ReportWire

Tag: Hackers

  • VPN flaws allowed Chinese hackers to compromise dozens of Ivanti customers, says report | TechCrunch

    [ad_1]

    In February 2021, software giant Ivanti discovered that Chinese hackers had breached the network of Pulse Secure, one of its subsidiaries that provided VPN appliances to dozens of companies and government agencies around the world, according to new reporting by Bloomberg.

    The hackers exploited a secret backdoor they had planted in Pulse Secure’s VPN software, Bloomberg reported, citing Ivanti’s chief security officer at the time and other sources. The backdoor allowed the hackers to gain access to 119 other unnamed organizations that used the company’s same VPN product.

    Mandiant was reportedly aware of the breaches as well, alerting Ivanti that hackers had exploited the bug to breach European and U.S. military contractors. 

    The previously unreported breach is the latest example of how acquisitions, layoffs, and cost-cutting driven by private equity firms helped to compromise the quality and security of Ivanti’s most critical technologies. After private investment giant Clearlake Capital Group acquired Ivanti in 2017, Bloomberg reported rounds of cuts — particularly in 2022 — affecting employees who had deep institutional knowledge of the company’s products and their security.

    Ivanti and Mandiant did not respond to a request for comment. 

    Bloomberg’s findings echo earlier reporting into rival provider of remote access tools, Citrix, which had large scale layoffs following a 2022 deal by Elliott Investment Management and Vista Equity Partners to buy the company. Like Ivanti, Citrix has been mired by cybersecurity incidents and critical flaws in recent years. 

    Ivanti’s VPN products have been the cause of at least two other major attacks since. 

    Techcrunch event

    Boston, MA
    |
    June 9, 2026

    In early 2024, U.S. cybersecurity agency CISA ordered all federal agencies to disconnect their Ivanti VPN appliances within two days because hackers were actively exploiting vulnerabilities that were unknown to Ivanti at the time. Ivanti also warned customers last year that hackers were exploiting another critical flaw in its Connect Secure product to hack corporate customers.

    [ad_2]

    Lorenzo Franceschi-Bicchierai

    Source link

  • Conduent data breach hits millions across multiple states

    [ad_1]

    NEWYou can now listen to Fox News articles!

    A ransomware attack on government technology giant Conduent is turning out to be far bigger than first reported. What initially sounded like a limited incident now appears to affect tens of millions of people across multiple states. In Texas alone, at least 15.4 million residents may have had their data exposed. Oregon has reported another 10.5 million affected individuals. And notifications have also gone out to hundreds of thousands of people in states like Delaware, Massachusetts and New Hampshire. If you rely on state healthcare programs or government services, your data could be part of this breach.

    Sign up for my FREE CyberGuy ReportGet my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

    What we know about the breach so far

    149 MILLION PASSWORDS EXPOSED IN MASSIVE CREDENTIAL LEAK

    What started as a “limited” ransomware incident now appears to impact tens of millions of people across multiple states. (Sebastian Kahnert/picture alliance via Getty Images)

    The cyberattack happened in January 2025 and was later claimed by the Safeway ransomware gang, which says it stole more than 8 terabytes of data. Conduent first disclosed the incident publicly in April, months after hackers disrupted its systems and caused outages to government services across the country.

    The company initially said about 4 million people in Texas were affected. That number has since jumped to 15.4 million, nearly half the state’s population. Oregon’s attorney general reported another 10.5 million impacted residents. Combined with other states issuing notifications, the total could reach into the dozens of millions.

    The stolen data includes names, Social Security numbers, medical information, and health insurance details. That combination is particularly dangerous because it can be used for identity theft, medical fraud, and highly targeted scams.

    Conduent processes data for large corporations, state agencies, and government healthcare programs. The company says its systems support services for more than 100 million people nationwide. However, it has not confirmed whether the breach affects that many individuals.

    In a filing with the SEC, Conduent acknowledged that the stolen data included a “significant number” of individuals’ personal information tied to its clients’ end users, meaning people who rely on government agencies and corporate services powered by the company.

    RANSOMWARE ATTACK EXPOSES SOCIAL SECURITY NUMBERS AT MAJOR GAS STATION CHAIN

    Why this breach is especially concerning

    Unlike a retail breach, where credit card data might be exposed, this incident involves deeply sensitive personal and medical information. Social Security numbers and health records are long-term identifiers. You cannot simply cancel or replace them like a debit card.

    Healthcare-related data is especially valuable on the black market because it can be used to file fraudulent insurance claims, obtain prescription drugs, or open financial accounts. And because Conduent works behind the scenes for state agencies, many people may not even realize their data was stored by the company in the first place.

    Conduent said it is still in the process of notifying affected individuals and expects to complete those notifications by early 2026. The company did not provide a clearer timeline or confirm how many total people will ultimately be alerted. Many people could be waiting months before knowing whether their information was compromised.

    Conduent responds to January 2025 data breach

    We reached out to Conduent for comment, and a company spokesperson provided CyberGuy with the following statement:

    “As previously disclosed in its April 2025 Form 8-K filing with the SEC, in January 2025, Conduent discovered that it was the victim of a cybersecurity incident. With respect to that incident, Conduent has agreed to send notification letters, on behalf of its clients, to individuals whose personal information may have been affected by this incident. Working in conjunction with our clients, we expect to send out all of the consumer notifications by April 15. In addition, a dedicated call center has been set up to address consumer inquiries. At this time, Conduent has no evidence of any attempted or actual misuse of any information potentially affected by this incident.

    “Upon discovery of the incident, Conduent acted quickly to secure its networks, restore its systems and operations, notify law enforcement, and conduct an investigation with the assistance of third-party forensics experts. In addition, given the nature and complexity of the data involved, Conduent worked diligently with a dedicated review team, including internal and external experts, and conducted a detailed analysis of the affected files to identify the personal information contained therein, which was a time-intensive process.

    “Both Conduent and our third-party experts monitor the dark web regularly and have no evidence of any personal information being released on the dark web.

    “Rest assured, we have followed all of the right protocols and have assured our clients that we have secured the necessary data. Conduent has been working with law enforcement and takes this matter seriously. We regret any inconvenience this incident may have caused.”

    How can I check if my information was sold on the dark web?

    To check if your information was sold on the dark web, you can go to haveibeenpwned.com and enter your email address into the search bar. The website will search to see what data of yours is out there and display if there were data breaches associated with your email address on various sites.

    If you find your data is out on the web, remove it with a data removal service. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Hacker typing into a computer.

    Hackers claim they stole more than 8 terabytes of data, including Social Security numbers and sensitive medical information. (Philip Dulian/picture alliance via Getty Images)

    8 steps you can take to protect yourself after the Conduent breach

    When a breach involves Social Security numbers and medical data, you need to think long term. Here’s what you should do.

    1) Place a credit freeze

    A credit freeze prevents lenders from opening new accounts in your name without your approval. It’s free and can be placed with Equifax, Experian, and TransUnion. This is one of the strongest protections you can put in place after an SSN exposure. You can temporarily lift it if you need to apply for credit.

    2) Monitor your credit reports regularly

    You’re entitled to free credit reports from all three major bureaus. Look for unfamiliar accounts, credit inquiries, or address changes. Early detection makes it much easier to shut down fraud before it snowballs.

    3) Use a password manager

    If attackers obtained personal details like your name and email, they may try credential-stuffing attacks against your other accounts. A password manager creates strong, unique passwords for every account, so one breach does not unlock everything else. Many password managers also include breach alerts if your credentials show up in known leaks.

    Also, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

    4) Secure your email account first

    Your email account is the gateway to nearly everything. Protect it with a strong password and two-factor authentication. Review recovery settings and recent login activity to make sure nothing has been altered.

    5) Enable two-factor authentication everywhere possible

    Two-factor authentication (2FA) adds another barrier, even if someone has your password. Use an authenticator app rather than SMS whenever possible for stronger protection.

    6) Install strong antivirus software

    Strong antivirus software can help block malicious links, phishing attempts, and ransomware. After a major breach, scammers often target victims with follow-up attacks pretending to offer help or compensation. Security software adds another layer of protection.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    7) Consider identity theft protection

    Identity theft services monitor your Social Security number, financial accounts, and even dark web marketplaces. If your information is misused, they can alert you quickly and help you recover faster. When SSNs are exposed, ongoing monitoring becomes especially important.

    See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com

    8) Reduce your digital footprint with a data removal service

    Scammers often combine breach data with personal details found on data broker sites. A data removal service works to remove your phone number, address, and other exposed information from hundreds of databases. While no service can erase everything, reducing what’s publicly available makes targeted fraud much harder.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Someone typing on a computer in a dark room.

    Because Conduent powers government and healthcare services behind the scenes, many affected people may not even realize their data was stored there. (Thomas Trutschel/Photothek via Getty Images)

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    Kurt’s key takeaway

    The Conduent breach highlights a growing risk that many people never see coming. When large government contractors are hit, millions can be affected at once. And because these companies operate behind the scenes, you may not even realize they hold your data. If your information was exposed, taking action now can prevent long-term damage. The sooner you lock things down, the harder it becomes for criminals to profit from your data.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Do you think companies that process government data are doing enough to protect it? Let us know your thoughts by writing to us at Cyberguy.com

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter 

    Copyright 2026 CyberGuy.com.  All rights reserved. 

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Panera Bread data breach exposes 5.1M customers

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Another major consumer brand has joined the growing list of companies hit by serious data breaches. Panera Bread has confirmed a cybersecurity incident after the hacking group ShinyHunters claimed it stole millions of customer records.

    The breach exposes a wide range of personal details, raising real concerns for anyone who has ever placed an order, created an account or shared contact information with the popular bakery chain.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    SUBSTACK DATA BREACH EXPOSES EMAILS AND PHONE NUMBERS

    Panera Bread confirmed a data breach after hackers claimed they stole millions of customer records containing contact information.  (AP Photo)

    What happened in the Panera Bread data breach?

    ShinyHunters added Panera Bread to its data leak site earlier this year, initially claiming it had stolen more than 14 million customer records. According to the group, the stolen data includes names, email addresses, phone numbers, home addresses and account-related information.

    Panera Bread has since confirmed a cybersecurity incident. In a statement to media outlets, the company described the exposed data as customer “contact information” and said it has contacted law enforcement and taken steps to address the incident. Panera has not shared technical details about how the attack occurred or whether customers need to take specific actions.

    Even “contact information” can be dangerous in the wrong hands. When combined, these details can be used for identity theft, targeted phishing and highly convincing social-engineering scams.

    ShinyHunters claims the attackers accessed Panera’s systems through Microsoft Entra single sign-on (SSO). While Panera has not confirmed that claim, it closely mirrors recent warnings from Okta about a surge in voice-phishing attacks targeting SSO platforms.

    In these attacks, criminals pose as IT or helpdesk staff and call employees directly. They pressure targets to approve authentication requests or enter login credentials on fake SSO pages. Once attackers capture session tokens or credentials, they can bypass some forms of multifactor authentication and move laterally through company systems. This approach relies on human trust rather than technical exploits, making it increasingly effective.

    How many people were actually affected?

    At first glance, claims that 14 million customers were affected suggested an enormous breach. However, researchers at Have I Been Pwned? later clarified that the attackers stole 14 million records, not data tied to 14 million unique individuals.

    After reviewing the leaked dataset, researchers now estimate the breach affected approximately 5.1 million unique people. The exposed information includes email addresses along with associated names, phone numbers, and physical addresses.

    That distinction matters, but it does not eliminate risk. Once stolen data is released publicly, it can spread quickly across criminal forums and be reused for years.

    149 MILLION PASSWORDS EXPOSED IN MASSIVE CREDENTIAL LEAK

    The hacking group ShinyHunters leaked stolen Panera customer data online after an attempted extortion failed.

    The hacking group ShinyHunters leaked stolen Panera customer data online after an attempted extortion failed. (Panera Bread)

    Hackers leaked the data after extortion failed

    ShinyHunters reportedly attempted to extort Panera Bread before publishing the stolen data. When those efforts failed, the group released a 760MB archive containing millions of customer records on its leak site.

    This reflects a broader shift in cybercrime. Instead of locking systems with ransomware, many groups now focus on quietly stealing data and threatening public exposure. These attacks are faster, harder to detect, and often just as profitable.

    ShinyHunters has used similar tactics in other high-profile incidents involving Bumble, Match Group, Crunchbase and other consumer platforms.

    Lawsuits filed after Panera breach disclosure

    The breach has already triggered legal fallout. Multiple class-action lawsuits have been filed in U.S. federal court, alleging that Panera failed to adequately protect customer data.

    The lawsuits claim Panera knew or should have known about security weaknesses and seek damages, improved security practices, and long-term identity theft protection for affected customers. Panera has not publicly commented on the litigation.

    A troubling pattern for Panera Bread

    This is not Panera Bread’s first major security lapse. In 2018, a cybersecurity researcher revealed that Panera had left millions of customer records exposed online in plain text. That incident later led to lawsuits and settlements.

    Repeated breaches often point to deeper challenges. Large organizations can struggle to secure cloud services, identity systems, and employee access at scale. When attackers target identity platforms instead of infrastructure, a single mistake can expose millions of records.

    We reached out to Panera Bread for a comment, but did not hear back before our deadline. 

    GRUBHUB CONFIRMS DATA BREACH AMID EXTORTION CLAIMS

    Person typing on their laptop.

    Exposed contact details like names, emails, and addresses can fuel phishing scams and identity theft long after a breach becomes public. (Donato Fasano/Getty Images)

    7 steps you can take to protect yourself following the Panera data breach

    When a major consumer brand suffers a breach, customers often don’t realize the risk until weeks or months later. These steps help limit what attackers can do with your information if your Panera data falls into the wrong hands.

    1) Use a strong, unique password for every account

    If you ever created a Panera Bread account, reset its password immediately. If you reused that password anywhere else, those accounts are now at risk, too. Attackers routinely test breached passwords across email, shopping and banking sites.

    A password manager helps by generating strong, unique passwords for every account and storing them securely so you never need to reuse credentials. Many password managers also alert you if your email or passwords appear in known data breaches, giving you an early warning to lock things down fast.

    Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

    2) Enable two-factor authentication (2FA) wherever possible

    Two-factor authentication (2FA) adds a second step to the login process, usually through an app or device you control. Even if someone gets your password through phishing or a breach, 2FA makes it much harder for them to access your account.

    3) Be cautious of phishing messages

    Cybercriminals often follow up breaches with fake emails or in-app messages pretending to offer help or security updates. Always double-check the sender and avoid clicking links. When in doubt, open the app or website directly rather than responding to the message. Using strong antivirus software adds another layer of protection by flagging malicious links and blocking known threats before they can do harm. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    4) Limit the personal details you share

    When names, email addresses, phone numbers and physical addresses are exposed, identity theft becomes a real risk. Identity theft-protection services monitor your personal information, alert you if it appears on the dark web, and watch for attempts to open new accounts in your name.

    If something does go wrong, these services often include recovery support to help freeze accounts, dispute fraud, and guide you through the cleanup process.

    See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

    5) Reduce your digital footprint with a data removal service

    Scammers don’t rely on one breach alone. They combine leaked data with information from data broker sites to build detailed profiles. Data removal services help remove your phone number, home address and other personal details from hundreds of these sites.

    While no service can erase everything, reducing what’s publicly available makes it much harder for criminals to target you with convincing scams or identity fraud. This is one of the most effective long-term ways to lower your risk after any major breach.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    6) Secure your email account

    Your email account controls password resets for most services. Protect it with a strong password and 2FA. Regularly review login activity and recovery settings, so attackers can’t use your email to take over other accounts.

    7) Watch for account changes after breach news

    Not every breach leads to immediate account takeovers. In some cases, attackers quietly test access weeks later. That is why staying alert after breach reports matters. Watch for password reset emails you did not request, profile changes you did not make, or new messages you did not send. Unexpected logouts or security alerts are also red flags. If you notice anything unusual, change your password immediately and review your security settings.

    Kurt’s key takeaway

    The Panera Bread data breach is another reminder that even familiar brands can become major cyber targets. While Panera says only contact information was exposed, that data is often enough to fuel scams and identity theft long after headlines fade. Staying proactive after breach news is now part of protecting your digital life.

    Do you still trust large brands to protect your personal information, or have repeated breaches changed how much data you’re willing to share? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2026 CyberGuy.com. All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Substack data breach exposes emails and phone numbers

    [ad_1]

    NEWYou can now listen to Fox News articles!

    If you read newsletters to stay informed, here is an update worth paying attention to. Substack, a popular platform where writers, journalists and creators send email updates directly to subscribers, has confirmed a data breach that exposed user data.

    The company says the exposed information includes email addresses, phone numbers and internal account metadata. More sensitive data, such as passwords, credit card numbers and financial information, was not affected. That is good news. Still, many users are asking how this happened and why it took months to detect.

    For clarity, CyberGuy does not use Substack to send its newsletters.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    ROBINHOOD TEXT SCAM WARNING: DO NOT CALL THIS NUMBER

    Substack confirmed a data breach that exposed users’ email addresses, phone numbers and internal account metadata after unauthorized access in October. (Photo Illustration by Robin Utrecht/SOPA Images/LightRocket via Getty Images)

    What we know so far about the Substack breach

    According to Substack, the unauthorized access occurred in October but was not identified until February. That means user data may have been exposed for several months before the issue was discovered. In response to CyberGuy’s request for comment, Substack shared an email from CEO and cofounder Chris Best that was sent to affected users on Wednesday, Feb. 4.

    “I’m incredibly sorry this happened,” Best wrote. “We take our responsibility to protect your data and your privacy seriously, and we came up short here.” He went on to say the company will “work very hard to make sure it does not happen again.”

    According to Best, Substack identified evidence of a system issue on February 3 that allowed an unauthorized third party to access limited user data in October. He confirmed the accessed data included email addresses, phone numbers and internal metadata. He also said passwords, credit card numbers and financial information were not accessed.

    What Substack says it is doing now

    Substack says it has fixed the system issue that allowed the unauthorized access and has launched a full investigation. The company also said it does not have evidence that the exposed information is being misused. Even so, it encouraged users to take extra caution with emails or text messages that appear suspicious. While the statement clarifies what data was exposed, it does not explain why the access went undetected for several months or what specific safeguards are now in place to prevent a similar incident. That gap remains a key concern.

    Why exposed emails and phone numbers still matter

    Email addresses and phone numbers are often the first pieces of information used in scams. Once attackers have verified contact details, they can send messages that feel personal, urgent or familiar. Those messages may reference subscriptions, billing or account changes to pressure people into clicking links or sharing information. Even without passwords, this type of exposure can increase the risk of phishing and impersonation attempts. That is why awareness matters now.

    MICROSOFT ‘IMPORTANT MAIL’ EMAIL IS A SCAM: HOW TO SPOT IT

    Person typing code on their laptop.

    Security experts warn exposed email addresses and phone numbers can fuel phishing and impersonation scams. (Photo by Annette Riedl/picture alliance via Getty Images)

    Ways to stay safe after the Substack breach

    If you have a Substack account, now is a good time to tighten things up.

    1) Watch for targeted messages

    Be cautious with emails or texts that reference your Substack account subscriptions or payments. Scammers may use real details to sound convincing.

    2) Avoid clicking links under pressure

    Urgent language is a common tactic. Go directly to Substack’s website instead of using links in messages. Use a strong antivirus to safeguard yourself from malicious links that install malware, potentially accessing your private information.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    3) Change your password anyway

    Even if passwords were not exposed, updating them adds a layer of protection, especially if you reuse passwords elsewhere. Consider using a password manager, which securely stores and generates complex passwords, reducing the risk of password reuse. 

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

    4) Limit data exposure

    Consider using a data removal service to reduce where your email and phone number appear online. Fewer data points make scams harder to pull off. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    5) Use two-factor authentication

    Enable two-factor authentication (2FA) wherever possible to reduce the risk of account takeover.

    SOUNDCLOUD DATA BREACH EXPOSES 29.8 MILLION USER ACCOUNTS

    Person typing on their laptop.

    The company said passwords and financial information were not accessed, but the breach went undetected for months. (Photographer: Luke MacGregor/Bloomberg via Getty Images)

    Kurt’s key takeaways

    Substack’s breach is a reminder that even creator-focused platforms face real security risks. While the company says sensitive data was not affected, unanswered questions remain about detection delays and transparency. Email addresses and phone numbers are powerful tools in the wrong hands. Staying alert now can prevent bigger problems later. Trust is built on clarity, and users are still waiting for it.

    Have you changed how you protect your email and phone number after recent data breaches, and what steps have made you feel safer? Let us know by writing to us at Cyberguy.com

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

    Copyright 2026 CyberGuy.com. All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Microsoft ‘Important Mail’ email is a scam: How to spot it

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Scam emails are getting better at looking official. This one claims to be an urgent warning from Microsoft about your email account. It looks serious. It feels time sensitive. And that is exactly the point. Lily reached out after something about the message did not sit right.

    “I need help with an email that I’m unsure is valid. Hoping you can help me determine whether this is a valid or a scam. I have attached two screenshots below. Thank you in advance,” Lily wrote.

    Here is the important takeaway up front. This email is not from Microsoft. It is a scam designed to rush you into clicking a dangerous link.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    WHY CLICKING THE WRONG COPILOT LINK COULD PUT YOUR DATA AT RISK

    A closer look at the sender shows a red flag scammers hope you will miss, a free email address posing as a trusted brand. (Kurt “CyberGuy” Knutsson)

    Why this Microsoft ‘Important Mail’ email is a scam

    Once you slow down and read it closely, the red flags pile up quickly.

    A generic greeting

    It opens with “Dear User.” Microsoft uses your name. Scammers avoid it because they do not know who you are.

    A hard deadline meant to scare you

    The message claims your email access will stop on Feb. 5, 2026. Scammers rely on fear and urgency to short-circuit good judgment.

    A completely wrong sender address

    The email came from accountsettinghelp20@aol.com. Microsoft does not send security notices from AOL. Ever.

    Pushy link language

    “PROCEED HERE” is designed to trigger a fast click. Microsoft messages sent to you to are clearly labeled Microsoft.com pages.

    Fake legal language

    Lines like “© 2026 All rights reserved” are often copied and pasted by scammers to look official.

    Attachments that should not be there

    Microsoft account alerts do not include image attachments. That alone is a major warning sign.

    10 WAYS TO PROTECT SENIORS FROM EMAIL SCAMS

    Windows 10 security flaws leave millions vulnerable

    The fake Microsoft email uses urgency and vague language to pressure you into clicking before you have time to think. (Kurt “CyberGuy” Knutsson)

    What would have happened if you clicked

    If you clicked the link, you would almost certainly land on a fake Microsoft login page. From there, attackers aim to steal:

    • Your email address
    • Your password
    • Access to other accounts tied to that email

    Once they have your email, they can reset passwords, dig through old messages and launch more scams using your identity.

    HACKERS ABUSE GOOGLE CLOUD TO SEND TRUSTED PHISHING EMAILS

    Person on phone

    Scam emails often reach people on their phones, where small screens make it easier to miss warning signs and click fast. (Kurt “CyberGuy” Knutsson)

    What to do if this email lands in your inbox

    If an email like this shows up, slow down and follow these steps in order. Each one helps stop the scam cold.

    1) Do not click or interact at all

    Do not click links, buttons or images. Do not reply. Even opening attachments can trigger tracking or malware. Strong antivirus software can block phishing pages, scan attachments and warn you about dangerous links before damage happens. Make sure yours is active and up to date. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    2) Delete the message immediately

    Once it is reported, delete it. There is no reason to keep it in your inbox or trash.

    3) Check your account the safe way

    If you want peace of mind, open a new browser window and go directly to the official Microsoft account website. Sign in normally. If there is a real issue, it will appear there.

    4) Change your password if you clicked

    If you clicked anything or entered information, change your Microsoft password right away. Use a strong, unique password you do not use anywhere else. A password manager can generate and store it securely for you. Then review recent sign-in activity for anything suspicious.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

    5) Enable two-factor authentication

    Turn on two-factor authentication (2FA) for your Microsoft account. This adds a second check, which can stop attackers even if they get your password.

    6) Use a data removal service for long-term protection

    Scammers often find targets through data broker sites. A data removal service helps reduce how much personal information is publicly available, which lowers your exposure to phishing in the first place.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    7) Report it as spam or phishing 

    Use your email app’s built-in reporting tool. This helps train filters and protects other users from seeing the same scam.

    Extra protection tips for real Microsoft notices

    When Microsoft actually needs your attention, the signs look very different.

    • Alerts appear inside your Microsoft account dashboard
    • Messages do not demand immediate action through random email links
    • Notices never come from free email services like AOL, Gmail or Yahoo

    That contrast makes scams easier to spot once you know what to look for.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Kurt’s key takeaways

    Scammers are counting on you being busy, distracted or worried about losing access to your email. That is why messages like this lean so hard on urgency. Your email sits at the center of your digital life, so attackers know a shutdown threat gets attention fast. The good news is that slowing down for even a few seconds changes everything. Lily did exactly the right thing by stopping and asking first. That single habit can prevent identity theft, account takeovers and a long, frustrating cleanup. Remember this rule. Emails that threaten shutdowns and demand immediate action are almost never legitimate. When something feels urgent, that is your cue to pause, verify on your own and never let an email rush you into a mistake.

    Have you seen a fake Microsoft warning like this recently, or did it pretend to come from another brand you trust? Let us know your thoughts by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

    Copyright 2026 CyberGuy.com. All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • SoundCloud data breach exposes 29.8 million user accounts

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Hackers have exposed personal and contact information tied to SoundCloud accounts, with data breach notification service Have I Been Pwned reporting impacts to approximately 29.8 million users. The breach hit one of the world’s largest audio platforms and left many users locked out with error messages before the company confirmed the incident.

    Founded in 2007, SoundCloud grew into an artist-first service hosting more than 400 million tracks from over 40 million creators. That scale made this incident especially concerning. SoundCloud said it detected unauthorized activity tied to an internal service dashboard and launched its incident response process. At the time, users reported 403 Forbidden errors, especially when connecting through VPNs.

    Sign up for my FREE CyberGuy ReportGet my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

    149 MILLION PASSWORDS EXPOSED IN MASSIVE CREDENTIAL LEAK

    SoundCloud confirmed unauthorized activity after users reported access errors, triggering an internal incident response. (iStock)

    What data was exposed in the SoundCloud breach

    SoundCloud initially said attackers accessed limited data and did not touch passwords or financial information. The company said the exposed information matched what users already show publicly on profiles.

    Later disclosures painted a much bigger picture.

    According to Have I Been Pwned, attackers harvested data from approximately 29.8 million accounts. That data included:

    • Email addresses
    • Usernames and display names
    • Profile photos and avatars
    • Follower and following counts
    • Geographic locations, in some cases

    While no passwords were taken, linking emails to public profiles creates real risk. That combination fuels phishing, impersonation and targeted scams.

    Who is behind the attack

    Security researchers tied the breach to ShinyHunters, a well-known extortion gang. Sources told BleepingComputer that the group attempted to extort SoundCloud following the data breach. SoundCloud later confirmed those claims. In a January update, the company said attackers made demands and launched email-flooding campaigns to harass users, employees and partners. ShinyHunters has also claimed responsibility for recent voice phishing attacks targeting single sign-on systems at Okta, Microsoft and Google. Those attacks targeted corporate SaaS accounts to steal data and extort.

    Why this breach matters even without passwords

    At first glance, this may sound less serious than breaches involving passwords or credit cards. That assumption can be dangerous. Email addresses tied to real profiles allow scammers to craft convincing messages. They can pose as SoundCloud, brands or even other creators. With follower counts and usernames, messages feel personal and believable. Once attackers gain trust, they push links, malware or fake login pages. That is often how larger account takeovers begin.

    What SoundCloud users should expect next

    SoundCloud has not said whether more details will be released. The company did confirm the attack and the extortion attempt, but it has not answered follow-up questions about the scope or internal controls. For users, the long-term risk comes from how widely this dataset spreads. Once published, exposed data rarely disappears. It circulates across forums, marketplaces and scam networks for years.

    We reached out to SoundCloud for comment, and a representative told us, “We are aware that a threat actor group has published data online allegedly taken from our organization. Please know that our security team—supported by leading third-party cybersecurity experts—is actively reviewing the claim and published data.”

    SoundCloud has said it has found no evidence that sensitive data, such as passwords or financial information, was accessed.

    Ways to stay safe after the SoundCloud breach

    If you have or had a SoundCloud account, now is the time to act. Even limited data exposure can lead to targeted scams if you ignore it.

    1) Watch for phishing and impersonation emails

    Scammers often move fast after a breach. Watch your inbox for messages that mention SoundCloud, music uploads, copyright issues or account warnings. Do not click links or open attachments from unexpected emails. When in doubt, go directly to the official website instead of using email links. Strong antivirus software adds another layer of protection here.

    Confused woman looking at her phone

    Nearly 29.8 million accounts had emails and public profile data harvested, raising concerns about phishing and impersonation. (Cyberguy.com)

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    2) Change your SoundCloud password anyway

    Passwords were not exposed, but changing them is still smart. Create a new password that you do not use anywhere else. If remembering passwords feels impossible, consider using a password manager to generate and securely store strong passwords. This reduces the risk of reuse across platforms.

    Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

    3) Turn on two-factor authentication

    Two-factor authentication (2FA) adds a critical barrier if someone tries to access your account. Even if attackers guess or obtain a password later, they still need a second verification step. Enable 2FA anywhere SoundCloud or connected services offer it.

    4) Lock down your email account 

    Your email is the real target after most breaches. If someone gains access to it, they can reset passwords everywhere else. Use a strong, unique password for your email account and turn on two-factor authentication. Review recovery emails and phone numbers to make sure they still belong to you.

    DATA BREACH EXPOSES 400,000 BANK CUSTOMERS’ INFO

    5) Reduce your online data footprint

    Attackers use breached emails to search data broker sites and social platforms for more details. The less data available, the harder you are to target. Consider a data removal service to limit how often your email and personal details appear across the web.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    6) Check your other accounts for suspicious activity

    Attackers often reuse exposed email addresses to test logins across streaming services, social media and shopping accounts. Watch for password reset emails you did not request or login alerts from unfamiliar locations. If something looks off, act fast.

    Someone typing on a computer in a dark room.

    Security researchers linked the breach to the ShinyHunters extortion group, which later attempted to pressure SoundCloud for payment. (Thomas Trutschel/Photothek via Getty Images)

    Kurt’s key takeaways

    Data breaches no longer stay contained to one app or one moment in time. Even when attackers expose information that looks harmless, the fallout can last much longer. The SoundCloud breach shows how public profile data paired with private contact details creates real exposure. Staying alert, limiting data sharing and using strong security habits remain your best defense as breaches continue to escalate.

    Have you checked which old or forgotten accounts still expose your email and could be putting you at risk right now? Let us know your thoughts by writing to us at Cyberguy.com

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter 

    Copyright 2026 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Tax season scams surge as filing confusion grows

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Tax season already brings stress. In 2026, it brings added confusion. Changes to tax filing programs and the discontinuation of the free government-run filing system have left many taxpayers unsure about what is legitimate. That uncertainty has created an opening for scammers who move quickly when people hesitate. 

    “Every tax season we see scammers ramp up their activity, and with likely confusion now that the free government-run filing system is discontinued, we’re sure scammers will take advantage,” said Lynette Owens, vice president of consumer marketing and education at Trend Micro.

    In past years, scammers have leaned heavily on impersonation. Fake IRS emails promising refunds, text messages claiming accounts have been flagged under new rules and fraudulent tax help offers that promise faster returns continue to circulate, Owens said. As February begins, many taxpayers feel pressure to file quickly. That urgency creates the perfect conditions for fraud.

    Sign up for my FREE CyberGuy Report

    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    WHY SCAMMERS OPEN BANK ACCOUNTS IN YOUR NAME

    Scam emails often pose as IRS notices and demand immediate action to protect a refund. The IRS does not contact taxpayers this way. (Kurt “CyberGuy” Knutsson)

    Why scammers thrive when tax rules feel unclear

    Uncertainty is one of the most effective tools scammers have. When taxpayers are unsure how filing rules work or whether a message is legitimate, criminals step in with communications designed to sound official and helpful. The goal is not clarity. It is speed.

    “Scammers aim to create a heightened sense of anxiety among the people they are targeting,” Owens said. “When taxpayers don’t feel confident about what’s real, whether it’s new filing options, eligibility rules or program updates, criminals step in with messages that sound official and helpful.” They often pose as the IRS, a tax prep service, or even government support. Once trust is established, the message quickly turns transactional, asking for clicks, personal data or payments.

    The most common IRS impersonation scams right now

    While the delivery methods change, the core message rarely does. Something is wrong, and it must be fixed immediately. 

    “The most common tactic we’re seeing is fake refund or account alert messages that claim something is wrong and demand immediate action,” Owens said. Other scams go a step further. Some direct victims to fake IRS login pages designed to steal credentials.

    Others promote fraudulent tax assistance, presenting themselves as government-backed or low-cost help in order to collect personal and financial information. These scams arrive by email, text message, phone calls and fake websites. Many are polished enough to appear legitimate at first glance.

    Why phrases like new rules and urgent issues work

    Language plays a central role in tax scams. Phrases such as new rules or urgent account issues are designed to trigger panic before logic has a chance to catch up. They suggest the recipient has missed something important or risks losing money.

    “Those phrases work because they can trigger panic and urgency, and people are more likely to react emotionally than logically,” Owens said. “New rules suggest you may have missed something important, and an urgent account issue creates fear of penalties, delays or losing a refund.” 

    The safest response is to pause. Do not click links, reply to messages or call phone numbers included in the alert. Instead, go directly to a trusted source like IRS.gov using your own browser.

    A real tax scam message that looks legitimate

    Many tax scams follow a familiar structure. A common example reads: “IRS Notice: Your tax refund is on hold due to a filing discrepancy under updated 2026 rules. Verify your identity now to avoid delays.” 

    At first glance, messages like this may appear credible. They often include official-looking logos, reference numbers and links that resemble real government pages.

    “It may include a convincing IRS-style logo, a case number and a link that looks legitimate at a glance,” Owens said. “But the red flags are usually the same.” The message pressures immediate action, directs users to non-government websites, and requests sensitive information such as Social Security numbers, bank details or login credentials.

    HOW TO STOP IMPOSTOR BANK SCAMS BEFORE THEY DRAIN YOUR WALLET

    A fake IRS notification

    Fake IRS alerts use urgent language like “account issue” or “new rules” to trigger panic. Scammers rely on fear to push quick decisions. (Kurt “CyberGuy” Knutsson)

    What happens after someone falls for a tax scam?

    The damage rarely ends with a single click. 

    “The most serious consequences are identity theft and financial loss,” Owens said. “Once scammers have personal information, they can file fraudulent tax returns, steal refunds, open credit accounts and access bank funds.”

    Victims often spend months working to recover lost money, repair credit damage and restore their identities.

    How the IRS really communicates with taxpayers

    Despite repeated warnings, many people still believe the IRS might email or text them. 

    “A legitimate tax service or the IRS won’t reach out unexpectedly by email, text or social media, and they won’t pressure you to act immediately,” Owens said.

    Scam messages often share the same warning signs. They sound urgent, include links or attachments and ask for sensitive information right away. If a message creates panic or demands fast action, that alone is reason to be skeptical. The IRS primarily communicates by official mail. Unexpected digital contact should always raise concern.

    What to watch for next as scams evolve

    Tax scams continue to grow more sophisticated each year. 

    “Taxpayers should watch for scams that feel more real than ever,” Owens said. “That includes highly polished phishing emails, refund texts designed for quick mobile clicks, fake tax help ads and cloned websites that mimic real IRS or tax prep portals.”

    The biggest mistake people still make is treating an unexpected tax message like an emergency. 

    “In tax season, speed is the scammer’s advantage,” Owens said. “Taking 30 seconds to double-check the source can prevent months of financial and identity damage.”

    What to do if you clicked or responded by mistake

    If someone realizes too late that a message was fraudulent, fast action can limit the damage. 

    “First, stop engaging immediately,” Owens said. “Don’t click links, download attachments or reply.”

    Next, report the incident. Forward phishing emails to phishing@irs.gov and file a report at reportfraud.ftc.gov.

    After that, monitor financial accounts closely, change passwords and consider placing a fraud alert or credit freeze if necessary.

    To learn more about how to do this, go to Cyberguy.com and search “How to freeze your credit.” 

    SCAMMERS TARGET RETIREES AS MAJOR 401(K) RULE CHANGES LOOM FOR 2026 TAX YEAR AHEAD NATIONWIDE

    A calculator on top of tax papers

    Tax scammers target personal and financial data to steal refunds or commit identity theft. (Kurt “CyberGuy” Knutsson)

    Ways to stay safe during tax season

    Scammers count on rushed decisions. The good news is that a few smart habits can dramatically lower your risk.

    1) Slow down before responding to tax messages

    Urgency is the scammer’s favorite tool. Messages that demand immediate action aim to short-circuit your judgment. 

    “Scammers rely on fear, urgency or false promises, especially during tax season,” Owens said. “It’s important to slow down, verify information through official channels, and use trusted security tools.” If a message pressures you to act fast, stop. Take a breath before doing anything else.

    2) Verify filing changes through official IRS channels

    Scam messages often reference new rules, updated policies or eligibility changes. That language sounds credible when filing programs shift. Always confirm changes by typing IRS.gov directly into your browser or signing in to your trusted tax provider account. Never rely on links or phone numbers included in a message.

    3) Protect tax accounts with strong credentials

    Tax portals hold valuable personal and financial data. Weak passwords make them easy targets. Use strong and unique passwords for every tax-related account. A password manager can help generate and store secure credentials without relying on memory.

    Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

    4) Watch for pressure tactics and refund promises

    Scammers know refunds motivate quick action. Messages claiming your refund is waiting, delayed or at risk often signal fraud. Be cautious of promises like faster refunds, guaranteed results or special access to government-backed assistance. Legitimate services do not operate that way.

    5) Avoid links and secure your devices with strong antivirus software 

    Clicking a single link can expose login credentials or install malware. Do not click on links in unexpected tax messages. Also, use strong antivirus software to help block malicious sites and detect threats before damage occurs.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    6) Reduce your digital footprint

    Personal data fuels tax scams. The more information criminals can find online, the easier impersonation becomes. Using a data removal service can help limit exposed personal details across data broker sites. Less data means fewer opportunities for scammers to exploit your identity.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    Kurt’s key takeaways

    Tax season pressure makes even cautious people vulnerable. In 2026, filing confusion adds fuel to the fire. Scammers know this and design messages to look official, urgent and helpful. Pausing, verifying and trusting official sources remains the strongest defense. When something feels rushed, it is usually for a reason.

    Have you received a suspicious IRS message this tax season, and what made you question whether it was real? Let us know by writing to us at Cyberguy.com

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2026 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Major US shipping platform left customer data wide open to hackers

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Cargo theft is no longer just about stolen trucks and forged paperwork. Over the past year, security researchers have been warning that hackers are increasingly targeting the technology behind global shipping, quietly manipulating systems that move goods worth millions of dollars. 

    In some cases, organized crime groups use hacked logistics platforms to redirect shipments, allowing criminals to steal goods without ever setting foot in a warehouse. One recent case involving a critical U.S. shipping technology provider shows just how exposed parts of the supply chain have been, and for how long.

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter     

    A key shipping platform was left wide open

    CRIME RINGS, HACKERS JOIN FORCES TO HIJACK TRUCKS NATIONWIDE, FUELING MAJOR HOLIDAY SHIPPING SECURITY FEARS

    Digital shipping platforms now control how goods move worldwide, making cybersecurity failures a direct risk to the global supply chain. (John Keeble/Getty Images)

    The company at the center of this incident is Bluspark Global, a New York-based firm whose Bluvoyix platform is used by hundreds of companies to manage and track freight moving around the world. While Bluspark isn’t a household name, its software supports a large slice of global shipping, including major retailers, grocery chains and manufacturers.

    For months, Bluspark’s systems reportedly contained basic security flaws that effectively left its shipping platform exposed to anyone on the internet. According to the company, five vulnerabilities were eventually fixed, including the use of plaintext passwords and the ability to remotely access and interact with the Bluvoyix platform. These flaws could have given attackers access to decades of shipment records and customer data.

    Bluspark says those issues are now resolved. But the timeline leading up to the fixes raises serious concerns about how long the platform was vulnerable and how difficult it was to alert the company in the first place.

    How a researcher uncovered the flaws

    Security researcher Eaton Zveare discovered the vulnerabilities in October while examining the website of a Bluspark customer. What started as a routine look at a contact form quickly escalated. By viewing the website’s source code, Zveare noticed that messages sent through the form passed through Bluspark’s servers using an application programming interface, or API.

    From there, things unraveled fast. The API’s documentation was publicly accessible and included a built-in feature that allowed anyone to test commands. Despite claiming authentication was required, the API returned sensitive data without any login at all. Zveare was able to retrieve large amounts of user account information, including employee and customer usernames and passwords stored in plaintext.

    Worse, the API allowed the creation of new administrator-level accounts without proper checks. That meant an attacker could grant themselves full access to Bluvoyix and view shipment data going back to 2007. Even security tokens designed to limit access could be bypassed entirely.

    Why it took weeks to fix critical shipping security flaws

    One of the most troubling parts of this story isn’t just the vulnerabilities themselves, but how hard it was to get them fixed. Zveare spent weeks trying to contact Bluspark after discovering the flaws, sending emails, voicemails, and even LinkedIn messages, without success.

    With no clear vulnerability disclosure process in place, Zveare eventually turned to Maritime Hacking Village, which helps researchers notify companies in the shipping and maritime industries. When that failed, he contacted the press as a last resort.

    Only after that did the company respond, through its legal counsel. Bluspark later confirmed it had patched the flaws and said it plans to introduce a formal vulnerability disclosure program. The company has not said whether it found evidence that attackers exploited the bugs to manipulate shipments, stating only that there was no indication of customer impact. It also declined to share details about its security practices or any third-party audits.

    10 ways you can stay safe when cyberattacks hit supply chains

    Hackers can break into a shipping or logistics platform without you ever realizing your data was involved. These steps help you reduce risk when attacks like this happen.

    1) Watch for delivery-related scams and fake shipping notices

    After supply chain breaches, criminals often send phishing emails or texts pretending to be shipping companies, retailers, or delivery services. If a message pressures you to click a link or “confirm” shipment details, slow down. Go directly to the retailer’s website instead of trusting the message.

    2) Use a password manager to protect your accounts

    If attackers gain access to customer databases, they often try the same login details on shopping, email, and banking accounts. A password manager ensures every account has a unique password, so one breach doesn’t give attackers the keys to everything else.

    Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

    3) Reduce your exposed personal data online

    Young woman types on smartphone

    Security researchers found exposed APIs that allowed access to sensitive shipping data without proper authentication. (Portra/Getty Images)

    Criminals often combine data from one breach with information scraped from data broker sites. Personal data removal services can help reduce how much of your information is publicly available, making it harder for criminals to target you with convincing scams.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    4) Run strong antivirus software on your devices

    Strong antivirus software can block malicious links, fake shipping pages, and malware-laced attachments that often follow high-profile breaches. Keeping real-time protection enabled adds an important layer when criminals try to exploit confusion.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    HUGE DATA LEAK EXPOSES 14 MILLION CUSTOMER SHIPPING RECORDS

    5) Enable two-factor authentication wherever possible

    Two-factor authentication (2FA) makes it much harder for attackers to take over accounts, even if they have your password. Prioritize email, shopping accounts, cloud storage and any service that stores payment or delivery information.

    6) Review your account activity and delivery history

    Check your online shopping accounts for unfamiliar orders, address changes, or saved payment methods you don’t recognize. Catching changes early can prevent fraud from escalating.

    7) Consider identity theft protection

    Identity theft protection services can alert you to suspicious credit activity and help you recover if attackers access your name, address or other personal details. Identity Theft companies can monitor personal information like your Social Security Number (SSN), phone number, and email address and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

    See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com

    8) Place a free credit freeze to stop new fraud

    If your name, email, or address was exposed, consider placing a credit freeze with the major credit bureaus. A freeze prevents criminals from opening new accounts in your name, even if they obtain additional personal data later. It’s free, easy to lift temporarily, and one of the most effective steps you can take after a breach. To learn more about how to do this, go to Cyberguy.com and search “How to freeze your credit.” 

    9) Lock down your shipping and retailer accounts

    Review the security settings on major shopping and delivery accounts, including retailers, grocery services and shipping providers. Pay close attention to saved delivery addresses, default shipping locations and linked payment methods. Attackers sometimes add their own address quietly and wait before making a move.

    10) Businesses should review third-party logistics access

    If you run a business that relies on shipping or logistics platforms, incidents like this are a reminder to review vendor access controls. Limit administrative permissions, rotate API keys regularly, and confirm vendors have a clear vulnerability disclosure process. Supply chain security depends on more than just your own systems.

    Someone typing on a computer in a dark room.

    Hackers increasingly target logistics technology, manipulating systems to redirect shipments without physical theft.  (Thomas Trutschel/Photothek via Getty Images)

    Kurt’s key takeaway

    Shipping platforms sit at the intersection of physical goods and digital systems, making them attractive targets for cybercriminals. When basic protections like authentication and password encryption are missing, the consequences can spill into the real world, from stolen cargo to supply chain disruption. The incident also highlights how many companies still lack clear, public ways for researchers to report vulnerabilities responsibly.

    Do you think companies that quietly power global supply chains are doing enough to protect themselves from cyber threats?  Let us know by writing to us at Cyberguy.com

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter 

    Copyright 2026 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Under Armour data breach claims trigger alerts for millions of users

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Sportswear and fitness brand Under Armour is investigating claims of a massive data breach after customer records were posted on a hacker forum. 

    The breach became widely known after millions of people received alerts warning their information may have been compromised. While Under Armour says its investigation is ongoing, cybersecurity researchers reviewing the leaked data say it appears to include personal details potentially linked to customer purchases.

    According to breach notification service Have I Been Pwned, the dataset contains email addresses linked to approximately 72 million people, prompting the organization to notify affected users directly. The scale of the exposure has raised new concerns about how consumer data can be misused long after a breach occurs.

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    THIRD-PARTY BREACH EXPOSES CHATGPT ACCOUNT DETAILS  

    Millions of Under Armour customers were alerted after stolen account data surfaced on a hacker forum, bringing the breach into public view. (Thomas Trutschel/Photothek via Getty Images)

    What happened in the Under Armour data breach

    The stolen data is reportedly linked to a ransomware attack that occurred in November 2025. At the time, the Everest ransomware group claimed responsibility and attempted to extort Under Armour by threatening to leak internal files. In January 2026, customer data from that incident appeared publicly on a popular hacking forum. Soon after, breach notification service Have I Been Pwned obtained a copy of the data and alerted affected users by email. According to reports, the seller claimed the stolen files came directly from the November breach and included millions of customer records.

    What data was exposed

    The leaked dataset reportedly includes a broad range of personal information. While payment card details have not been confirmed, the exposed data is still valuable to cybercriminals.

    Compromised information may include:

    Researchers also found email addresses belonging to Under Armour employees within the data. That increases the risk of targeted phishing and business email compromise scams.

    Under Armour’s response so far

    “We are aware of claims that an unauthorized third party obtained certain data,” an Under Armour spokesperson told CyberGuy. “Our investigation of this issue, with the assistance of external cybersecurity experts, is ongoing. Importantly, at this time, there’s no evidence to suggest this issue affected UA.com or systems used to process payments or store customer passwords. Any implication that sensitive personal information of tens of millions of customers has been compromised is unfounded. The security of our systems and data is a top priority for UA, and we take this issue very seriously.”

    Why this breach matters

    Even without passwords or payment details, this breach still poses serious risks. Names, email addresses, birth dates and purchase history can be used to create highly convincing scams. Cybercriminals often reference real purchases or account details to gain trust. As a result, phishing emails tied to this breach may appear legitimate and urgent. Over time, exposed data like this can also be combined with other breaches to build detailed identity profiles that are harder to protect against.

    How to check if your passwords were stolen

    To see if your email was affected, visit the Have I Been Pwned website. It is the first and official source for this newly added dataset. Enter your email address to find out if your information appears in the leak. When done, come back here for Step 1 below.

    Ways to stay safe after the Under Armour data breach

    If you received a breach alert or believe your information may be included, taking action now can reduce your risk later.

    1) Change reused passwords and use a password manager

    If you reused the same password on other sites, change those passwords right away. Even if Under Armour says passwords were not affected, exposed email addresses are often used in follow-up attacks. A password manager makes this easier. It creates strong, unique passwords for each account and stores them securely. That way, one breach cannot unlock multiple accounts.

    woman working on budget

    The leaked data reportedly includes email addresses, birth dates and purchase details, which can be exploited in targeted phishing scams. (Kurt “CyberGuy” Knutsson)

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

    2) Watch for phishing emails tied to Under Armour

    Cybercriminals often move fast after a breach. As a result, emails that appear to come from Under Armour or fitness brands may land in your inbox. Be cautious of messages that claim there is an issue with your account or a recent purchase. Do not click links or open attachments in unexpected emails. Instead, go directly to the company’s official website if you need to check your account. Using strong antivirus software can also help block malicious links and attachments before they cause harm.

    ILLINOIS DHS DATA BREACH EXPOSES 700K RESIDENTS’ RECORDS

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    3) Turn on two-factor authentication everywhere you can

    Two-factor authentication (2FA) adds an extra layer of protection. Even if someone gets your password, they still need a second step to log in. Turn it on for email accounts first. Then enable it for shopping, fitness and financial accounts. This single step can stop many account takeover attempts linked to breached data.

    4) Monitor for password reset attempts and account alerts

    After a breach, attackers often test stolen email addresses across multiple sites. That activity can trigger password reset emails you did not request. Pay close attention to these alerts. If you see one, secure the account immediately by changing the password and reviewing recent activity.

    5) Be skeptical of messages that reference past purchases

    This breach included purchase information, which makes scams more convincing. Attackers may reference real products or order details to earn your trust. Treat any message that pressures you to act quickly as suspicious. Legitimate companies do not demand immediate action by email or text.

    6) Reduce your exposure with a data removal service

    Over time, exposed personal data often ends up with data brokers. These companies collect and sell profiles that scammers use for targeting. A data removal service can help you request the deletion of your information from these databases. Reducing what is publicly available makes it harder for criminals to build detailed profiles.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    Under Armour Outdoor store in China

    Security experts warn that even without payment data, exposed personal information can fuel fraud long after a breach is discovered. (Cheng Xin/Getty Images)

    Kurt’s key takeaways

    The Under Armour data breach is a reminder that even major global brands can become targets. While payment systems appear unaffected, the exposure of personal data still creates long-term risks for millions of customers. Data breaches often unfold over time. What starts as leaked records can later fuel scams, identity theft and targeted attacks. Staying alert now can reduce the chance of bigger problems later.

    If your personal shopping or fitness data were exposed in a breach like this, would you keep using the brand or move on to a competitor? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2026 CyberGuy.com. All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Google Fast Pair flaw lets hackers hijack headphones

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Google designed Fast Pair to make Bluetooth connections fast and effortless. One tap replaces menus, codes and manual pairing. That convenience now comes with serious risk. Security researchers at KU Leuven uncovered flaws in Google’s Fast Pair protocol that allows silent device takeovers. They named the attack method WhisperPair. An attacker nearby can connect to headphones, earbuds or speakers without the owner knowing. In some cases, the attacker can also track the user’s location. Even more concerning, victims do not need to use Android or own any Google products. iPhone users are also affected.

    Sign up for my FREE CyberGuy Report

    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    APPLE WARNS MILLIONS OF IPHONES ARE EXPOSED TO ATTACK

    Fast Pair makes connecting Bluetooth headphones quick, but researchers found that some devices accept new pairings without proper authorization.       (Kurt “CyberGuy” Knutsson)

    What WhisperPair is and how it hijacks Bluetooth devices

    Fast Pair works by broadcasting a device’s identity to nearby phones and computers. That shortcut speeds up pairing. Researchers found that many devices ignore a key rule. They still accept new pairings while already connected. That opens the door to abuse.

    Within Bluetooth range, an attacker can silently pair with a device in about 10 to 15 seconds. Once connected, they can interrupt calls, inject audio or activate microphones. The attack does not require specialized hardware and can be carried out using a standard phone, laptop, or low-cost device like a Raspberry Pi. According to the researchers, the attacker effectively becomes the device owner.

    Audio brands affected by the Fast Pair vulnerability

    The researchers tested 17 Fast Pair compatible devices from major brands, including Sony, Jabra, JBL, Marshall, Xiaomi, Nothing, OnePlus, Soundcore, Logitech and Google. Most of these products passed Google certification testing. That detail raises uncomfortable questions about how security checks are performed.

    How headphones can become tracking devices

    Some affected models create an even bigger privacy issue. Certain Google and Sony devices integrate with Find Hub, which uses nearby devices to estimate location. If a headset has never been linked to a Google account, an attacker can claim it first. That allows continuous tracking of the user’s movements. If the victim later receives a tracking alert, it may appear to reference their own device. That makes the warning easy to dismiss as an error.

    GOOGLE NEST STILL SENDS DATA AFTER REMOTE CONTROL CUTOFF, RESEARCHER FINDS

    A screenshot of a location screen

    Attacker’s dashboard with location from the Find Hub network. (KU Leuven)

    Why many Fast Pair devices may stay vulnerable

    There is another problem most users never consider. Headphones and speakers require firmware updates. Those updates usually arrive through brand-specific apps that many people never install. If you never download the app, you never see the update. That means vulnerable devices could remain exposed for months or even years.

    The only way to fix this vulnerability is by installing a software update issued by the device manufacturer. While many companies have released patches, updates may not yet be available for every affected model. Users should check directly with the manufacturer to confirm whether a security update exists for their specific device.

    Why convenience keeps creating security gaps

    Bluetooth itself was not the problem. The flaw lives in the convenience layer built on top of it. Fast Pair prioritized speed over strict ownership enforcement. Researchers argue that pairing should require cryptographic proof of ownership. Without it, convenience features become attack surfaces. Security and ease of use do not have to conflict. But they must be designed together.

    Google responds to the Fast Pair WhisperPair security flaws

    Google says it has been working with researchers to address the WhisperPair vulnerabilities and began sending recommended patches to headphone manufacturers in early September. Google also confirmed that its own Pixel headphones are now patched.

    In a statement to CyberGuy, a Google spokesperson said, “We appreciate collaborating with security researchers through our Vulnerability Rewards Program, which helps keep our users safe. We worked with these researchers to fix these vulnerabilities, and we have not seen evidence of any exploitation outside of this report’s lab setting. As a best security practice, we recommend users check their headphones for the latest firmware updates. We are constantly evaluating and enhancing Fast Pair and Find Hub security.”

    Google says the core issue stemmed from some accessory makers not fully following the Fast Pair specification. That specification requires accessories to accept pairing requests only when a user has intentionally placed the device into pairing mode. According to Google, failures to enforce that rule contributed to the audio and microphone risks identified by the researchers.

    To reduce the risk going forward, Google says it updated its Fast Pair Validator and certification requirements to explicitly test whether devices properly enforce pairing mode checks. Google also says it provided accessory partners with fixes intended to fully resolve all related issues once applied.

    On the location tracking side, Google says it rolled out a server-side fix that prevents accessories from being silently enrolled into the Find Hub network if they have never been paired with an Android device. According to the company, this change addresses the Find Hub tracking risk in that specific scenario across all devices, including Google’s own accessories.

    Researchers, however, have raised questions about how quickly patches reach users and how much visibility Google has into real-world abuse that does not involve Google hardware. They also argue that weaknesses in certification allowed flawed implementations to reach the market at scale, suggesting broader systemic issues.

    For now, both Google and the researchers agree on one key point. Users must install manufacturer firmware updates to be protected, and availability may vary by device and brand.

    SMART HOME HACKING FEARS: WHAT’S REAL AND WHAT’S HYPE

    A location screen

    Unwanted tracking notification showing the victim’s own device. (KU Leuven)

    How to reduce your risk right now

    You cannot disable Fast Pair entirely, but you can lower your exposure.

    1) Check if your device is affected

    If you use a Bluetooth accessory that supports Google Fast Pair, including wireless earbuds, headphones or speakers, you may be affected. The researchers created a public lookup tool that lets you search for your specific device model and see whether it is vulnerable. Checking your device is a simple first step before deciding what actions to take. Visit whisperpair.eu/vulnerable-devices to see if your device is on the list.

    2) Update your audio devices

    Install the official app from your headphone or speaker manufacturer. Check for firmware updates and apply them promptly.

    3) Avoid pairing in public places

    Pair new devices in private spaces. Avoid pairing in airports, cafés or gyms where strangers are nearby.

    4) Factory reset if something feels off

    Unexpected audio interruptions, strange sounds or dropped connections are warning signs.  A factory reset can remove unauthorized pairings, but it does not fix the underlying vulnerability. A firmware update is still required.

    5) Turn off Bluetooth when not needed

    Bluetooth only needs to be on during active use. Turning off Bluetooth when not in use limits exposure, but it does not eliminate the underlying risk if the device remains unpatched.

    6) Reset secondhand devices

    Always factory reset used headphones or speakers before pairing them. This removes hidden links and account associations.

    7) Take tracking alerts seriously

    Investigate Find Hub or Apple tracking alerts, even if they appear to reference your own device.

    8) Keep your phone updated

    Install operating system updates promptly. Platform patches can block exploit paths even when accessories lag behind.

    Kurt’s key takeaways

    WhisperPair shows how small shortcuts can lead to large privacy failures. Headphones feel harmless. Yet they contain microphones, radios and software that need care and updates. Ignoring them leaves a blind spot that attackers are happy to exploit. Staying secure now means paying attention to the devices you once took for granted.

    Should companies be allowed to prioritize fast pairing over cryptographic proof of device ownership? Let us know by writing to us at Cyberguy.com

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 

    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2026 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Why clicking the wrong Copilot link could put your data at risk

    [ad_1]

    NEWYou can now listen to Fox News articles!

    AI assistants are supposed to make life easier. Tools like Microsoft Copilot can help you write emails, summarize documents and answer questions using information from your own account. But security researchers are now warning that a single bad link could quietly turn that convenience into a privacy risk. 

    A newly discovered attack method shows how attackers could hijack a Copilot session and siphon data without you seeing anything suspicious on screen.

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.     

    Because Copilot stays tied to your logged-in Microsoft account, attackers can quietly use your active session to access data in the background. (Photo by Donato Fasano/Getty Images)

    What researchers discovered about Copilot links

    ILLINOIS DHS DATA BREACH EXPOSES 700K RESIDENTS’ RECORDS

    Security researchers at Varonis uncovered a technique they call “Reprompt.” In simple terms, it shows how attackers could sneak instructions into a normal-looking Copilot link and make the AI do things on their behalf.

    Here’s the part that matters to you: Microsoft Copilot is connected to your Microsoft account. Depending on how you use it, Copilot can see your past conversations, things you’ve asked it and certain personal data tied to your account. Normally, Copilot has guardrails to prevent sensitive information from leaking. Reprompt showed a way around some of those protections.

    The attack starts with just one click. If you open a specially crafted Copilot link sent through email or a message, Copilot can automatically process hidden instructions embedded inside the link. You don’t need to install anything, and there are no pop-ups or warnings. After that single click, Copilot can keep responding to instructions in the background using your already logged-in session. Even closing the Copilot tab does not immediately stop the attack, because the session stays active for a while.

    How Reprompt works

    Varonis found that Copilot accepts questions through a parameter inside its web address. Attackers can hide instructions inside that address and make Copilot execute them as soon as the page loads.

    That alone would not be enough, because Copilot tries to block data leaks. The researchers combined several tricks to get around this. First, they injected instructions directly into Copilot through the link itself. This allowed Copilot to read information it normally shouldn’t share.

    Second, they used a “try twice” trick. Copilot applies stricter checks the first time it answers a request. By telling Copilot to repeat the action and double-check itself, the researchers found that those protections could fail on the second attempt.

    Third, they showed that Copilot could keep receiving follow-up instructions from a remote server controlled by the attacker. Each response from Copilot helped generate the next request, allowing data to be quietly sent out piece by piece. The result is an invisible back-and-forth where Copilot keeps working for the attacker using your session. From your perspective, nothing looks wrong.

    MICROSOFT SOUNDS ALARM AS HACKERS TURN TEAMS PLATFORM INTO ‘REAL-WORLD DANGERS’ FOR USERS

    Varonis responsibly reported the issue to Microsoft, and the company fixed it in the January 2026 Patch Tuesday updates. There is no evidence that Reprompt was used in real-world attacks before the fix. Still, this research is important because it shows a bigger problem. AI assistants have access, memory and the ability to act on your behalf. That combination makes them powerful, but also risky if protections fail. As researchers put it, the danger increases when autonomy and access come together.

    It’s also worth noting that this issue only affected Copilot Personal. Microsoft 365 Copilot, which businesses use, has extra security layers like auditing, data loss prevention and admin controls.

    “We appreciate Varonis Threat Labs for responsibly reporting this issue,” a Microsoft spokesperson told CyberGuy. “We have rolled out protections that address the scenario described and are implementing additional measures to strengthen safeguards against similar techniques as part of our defense-in-depth approach.”

    8 steps you can take to stay safe from AI attacks

    Even with the fix in place, these habits will help protect your data as AI tools become more common.

    1) Install Windows and browser updates immediately

    Security fixes only protect you if they’re installed. Attacks like Reprompt rely on flaws that already have patches available. Turn on automatic updates for Windows, Edge and other browsers so you don’t delay critical fixes. Waiting weeks or months leaves a window where attackers can still exploit known weaknesses.

    2) Treat Copilot and AI links like login links

    If you wouldn’t click a random password reset link, don’t click unexpected Copilot links either. Even links that look official can be weaponized. If someone sends you a Copilot link, pause and ask yourself whether you were expecting it. When in doubt, open Copilot manually instead.

    Corporate signage of Microsoft Corp at Microsoft India Development Center

    Even after Microsoft fixed the flaw, the research highlights why limiting data exposure and monitoring account activity still matters as AI tools evolve. (Photographer: Prakash Singh/Bloomberg via Getty Images)

    3) Use a password manager to protect your accounts

    A password manager creates and stores strong, unique passwords for every service you use. If attackers manage to access session data or steal credentials indirectly, unique passwords prevent one breach from unlocking your entire digital life. Many password managers also warn you if a site looks suspicious or fake.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords, and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

    4) Enable two-factor authentication on your Microsoft account

    Two-factor authentication (2FA) adds a second layer of protection, even if attackers gain partial access to your session. It forces an extra verification step, usually through an app or device, making it much harder for someone else to act as you inside Copilot or other Microsoft services.

    5) Reduce how much personal data exists online

    Data broker sites collect and resell personal details like your email address, phone number, home address and even work history. If an AI tool or account session is abused, that publicly available data can make the damage worse. Using a data-removal service helps delete this information from broker databases, shrinking your digital footprint and limiting what attackers can piece together.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    6) Run strong antivirus software on your device

    Modern antivirus tools do more than scan files. They help detect phishing links, malicious scripts and suspicious behavior tied to browser activity. Since Reprompt-style attacks start with a single click, having real-time protection can stop you before damage happens, especially when attacks look legitimate.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    7) Regularly review your account activity and settings

    Check your Microsoft account activity for unfamiliar logins, locations, or actions. Review what services Copilot can access, and revoke anything you no longer need. These checks don’t take long, but they can reveal issues early, before attackers have time to do serious damage. Here’s how:

    Go to account.microsoft.com, and sign in to your Microsoft account.

    Select Security, then choose View my sign-in activity and verify your identity if prompted.

    Review each login for unfamiliar locations, devices or failed sign-in attempts.

    If you see anything suspicious, select This wasn’t me or Secure your account, then change your password immediately and enable two-step verification.

    Visit account.microsoft.com/devices, and remove any devices you no longer recognize or use.

    In Microsoft Edge, open Settings > Appearance > Copilot and Sidebar > Copilot, and turn off Allow Microsoft to access page content if you want to limit Copilot’s access.

    Review apps connected to your Microsoft account and revoke permissions you no longer need.

    close up of hands of business person working on computer, man using internet and social media

    A single Copilot link can carry hidden instructions that run the moment you click, without any warning or pop-ups.  (iStock)

    8) Be specific about what you ask AI tools to do

    Avoid giving AI assistants broad authority like “handle whatever is needed.” Wide permissions make it easier for hidden instructions to influence outcomes. Keep requests narrow and task-focused. The less freedom an AI has, the harder it is for malicious prompts to steer it silently.

    Kurt’s key takeaway

    Reprompt doesn’t mean Copilot is unsafe to use, but it does show how much trust these tools require. When an AI assistant can think, remember and act for you, even a single bad click can matter. Keeping your system updated and being selective about what you click remain just as important in the age of AI as it was before.

    Do you feel comfortable letting AI assistants access your personal data, or does this make you more cautious? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

    Copyright 2026 CyberGuy.com. All rights reserved. 

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Ransomware attack exposes Social Security numbers at major gas station chain

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Cybercriminals are happy to target almost any industry where data can be stolen. In many cases, less prepared and less security-focused companies are simply easier targets. 

    A recent ransomware attack on a company tied to dozens of gas stations across Texas shows exactly how this plays out. The incident exposed highly sensitive personal data, including Social Security numbers and driver’s license details, belonging to hundreds of thousands of people. 

    The breach went undetected for days, giving attackers ample time to move through internal systems and steal sensitive data. If you’ve ever paid at the pump or shopped inside one of these convenience stores, this is the kind of incident that should make you stop and pay attention.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    What happened in the Gulshan ransomware attack

    According to a disclosure filed with the Maine Attorney General’s Office, Gulshan Management Services, Inc. reported a cybersecurity incident that impacted more than 377,000 individuals. Gulshan is linked to Gulshan Enterprises, which operates around 150 Handi Plus and Handi Stop gas stations and convenience stores across Texas.

    WINDOWS 10 USERS FACE RANSOMWARE NIGHTMARE AS MICROSOFT SUPPORT ENDS IN 2025 WORLDWIDE

    The company says it detected unauthorized access to its IT systems in late September. Investigators later determined that attackers had been inside the network for roughly ten days before anyone noticed. The intrusion began with a phishing attack, a reminder of how a single deceptive email can still open the door to massive breaches.

    Ransomware attacks don’t just hit tech companies. Retailers like gas stations store sensitive customer and employee data that criminals actively target. (Kurt “CyberGuy” Knutsson)

    During that window, the attackers accessed and stole personal data, then deployed ransomware that encrypted files across Gulshan’s systems. The compromised information includes names, contact details, Social Security numbers and driver’s license numbers. That combination is especially dangerous, since it can be used for identity theft, account takeovers and fraud that may surface months or even years later.

    Why the lack of a ransomware claim still matters

    So far, no known ransomware group has publicly taken credit for the attack. That might sound like good news, but it does not necessarily change the risk for affected individuals. In many ransomware cases, silence can mean one of two things. Either the attackers have not yet posted stolen data publicly, or the victim company may have resolved the incident privately.

    Gulshan’s filing states that it restored its systems using known-safe backups. That detail often suggests a company chose to rebuild rather than negotiate with attackers. Even so, once data has been copied out of a network, there is no way to pull it back. Whether or not the stolen information ever appears online, the exposure alone puts affected people at long-term risk.

    This incident also highlights a recurring pattern. Retail and service businesses handle huge volumes of personal data but often rely on legacy systems and frontline employees who are prime phishing targets. Gas stations may not feel like obvious hacking targets, but their payment systems, loyalty programs and HR databases make them valuable all the same.

    We reached out to Gulshan Management Services for comment regarding the breach, but did not receive a response before our deadline.

    Texas gas station customer

    A customer pumps gas at a gas station on Feb. 13, 2025, in Austin, Texas.  (Brandon Bell/Getty Images)

    10 steps you can take to protect yourself after a breach like this

    If your information was exposed in this breach or any similar ransomware incident, there are concrete steps you can take to reduce the fallout.

    1) Monitor your credit and identity closely

    If the company offers free credit monitoring or identity protection, enroll in it. These services can alert you early if someone tries to open accounts or misuse your identity. If nothing is offered, consider signing up for a reputable identity theft protection service on your own.

    Identity Theft companies can monitor personal information like your Social Security Number (SSN), phone number, and email address and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

    See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

    2) Consider a personal data removal service

    The less of your information that’s floating around data broker sites, the harder it is for criminals to target you. Data removal services can help reduce your digital footprint over time.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Frontier fallout as 750K customers' data exposed in RansomHub cyberattack

    Even when no ransomware group claims responsibility, stolen data can still fuel identity theft, fraud, and account takeovers long after a breach occurs. (Kurt “CyberGuy” Knutsson)

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    3) Use a password manager

    A password manager helps you create and store unique passwords for every account. If attackers try to reuse stolen data to break into your online accounts, strong, unique passwords can stop that attempt cold.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    FIBER BROADBAND GIANT INVESTIGATES BREACH AFFECTING 1M USERS

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

    4) Turn on two-factor authentication (2FA) everywhere possible

    2FA adds an extra barrier, even if someone has your personal details. Prioritize email, banking, cloud storage, and shopping accounts, since those are often targeted first.

    5) Install and keep a strong antivirus software running

    Strong antivirus software can help detect phishing attempts, malicious downloads, and suspicious activity before it turns into a full compromise. Keep real-time protection enabled and don’t ignore warnings.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    6) Watch for phishing and follow-up scams

    After breaches like this, scammers often send fake emails or texts pretending to be the affected company or a credit monitoring service. Slow down, verify messages independently, and never click links you weren’t expecting.

    7) Review your credit reports regularly

    Check your reports from all major credit bureaus for unfamiliar accounts or inquiries. You’re entitled to free reports, and catching issues early makes them much easier to fix.

    8) Freeze your credit to stop new accounts from being opened

    If criminals expose your Social Security number, place a credit freeze as soon as possible. A credit freeze blocks lenders from opening new accounts in your name, even when thieves have your personal details. The credit bureaus offer freezes for free, and you can temporarily lift one when you apply for credit yourself. This step stops identity theft before it starts, instead of alerting you after the damage is done. If you prefer not to freeze your credit, place a fraud alert instead. A fraud alert tells lenders to verify your identity before approving credit, which adds another layer of protection.

    To learn more about how to do this, go to Cyberguy.com and search “How to freeze your credit.” 

    Person using their smartphone.

    In the Gulshan attack, hackers spent days inside internal systems, stealing personal data before deploying ransomware that locked down files. (Silas Stein/picture alliance via Getty Images)

    9) Protect yourself from tax refund fraud with an IRS Identity Protection PIN

    When Social Security numbers are stolen, tax fraud often follows. Criminals can file fake tax returns in your name to steal refunds before you ever submit your paperwork. An IRS Identity Protection PIN (IP PIN) helps prevent this by ensuring only you can file a tax return using your SSN. It’s a simple but powerful safeguard that can block a common form of identity theft tied to data breaches.

    10) Lock down existing bank and financial accounts

    Don’t just watch for new fraud, proactively secure the accounts you already have. Enable alerts on bank and credit card accounts for large transactions, new payees, or changes to contact information. If your SSN or driver’s license number was exposed, consider calling your bank to ask about additional protections or account notes. Acting early can prevent small issues from becoming major financial problems.

    Kurt’s key takeaway

    Your personal data doesn’t just live with banks and hospitals. Retailers, gas stations, and convenience store operators also hold information that can cause real harm if it falls into the wrong hands. When attackers get in through something as simple as a phishing email and stay undetected for days, the damage can spread fast. You can’t prevent these breaches yourself, but you can limit how much power stolen data gives criminals by locking down your accounts and staying alert.

    Do you think everyday businesses like gas stations take cybersecurity seriously enough? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2026 CyberGuy.com. All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Web skimming attacks target major payment networks

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Online shopping feels familiar and fast, but a hidden threat continues to operate behind the scenes. 

    Researchers are tracking a long-running web skimming campaign that targets businesses connected to major payment networks. Web skimming is a technique where criminals secretly add malicious code to checkout pages so they can steal payment details as shoppers type them in. 

    These attacks work quietly inside the browser and often leave no obvious signs. Most victims only discover the problem after unauthorized charges appear on their statements.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    WHATSAPP WEB MALWARE SPREADS BANKING TROJAN AUTOMATICALLY

    Web skimming attacks hide inside checkout pages and steal card details as shoppers type them in. (Kurt “CyberGuy” Knutsson)

    What Magecart is and why it matters

    Magecart is the name researchers use for groups that specialize in web-skimming attacks. These attacks focus on online stores where shoppers enter payment details during checkout. Instead of hacking banks or card networks directly, attackers slip malicious code into a store’s checkout page. That code is written in JavaScript, which is a common type of website code used to make pages interactive. Legitimate sites use it for things like forms, buttons and payment processing.

    In Magecart attacks, criminals abuse that same code to secretly copy card numbers, expiration dates, security codes and billing details as shoppers type them in. The checkout still works, and the purchase goes through, so there is no obvious warning sign. Magecart originally described attacks against Magento-based online stores. Today, the term applies to web-skimming campaigns across many e-commerce platforms and payment systems.

    Which payment providers are being targeted?

    Researchers say this campaign targets merchants tied to several major payment networks, including:

    • American Express
    • Diners Club
    • Discover, a subsidiary of Capital One
    • JCB Co., Ltd.
    • Mastercard
    • UnionPay

    Large enterprises that rely on these payment providers face a higher risk due to complex websites and third-party integrations.

    700CREDIT DATA BREACH EXPOSES SSNS OF 5.8M CONSUMERS

    A woman holds a credit card as she types on her laptop.

    Criminals use hidden code to copy payment data while the purchase still goes through normally. (Kurt “CyberGuy” Knutsson)

    How attackers slip skimmers into checkout pages

    Attackers usually enter through weak points that are easy to overlook. Common entry paths include vulnerable third-party scripts, outdated plugins and unpatched content management systems. Once inside, they inject JavaScript directly into the checkout flow. The skimmer monitors form fields tied to card data and personal details, then quietly sends that information to attacker-controlled servers.

    Why web skimming attacks are hard to detect

    To avoid detection, the malicious JavaScript is heavily obfuscated. Some versions can remove themselves when they detect an admin session, which makes inspections appear clean. Researchers also found the campaign uses bulletproof hosting. These hosting providers ignore abuse reports and takedown requests, giving attackers a stable environment to operate. Because web skimmers run inside the browser, they can bypass many server-side fraud controls used by merchants and payment providers.

    Who Magecart web skimming attacks affect most

    Magecart campaigns impact three groups at the same time:

    • Shoppers who unknowingly give up card data
    • Merchants whose checkout pages are compromised
    • Payment providers that detect fraud after the damage is done

    This shared exposure makes detection slower and response more difficult.

    NEW MALWARE CAN READ YOUR CHATS AND STEAL YOUR MONEY

    Selling on the internet? Beware of sneaky tactics scammers use to trick you

    Simple protections like virtual cards and transaction alerts can limit damage and expose fraud faster. (Kurt “CyberGuy” Knutsson)

    How to stay safe as a shopper

    While shoppers cannot fix compromised checkout pages, a few smart habits can reduce exposure, limit how stolen data is used, and help catch fraud faster.

    1) Use virtual or single-use cards

    Virtual and single-use cards are digital card numbers that link to your real credit or debit account without exposing the actual number. They work like a normal card at checkout, but add an extra layer of protection. Most people already have access to them through services they use every day, including:

    Major banks and credit card issuers that offer virtual card numbers inside their apps

    Mobile wallet apps like Apple Pay and Google Pay generate temporary card numbers for online purchases, keeping your real card number hidden.

    Some payment apps and browser tools that create one-time or merchant-locked card numbers

    A single-use card typically works for one purchase or expires shortly after use. A virtual card can stay active for one store and be paused or deleted later. If a web skimming attack captures one of these numbers, attackers usually cannot reuse it elsewhere or run up repeat charges, which limits financial damage and makes fraud easier to stop.

    2) Turn on transaction alerts

    Transaction alerts notify you the moment your card is used, even for small purchases. If web skimming leads to fraud, these alerts can expose unauthorized charges quickly and give you a chance to freeze the card before losses grow. For example, a $2 test charge on your card can signal fraud before larger purchases appear.

    3) Lock down financial accounts

    Use strong, unique passwords for banking and card portals to reduce the risk of account takeover. A password manager helps generate and store them securely.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

    4) Install strong antivirus software

    Strong antivirus software can block connections to malicious domains used to collect skimmed data and warn you about unsafe websites.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    5) Use a data removal service

    Data removal services can reduce how much personal information is exposed online, making it harder for criminals to pair stolen card data with full identity details.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    6) Watch for unexpected card activity

    Review statements regularly, even for small charges, since attackers often test stolen cards with low-value transactions.

    Kurt’s key takeaways

    Magecart web skimming shows how attackers can exploit trusted checkout pages without disrupting the shopping experience. While consumers cannot fix compromised sites, simple safeguards can reduce risk and help catch fraud early. Online payments rely on trust, but this campaign shows why that trust should always be paired with caution.

    Does knowing how web skimming works make you rethink how safe online checkout really is?  Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

    Copyright 2026 CyberGuy.com. All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Fiber broadband giant investigates breach affecting 1M users

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Brightspeed, one of the largest fiber broadband providers in the United States, is investigating claims that hackers stole sensitive data tied to more than 1 million customers.

    The allegations surfaced when a group calling itself the Crimson Collective posted messages on Telegram warning Brightspeed employees to check their email. The group claims it has access to over 1 million residential customer records and threatened to release sample data if the company does not respond.

    At this point, Brightspeed has not confirmed a breach. However, the company says it is actively investigating what it calls a potential cybersecurity event.

    DATA BREACH EXPOSES 400,000 BANK CUSTOMERS’ INFO

    Fiber networks carry massive amounts of personal data, which makes internet providers attractive targets for extortion groups. (Philip Dulian/picture alliance via Getty Images)

    Sign up for my FREE CyberGuy ReportGet my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter 

    What the hackers say they stole

    According to Crimson Collective, the stolen data includes a wide range of personally identifiable information. The group claims it has access to:

    • Customer names, email addresses and phone numbers
    • Home and billing addresses
    • User account details linked to session or user IDs
    • Payment history and partial payment card information
    • Appointment and order records tied to customer accounts

    If accurate, that combination of data could create serious identity theft and fraud risks for affected customers.

    Brightspeed responds to the allegations

    Brightspeed says it takes the situation seriously, even as it continues to verify the claims.

    In a statement shared with BleepingComputer, the company said it is rigorously monitoring threats and working to understand what happened. Brightspeed added that it will keep customers, employees and authorities informed as more details become available.

    So far, there has been no public notice on Brightspeed’s website or social media channels confirming customer data exposure.

    Who Brightspeed is and why this matters

    Brightspeed is a U.S. telecommunications and internet service provider founded in 2022 after Apollo Global Management acquired local exchange assets from Lumen Technologies.

    Headquartered in Charlotte, North Carolina, the company serves rural and suburban communities across 20 states. It has rapidly expanded its fiber footprint, passing more than 2 million homes and businesses and aiming to reach over 5 million locations.

    Because Brightspeed focuses on underserved areas, many customers rely on it as their primary internet provider. That makes any potential breach especially concerning.

    A closer look at Crimson Collective

    Crimson Collective is not new to high-profile targets. In October, the group breached a GitLab instance tied to Red Hat, stealing hundreds of gigabytes of internal development data.

    That incident later rippled outward. In December, Nissan confirmed that personal data for about 21,000 Japanese customers was exposed through the same breach.

    More recently, researchers say Crimson Collective has targeted cloud environments, including Amazon Web Services, by abusing exposed credentials and creating rogue access accounts to escalate privileges.

    In other words, the group has a track record that makes its claims hard to ignore.

    What this could mean for customers

    Even though Brightspeed has not confirmed a breach, the claims alone are enough to raise red flags. If customer data was accessed, it could be used for phishing scams, account takeovers or payment fraud.

    Cybercriminals often move fast after breaches. That means customers should stay alert even before an official notice appears.

    CyberGuy reached out to Brightspeed for comment, and a spokesperson told us,

    “We take the security of our networks and protection of our customers’ and employees’ information seriously and are rigorous in securing our networks and monitoring threats. We are currently investigating reports of a cybersecurity event. As we learn more, we will keep our customers, employees, stakeholders and authorities informed.”

    JANUARY SCAMS SURGE: WHY FRAUD SPIKES AT THE START OF THE YEAR

    How to protect your personal data and online accounts

    Even if this Brightspeed investigation does not end up impacting your account, these steps are worth following. Most data breaches lead to the same downstream risks, like phishing scams, account takeovers and identity theft. Building these habits now can help protect you across all your online accounts.

    Woman typing on her phone.

    Cybercriminals often use public posts and countdowns to pressure companies into responding quickly. (Sebastian Kahnert/picture alliance via Getty Images)

    1) Watch for phishing attempts

    Scammers often take advantage of breach headlines to create panic. Be cautious with emails, calls or texts that mention your internet account billing problems or service changes. If a message pushes urgency or pressure, pause before responding.

    2) Avoid suspicious links and attachments

    Do not click links or open attachments tied to account notices or payment issues. Instead, open a new browser window and go directly to the company’s official website or app. Strong antivirus software adds another layer of protection against malicious downloads.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    3) Update your account passwords

    Change your Brightspeed account password and review passwords on other important accounts. Use strong, unique passwords that you do not reuse elsewhere. A trusted password manager can generate and store complex passwords, which makes account takeovers much harder.

    Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com/Passwords) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

    4) Reduce your data footprint

    Personal data spreads quietly across data broker sites. Using a data removal service can help limit how much of your information is publicly available. Less exposed data means fewer opportunities for scammers to target you.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    5) Turn on account alerts

    Brightspeed lets customers turn on account and billing alerts through the My Brightspeed site or app. You can choose which notifications you receive by email or text. Alerts can help you catch unusual activity early and respond before more damage occurs.

    6) Monitor your financial accounts closely

    Check bank and credit card statements often. Look for small or unfamiliar charges since criminals sometimes test stolen data with low-dollar transactions before attempting larger fraud.

    7) Consider fraud alerts or a credit freeze

    If sensitive information may have been exposed, placing a fraud alert or credit freeze can add protection. These steps make it harder for criminals to open new accounts in your name. To learn more about how to do this, go to Cyberguy.com and search “How to freeze your credit.” 

    You may also want to consider an identity theft protection service that monitors for suspicious activity and sends alerts. Identity Theft companies can monitor personal information like your Social Security number (SSN), phone number, and email address, and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

    See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com

    Woman holds her face after looking at her computer

    When personal and billing information is exposed, the risk extends beyond one company to everyday customers. (Pixelfit/Getty Images)

    Kurt’s key takeaways

    Brightspeed’s investigation is still unfolding, and the company says it will share updates as it learns more. Until then, the claims highlight how valuable customer data has become and how aggressively extortion groups are targeting infrastructure providers. For customers, caution is the best defense. For companies, transparency and speed will matter if these claims turn out to be real.

    Do you feel companies are doing enough to keep your personal data safe? Let us know by writing to us at Cyberguy.com

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter 

    Copyright 2026 CyberGuy.com.  All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • WhatsApp Web malware spreads banking trojan automatically

    [ad_1]

    NEWYou can now listen to Fox News articles!

    A new malware campaign is turning WhatsApp Web into a weapon. Security researchers say a banking Trojan linked to Astaroth is now spreading automatically through chat messages, making the attack harder to stop once it starts. 

    The campaign is known as Boto Cor-de-Rosa. It shows how cybercriminals keep evolving, especially when they can abuse tools people trust every day. This attack focuses on Windows users and uses WhatsApp Web as both the delivery system and the engine that spreads the infection further.

    Sign up for my FREE CyberGuy Report

    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    BROWSER EXTENSION MALWARE INFECTED 8.8M USERS IN DARKSPECTRE ATTACK

    Attackers abuse WhatsApp Web to spread malware through messages that appear to come from people you trust. (Kurt “CyberGuy” Knutsson)

    How this WhatsApp Web attack works

    The attack starts with a simple message. A contact sends what looks like a routine ZIP file through WhatsApp. The file name appears random and harmless, which lowers suspicion. Once opened, the ZIP contains a Visual Basic script disguised as a normal document. If the user runs it, the script quietly pulls in two more pieces of malware. Then the script downloads the Astaroth banking malware written in Delphi. It also installs a Python-based module designed to control WhatsApp Web. Both components run in the background without obvious warning signs. From there, the infection becomes self-sustaining.

    Malware that spreads itself through your contacts

    What makes this campaign especially dangerous is how it propagates. The Python module scans the victim’s WhatsApp contacts and sends the malicious ZIP file to every conversation automatically. Researchers at Acronis found that the malware adapts its messages based on the time of day. It sends friendly greetings, making the message feel normal and familiar. The text reads, “Here is the requested file. If you have any questions, I’m available!” Because the message appears to come from someone you know, many people open it without hesitation.

    NEW MALWARE CAN READ YOUR CHATS AND STEAL YOUR MONEY

    Person holds iPhone showing the Whatsapp logo

    A single ZIP file sent through chat can quietly install banking malware and begin spreading to every contact. (Kurt “CyberGuy” Knutsson)

    Built-in tracking keeps the attack efficient

    This malware is carefully designed to monitor its own performance in real time. The propagation tool tracks how many messages are successfully delivered, how many fail to send, and the overall sending speed measured per minute. After every 50 messages, it generates progress updates that show how many contacts have been reached. This feedback allows attackers to measure success quickly and make adjustments if something stops working.

    What happens after infection

    The initial script is heavily obfuscated to avoid detection by antivirus tools. Once it runs, it launches PowerShell commands that download more malware from compromised websites. One known domain used in this campaign is coffe-estilo.com. The malware installs itself inside a folder that mimics a Microsoft Edge cache directory. Inside are executable files and libraries that make up the full Astaroth banking payload. From there, the malware can steal credentials, monitor activity and potentially access financial accounts.

    Why WhatsApp Web is being abused

    WhatsApp Web is popular because it mirrors your phone conversations on a computer. That convenience makes it easy to send messages, share files and type faster, but it also introduces risk. When you use WhatsApp Web, you link your phone to a browser by scanning a QR code at web.whatsapp.com. Once connected, that browser session becomes a trusted extension of your account. Your chats appear on the screen, messages you send come from your real number and incoming messages sync across both devices.

    That setup is exactly what attackers take advantage of. If malware gains access to a computer with WhatsApp Web logged in, it can act as the user. It can read messages, access contact lists and send files or links that look completely legitimate. The messages do not raise alarms because they are coming from a real account, not a fake one.

    This is what turns WhatsApp Web into an effective delivery system for malware. Instead of breaking into WhatsApp itself, attackers simply abuse an open browser session to spread malicious files automatically. Many users do not realize the danger because WhatsApp Web feels harmless. It is often left signed in on work computers, shared devices or systems without strong security. In those situations, malware does not need advanced tricks. It only needs access to an already trusted session. That combination of convenience and trust is why WhatsApp Web has become such an attractive target.

    MALICIOUS MAC EXTENSIONS STEAL CRYPTO WALLETS AND PASSWORDS

    A person typing on a laptop. (Kurt "CyberGuy" Knutsson)  

    Once WhatsApp Web is compromised, malware can act like the user, sending messages and files that look completely legitimate.  (Kurt “CyberGuy” Knutsson)

    How to stay safe from WhatsApp Web malware

    Attacks like this WhatsApp Web malware are designed to spread fast through trusted conversations. A few smart habits can dramatically lower your risk.

    1) Be skeptical of unexpected attachments

    Messaging apps feel casual, which is exactly why attackers use them. Never open ZIP files sent through chat unless you confirm with the sender first. Watch for file names made of random numbers or unfamiliar names. Treat messages that create urgency or feel overly familiar as a warning sign. If a file arrives out of nowhere, pause before clicking.

    2) Lock down WhatsApp Web access

    This campaign abuses WhatsApp Web to spread automatically once a device is infected. Check active WhatsApp Web sessions and log out of any you do not recognize. Avoid leaving WhatsApp Web signed in on shared or public computers. Enable two-factor authentication (2FA) inside WhatsApp settings. Cutting off Web access helps limit how far malware can travel.

    3) Keep your Windows PC locked down and use strong antivirus software 

    This type of malware takes advantage of systems that fall behind on updates. Install Windows updates as soon as they are available. Also, keep your web browser fully updated. Staying current closes many of the doors attackers try to slip through. In addition, use strong antivirus software that watches for script abuse and PowerShell activity in real time.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

    4) Limit how much of your personal data is online

    Banking malware often pairs with identity theft and financial fraud. One way to reduce the fallout is by shrinking your digital footprint. A data removal service can help remove your personal information from data broker sites that attackers often search. With less information available, criminals have fewer details to exploit if malware reaches your device.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    5) Add identity theft protection for extra coverage

    Even with strong security habits, financial monitoring adds another layer of protection. An identity theft protection service can watch for suspicious activity tied to your credit and personal data. Identity theft companies can monitor personal information like your Social Security number (SSN), phone number, and email address, and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

    You should also turn on alerts for bank and credit card transactions so you are notified quickly if something looks wrong. The less exposed your data is, the fewer opportunities attackers have to cause damage.

    See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

    6) Slow down and trust your instincts

    Most malware infections happen because people act too quickly. If a message feels off, trust that instinct. Familiar names and friendly language can lower your guard, but they should never replace caution. Take a moment to verify the message or file before opening anything. Attackers rely on trust and urgency to succeed. Slowing down takes away their advantage.

    Kurt’s key takeaways

    This WhatsApp Web malware campaign is a reminder that cyberattacks no longer rely on obvious red flags. Instead, they blend into everyday conversations and use familiar tools to spread quietly and quickly. What makes this threat especially concerning is how little effort it takes for it to move from one device to dozens of others. A single click can turn a trusted chat into a delivery system for banking malware and identity theft. The good news is that small changes make a big difference. Paying attention to attachments, locking down WhatsApp Web access, keeping devices updated and slowing down before clicking can stop these attacks cold. As messaging platforms continue to play a bigger role in daily life, staying alert is no longer optional. Awareness and simple habits remain some of the strongest defenses you have.

    Do you think messaging apps are doing enough to protect users from malware that spreads through trusted conversations?  Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 

    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2026 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • January scams surge: Why fraud spikes at the start of the year

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Every January, I hear from people who say the same thing: “I just got an email that looked official, and I almost fell for it.” That’s not a coincidence. January is one of the busiest months of the year for scammers. While most of us are focused on taxes, benefits, subscriptions, and getting our finances in order, criminals are doing their own kind of cleanup, refreshing scam lists and going after people with newly updated personal data. If you’ve ever received a message claiming your account needs to be “verified,” your benefits are at risk, or your tax information is incomplete, this article is for you.

    Sign up for my FREE CyberGuy Report

    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    10 SIMPLE CYBERSECURITY RESOLUTIONS FOR A SAFER 2026

    Scam messages often look urgent and official, pushing you to act before you have time to think. That pressure is exactly what criminals rely on. (Kurt “CyberGuy” Knutsson)

    Why January is prime time for scammers

    January is when scammers have everything they need. According to YouMail’s Robocall Index, U.S. consumers received just over 4.7 billion robocalls in January 2025, a roughly 9% increase from December 2024. This year, we can expect the same pattern from scammers.

    They know:

    But the biggest reason scams spike now? Your personal data is easier to find than you think. Data brokers quietly collect and update profiles year after year. By January, those profiles are often more complete than ever, and scammers know it.

    The “account verification” scam you’ll see everywhere

    One of the most common January scams looks harmless at first. You get a message saying:

    • “Your Social Security account needs verification”
    • “Your Medicare information has to be updated”
    • “Your benefits could be delayed without action”

    The message sounds official. Sometimes it even uses your real name or location. That’s where people get tricked. Government agencies don’t ask for sensitive information through random emails or texts. Scammers rely on urgency and familiarity to push you into reacting before thinking.

    My rule: If you didn’t initiate the request, don’t respond to it. Always go directly to the agency’s official website or phone number, never through a link sent to you.

    MAKE 2026 YOUR MOST PRIVATE YEAR YET BY REMOVING BROKER DATA

    A person typing on a laptop. (Kurt "CyberGuy" Knutsson)  

    January is a prime time for fraud because people are dealing with taxes, benefits and account updates. Scammers know these messages feel expected and familiar. (Kurt “CyberGuy” Knutsson)

    Fake tax and benefits notices ramp up in January

    Another favorite scam this time of year involves taxes and refunds.

    You may see:

    • Emails claiming you owe back taxes
    • Messages saying you’re due a refund
    • Notices asking you to “confirm” banking information.

    These scams work because they arrive at exactly the moment people expect to hear from tax agencies or benefits programs.

    Scammers don’t need much to sound convincing. A name, an email address or an old address is often enough. If you get a tax-related message out of the blue, slow down. Real agencies don’t pressure you to act immediately.

    Subscription “problems” that aren’t real

    January is also when subscription scams explode. Fake messages claim:

    Scammers know most people have subscriptions, so they play the odds. Instead of clicking, open the app or website directly. If there’s a real problem, you’ll see it there.

    Why these scams feel so personal

    People often tell me, “But they used my name, how did they know?” Here’s the uncomfortable truth: They probably bought it. Data brokers compile massive profiles that include:

    • Address histories
    • Phone numbers and emails
    • Family connections
    • Shopping behavior.

    That data is sold, shared and leaked. Once scammers have it, they can tailor messages that feel real, because they’re built on real information.

    10 WAYS TO PROTECT SENIORS FROM EMAIL SCAMS

    The more personal data scammers have, the more convincing their messages become. Removing your information from data broker sites can help reduce targeted scams over time.

    The more personal data scammers have, the more convincing their messages become. Removing your information from data broker sites can help reduce targeted scams over time. (Kurt “CyberGuy” Knutsson)

    What you should do right now

    Before January gets any busier, take these steps to reduce your exposure to scams and fraud:

    1) Remove your personal data from broker sites

    Deleting emails or blocking numbers helps, but it does not stop scams at the source. Scammers rely on data broker sites that quietly collect, update and sell your personal information. Removing your data from those sites reduces scam calls, phishing emails and targeted texts over time. It also makes it harder for criminals to personalize messages using your real name, address or family connections. You have two ways to do this:

    Do it yourself:

    You can visit individual data broker websites, search for your profile and submit opt-out requests.This method works, but it takes time. Each site has its own rules, identity verification steps, and response timelines. Many brokers also re-add data later, which means you have to repeat the process regularly.

    Use a data removal service:

    A data removal service automates the opt-out process by contacting hundreds of data brokers on your behalf and monitoring for re-listings. This option saves time and provides ongoing protection, especially if you want long-term results without constant follow-ups.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services, and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    2) Don’t click links in unexpected messages

    If you did not initiate the request, do not click. Scam messages are designed to create urgency, especially around taxes, benefits and account issues. Instead, go directly to the official website by typing the address yourself or using a saved bookmark. This single habit prevents most phishing attacks.

    3) Turn on two-factor authentication wherever possible

    Two-factor authentication (2FA) adds a critical second layer of protection. Even if someone gets your password, they still cannot access your account without the second verification code. Start with email, financial accounts, social media and government services.

    4) Check accounts only through official apps or websites

    If you receive a warning about an account problem, do not trust the message itself. Open the official app or website, and check there. If something is wrong, you will see it immediately. If not, you just avoided a scam.

    5) Watch for account alerts and login activity

    Enable login alerts and security notifications on important accounts. These alerts can warn you if someone tries to sign in from a new device or location. Early warnings give you time to act before real damage occurs.

    6) Use strong, unique passwords and a password manager

    Reusing passwords makes it easy for scammers to take over multiple accounts at once. If one service is compromised, attackers try the same login on email, banking, and social media accounts. A password manager helps you create and store strong, unique passwords for every account without needing to remember them. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Kurt’s key takeaways

    January scams aren’t random. They’re targeted, timed and fueled by personal data that shouldn’t be public in the first place. The longer your information stays online, the easier it is for scammers to use it against you. If you want a quieter inbox, fewer scam calls and less risk this year, take action early, before criminals finish rebuilding their lists. Protect your data now, and you’ll be safer all year long.

    Have you noticed more scam emails, texts or calls since the new year started? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report. Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2026 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Instagram password reset surge: Protect your account

    [ad_1]

    NEWYou can now listen to Fox News articles!

    If your inbox suddenly shows an Instagram “Reset your password” email you never requested, you are not alone. A wave of unexpected reset messages is hitting people right now, and attackers are betting you will panic, click fast and make a mistake.

    Here is the tricky part. Many of these emails are real. They can come directly from Instagram because someone triggered the legitimate password reset flow. That makes the alert feel extra convincing, even when you did nothing wrong.

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    FACEBOOK, INSTAGRAM ARE USING YOUR DATA TO TRAIN AI: LEARN HOW TO PROTECT IT

    Unexpected Instagram password reset emails can look completely legitimate, which is why so many users are caught off guard during this surge. (Cyverguy.com)

    Why Instagram password reset emails are surging

    This surge is happening because the reset emails themselves can be real, even when the intent behind them is not. Instead of building fake phishing pages or using malware, attackers take advantage of Instagram’s normal account recovery system.

    The process is simple. An attacker enters your username or email into Instagram’s real password reset form. Instagram automatically sends a legitimate reset email to you. The attacker then waits to see how you react.

    At this point, your account has not been hacked. The risk comes from what happens next. Attackers are counting on common mistakes, such as clicking the reset button and rushing through the process, reusing a weak password, getting redirected to a fake follow-up page or falling for a second scam email that arrives soon after.

    That is why this tactic works as a stress test. It creates urgency and pressure, even though nothing has been compromised yet.

    Why attackers love this tactic

    This is classic social engineering. The attacker does not need to outsmart Instagram. They need to outsmart you in a stressed moment. A reset email creates urgency. It also feels official. That combination leads people to click first and think second, which is exactly the outcome attackers want. You can treat these surprise reset emails as an early warning system. If you get one:

    • Someone may know your username or email
    • Your account could be on a target list from a leak or scrape
    • Your current security setup will decide whether this stays annoying or turns into a takeover

    If an email pressures you to act immediately, threatens account deletion or asks for extra information, treat it as suspicious.

    The BreachForums leak connection

    The timing of this surge has raised fresh concerns. Reports point to data tied to roughly 17.5 million Instagram accounts being shared on BreachForums, an underground forum where cybercriminals trade and discuss stolen data. The alleged post appeared in early January 2026, which lines up with when many users began reporting a sudden wave of password reset emails, sometimes receiving several in a short period of time.

    This timing alone does not prove a direct connection. However, leaked usernames or email addresses can make it much easier for attackers to target large numbers of accounts at once, which is exactly what this kind of reset spam depends on. We reached out to Meta for comment but did not receive a response before our deadline. 

    We reached out to Meta for comment, and a spokesperson for the company told CyberGuy, “We fixed an issue that allowed an external party to request password reset emails for some Instagram users. We want to reassure everyone there was no breach of our systems and people’s Instagram accounts remain secure. People can disregard these emails and we apologize for any confusion this may have caused.” 

    How to tell if the reset email is legitimate

    A legitimate Instagram reset email can still be part of an attack attempt. So your goal is not “confirm it is real,” it is “avoid reacting in a risky way.” Instagram’s own guidance boils down to this:

    • A reset email alone does not mean your account is compromised
    • If you did not request it, do not use the link
    • Use Instagram’s official paths in the app to review security and report suspicious messages

    Also, if you get emails about changing your account email address, Instagram says those messages can include a way to reverse the change, which can help you recover if someone broke in.

    Instagram icon on an iPhone sitting on table.

    These real-looking messages are designed to create urgency and push people to click before slowing down and checking their account security. (Cyverguy.com)

    What a real Instagram password reset email looks like

    A legitimate reset email usually has these elements:

    • Sender: Comes from an official Instagram domain, such as security@mail.instagram.com
    • Subject line: Often says “Reset your Instagram password” or “Password reset request”
    • Instagram branding: Logo at the top with clean formatting
    • Call to action button: A button like “Reset Password”
    • Reassurance text: A line explaining that if you did not request this, you can ignore the email and nothing will change
    • Safety option: Language telling you how to report the email if you did not initiate it

    This is why the current surge is so effective. The emails look normal and arrive from real Instagram systems. 

    META ENDS FACT-CHECKING PROGRAM AS ZUCKERBERG VOWS TO RESTORE FREE EXPRESSION ON FACEBOOK, INSTAGRAM

    What Instagram reset alerts can look like inside the app

    You may also see security messages directly in Instagram, such as:

    • Login attempt alerts
    • Notifications about a password reset request
    • Prompts asking you to confirm a login from a new device

    These in-app alerts are generally safer to interact with than email links, especially during a surge.

    What scammers rely on

    Attackers are counting on one thing: panic. When users see a reset email they did not request, many rush to click before reading the fine print. That fast reaction is what turns a harmless reset request into a real account takeover.

    What to do right now if you get a reset email you did not request

    So, what should you do if one of these password reset emails lands in your inbox? Take a breath first. Then do this.

    1) Do not click the button in the email and use strong antivirus software 

    Even if the message looks real, treat it like a hot surface. If you want to change your password, do it from the Instagram app or by typing Instagram’s address into your browser yourself. Strong antivirus software adds another layer of protection here. It can help block malicious links, fake login pages and follow-up scams that often appear during a reset email surge.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

    2) Check your Instagram security activity in the app

    Open Instagram and look for signs someone tried to log in:

    • Unknown devices
    • Login alerts you do not recognize
    • Changes to email, phone number or linked accounts

    If anything looks off, remove the device and update your credentials.

    3) Turn on two-factor authentication (2FA) and keep it on

    Two-factor authentication (2FA) is the biggest roadblock for account takeover. Even if someone knows your password, they still need your code to get in from an unfamiliar device. Instagram has pushed 2FA heavily for higher-risk accounts and urges users to enable it. Use an authenticator app if you can. It is often safer than SMS.

    4) Change your password if you feel unsure

    If you suspect someone guessed your password, or you reused it elsewhere, change it. Make it long and unique. A password manager can help you generate and store strong passwords without reusing them. Then update the password on your email account too. Your email inbox controls most password resets, so make sure it also uses a strong, unique password.

    Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com/Passwords) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

    5) Use a data removal service to reduce targeting

    Password reset surges often follow data leaks. When your email address and personal details appear on data broker sites, attackers can target you more easily. A data removal service helps limit where your information shows up online. By shrinking your digital footprint, you reduce the chances of being singled out during large-scale reset email attacks.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    Someone with a hoodie types suspiciously on a laptop that displays a dark screen.

    The safest response is to avoid email links, open the Instagram app directly and review login activity and security settings instead. (Kurt “CyberGuy” Knutsson)

    6) Watch for follow-up scams

    After a reset surge, criminals often switch tactics. Next, you may see:

    • Fake “Instagram Support” emails
    • DMs claiming your account will be deleted
    • Login approval prompts you did not trigger

    Slow down and verify everything inside the app.

    Kurt’s key takeaways

    A spike in Instagram password reset emails feels scary because it looks like someone is already inside your account. Often, they are not. Still, the surge is a reminder to tighten your basics. Use the app to check security. Turn on two-factor authentication. Change the passwords you reused. Most importantly, do not let an unexpected email rush you into the one click that hands over access.

    Have you received an unexpected Instagram password reset email recently, and how did you handle it? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – when you join my CYBERGUY.COM newsletter. 

    Copyright 2026 CyberGuy.com. All rights reserved. 

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • 10 ways to protect seniors from email scams

    [ad_1]

    Cyber expert shares tips to avoid AI phishing scams

    Kurt ‘The CyberGuy’ Knutsson shares practical ways to avoid falling victim to AI-generated phishing scams and discusses a report that North Korean agents are posing as I.T. workers to funnel money into the country’s nuclear program.

    NEWYou can now listen to Fox News articles!

    Email scams have become one of the fastest ways scammers steal money from older adults. A single click can expose bank accounts, personal data and retirement savings built over a lifetime. That growing risk is what prompted Bob to write to us with a question many families are now facing:

    “My friend’s father is 95 and absolutely lives through his phone/laptop. He refuses to give up either and often clicks on email links. A few years ago, he got caught up in a gift card scam that almost cost him his life savings. It’s not taking away the car keys anymore; it is taking away the email and access to online banking! What do you recommend that his daughter do to protect his online presence?”

    Bob is right. For many seniors, email and online banking have replaced car keys as the most dangerous access point. The goal is not to take devices away. It is to quietly put guardrails in place so one bad click does not turn into a financial disaster.

    Here is a practical plan families can actually use.

    HACKERS ABUSE GOOGLE CLOUD TO SEND TRUSTED PHISHING EMAILS

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

     1) Separate money from daily email use

    Start by limiting how much damage a single click can cause. If possible, remove online banking access from the devices used for email. When that is not realistic, open a second checking account with only everyday spending money and link it to a debit card for routine purchases.

    Keep primary savings accounts offline or set to view-only access. If available, require in-branch or phone verification for transfers above a set amount. This way, even if credentials are compromised, the largest accounts remain protected. 

    2) Lock down email to stop scams targeting seniors

    Email is the number one entry point for scams targeting seniors. Strong filtering matters. Use an email provider with advanced spam protection, such as Gmail or Outlook.com. In the email settings:

    • Turn off automatic image loading
    • Disable link previews
    • Block or auto-quarantine attachments from unknown senders
    • Automatically move messages from unknown senders to a Review folder

    If available, enable warnings for emails that use familiar display names but come from unfamiliar addresses. This helps stop impersonation scams that pretend to be family, banks or service providers. These steps slow scammers down and reduce impulse clicks before damage happens.

    Email is dominant, but voicemail and callback scams are also growing fast among seniors, often as a follow-up to phishing emails. If possible, silence unknown callers and block voicemail-to-email transcription for unfamiliar numbers, since many scams now start with urgent callback messages rather than links.

    Email scams often start with messages that look routine but hide urgent threats designed to trigger quick clicks. (Kurt “CyberGuy” Knutsson)

    3) Add a trusted second set of eyes

    Next, add safety nets that notify family members when something looks wrong. Enable banking alerts for large withdrawals, new payees, password changes, unusual logins and new device sign-ins. Add his daughter as a trusted contact wherever the bank allows it. If available, enable delays or approval requirements for first-time transfers to new payees. This creates a cooling period that can stop scam-driven transactions. For email accounts, set up a recovery contact so that his daughter is notified immediately if someone attempts to access or reset the account.

    Enable two-factor authentication (2FA) on email and banking accounts, but pair it with device and transfer alerts, since many scams now succeed even when 2FA is enabled.

    4) Harden devices so clicks do not equal catastrophe

    Devices should be set up to fail safely. Keep operating systems and browsers updated. Make sure the laptop uses a standard user account instead of an administrator account. This prevents software from installing without approval. Install real-time protection that blocks scam sites before they load. Strong antivirus software helps block malicious links and fake login pages automatically.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    5) Use a password manager to block fake logins

    Password reuse makes scams far more dangerous. Fake pop-ups and lookalike websites are designed to trick people into typing usernames and passwords by hand. A password manager removes that risk by storing credentials securely and autofilling them only on legitimate websites. If a page is fake or malicious, the password manager will not fill anything. That simple refusal often prevents account takeovers before they start. Password managers also reduce frustration by eliminating the need to remember or reuse passwords across email, banking and shopping accounts. When set up correctly, this protection works quietly in the background on both phones and laptops.

    Many phishing scams no longer rely on obvious fake emails. They rely on realistic login pages. Autofill protection is one of the most effective ways to stop these attacks without changing daily habits.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

    MALICIOUS CHROME EXTENSIONS CAUGHT STEALING SENSITIVE DATA

    6) Freeze credit and monitor identity exposure

    If scammers already have personal information, prevention alone is not enough. Freeze credit with Experian, TransUnion and Equifax to prevent new accounts from being opened. Also, place freezes with ChexSystems and the National Consumer Telecom and Utilities Exchange to stop criminals from opening bank accounts, phone lines, or utility services in his name.

    If possible, request an IRS Identity Protection PIN to prevent tax-related identity theft.

    Add ongoing identity monitoring so suspicious activity triggers alerts quickly. Identity Theft companies can monitor personal information like your Social Security number (SSN), phone number and email address, and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

    See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

    7) Set clear rules around scams and payments

    Technology helps, but expectations matter. Have one calm conversation and agree on simple rules:

    • No gift cards for urgent emails or texts
    • No sending money through unfamiliar apps or cryptocurrency
    • Always call a trusted family member before acting on urgency

    Post these rules near the computer or phone. Visual reminders reduce panic decisions. Also, before setting rules, choose one primary trusted contact. Multiple helpers can slow response during urgent scams and create confusion when fast decisions matter. That person should be the default call for anything urgent involving money, account access, or unexpected requests.

    Old man and adult look at a computer

    Adult children increasingly step in to help parents spot red flags before a simple mistake turns into a financial loss. (Kurt “CyberGuy” Knutsson)

    8) Reduce exposure with a data removal service

    Scammers often find seniors by pulling personal details from public data broker websites. These sites publish phone numbers, addresses, relatives and age information that make targeting easier. A data removal service works behind the scenes to opt seniors out of these databases and reduce how much personal information is publicly available online. Fewer exposed details means fewer scam calls, fewer phishing emails and fewer impersonation attempts. This step does not stop every scam, but it significantly lowers how often seniors are targeted in the first place.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    9) Use senior-friendly monitoring tools the right way

    Many tools designed for child safety also work well for seniors when used thoughtfully. When configured correctly, they add protection without interfering with daily routines.

    Below are device-specific steps families can use today.

    iPhone and iPad

    Apple’s built-in Screen Time tools provide strong protection without installing extra apps.

    What to set up:

    • Open Settings and tap Screen Time
    • Turn on Screen Time for the device
    • Tap Content & Privacy Restrictions and turn it on
    • Under App Store Purchases, set app installs to Don’t Allow
    • Tap Web Content and limit access to approved or safe websites
    • Set a Screen Time passcode known only to the caregiver

    If the caregiver wants remote visibility or control, add the device to Family Sharing and manage Screen Time from the caregiver’s Apple ID.

    BROWSER EXTENSION MALWARE INFECTED 8.8M USERS IN DARKSPECTRE ATTACK

    Why this helps: It blocks many scam sites, prevents accidental app installs and stops fake update prompts from causing damage.

    Android phones and tablets

    Android offers built-in protections and optional supervised controls.

    What to set up:

    Settings may vary depending on your Android phone’s manufacturer

    • Open Settings and go to Digital Wellbeing & parental controls
    • Turn on parental controls for the device
    • Restrict app installs and require approval for new downloads
    • Enable Safe Browsing and website filtering
    • Turn on alerts for new app installs and account changes

    For families who want shared oversight, Google Family Link can be used to supervise app installs and receive alerts, as long as both parties agree.

    Why this helps: Many Android scams rely on fake app installs. These settings block that path.

    Windows computers

    Windows protection works best when user accounts are set correctly.

    What to set up:

    • Create a standard user account for daily use
    • Keep the caregiver account as the only administrator
    • Turn on Microsoft Family Safety if available
    • Enable SmartScreen and browser phishing protection
    • Block software installs without administrator approval

    Why this helps: Malware often installs silently on admin accounts. This setup prevents that.

    Mac computers

    macOS includes built-in controls similar to those on iPhone and iPad.

    What to set up:

    • Create a standard user account for the senior
    • Limit administrator access to a trusted caregiver
    • Open System Settings and enable Screen Time
    • Restrict app installs and system changes
    • Keep built-in malware and phishing protections enabled
    Two people look at a computer together

    Simple digital guardrails can reduce risk while allowing seniors to keep their devices and independence. (Kurt “CyberGuy” Knutsson)

    Why this helps: It prevents fake software updates and malicious downloads from installing.

    10) Best practices for all devices

    • Use alert-only or limited-control settings whenever possible
    • Review settings together so expectations are clear
    • Avoid tools that feel invasive or confusing
    • Focus on blocking harm, not monitoring behavior

    This is not about spying. It is about adding digital seatbelts while preserving independence. When used respectfully, these tools reduce risk without changing daily habits.

    Pro Tip: Use a secure email service for added privacy

    For families looking to go a step further, switching to a secure email service can significantly reduce scam exposure. Privacy-focused email providers are designed to limit tracking, block hidden tracking pixels, and reduce how much data advertisers or scammers can collect from inbox activity. Many secure email services also offer disposable or alias email addresses for one-time signups. If an alias starts receiving spam or scam messages, it can be disabled without affecting the main email account. This makes it easier to keep a primary email address private and limit long-term exposure. Secure email platforms typically include features like encrypted messages, no advertising and stronger privacy controls. While switching email providers is optional, it can be a useful upgrade for seniors who receive large volumes of spam or have been repeatedly targeted by scams.

    Why it matters: Less tracking means fewer scam attempts. Aliases reduce how often personal email addresses are exposed, without changing daily habits.

    For recommendations on private and secure email providers that offer alias addresses, visit Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Kurt’s key takeaways

    Protecting seniors online is not about control. It is about prevention. Email scams are designed to exploit trust and urgency, especially in people who did not grow up with digital threats. Smart guardrails protect independence while preventing irreversible mistakes. If email and banking are today’s car keys, families need modern safety features to go with them.

    If your parent clicked a scam email right now, would you know before the money was gone? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Fake error popups are spreading malware fast

    [ad_1]

    NEWYou can now listen to Fox News articles!

    A dangerous cybercrime tool has surfaced in underground forums, making it far easier for attackers to spread malware. 

    Instead of relying on hidden downloads, this tool pushes fake error messages that pressure you into fixing problems that never existed. Security researchers say this method is spreading quickly because it feels legitimate. The page looks broken. The warning feels urgent. The fix sounds simple. 

    That combination is proving alarmingly effective for cybercriminals.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    How fake error malware attacks actually work

    These attacks begin with a compromised website. When a visitor lands on the page, something looks wrong right away. Text appears broken. Fonts look scrambled. Visual elements seem corrupted. A pop-up then appears claiming the issue can be fixed with a browser update or a missing system font. A button offers to repair the problem instantly. 

    Clicking that button copies a command to the clipboard and displays instructions to paste it into PowerShell or a system terminal. That single step launches the infection.

    MALICIOUS CHROME EXTENSIONS CAUGHT STEALING SENSITIVE DATA

    Fake error popups make a website look broken by scrambling text or fonts to create urgency and panic. (Jens Büttner/picture alliance via Getty Images)

    Why this new tool changes the threat landscape

    The tool behind these attacks is called ErrTraffic. It automates the entire process and removes the technical barriers that once limited cybercrime operations. For about $800, attackers get a full package with a control panel and scripted payload delivery. Analysts at the Hudson Rock Threat Intelligence Team identified the tool after tracking its promotion on Russian-language forums in early December 2025. 

    ErrTraffic works through a simple JavaScript injection. A single line of code connects a hacked site to the attacker’s dashboard. From there, everything adapts automatically. The script detects the operating system and browser. It then displays a customized fake error message in the correct language. The attack works across Windows, Android, macOS and Linux.

    MOST PARKED DOMAINS NOW PUSH SCAMS AND MALWARE

    Teen using their laptop.

    The popups often claim a browser update or missing system font is needed to fix the problem. (Daniel Acker/Bloomberg via Getty Images)

    Why security software struggles to stop it

    Traditional malware defenses look for suspicious downloads or unauthorized installations. ErrTraffic avoids both. Browsers see normal text copying. Security tools see a legitimate system utility being opened manually. Nothing appears out of place. That design allows the attack to slip through protections that would normally stop malware in its tracks.

    The success rate is deeply concerning

    Data pulled from active ErrTraffic campaigns shows conversion rates approaching 60%. That means more than half of the visitors who see the fake error message follow the instructions and install malware. Once active, the tool can deliver infostealers like Lumma or Vidar on Windows devices. Android targets often receive banking trojans instead. The control panel even includes geographic filtering, with built-in blocks for Russia and neighboring regions to avoid drawing attention from local authorities.

    What happens after infection?

    Once malware is installed, credentials and session data are stolen. Those compromised logins are then used to breach additional websites. Each newly hacked site becomes another delivery vehicle for the same attack. That cycle allows the campaign to grow without direct involvement from the original operator.

    FAKE WINDOWS UPDATE PUSHES MALWARE IN NEW CLICKFIX ATTACK

    Man looks distressed while at his computer

    Following the on-screen instructions can quietly trigger malware that steals passwords and personal data. (Kurt Knutsson)

    Ways to stay safe from fake error malware

    A few smart habits can significantly reduce risk when facing fake error pop-ups and browser-based traps.

    1) Never run commands suggested by a website

    Legitimate websites never ask you to copy and paste commands into PowerShell or a system terminal. Fake error malware relies on convincing messages that pressure you into doing exactly that. If a page instructs you to run code to fix a problem, close it immediately.

    2) Close pages that claim your system is corrupted

    Fake error campaigns often use broken text, scrambled fonts or warnings about missing files to grab attention. As a result, these visuals create urgency and trigger fear. In reality, a real system problem never announces itself through a random website, so close the page right away.

    3) Install updates only through official system settings

    Real browser and operating system updates come from built-in update tools, not pop-ups on websites. If an update is needed, your device will notify you directly through system settings or trusted app stores.

    4) Install strong antivirus software on every device

    Strong antivirus software can help block malicious scripts, detect infostealers and stop suspicious behavior before damage spreads. This is especially important since fake error malware targets Windows, Android, macOS and Linux systems.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    5) Use a data removal service to reduce exposure

    Stolen credentials fuel the spread of fake error malware. Removing personal information from data broker sites can reduce the impact if login details are compromised and limit how far an attack can spread.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    6) Treat font and browser update pop-ups with suspicion

    Claims about missing fonts or outdated browsers are a hallmark of these attacks. Modern systems manage fonts automatically, and browsers update themselves. A webpage has no reason to request manual fixes.

    If a real update is needed, the operating system will request it directly. A random webpage never should.

    Kurt’s key takeaways 

    Fake error malware works because it plays on a very human reaction. When something on a screen suddenly looks broken, most people want to fix it fast and move on. That split-second decision is exactly what attackers are counting on. Tools like ErrTraffic show how polished these scams have become. The messages look professional. The instructions feel routine. Nothing about the moment screams danger. But behind the scenes, one click can quietly hand over passwords, banking access and personal data. The good news is that slowing down makes a real difference. Closing a suspicious page and trusting built-in system updates can stop these attacks cold. When it comes to pop-ups claiming your device is broken, walking away is often the smartest fix.

    Have you ever seen a pop-up or error message that made you stop and wonder if it was real? Tell us what it looked like and how you handled it by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

    Copyright 2025 CyberGuy.com. All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Browser extension malware infected 8.8M users in DarkSpectre attack

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Browser extensions promise convenience. Many offer simple tools like new tab pages, translators or video helpers. 

    Researchers, however, uncovered a long-running malware operation that abused that trust on a massive scale. Koi Security analysts identified the threat while analyzing suspicious infrastructure tied to a campaign known as ShadyPanda. What started as one investigation quickly revealed something far larger.

    The group behind it is now known as DarkSpectre. According to Koi researchers, it infected more than 8.8 million users across Chrome, Edge and Firefox over seven years. This was not a smash-and-grab attack. It was slow, deliberate and highly organized. Instead of rushing malicious code into marketplaces, the group played the long game.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    MALICIOUS CHROME EXTENSIONS CAUGHT STEALING SENSITIVE DATA

    Security researchers say millions of users unknowingly installed browser extensions that later turned malicious after years of appearing legitimate. (Donato Fasano/Getty Images)

    One threat actor behind three major campaigns

    At first, the activity looked like separate threats. That changed once Koi analysts followed the infrastructure breadcrumbs. By pivoting from domains linked to ShadyPanda, Koi researchers uncovered shared systems powering multiple extension clusters. That analysis confirmed that ShadyPanda, GhostPoster and Zoom Stealer were not separate actors. They were one coordinated operation. Together, these campaigns targeted both everyday users and corporate environments.

    ShadyPanda

    This campaign focused on mass surveillance and affiliate fraud. Researchers estimate it affected more than 4 million users, with some analyses suggesting the total could reach up to 5.6 million as additional related extensions were linked. In several cases, extensions remained legitimate for more than five years before quietly turning malicious.

    GhostPoster

    This campaign used a clever trick. It hid malicious code inside image files to bypass security checks. It impacted 1.05 million users.

    Zoom Stealer

    This operation targeted corporate meeting data across more than 28 conferencing platforms. It affected 2.2 million users.

    Different goals. Same operator.

    How Koi uncovered DarkSpectre’s hidden network

    The breakthrough came when Koi analysts examined two domains tied to ShadyPanda. Those domains powered legitimate extension features like weather widgets and new tab pages. They were not command servers. That was the trick. Those same clean domains appeared again and again across other extensions that quietly connected to entirely different malicious infrastructure.

    One domain led to extensions. Those extensions exposed new domains. Those domains were connected to even more extensions. Following that chain allowed Koi to uncover over 100 connected extensions across multiple browser marketplaces. Some extensions even reused infrastructure already flagged in earlier investigations. That overlap confirmed DarkSpectre was operating at a nation-state scale.

    How DarkSpectre stayed hidden for years

    DarkSpectre succeeded by blending legitimate functionality with hidden malware. Users got what they expected. Meanwhile, the threat ran quietly in the background.

    Time-delayed activation fooled reviewers

    Some extensions waited days before activating malicious behavior. Others triggered malware on only a small percentage of page loads. This made detection during marketplace reviews extremely difficult.

    Malicious code disguised as images

    The group hid JavaScript inside PNG image files. The extension loaded its own logo, extracted the hidden code and executed it silently.

    No updates required

    Instead of pushing new extension versions, DarkSpectre controlled everything from its servers. Operators could change behavior anytime without alerting users or marketplaces. Koi researchers noted this approach gave the attackers long-term flexibility and control.

    Why the Zoom Stealer campaign stands out

    Most malware focuses on consumer fraud. Zoom Stealer focused on intelligence.

    According to Koi analysts, these extensions collected the following:

    • Meeting links with embedded passwords
    • Meeting IDs, topics and schedules
    • Speaker names, titles, bios and photos
    • Company affiliations and branding

    Worse yet, the data streamed in real time. The moment a user joined or viewed a meeting, the information flowed out. This type of data enables phishing impersonation and corporate espionage at scale.

    Why browser extensions remain a weak link

    Extension marketplaces typically evaluate code only at submission or update. Koi’s investigation shows how attackers exploit that model. Once an extension earns trust badges and positive reviews, users stop questioning it. That trust becomes a weapon. A clean extension today can become a threat tomorrow.

    Ways to stay safe from malicious browser extensions

    You do not need to avoid extensions entirely. You do need to stay cautious.

    1)  Keep your browser up-to-date

    Make sure you turn on automatic updates for your browser (e.g., Chrome, Firefox, Edge) so you’re always running the latest version without thinking about it. 

    2) Review your installed extensions

    Remove anything you no longer use. Fewer extensions reduce risk. CyberGuy has step-by-step guides showing how to review and remove browser extensions safely, making it easy to clean up your browser in just a few minutes. In Chrome, Edge and Firefox, open the menu, go to Extensions or Add-ons, and remove anything you do not use or trust.

    3) Install extensions only from trusted sources

    Official browser stores like the Chrome Web Store have rules and scans to catch bad actors. They’re not perfect, but they are still a better option when compared to a random website on the internet. Extensions from unknown websites or third-party downloads are far more likely to hide malware or spyware. 

    FAKE AI CHAT RESULTS ARE SPREADING DANGEROUS MAC MALWARE

    Hacker on their laptop.

    A long-running malware operation quietly abused trusted browser extensions across Chrome, Edge and Firefox, infecting millions worldwide. (Morteza Nikoubazl/NurPhoto via Getty Images)

    4) Have strong antivirus software

    Strong antivirus software can warn you before you install malicious software, such as sketchy browser extensions. It can also alert you to phishing emails and ransomware scams, helping keep your personal information and digital assets safe.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    5) Invest in personal data removal services

    If your personal data was exposed in this security incident, it’s crucial to act quickly to reduce your risk of identity theft and scams. A data removal service can help you remove all this personal information from the internet. 

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. 

    It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    6) Be skeptical of extensions requesting unnecessary access

    Some extensions overreach on purpose. A calculator tool asking for your browsing history or a weather app wanting your login data is a huge red flag. Before installing, ask: “Does this permission match the extension’s job?” If the answer’s no, don’t install it. Watch out for broad permissions like “Read and change all your data on websites you visit” unless it’s clearly justified (e.g., a password manager). If an update suddenly adds new permission requests, dig into why. It might mean the extension’s been sold or hacked.

    7) Change your passwords — and do it safely

    If you’ve ever saved passwords in your browser (e.g., via the browser’s built-in password manager or the “Save Password” prompt), those credentials could be at risk if a malicious extension was installed. These built-in managers store passwords locally or in your Google, Microsoft or Firefox account, and a compromised browser can give bad actors a way in.

    This doesn’t typically apply to dedicated password manager extensions, which encrypt your data independently and don’t rely on browser storage. However, if you’re unsure whether an extension has been compromised, it’s always smart to update your master password and enable two-factor authentication. 

    For maximum safety, change your most important passwords (email, bank, shopping, cloud services) from a different, secure device, such as your phone or another computer where the questionable extension was never installed. Avoid using the same browser that may have been exposed. Then, consider switching to a password manager to create and store strong, unique logins going forward. 

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

     10 SIMPLE CYBERSECURITY RESOLUTIONS FOR A SAFER 2026

    Hackers typing on a laptop.

    Analysts uncovered a coordinated campaign that hid spyware inside everyday browser tools like new tab pages and translators. (Morteza Nikoubazl/NurPhoto via Getty Images)

    8) Watch for behavior changes

    Subtle changes often appear before obvious damage. Sudden redirects, new tabs opening on their own, unfamiliar search results, popups, slower browsing or websites asking you to re-log in unexpectedly can all signal a malicious or compromised extension. Pay attention if ads appear where they never did before or if your browser settings change without your input.

    Koi’s investigation shows how attackers rely on patience. Once an extension earns trust and sits quietly for years, users stop watching it. That makes small behavior changes easy to miss. If something feels off, do not ignore it. Disable extensions one by one to identify the culprit. If the issue disappears, remove that extension permanently.

    When in doubt, trust your instincts. Browsers should not surprise you.

     CLICK HERE TO DOWNLOAD THE FOX NEWS APP 

    Kurt’s key takeaways

    DarkSpectre is a reminder that online threats are getting smarter and quieter. This was not a smash-and-grab attack. It unfolded slowly, over years, and relied on trust most people never think twice about. Koi analysts connected the dots by tracking shared infrastructure across campaigns, but they also warn that some sleeper extensions may still be installed and trusted today. Browser extensions can be helpful, but every extra add-on is another door into your browser. Paying attention, cleaning house now and then, and questioning what you install can make a real difference.

    When was the last time you checked what your browser extensions are really doing behind the scenes? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

    Copyright 2025 CyberGuy.com. All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link