through adult ads, push notifications and cloned social media accounts.

    How to recognize a genuine VPN app

    Google recommends installing VPN services only from trusted sources. In Google Play, legitimate VPNs include a verified VPN badge to show that the app passed an authenticity check.

    A real VPN will never ask for access to your contacts, photos or private messages. It will not ask you to sideload updates or follow outside links for installation.

    Be careful with free VPN claims. Many free privacy tools rely on excessive data collection or hide malware inside downloadable files.

    Ways to stay safe from fake VPN apps

    Staying ahead of these fake VPN scams starts with a few smart habits that make your device much harder for attackers to target.

    1) Download only from official app stores

    Stick to the Google Play Store. Avoid links from ads, pop-ups or messages that try to rush you. Many fake VPN campaigns depend on off-platform downloads because they cannot pass the Play Store security checks.

    2) Look for the VPN badge in Google Play

    Google now includes a special VPN badge that verifies an app has passed an authenticity review. This badge confirms that the developer followed strict guidelines and that the app went through additional screening.

    If you want a reliable VPN that has already been vetted for security and performance, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android and iOS devices at Cyberguy.com.

    3) Use a data removal service

    Malicious VPN apps often target information already floating around the web, including your email, phone number and personal details exposed through data brokers. A trusted data removal service can help pull your information from people-search sites and broker databases, which reduces the amount of data scammers can use against you. This limits the damage if a fake VPN app steals your info or if attackers try to match stolen data with public records to build convincing scams.

    CAN YOU BE TRACKED WHEN USING A VPN?

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Sad elderly woman sit on sofa hold smartphone feels disappointed by received sms bad news, awful message, difficulties with modern device usage, unpleasant notification, stressed older person concept

    Once installed, these lookalike VPN apps steal passwords, messages and financial details. (iStock)

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    4) Turn on Google Play Protect and use a strong antivirus software

    Google Play Protect, which is built-in malware protection for Android devices, automatically removes known malware. However, it is important to note that Google Play Protect may not be enough. Historically, it isn’t 100% foolproof at removing all emerging malware from Android devices. 

    Settings may vary depending on your Android phone’s manufacturer 

    How to turn it on: Open Google Play Store → Tap your profile icon → Select Play Protect → Tap Settings → Turn on Scan apps with Play Protect → Turn on Improve harmful app detection.

    While Google Play Protect offers a helpful first layer of defense, it is not a full antivirus. A strong antivirus software adds another layer of protection. It can block malicious downloads, detect hidden malware and warn you when an app acts in unusual ways. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    5) Review app permissions carefully

    A genuine VPN only needs network-related permissions. If a VPN asks for access to photos, contacts or messages, treat it as a major warning sign. Restrict permissions when possible.

    6) Avoid sideloading apps from unknown sources

    Sideloaded apps bypass Google’s security filters. Attackers often hide malware inside APK files or update prompts that promise extra features. If you’re unfamiliar with the term, sideloading means installing apps outside the Google Play Store, usually by downloading a file from a website, email or message. These apps never go through Google’s safety checks, which makes them far riskier to install.

    7) Watch for aggressive ads and scare tactics

    Fake VPN ads often claim your device is already infected or that your connection is not secure. Real privacy apps do not use panic-based marketing.

    8) Research the developer before downloading

    Look up the developer’s website and reviews. A legitimate VPN provider will have a clear privacy policy, customer support and a consistent history of app updates.

    9) Be skeptical of anything labeled free

    Free VPNs often rely on risky data practices or hide malware. If a service promises premium features at no cost, question how it pays its bills.

    DO YOU NEED A VPN AT HOME? HERE ARE 10 REASONS YOU DO

    10) Avoid recovery scams after an attack

    If someone contacts you claiming they can recover stolen money, cut contact. Real agencies never demand upfront fees and never request remote access to your device.

    11) Keep your device updated

    Install security patches as soon as they appear. Updates protect your phone from malware strains that rely on old software vulnerabilities.

    A woman looking at a VPN on a smartphone

    Scammers now use AI-generated ads and fake brands to trick you into quick downloads. (Kurt “CyberGuy” Knutsson)

    Kurt’s key takeaways

    Fake VPN apps are becoming a major threat to Android users as scammers exploit the rising demand for privacy tools and home network security. Attackers hide behind familiar logos, aggressive ads and AI-powered campaigns to push apps that steal data the moment you install them. Staying safe requires careful downloading habits, attention to permissions and a healthy amount of skepticism toward anything that claims instant privacy or premium features for free.

    Do you think Google should do more to block fake VPN apps in the Play Store? Let us know by writing to us at Cyberguy.com

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

    Copyright 2025 CyberGuy.com.  All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • France will investigate Musk’s Grok chatbot after Holocaust denial claims

    [ad_1]

    PARIS (AP) — France’s government is taking action against billionaire Elon Musk ‘s artificial intelligence chatbot Grok after it generated French-language posts that questioned the use of gas chambers at Auschwitz, officials said.

    Grok, built by Musk’s company xAI and integrated into his social media platform X, wrote in a widely shared post in French that gas chambers at the Auschwitz-Birkenau death camp were designed for “disinfection with Zyklon B against typhus” rather than for mass murder — language long associated with Holocaust denial.

    The Auschwitz Memorial highlighted the exchange on X, saying that the response distorted historical fact and violated the platform’s rules.

    In later posts on its X account, the chatbot acknowledged that its earlier reply to an X user was wrong, said it had been deleted and pointed to historical evidence that Auschwitz’s gas chambers using Zyklon B were used to murder more than 1 million people. The follow-ups were not accompanied by any clarification from X.

    In tests run by The Associated Press on Friday, its responses to questions about Auschwitz appeared to give historically accurate information.

    Grok has a history of making antisemitic comments. Earlier this year, Musk’s company took down posts from the chatbot that appeared to praise Adolf Hitler after complaints about antisemitic content.

    The Paris prosecutor’s office confirmed to The Associated Press on Friday that the Holocaust-denial comments have been added to an existing cybercrime investigation into X. The case was opened earlier this year after French officials raised concerns that the platform’s algorithm could be used for foreign interference.

    Prosecutors said that Grok’s remarks are now part of the investigation, and that “the functioning of the AI will be examined.”

    France has one of Europe’s toughest Holocaust denial laws. Contesting the reality or genocidal nature of Nazi crimes can be prosecuted as a crime, alongside other forms of incitement to racial hatred.

    Several French ministers, including Industry Minister Roland Lescure, have also reported Grok’s posts to the Paris prosecutor under a provision that requires public officials to flag possible crimes. In a government statement, they described the AI-generated content as “manifestly illicit,” saying it could amount to racially motivated defamation and the denial of crimes against humanity.

    French authorities referred the posts to a national police platform for illegal online content and alerted France’s digital regulator over suspected breaches of the European Union’s Digital Services Act.

    The case adds to pressure from Brussels. This week, the European Commission, the EU’s executive branch, said that the bloc is in contact with X about Grok and called some of the chatbot’s output “appalling,” saying it runs against Europe’s fundamental rights and values.

    Two French rights groups, the Ligue des droits de l’Homme and SOS Racisme, have filed a criminal complaint accusing Grok and X of contesting crimes against humanity.

    X and its AI unit, xAI, did not immediately respond to requests for comment.

    [ad_2]

    Source link

  • ‘Cloud Storage Full’ scam steals your photos and money

    [ad_1]

    NEWYou can now listen to Fox News articles!

    A new scam is sweeping across smartphones and catching thousands of people off guard. Criminals are sending fake “Cloud Storage Full” or “photo deletion” alerts that claim your images and videos are about to disappear unless you upgrade your storage. 

    The warning looks urgent and real. It even mimics major cloud services. But the moment you click the link, you enter a trap.

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

    How this fast-growing ‘Cloud Storage Full’ scam tricks victims

    Trend Micro researchers recently uncovered this fast-growing phishing campaign after seeing a massive jump in activity. The company reports a 531% month-over-month spike from September to October, which shows how quickly the scheme is spreading.

    PROTECT YOUR DATA BEFORE HOLIDAY SHOPPING SCAMS STRIKE

    Scammers use convincing storage alerts and fake dashboards to push victims into paying small fees that expose their credit card details. (Pixelfit/Getty Images)

    Scammers are sending personalized SMS and iMessage alerts that include your name and a believable count of photos or videos. Once you tap the link, you land on a convincing fake website that appears to be a cloud storage dashboard. From there, you are urged to pay a tiny $1.99 upgrade fee to prevent deletion. Instead of protecting anything, you hand over your credit card, PayPal login or other personal information.

    Trend Micro provided several screenshots and internal samples that reveal how polished the scam has become. The fake sites use progress bars, countdown timers and warnings that your files will be lost. They even simulate a cloud storage layout to match the look of popular platforms. 

    Jon Clay, VP of threat intelligence at Trend Micro, shared an important warning to CyberGuy:

    “The recent spike in ‘Cloud Storage Full’ scams shows just how well cybercriminals are perfecting emotional manipulation. These scams prey on fear and urgency, warning users their photos will be deleted unless they pay a small upgrade fee. During a time of year when we may be capturing many precious moments on camera, scammers are targeting older adults who may think this type of scam message is legitimate and who may be worried and anxious about losing something that cannot easily replace. Consumers should always stay cautious of unsolicited messages and always verify alerts directly through official apps or websites.”

    Trend Micro’s analysis outlines exactly how the scam works, from the initial message to the final theft. Their screenshots show fake dashboards, false warnings and pages asking for credit card or PayPal details. Some versions even redirect to legitimate sites later to cover their tracks.

    How the ‘Cloud Storage Full’ scam works

    Scammers follow a predictable pattern with this scheme, and each stage reveals a clear red flag that can help you spot the danger early.

    1) Initial contact

    Victims receive an unsolicited SMS or iMessage that claims their photos or videos will be deleted soon. Messages include the person’s first name and fake counts like “1,675 images” or “2,010 snaps” to boost credibility. Scammers add statements like “Act now” or “Final warning” to trigger panic. Each message ends with a short link that leads to a malicious .info domain.

    FAKE CHATGPT APPS ARE HIJACKING YOUR PHONE WITHOUT YOU KNOWING

    2) Trust building

    After tapping the link, the user arrives at a fake “Cloud Storage Full” website. It mirrors the fonts, icons and button styles of real cloud services. Users see alerts such as “Your photos, contacts and private data will be lost.” Everything looks polished to reduce suspicion.

    3) The hook

    The site claims your storage is completely full and urges a one-time upgrade for $1.99. A progress bar sits at 100% full and a countdown timer warns that data will vanish in minutes. The “Continue” button goes to a fake payment page.

    4) The exit

    Once victims enter credit card or PayPal details, scammers harvest the data instantly. Attackers may use stolen credentials for unauthorized purchases, credential stuffing or resale on dark web markets. Some victims receive fake receipt emails to make the charge look legitimate.

    Trend Micro reports that certain scam sites later redirect to real pages like iolo.com to hide their tracks.

    An elderly man purchasing something with his credit card online

    Scammers use fake dashboards and alerts to push victims to share payment info. (Kurt “CyberGuy” Knutsson)

    Red flags to watch for

    • Urgent warnings that your photos will be deleted
    • Unfamiliar links ending in .info
    • Messages that include your name to appear credible
    • Payment requests for tiny fees like $1.99
    • Countdown timers meant to force quick decisions
    • Sites that look familiar but have unusual URLs

    Tips to stay safe from ‘Cloud Storage Full’ scams

    Scammers rely on fear and urgency to push quick decisions, but a few smart habits can shut down their tricks before they start.

    1) Verify alerts inside the official app or website

    Open your cloud storage app or go to the official website directly. If you see a real problem, it will appear there. This simple step prevents you from reacting to fake warnings.

    GHOST-TAPPING SCAM TARGETS TAP-TO-PAY USERS

    2) Never tap storage alerts sent through SMS or iMessage and use strong antivirus software

    Break the habit of tapping links in messages. Real cloud services rarely text users about photo deletion. A strong antivirus tool will flag dangerous links before they open.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com

    3) Use a data removal service

    Consider using a reputable data removal service to scrub your personal details from data broker sites. This step makes it harder for scammers to target you with personalized messages that look real.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    4) Watch for strange links

    Look closely at every link. Scammers rely on short domains that look suspicious. Legitimate companies avoid shortened URLs and unknown domains.

    5) Use multi-factor authentication

    Turn on multi-factor authentication (MFA) for all cloud and payment accounts. It adds a powerful layer of protection if criminals steal your login.

    6) Check your credit card for small test charges

    Review your statements often. Attackers start with tiny charges to test a card before making bigger purchases.

    GEEK SQUAD SCAM EMAIL: HOW TO SPOT AND STOP IT

    7) Use a password manager

    A good password manager helps you create strong, unique passwords. It limits the fallout if your login appears in a data breach.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Man reviews inheritance documents

    These fake storage warnings mimic real cloud services and pressure users to upgrade for $1.99. Once you enter payment info, scammers steal it instantly. (uchar/Getty Images)

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com

    8) Report suspicious messages

    Forward scam texts to 7726 (SPAM). This helps carriers block similar messages for everyone.

    Kurt’s key takeaways

    This scam spreads because it hits people where they are most vulnerable. Our phones store personal memories, family events and moments we never want to lose. Scammers know this and are now creating messages that look real enough to fool even the most cautious users. Emotional triggers like fear and urgency remain powerful tools for cybercriminals. Always question surprise warnings about data loss. When in doubt, check your account directly through the official app or website. A few seconds of verification can save you from credit card theft and identity headaches.

    Have you ever received a message like this, and how did you handle it? Let us know by writing to us at Cyberguy.com

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 

    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

    Copyright 2025 CyberGuy.com. All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • France moves against Musk’s Grok chatbot after Holocaust denial claims

    [ad_1]

    PARIS — France’s government is taking action against artificial intelligence chatbot Grok, which was launched by a company owned by billionaire Elon Musk, after it generated French-language posts that questioned the use of gas chambers at Auschwitz and listed Jewish public figures, officials said.

    Grok, built by Musk company xAI and integrated into his social media platform X, said in a widely shared post in French that gas chambers at the Auschwitz-Birkenau death camp were designed for “disinfection with Zyklon B against typhus” rather than for mass murder — language long associated with Holocaust denial.

    The Auschwitz Memorial highlighted the exchange on X, and said that the response distorted historical fact and violated the platform’s rules.

    As of this week, Grok’s responses to questions about Auschwitz appear to give historically accurate information.

    Grok has a history of making antisemitic comments. Earlier this year, Musk’s company took down posts from the chatbot that appeared to praise Adolf Hitler after complaints about antisemitic content.

    The Paris prosecutor’s office confirmed to The Associated Press on Friday that the Holocaust-denial comments have been added to an existing cybercrime investigation into X. The case was opened earlier this year after French officials raised concerns that the platform’s algorithm could be used for foreign interference.

    Prosecutors said that Grok’s remarks are now part of the investigation, and that “the functioning of the AI will be examined.”

    France has one of Europe’s toughest Holocaust denial laws. Contesting the reality or genocidal nature of Nazi crimes can be prosecuted as a crime, alongside other forms of incitement to racial hatred.

    Several French ministers, including Industry Minister Roland Lescure, have also reported Grok’s posts to the Paris prosecutor under a provision that requires public officials to flag possible crimes. In a government statement, they described the AI-generated content as “manifestly illicit,” saying it could amount to racially motivated defamation and the denial of crimes against humanity.

    French authorities referred the posts to a national police platform for illegal online content and alerted France’s digital regulator over suspected breaches of the European Union’s Digital Services Act.

    The case adds to pressure from Brussels. This week, the European Commission, the EU’s executive branch, said that the bloc is in contact with X about Grok and called some of the chatbot’s output “appalling,” saying it runs against Europe’s fundamental rights and values.

    Two French rights groups, the Ligue des droits de l’Homme and SOS Racisme, have filed a criminal complaint accusing Grok and X of contesting crimes against humanity.

    X and its AI unit, xAI, didn’t immediately respond to requests for comment.

    [ad_2]

    Source link

  • Craigslist car report scam targets vehicle sellers

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Selling your car online should be simple. Lately, though, more sellers are running into fake “vehicle report” demands from so-called buyers. The pitch looks routine, yet it leads straight to a payment page on a site you don’t know. 

    We heard from Nick K. of Washington, who spotted the pattern in real time.

    “In trying to sell a car, it has become apparent that there is a scam related to CarFax-type reports,” Nick wrote in an email to us. “The way it works is a guy texts or emails saying they are interested in your car, but they say they must have a car report from a specific service. At first, I thought it was just a way for a guy to sell more reports, but after thinking about it for a while, it seems like it could be a great way to harvest credit card numbers, etc. I have not been a victim of this, but in the course of selling a car recently, I had several instances of this. There are several warning signs: ‘Will you accept cash?’ Questions indicating they have not read the ad. Offering more than the ad asks for. Short nonsensical first contact. These are just the usual signs I am looking for when I am trying to decide if someone responding to a Craigslist or FB ad is legit.”

    Nick’s instincts are spot on. This Craigslist car report scam has been spreading across Craigslist, Facebook Marketplace and other online classifieds.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    CONNECTICUT MAN LOSES LIFE SAVINGS IN CRYPTO SCAM

    Scammers posing as buyers on Craigslist are asking sellers to buy fake “vehicle history reports” from fraudulent sites.  (Kurt “CyberGuy” Knutsson)

    How the Craigslist car report scam works

    This scam often starts with a message that looks completely normal. A supposed buyer texts asking something like, “1985 F150 Available?” and quickly follows up with friendly but vague questions such as, “OK, I’m interested in seeing it. When and where would be good for you?”

    Once you respond, the “buyer” develops just enough rapport to sound legitimate. Then comes the setup. The “buyer” says he is serious about purchasing but wants to see a detailed ASR report first, something most sellers have never heard of.

    That’s exactly what happened to Nick K. After he shared the Craigslist link and vehicle details, the fake buyer sent this reply:

    “Auto Smart Report, here’s the link you can get the papers from. Oh, I forgot to ask for your name? I’m Richard. Will you accept a cash payment? Let me know.”

    It sounds harmless, even reassuring. But the scam hinges on getting you to click that link. The site looks professional, promising a “Complete Vehicle History at Your Fingertips.” Yet once you enter your information, you’re not buying a report; you’re handing over your credit card details and personal data to criminals.

    When the seller, in this case, pushed back, the scammer doubled down with more pressure tactics.

    “If you can show me the Auto Smart Report, that would be great, as it’s the most reliable and complete report. My offer to you is $7,000. I have no issue with that.” Notice the scammer just increased the amount that he is willing to pay for the vehicle by $500.

    They’ll say anything to keep you engaged and make the transaction sound routine. But the moment you pay for the fake report, the buyer disappears. His only goal is to harvest your financial information, not purchase your vehicle.

    INSIDE A SCAMMER’S DAY AND HOW THEY TARGET YOU

    A fraudulent email exchange

    Behind the friendly text messages, these fake buyers are after your payment info, not your vehicle. (Kurt “CyberGuy” Knutsson)

    Warning signs to watch for

    • Requests for unknown report names like “ASR”
    • Messages that ignore your ad details
    • Offers above your asking price
    • Phrases like “will you accept cash?” or “I just need to see a report first”
    • Demands for a specific site instead of accepting a Carfax, AutoCheck or NMVTIS report
    • Generic greetings like “dear,” “brother” or “friend”

    If you see two or more of these at once, treat the lead as suspicious.

    TOP 5 OVERPAYMENT SCAMS TO AVOID

    A fraudulent email exchange

    These convincing messages often include phrases like “I just need to see an ASR report first” or “will you accept cash?” to appear legitimate. (Kurt “CyberGuy” Knutsson)

    How to stay safe from Craigslist car report scams

    Even the most convincing buyer could turn out to be a scammer, but these smart moves can help you stay safe, protect your money and keep your personal data out of the wrong hands.

    1) Do not click buyer-sent links, and use strong antivirus software

    Avoid clicking any link sent through text, email or messaging apps. These often lead to phishing sites or hidden malware downloads. Keep your devices protected with strong antivirus software. Run regular scans and keep your software updated to block new threats.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    2) Never enter payment info on unfamiliar sites

    If a buyer insists you use a website you’ve never heard of, stop immediately. Always verify a site’s legitimacy before sharing any financial or personal details.

    3) Use a data removal service

    Consider a data removal service to remove your personal details from data broker sites. This limits how easily scammers can find and target you.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    4) Use trusted report services

    Stick to established names like Carfax, AutoCheck or NMVTIS. These are widely recognized and accepted by real buyers.

    5) Share your VIN in the ad

    Including your vehicle’s VIN lets genuine buyers run their own reports safely without needing your involvement.

    6) Block and report scammers

    Report suspicious messages directly to the platform and to the FTC at reportfraud.ftc.gov. Sharing details helps others stay safe.

    7) If you paid on a fake site

    Contact your bank right away, cancel the card and monitor your account for unauthorized charges. Quick action can prevent further loss.

    8) Meet smart and stay cautious

    When meeting a buyer, choose a public place with security cameras. Bring a friend, keep your phone charged and document all communication.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Kurt’s key takeaways

    This scam works because a vehicle report sounds routine. A fake buyer pushes you to a site you’ve never heard of, then applies pressure to act fast. Slow down, verify and stick to well-known services. Real buyers will accept a report you provide or will run one themselves. You can still sell safely on marketplaces by following a few simple rules. Control the process, choose the report source and avoid links sent by strangers. Thanks to readers like Nick, more sellers can spot the trap before any money or data is at risk.

    Have you seen buyers pushing odd report sites when you sell online? What tipped you off first?  Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link