ReportWire

Tag: Hackers

  • Malicious Chrome extensions caught stealing sensitive data

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Chrome extensions are supposed to make your browser more useful, but they’ve quietly become one of the easiest ways for attackers to spy on what you do online. Security researchers recently uncovered two Chrome extensions that have been doing exactly that for years.

    These extensions looked like harmless proxy tools, but behind the scenes, they were hijacking traffic and stealing sensitive data from users who trusted them. What makes this case worse is where these extensions were found. Both were listed on Chrome’s official extension marketplace.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    FAKE AI CHAT RESULTS ARE SPREADING DANGEROUS MAC MALWARE

    Security researchers uncovered malicious Chrome extensions that quietly routed users’ web traffic through attacker-controlled servers to steal sensitive data. (Gokhan Balci/Anadolu Agency/Getty Images)

    Malicious Chrome extensions hiding in plain sight

    Researchers at Socket discovered two Chrome extensions using the same name, “Phantom Shuttle,” that were posing as tools for proxy routing and network speed testing (via Bleeping Computer). According to the researchers, the extensions have been active since at least 2017.

    Both extensions were published under the same developer name and marketed towards foreign trade workers who need to test internet connectivity from different regions. They were sold as subscription-based tools, with prices ranging from roughly $1.40 to $13.60.

    At a glance, everything looked normal. The descriptions matched the functionality. The pricing seemed reasonable. The problem was what the extensions were doing after installation.

    How Phantom Shuttle steals your data

    Socket researchers say Phantom Shuttle routes all your web traffic through proxy servers controlled by the attacker. Those proxies use hardcoded credentials embedded directly into the extension’s code. To avoid detection, the malicious logic is hidden inside what appears to be a legitimate jQuery library.

    The attackers didn’t just leave credentials sitting in plain text. The extensions hide them using a custom character-index encoding scheme. Once active, the extension listens to web traffic and intercepts HTTP authentication challenges on any site you visit.

    To make sure traffic always flows through their infrastructure, the extensions dynamically reconfigure Chrome’s proxy settings using an auto-configuration script. This forces your browser to route requests exactly where the attacker wants them.

    In its default “smarty” mode, Phantom Shuttle routes traffic from more than 170 high-value domains through its proxy network. That list includes developer platforms, cloud service dashboards, social media sites and adult content portals. Local networks and the attacker’s own command-and-control domain are excluded, likely to avoid breaking things or raising suspicion.

    While acting as a man-in-the-middle, the extension can capture anything you submit through web forms. That includes usernames, passwords, card details, personal information, session cookies from HTTP headers and API tokens pulled directly from network requests.

    CyberGuy contacted Google about the extensions, and a spokesperson confirmed that both have been removed from the Chrome Web Store.

    10 SIMPLE CYBERSECURITY RESOLUTIONS FOR A SAFER 2026

    A person typing on their computer.

    Two Chrome extensions posing as proxy tools were found spying on users for years while listed on Google’s official Chrome Web Store. (Yui Mok/PA Images via Getty Images)

    How to review the extensions installed in your browser (Chrome)

    The step-by-step instructions below apply to Windows PCs, Macs and Chromebooks. In other words, desktop Chrome. Chrome extensions cannot be fully reviewed or removed from the mobile app.

    Step 1: Open your extensions list

    • Open Chrome on your computer.
    • Click the three-dot menu in the top-right corner.
    • Select Extensions
    • Then click Manage Extensions.

    You can also type this directly into the address bar and press Enter:
    chrome://extensions

    Step 2: Look for anything you do not recognize

    Go through every extension listed and ask yourself:

    • Do I remember installing this?
    • Do I still use it?
    • Do I know what it actually does?

    If the answer is no to any of these, take a closer look.

    Step 3: Review permissions and access

    Click Details on any extension you are unsure about. Pay attention to:

    • Permissions, especially anything that can read or change data on websites you visit
    • Site access, such as extensions that run on all sites
    • Background access, which allows the extension to stay active even when not in use

    Proxy tools, VPNs, downloaders and network-related extensions deserve extra scrutiny.

    Step 4: Disable suspicious extensions first

    If something feels off, toggle the extension off. This immediately stops it from running without deleting it. If everything still works as expected, the extension was likely not essential.

    Step 5: Remove extensions you no longer need

    To fully remove an extension:

    • Click Remove
    • Confirm when prompted

    Unused extensions are a common target for abuse and should be cleaned out regularly.

    Step 6: Restart Chrome

    Close and reopen Chrome after making changes. This ensures disabled or removed extensions are no longer active.

    MICROSOFT TYPOSQUATTING SCAM SWAPS LETTERS TO STEAL LOGINS

    Google Chrome screen on a laptop.

    Cybersecurity experts warn that trusted browser extensions can become powerful surveillance tools once installed. (Gabby Jones/Bloomberg via Getty Images)

    6 steps you can take to stay safe from malicious Chrome extensions

    You can’t control what slips through app store reviews, but you can reduce your risk by changing how you install and manage extensions.

    1) Install extensions only when absolutely necessary

    Every extension increases your attack surface. If you don’t genuinely need it, don’t install it. Convenience extensions often come with far more permissions than they deserve.

    2) Check the publisher carefully

    Reputable developers usually have a history, a website and multiple well-known extensions. Be cautious with tools from unknown publishers, especially those offering network or proxy features.

    3) Read multiple user reviews, not just ratings

    Star ratings can be faked or manipulated. Look for detailed reviews that mention long-term use. Watch out for sudden waves of generic praise.

    4) Review permissions before clicking install

    If an extension asks to “read and change all data on websites you visit,” take that seriously. Proxy tools and network extensions can see everything you do.

    5) Use a password manager

    A password manager won’t stop a malicious extension from spying on traffic, but it can limit damage. Unique passwords mean stolen credentials can’t unlock multiple accounts. Many managers also refuse to autofill on suspicious pages.

    Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com/Passwords) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

    6) Install strong antivirus software

    Strong antivirus software can flag suspicious network activity, proxy abuse and unauthorized changes to browser settings. This adds a layer of defense beyond Chrome’s own protections.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Kurt’s key takeaway

    This attack doesn’t rely on phishing emails or fake websites. It works because the extension itself becomes part of your browser. Once installed, it sees nearly everything you do online. Extensions like Phantom Shuttle are dangerous because they blend real functionality with malicious behavior. The extensions deliver the proxy service they promise, which lowers suspicion, while quietly routing user data through attacker-controlled servers.

    When was the last time you reviewed the extensions installed in your browser? Let us know by writing to us at Cyberguy.com.
     

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com. All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Crypto Users Lose Far Less To Phishing As Losses Drop 83% – Details

    [ad_1]

    Crypto phishing losses plunged in 2025, but experts warn the threat has only changed shape rather than disappeared. Reports show a sharp fall in money stolen by wallet-draining scams, even as attackers tested new tricks tied to recent protocol changes.

    Related Reading

    Scam Sniffer Data Shows Drop

    According to Scam Sniffer’s 2025 analysis, wallet drainer phishing losses fell to about $83.85 million — an 83% decline from roughly $494 million in 2024.

    The number of affected wallets dropped to around 106,000, a fall of about 68% year-on-year. These figures come from the security platform’s annual study and were picked up by major crypto outlets.

    Attackers Shift, Not Stop

    Only 11 incidents topped $1 million in 2025, down from 30 the prior year, signaling fewer headline grabs but a rise in smaller hits. The largest single theft recorded last year was roughly $6.5 million, tied to a malicious Permit signature attack.

    Average losses per victim fell to roughly $790, which suggests attackers moved toward more frequent, lower-value strikes.

    Source: Scam Sniffer

    Market Moves Mattered

    Losses followed market activity. The third quarter logged the highest damage at about $31 million, when Ethereum’s rally brought more users and approvals onchain.

    Monthly peaks included August, which posted about $12.17 million, while December was the quietest with roughly $2 million. That pattern shows fraudsters target busy trading windows.

    Source: Scam Sniffer

    Permit Signatures And New Vectors

    Reports highlighted Permit and Permit2 signature abuses as a major driver of big losses, accounting for a large share of multi-million cases.

    Scam Sniffer also flagged EIP-7702 batch signature techniques that were used in a few complex attacks after network upgrades. Security teams say these methods exploit user approval flows rather than raw smart-contract bugs.

    Total crypto market cap currently at $3.08 trillion. Chart: TradingView

    Why The Drop Happened

    Analysts attribute much of the improvement to better wallet warnings, wider use of approval revocation tools, and more active tracking by onchain monitors.

    Some defenders also point to reduced market froth in parts of the year, which lowered the pool of high-value targets. Still, multiple outlets stress that reduced totals do not equal safety.

    Related Reading

    Based on reports, phishing will likely remain cyclical: losses could spike again during big rallies or when new signing features are introduced.

    Security firms urge users to check approvals, avoid blind signing, and use wallet tools that flag risky requests. Regulators and exchanges are watching the trend, but responsibility for many attacks still falls to individual users and wallet software.

    Featured image from Unsplash, chart from TradingView

    [ad_2]

    Christian Encila

    Source link

  • OpenAI admits AI browsers face unsolvable prompt attacks

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Cybercriminals don’t always need malware or exploits to break into systems anymore. Sometimes, they just need the right words in the right place. OpenAI is now openly acknowledging that reality. The company says prompt injection attacks against artificial intelligence (AI)-powered browsers are not a bug that can be fully patched, but a long-term risk that comes with letting AI agents roam the open web. This raises uncomfortable questions about how safe these tools really are, especially as they gain more autonomy and access to your data.

    Sign up for my FREE CyberGuy Report 

    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    NEW MALWARE CAN READ YOUR CHATS AND STEAL YOUR MONEY

    AI-powered browsers can read and act on web content, which also makes them vulnerable to hidden instructions attackers can slip into pages or documents. (Kurt “CyberGuy” Knutsson)

    Why prompt injection isn’t going away

    In a recent blog post, OpenAI admitted that prompt injection attacks are unlikely to ever be completely eliminated. Prompt injection works by hiding instructions inside web pages, documents or emails in ways that humans don’t notice, but AI agents do. Once the AI reads that content, it can be tricked into following malicious instructions.

    OpenAI compared this problem to scams and social engineering. You can reduce them, but you can’t make them disappear. The company also acknowledged that “agent mode” in its ChatGPT Atlas browser increases risk because it expands the attack surface. The more an AI can do on your behalf, the more damage it can cause when something goes wrong.

    OpenAI launched the ChatGPT Atlas browser in October, and security researchers immediately started testing its limits. Within hours, demos appeared showing that a few carefully placed words inside a Google Doc could influence how the browser behaved. That same day, Brave published its own warning, explaining that indirect prompt injection is a structural problem for AI-powered browsers, including tools like Perplexity’s Comet.

    This isn’t just OpenAI’s problem. Earlier this month, the National Cyber Security Centre in the U.K. warned that prompt injection attacks against generative AI systems may never be fully mitigated.

    FAKE AI CHAT RESULTS ARE SPREADING DANGEROUS MAC MALWARE

    ChatGPT Atlas screen in an auditorium

    Prompt injection attacks exploit trust at scale, allowing malicious instructions to influence what an AI agent does without the user ever seeing it. (Kurt “CyberGuy” Knutsson)

    The risk trade-off with AI browsers

    OpenAI says it views prompt injection as a long-term security challenge that requires constant pressure, not a one-time fix. Its approach relies on faster patch cycles, continuous testing and layered defenses. That puts it broadly in line with rivals like Anthropic and Google, which have both argued that agentic systems need architectural controls and ongoing stress testing.

    Where OpenAI is taking a different approach is with something it calls an “LLM-based automated attacker.” In simple terms, OpenAI trained an AI to act like a hacker. Using reinforcement learning, this attacker bot looks for ways to sneak malicious instructions into an AI agent’s workflow.

    The bot runs attacks in simulation first. It predicts how the target AI would reason, what steps it would take and where it might fail. Based on that feedback, it refines the attack and tries again. Because this system has insight into the AI’s internal decision-making, OpenAI believes it can surface weaknesses faster than real-world attackers.

    Even with these defenses, AI browsers aren’t safe. They combine two things attackers love: autonomy and access. Unlike regular browsers, they don’t just display information, but also read emails, scan documents, click links and take actions on your behalf. That means a single malicious prompt hidden in a webpage, document or message can influence what the AI does without you ever seeing it. Even when safeguards are in place, these agents operate by trusting content at scale, and that trust can be manipulated.

    THIRD-PARTY BREACH EXPOSES CHATGPT ACCOUNT DETAILS

    Person wearing a hoodie works on multiple computer screens displaying digital data in a dark room.

    As AI browsers gain more autonomy and access to personal data, limiting permissions and keeping human confirmation in the loop becomes critical for safety. (Kurt “CyberGuy” Knutsson)

    7 steps you can take to reduce risk with AI browsers

    You may not be able to eliminate prompt injection attacks, but you can significantly limit their impact by changing how you use AI tools.

    1) Limit what the AI browser can access

    Only give an AI browser access to what it absolutely needs. Avoid connecting your primary email account, cloud storage or payment methods unless there’s a clear reason. The more data an AI can see, the more valuable it becomes to attackers. Limiting access reduces the blast radius if something goes wrong.

    2) Require confirmation for every sensitive action

    Never allow an AI browser to send emails, make purchases or modify account settings without asking you first. Confirmation breaks long attack chains and gives you a moment to spot suspicious behavior. Many prompt injection attacks rely on the AI acting quietly in the background without user review.

    3) Use a password manager for all accounts

    A password manager ensures every account has a unique, strong password. If an AI browser or malicious page leaks one credential, attackers can’t reuse it elsewhere. Many password managers also refuse to autofill on unfamiliar or suspicious sites, which can alert you that something isn’t right before you manually enter anything.

    Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com

    4) Run strong antivirus software on your device

    Even if an attack starts inside the browser, antivirus software can still detect suspicious scripts, unauthorized system changes or malicious network activity. Strong antivirus software focuses on behavior, not just files, which is critical when dealing with AI-driven or script-based attacks.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    5) Avoid broad or open-ended instructions

    Telling an AI browser to “handle whatever is needed” gives attackers room to manipulate it through hidden prompts. Be specific about what the AI is allowed to do and what it should never do. Narrow instructions make it harder for malicious content to influence the agent.

    6) Be careful with AI summaries and automated scans

    When an AI browser scans emails, documents or web pages for you, remember that hidden instructions can live inside that content. Treat AI-generated actions as drafts or suggestions, not final decisions. Review anything the AI plans to act on before approving it.

    7) Keep your browser, AI tools and operating system updated

    Security fixes for AI browsers evolve quickly as new attack techniques emerge. Delaying updates leaves known weaknesses open longer than necessary. Turning on automatic updates ensures you get protection as soon as they’re available, even if you miss the announcement.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Kurt’s key takeaway

    There’s been a meteoric rise in AI browsers. We’re now seeing them from major tech companies, including OpenAI’s Atlas, The Browser Company’s Dia and Perplexity’s Comet. Even existing browsers like Chrome and Edge are pushing hard to add AI and agentic features into their current infrastructure. While these browsers can be useful, the technology is still early. It’s best not to fall for the hype and to wait for it to mature.

    Do you think AI browsers are worth the risk today, or are they moving faster than security can keep up? Let us know by writing to us at Cyberguy.com

    Sign up for my FREE CyberGuy Report 

    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • University of Phoenix data breach hits 3.5M people

    [ad_1]

    NEWYou can now listen to Fox News articles!

    The University of Phoenix has confirmed a major data breach affecting nearly 3.5 million people. The incident traces back to August when attackers accessed the university’s network and quietly stole sensitive information.

    The school detected the intrusion on Nov. 21. That discovery came after the attackers listed the university on a public leak site. In early December, the university disclosed the incident, and its parent company filed an 8-K with regulators.

    The scope is large. Notification letters filed with Maine’s Attorney General show 3,489,274 individuals are impacted. Those affected include current and former students, faculty, staff and suppliers.

    Sign up for my FREE CyberGuy Report

    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    DATA BREACH EXPOSES 400K BANK CUSTOMERS’ INFO

    The University of Phoenix data breach exposed sensitive personal and financial information tied to nearly 3.5 million people. (Kurt “CyberGuy” Knutsson)

    What happened and how attackers got in

    According to the university, hackers exploited a zero-day vulnerability in Oracle E-Business Suite. This application handles financial operations and contains highly sensitive data.

    Based on the technical details shared so far, security researchers believe the attack aligns with tactics used by the Clop ransomware gang. Clop has a long track record of stealing data through zero-day flaws rather than encrypting systems.

    The vulnerability tied to this campaign is tracked as CVE-2025-61882. Investigators say it has been abused since early August.

    What data was exposed

    The university says the attackers accessed highly sensitive personal and financial information. That includes:

    • Full names
    • Contact information
    • Dates of birth
    • Social security numbers
    • Bank account numbers
    • Routing numbers

    This type of data creates a serious risk. It can fuel identity theft, financial fraud, and targeted phishing scams.

    700CREDIT DATA BREACH EXPOSES SSNS OF 5.8M CONSUMERS

    A hacker uses a laptop in to steal data.

    Stolen University of Phoenix records could be used by criminals to launch targeted phishing and identity theft attacks.  (Kurt “CyberGuy” Knutsson)

    Nearly 3.5 million people impacted

    In letters sent to affected individuals, the university confirmed the breach affects 3,489,274 people. If you are a current or former student or employee, watch your mail closely.

    These notifications often arrive by postal mail, not email. The letter explains what data was exposed and includes instructions for protective services.

    We reached out to The University of Phoenix for comment, and a rep provided CyberGuy with the following statement: 

    “We recently experienced a cybersecurity incident involving the Oracle E-Business Suite software platform. Upon detecting the incident on November 21, 2025, we promptly took steps to investigate and respond with the assistance of leading third-party cybersecurity firms. We are reviewing the impacted data and will provide the required notifications to affected individuals and regulatory entities.”

    Free identity protection is now available

    The University of Phoenix is offering impacted individuals free identity protection services. These include:

    • 12 months of credit monitoring
    • Identity theft recovery assistance
    • Dark web monitoring
    • A $1 million fraud reimbursement policy

    To enroll, you must use the redemption code provided in the notification letter. Without that code, you cannot activate the service.

    This attack fits a larger Clop campaign

    The University of Phoenix breach is not an isolated case. Clop has used similar tactics in past campaigns involving GoAnywhere MFT, Accellion FTA, MOVEit Transfer, Cleo, and Gladinet CentreStack.

    Other universities have also reported Oracle EBS-related incidents. These include Harvard University and the University of Pennsylvania.

    The U.S. government is taking notice. The U.S. Department of State is now offering a reward of up to $10 million for information linking Clop’s attacks to a foreign government.

    Why colleges are prime targets

    Universities store massive amounts of personal data. Student records, financial aid files, payroll systems, and donor databases all live under one roof.

    Like healthcare organizations, colleges present a high-value target. A single breach can expose years of data tied to millions of people.

    MAKE 2026 YOUR MOST PRIVATE YEAR YET BY REMOVING BROKER DATA

    Outsmart hackers who are out to steal your identity

    Affected University of Phoenix students and staff should act quickly to monitor accounts and protect their identities. (Kurt “CyberGuy” Knutsson)

    Steps to stay safe right now

    If you believe you may be affected, act quickly. These steps can reduce your risk.

    1) Watch for your breach notification letter

    Read it carefully. It explains what data was exposed and how to enroll in protection services.

    2) Enroll in the free identity protection

    First, use the redemption code provided. Because social security and banking data are involved, credit monitoring and recovery services matter. Even if you do not qualify for the free service, an identity theft protection service is still a smart move.

    In addition, these services actively monitor sensitive details like your social security number, phone number and email address. If your information appears on the dark web or if someone tries to open a new account, you receive an alert right away. As a result, many services also help you quickly freeze bank and credit card accounts to limit further fraud.

    See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com

    3) Use a data removal service

    Because this breach exposed names, contact details and other identifiers, reducing what is publicly available about you matters. A data removal service can help remove your personal information from data broker sites, which lowers the risk of targeted phishing or fraud tied to the stolen University of Phoenix records.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    4) Monitor financial accounts daily

    Check bank statements and credit card activity for unfamiliar charges. Report anything suspicious immediately.

    5) Consider freezing your credit

    A credit freeze can stop criminals from opening new accounts in your name. It is free and reversible. To learn more about how to do this, go to Cyberguy.com and search “How to freeze your credit.” 

    6) Be alert for phishing attempts and use strong antivirus software 

    Expect more scam emails and phone calls. Criminals may reference the breach to sound legitimate.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    7) Secure your devices

    Keep your operating systems and apps up to date, as attackers often exploit outdated software to gain access. In addition, enable automatic updates and review app permissions to prevent stolen personal data from being combined with device-level access and causing further harm.

    Kurt’s key takeaways

    The University of Phoenix data breach highlights a growing problem across higher education. When attackers exploit trusted enterprise software, the fallout spreads fast and wide. While free identity protection helps, long-term vigilance matters most. Staying alert can limit damage long after the headlines fade.

    If universities cannot protect this level of sensitive data, should students demand stronger cybersecurity standards before enrolling? Let us know by writing to us at Cyberguy.com

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 

    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Make 2026 your most private year yet by removing broker data

    [ad_1]

    NEWYou can now listen to Fox News articles!

    As you think about New Year’s resolutions, consider one that protects every part of your life in 2026: removing your personal data from the internet. Not your social media posts. Not your email subscriptions. Your personal data, the files companies quietly collect and sell without your consent.

    Most people do not realize how much of their life already circulates inside massive databases run by data brokers. These companies exist for one purpose: to collect, package and sell personal information. They do it continuously, often without your knowledge or approval, to anyone willing to pay. As 2026 begins, this is the digital cleanup that matters most.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    10 SIMPLE CYBERSECURITY RESOLUTIONS FOR A SAFER 2026

    Data brokers quietly collect and sell personal information, creating detailed profiles that fuel scams, identity theft and privacy risks heading into 2026. (Photo by Kira Hofmann/picture alliance via Getty Images)

    What’s in your “digital file” and why it’s a problem in 2026

    Data brokers work like factories. They pull information from the apps you use, websites you visit, loyalty cards you scan, public records and even location data from your phone. Then they combine it into a shockingly detailed picture of your life, including:

    • Your full name and past addresses
    • Your phone numbers and email accounts
    • Your shopping history
    • Predicted income, political leanings, age and marital status
    • Your internet browsing habits
    • Where you go daily, down to the GPS coordinates.

    This data is packaged and sold to advertisers, insurers, political groups, background-check sites and, most worryingly, scammers. And going into 2026, the threat landscape is completely different:

    • AI-powered scams rely on data brokers: Scammers don’t guess anymore-they buy. They use broker data to tailor scams, impersonate companies you interact with and even mimic family members.
    • Deepfake phone scams are exploding: When a scammer knows your relatives’ names, phone numbers, travel dates and habits, a deepfake call becomes dangerously believable.
    • Data breaches are more frequent than ever: Your info doesn’t get leaked once; it gets leaked again and again because brokers constantly resell it.
    • The more data you leave exposed, the easier identity theft becomes: One exposed address or phone number is annoying. Hundreds of exposed data points? That’s a permanent risk until you remove them.

    If you want 2026 to be your safest year yet, the best thing you can do is reduce the amount of personal data available about you online, starting with data brokers.

    Why data brokers make it so hard to delete your information

    Technically, data brokers have to delete your data if you request it. But here’s the part they don’t advertise: They want you to give up. Some brokers hide their opt-out pages behind dozens of clicks. Others require you to fax forms, upload IDs, or repeat the request every 30–90 days because they reactivate your profile without warning. Now multiply that by 180–500+ data brokers, depending on your location. This is why most people never delete their information: it’s just too time-consuming.

    The simplest fix: automate the removals

    This is where a data removal service helps. These services automatically request the removal of your personal information from hundreds of data brokers on your behalf. That includes people-search websites, marketing databases, background-check services and similar data marketplaces. Instead of tracking down each site yourself, automation handles the process for you. Here’s what it does:

    • Identifies which brokers are storing your data
    • Sends legal removal requests for you
    • Follows up continually until your data is deleted
    • Stops brokers from relisting you
    • Keeps monitoring throughout 2026.

    For most people, that means removing your data from hundreds of databases in just a few minutes of setup. If you want a clean digital slate for 2026, this is the closest thing to hitting “erase.”

    Why the New Year is the best time to act

    You can remove your data at any time. However, early January is one of the most effective moments to do it. Here’s why.

    700CREDIT DATA BREACH EXPOSES SSNS OF 5.8M CONSUMERS

    Person typing on their computer.

    Cybersecurity experts warn that personal data circulating online makes consumers more vulnerable to AI-powered scams and deepfake fraud. (Photo by Nikolas Kokovlis/NurPhoto via Getty Images)

    1) Your data footprint is the largest after the holidays

    The holiday season creates a surge in data sharing. Retailers, loyalty programs, airlines, travel sites and apps collect huge amounts of personal information in November and December. Shoppers often share email addresses, phone numbers and location data to unlock discounts and faster checkout.

    Holiday spending continues to rise year over year. More spending means more data. As a result, your personal information spreads across more databases than at any other time of the year.

    2) Data brokers refresh profiles at the start of the year

    After the holiday rush, data brokers update and expand their profiles using newly collected information. January is when many of these companies organize, repackage and resell their datasets.

    Starting the removal process early helps limit how widely your information gets shared. Since removals can take days or even weeks, acting now reduces exposure before that data circulates further.

    3) Scams increase during tax season

    From January through April, scammers ramp up activity tied to tax season. Common threats include IRS impersonation scams, fake refund messages and W-2 fraud. Many of these attacks rely on data pulled from broker databases.

    When scammers have accurate personal details, their messages feel more convincing. Reducing your data exposure now lowers the risk. Removing your information from major data broker sites is a strong first step. It also helps to check smaller, lesser-known sites that may still list your details.

    PORNHUB HIT BY MASSIVE USER DATA LEAK EXPOSING 200 MILLION RECORDS

    Person working on their Macbook.

    Removing personal data from data broker sites can reduce exposure to scammers and help protect finances and privacy in the new year. (Photo by Phil Barker/Future Publishing via Getty Images)

    How to start 2026 with a clean data slate (3 steps)

    Using a reputable data removal service can simplify the entire process. These services automate requests to remove your personal information from data brokers, including many sites that are difficult to handle on your own.

    Step 1) Run a quick exposure check

    Start by searching for your name on Google. Look for results that show your address, date of birth, phone number, or email address. Sites that display this information often belong to data brokers or businesses that sell personal data for profit.

    Make a short list of the pages where your information appears.

    Step 2) Automate the removals

    Instead of spending weeks contacting each site manually, a data removal service can handle the work for you. You submit the links you found, and the service requests removals on your behalf across hundreds of databases.

    This approach is especially helpful if:

    • You have moved recently
    • You shop online often
    • You receive frequent spam or scam messages
    • You want stronger privacy protections in 2026

    Many people see multiple removals within the first few weeks.

    Step 3) Keep it clean all year

    Data brokers do not stop collecting information. Even after removals, your data can reappear months later. Ongoing monitoring helps catch new listings and remove them before they spread further.

    That long-term protection is what keeps your data footprint smaller throughout the year.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Kurt’s key takeaways

    If you want 2026 to be the year you take control of your digital life, start with the one thing that influences your security, your inbox, your finances and your peace of mind: Clearing your personal data from data broker sites. You can spend months trying to do it manually, or sign up once and let a data removal service handle all the hard work. A safer, quieter, more private 2026 is just minutes away.

    How much of your personal information do you think is already being bought and sold without your knowledge? Let us know by writing to us at Cyberguy.com. 

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • 700Credit data breach exposes SSNs of 5.8M consumers

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Data breaches tied to financial services companies are no longer rare, but they still hit harder when Social Security numbers are involved. In the latest incident, U.S.-based fintech company 700Credit has confirmed that the personal data of more than 5.8 million people was exposed. The breach did not originate from a direct compromise of 700Credit’s internal network, which makes it more concerning. It began with a third-party integration partner and quietly snowballed over several months before it was detected. By the time the issue was contained, hackers had managed to steal a significant amount of sensitive consumer data.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    DATA BREACH EXPOSES 400K BANK CUSTOMERS’ INFO

    A data breach at fintech firm 700Credit exposed the personal information of more than 5.8 million people after hackers accessed data through a third-party vendor. (Photo by Philip Dulian/picture alliance via Getty Images)

    What went wrong at 700Credit

    The company says the breach traces back to July, when a threat actor compromised one of its third-party integration partners, as reported by Bleeping Computer. During that intrusion, the attacker discovered an exposed API that could be used to access customer information linked to 700Credit’s dealership clients. The integration partner failed to inform 700Credit about the compromise, allowing the access to continue unnoticed.

    Suspicious activity was only detected on October 25, when 700Credit flagged unusual behavior on its systems and launched an internal investigation. The company says it brought in third-party computer forensic specialists to assess the scope of the incident and determine what data had been affected.

    According to the company’s findings, certain records within its web application were copied without authorization. These records are related to customers of auto dealerships that use 700Credit’s services. Managing Director Ken Hill later confirmed that roughly 20% of the consumer data accessible through the affected system was stolen between May and October.

    What data was exposed and why it matters

    While 700Credit has not published an exhaustive list of every data field involved, the company has confirmed that highly sensitive personal information was exposed. This includes Social Security numbers, which significantly raises the risk of identity theft and financial fraud. When SSNs are compromised, the impact is long-term. You cannot simply change them like a password.

    The company has published a dedicated page on its website outlining the breach and the types of information impacted. As part of its response, 700Credit is offering affected individuals 12 months of free identity protection and credit monitoring through TransUnion. You have a 90-day window to enroll in this service after receiving the notification.

    Notably, audio streaming platform SoundCloud and adult video sharing platform Pornhub also suffered data breaches tied to third-party vendors. There is no indication that the same vendor was involved in all three incidents, but the cases highlight how risky third-party access can be when vendors handle sensitive consumer data.

    CyberGuy reached out to 700Credit for comment but did not receive a response before publication.

    PASSWORD MANAGER FINED AFTER MAJOR DATA BREACH

    Person on their smartphone.

    Social Security numbers were among the sensitive data stolen in a monthslong breach involving 700Credit and an outside integration partner. (Photo by Matt Cardy/Getty Images)

    6 steps you can take to stay safe after a data breach

    When breaches like this happen, the damage is not always immediate. Your data can sit in underground markets for months before it is abused. That is why it helps to lock things down early. Here are six practical steps you can take.

    1) Use strong antivirus software 

    A good antivirus helps block malicious downloads, phishing links and spyware that often follow large data leaks. Attackers know your details are exposed and may try to target you directly with malware-based scams.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

    2) Switch to a password manager

    If you are still reusing passwords, this is the time to stop. A password manager helps you generate strong, unique passwords for every service and keeps them stored securely. If one site is breached, the rest of your accounts stay protected.

    Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

    3) Enable two-factor authentication everywhere

    Turn on 2FA for email, banking, social media and cloud accounts. Even if someone has your password, they cannot log in without the second factor. App-based authenticators are more secure than SMS, where possible.

    4) Sign up for identity theft and credit monitoring

    Monitoring services alert you when new accounts, loans or credit checks appear in your name. Early alerts give you a chance to act before serious financial damage is done.

    Identity Theft companies can monitor personal information like your Social Security number, phone number and email address, and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

    See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

    PETCO CONFIRMS MAJOR DATA BREACH INVOLVING CUSTOMER DATA

    Photo of a phone with malware.

    Hackers quietly accessed consumer data tied to auto dealerships using 700Credit services before the breach was discovered in October. (Photo by Jaque Silva/NurPhoto via Getty Images)

    5) Consider a personal data removal service

    Your phone number, address and other details are often already scattered across data broker sites. Data removal services help reduce your digital footprint, making it harder for attackers to profile and target you after a breach.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    6) Freeze your credit if SSNs are exposed

    If your Social Security number is involved, a credit freeze is one of the strongest defenses. It prevents new credit accounts from being opened without your approval and can be lifted temporarily when needed. To learn more about how to do this, go to Cyberguy.com and search “How to freeze your credit.”

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Kurt’s key takeaway

    Third-party APIs and integrations are essential for modern digital services, but they also expand the attack surface. When third-party partners fail to disclose breaches quickly, the downstream impact can be massive, as this case shows. If you receive a notification from 700Credit, take it seriously. Enroll in the credit monitoring service, review your credit reports, and consider locking them down. Even if no fraud has occurred yet, breaches involving SSNs often lead to delayed abuse months or even years later.

    Should companies be held accountable when a third-party vendor exposes customer information? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Pornhub hit by massive user data leak exposing 200 million records

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Pornhub is dealing with fresh fallout after the hacking group ShinyHunters claimed responsibility for a massive user data leak. The group says it stole 94GB of data tied to more than 200 million records and is now attempting to extort the company for a Bitcoin ransom.

    According to reporting from BleepingComputer, the hackers say they will publish the data if their demands are not met. Pornhub has acknowledged the situation but maintains its core systems were not breached.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter

    DATA BREACH EXPOSES 400K BANK CUSTOMERS’ INFO

    Pornhub is facing new fallout after hackers claimed to steal millions of user records tied to Premium accounts. The group is threatening to release sensitive activity data unless paid in Bitcoin. (Philip Dulian/picture alliance via Getty Images)

    What data ShinyHunters claims to have stolen

    ShinyHunters says the exposed data focuses on Pornhub Premium users. While no financial information was included, the dataset still contains highly sensitive activity details.

    The group claims the stolen records include:

    • Email addresses
    • Activity type
    • Location
    • Video URLs and video names
    • Keywords linked to videos
    • Timestamps showing when the activity occurred

    Activity logs reportedly show whether a user watched or downloaded a video or viewed a channel. Search histories are also included, which raises serious privacy concerns if the data is released publicly.

    How Mixpanel is connected to the breach

    The alleged breach appears linked to a separate November security incident involving Mixpanel, a data analytics vendor that previously worked with Pornhub. That earlier breach occurred after a smishing attack gave threat actors access to Mixpanel systems. However, Mixpanel says it does not believe Pornhub data came from that incident. The company stated it found no evidence that the data was taken during its November 2025 breach. Pornhub has also clarified that it stopped working with Mixpanel in 2021. That means the stolen data would be several years old. Reuters contacted some Pornhub customers to verify the claims. Those users confirmed the data tied to their accounts was accurate but outdated, which aligns with the Mixpanel timeline.

    What Pornhub says was not exposed

    Pornhub moved quickly to reassure users following the reports. In a security notice, the company said:

    “This was not a breach of Pornhub Premium’s systems. Passwords, payment details and financial information remain secure and were not exposed.”

    That distinction reduces the immediate risk of financial fraud. However, exposure of viewing habits and search activity still carries long-term privacy risks. We reached out to Pornhub for a comment, but did not hear back before our deadline.

    Why ShinyHunters remains a serious threat

    ShinyHunters has been linked to some of the most disruptive data breaches this year. The group relies heavily on social engineering tactics such as phishing and smishing to gain access to corporate systems. Once inside, the group typically steals large datasets and uses extortion threats to pressure companies into paying ransoms. This strategy has affected businesses and users worldwide.

    PASSWORD MANAGER FINED AFTER MAJOR DATA BREACH

    Person typing on their laptop.

    A hacking group says it obtained years-old Pornhub Premium user data, including viewing activity and search history. Pornhub says its core systems were not breached. (Donato Fasano/Getty Images)

    Pornhub warns Premium members about direct contact from hackers

    Pornhub has updated its online statement to warn Premium members about possible direct contact from cybercriminals. In cases involving adult platforms, this type of outreach often escalates into sextortion attempts, where criminals threaten to expose private activity unless victims pay.

    “We are aware that the individuals responsible for this incident have threatened to contact impacted Pornhub Premium users directly. You may therefore receive emails claiming they have your personal information. As a reminder, we will never ask for your password or payment information by email.”

    Pornhub remains one of the world’s most visited adult video platforms. People can view content anonymously or create accounts to upload and interact with videos. 

    PETCO CONFIRMS MAJOR DATA BREACH INVOLVING CUSTOMER DATA

    Hacker on his laptop.

    ShinyHunters claims responsibility for a massive Pornhub data leak involving alleged user activity records. The company says passwords and payment details remain secure. (Morteza Nikoubazl/NurPhoto via Getty Images)

    Ways to stay safe after a data breach

    Even if the data is several years old, users should take this opportunity to strengthen their digital security.

    1) Change your passwords

    Start by updating your Pornhub password. Next, change the password for any email or payment account linked to it. Using a password manager makes it easier to create and store strong, unique passwords.

    Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com/Passwords) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com

    2) Stay alert for phishing attempts and install strong antivirus software 

    Data breaches often lead to follow-up scams. Be cautious of emails, texts or phone calls that reference Pornhub or account issues. Avoid clicking links, downloading attachments or sharing personal information unless you can verify the source. Installing a strong antivirus program adds another layer of defense against malicious links and downloads.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    3) Use a data removal service to limit future exposure

    Data removal services work to remove your personal information from data broker websites that collect and sell details such as email addresses, locations and online identifiers. If leaked data from this breach is shared, resold or cross-referenced with broker databases, removing your information can make it much harder for scammers to connect it to you.

    This step is especially important after high-profile breaches involving activity data. Shrinking what is publicly available about you reduces the risk of targeted phishing, impersonation and long-term privacy harm.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan

    4) Consider identity theft protection

    Identity Theft companies can monitor personal information such as your Social Security Number (SSN), phone number, and email address and alert you if it is being sold on the dark web or used to open an account. Early warnings can help limit damage if your data surfaces. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

    See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com

    5) Add extra privacy protection with a VPN

    A VPN helps protect your browsing activity by masking your IP address and encrypting your internet traffic. That is especially relevant in breaches like this one, where exposed activity data may include location signals or usage patterns. While a VPN cannot erase past exposure, it reduces how much new information is visible going forward and makes it harder to link future activity back to you. Using a VPN consistently can also limit tracking across sites, which helps lower your overall digital footprint after a breach.

    For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android & iOS devices at Cyberguy.com

     CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Kurt’s key takeaways

    The Pornhub massive data leak highlights how long stored user information can remain a risk. While passwords and payment details were not exposed, activity data can still be damaging if released. ShinyHunters has shown it is willing to apply pressure through public threats. As a result, you should stay vigilant and proactive about your online security.

    Should companies be allowed to store years of user activity data once it is no longer needed? Let us know by writing to us at Cyberguy.com
     

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • These are the cybersecurity stories we were jealous of in 2025 | TechCrunch

    [ad_1]

    It’s the end of the year. That means it’s time for us to celebrate the best cybersecurity stories we didn’t publish. Since 2023, TechCrunch has looked back at the best stories across the board from the year in cybersecurity.

    If you’re not familiar, the idea is simple. There are now dozens of journalists who cover cybersecurity in the English language. There are a lot of stories about cybersecurity, privacy, and surveillance that are published every week. And a lot of them are great, and you should read them. We’re here to recommend the ones we liked the most, so keep in mind that it’s a very subjective and, at the end of the day, incomplete list. 

    Anyway, let’s get into it. — Lorenzo Franceschi-Bicchierai

    Shane Harris described how he cultivated a senior Iranian hacker as a source, who was then killed

    Every once in a while, there’s a hacker story that as soon as you start reading, you think it could be a movie or a TV show. This is the case with Shane Harris’ very personal tale of his months-long correspondence with a top Iranian hacker. 

    In 2016, The Atlantic’s journalist made contact with a person claiming to work as a hacker for Iran’s intelligence, where he claimed to have worked on major operations, such as the downing of an American drone and the now-infamous hack against oil giant Saudi Aramco, where Iranian hackers wiped the company’s computers. Harris was rightly skeptical, but as he kept talking to the hacker, who eventually revealed his real name to him, Harris started to believe him. When the hacker died, Harris was able to piece together the real story, which somehow turned out to be more incredible than the hacker had led Harris to believe. 

    The gripping story is also a great behind-the-scenes look at the challenges cybersecurity reporters face when dealing with sources claiming to have great stories to share.

    The Washington Post revealed a secret order demanding Apple let U.K. officials spy on users’ encrypted data

    In January, the U.K. government secretly issued Apple with a court order demanding that the company build a back door so police can access the iCloud data of any customer in the world. Due to a worldwide gag order, it was only because The Washington Post broke the news that we learned the order existed to begin with. The demand was the first of its kind, and — if successful — would be a major defeat for tech giants who have spent the past decade locking themselves out of their users’ own data so they can’t be compelled to provide it to governments.

    Apple subsequently stopped offering its opt-in end-to-end encrypted cloud storage to its customers in the U.K. in response to the demand. But by breaking the news, the secret order was thrust into the public eye and allowed both Apple and critics to scrutinize U.K. surveillance powers in a way that hasn’t been tested in public before. The story sparked a months-long diplomatic row between the U.K. and the United States, prompting Downing Street to drop the request — only to try again several months later.

    “The Trump administration accidentally texted me its war plans” by The Atlantic is this year’s best headline

    This story was the sort of fly-on-the-wall access that some reporters would dream of, but The Atlantic’s editor-in-chief got to play out in real time after he was unwittingly added to a Signal group of senior U.S. government officials by a senior U.S. government official discussing war plans on their cell phones. 

    “We are currently clean on OPSEC,” said Secretary of Defense Pete Hegseth. they were not. Image Credits:The Atlantic (screenshot)

    Reading the discussion about where U.S. military forces should drop bombs — and then seeing news reports of missiles hitting the ground on the other side of the world — was confirmation that Jeffrey Goldberg needed to know that he was, as he suspected, in a real chat with real Trump administration officials, and this was all on-the-record and reportable.

    And so he did, paving the way for a months-long investigation (and critique) of the government’s operational security practices, in what was called the biggest government opsec mistake in history. The unraveling of the situation ultimately exposed security lapses involving the use of a knock-off Signal clone that further jeopardized the government’s ostensibly secure communications.

    Brian Krebs tracked down a prolific hacker group admin as a Jordanian teenager

    Brian Krebs is one of the more veteran cybersecurity reporters out there, and for years he has specialized in following online breadcrumbs that lead to him revealing the identity of notorious cybercriminals. In this case, Krebs was able to find the real identity behind a hacker’s online handle Rey, who is part of the notorious advanced persistent teenagers‘ cybercrime group that calls itself Scattered LAPSUS$ Hunters.

    Krebs’ quest was so successful that he was able to talk to a person very close to the hacker — we won’t spoil the whole article here — and then the hacker himself, who confessed to his crimes and claimed he was trying to escape the cybercriminal life. 

    Independent media outlet 404 Media has accomplished more impact journalism this year than most mainstream outlets with vastly more resources. One of its biggest wins was exposing and effectively shuttering a massive air travel surveillance system tapped by federal agencies and operating in plain sight.

    404 Media reported that a little-known data broker set up by the airline industry called the Airlines Reporting Corporation was selling access to 5 billion plane tickets and travel itineraries, including names and financial details of ordinary Americans, allowing government agencies like ICE, the State Department, and the IRS to track people without a warrant.

    ARC, owned by United, American, Delta, Southwest, JetBlue, and other airlines, said it would shut down the warrantless data program following 404 Media’s months-long reporting and intense pressure from lawmakers.

    Wired made the 3D-printed gun that Luigi Mangione allegedly used to kill a healthcare executive to test the legalities of “ghost guns”

    The killing of UnitedHealthcare CEO Brian Thompson in December 2024 was one of the biggest stories of the year. Luigi Mangione, the chief suspect in the killing, was soon after arrested and indicted on charges of using a “ghost gun,” a 3D-printed firearm that had no serial numbers and built in private without a background check — effectively a gun that the government has no idea exists.

    Wired, using its past reporting experience on 3D-printed weaponry, sought to test how easy it would be to build a 3D-printed gun, while navigating the patchwork legal (and ethical) landscape. The reporting process was exquisitely told, and the video that goes along with the story is both excellent and chilling.

    NPR detailed a federal whistleblower’s account of how DOGE took sensitive government data, and the threats he faced

    DOGE, or the Department of Government Efficiency, was one of the biggest running stories of the year, as the gang of Elon Musk’s lackeys ripped through the federal government, tearing down security protocols and red tape, as part of the mass-grab of citizens’ data. NPR had some of the best investigative reporting uncovering the resistance movement of federal workers trying to prevent the pilfering of the government’s most sensitive data.

    In one story detailing a whistleblower’s official disclosure as shared with members of Congress, a senior IT employee in the National Labor Relations Board told lawmakers that as he was seeking help investigating DOGE’s activity, he “found a printed letter in an envelope taped to his door, which included threatening language, sensitive personal information and overhead pictures of him walking his dog, according to the cover letter attached to his official disclosure.”

    Mother Jones found an exposed dataset of tracked surveillance victims, including world leaders, a Vatican enemy, and maybe you

    Any story that starts with a journalist saying they found something that made them “feel like shitting my pants,” you know it’s going to be a fun read. Gabriel Geiger found a dataset from a mysterious surveillance company called First Wap, which contained records on thousands of people from around the world whose phone locations had been tracked. 

    The dataset, spanning 2007 through 2015, allowed Geiger to identify dozens of high-profile people whose phones were tracked, including a former Syrian first lady, the head of a private military contractor, a Hollywood actor, and an enemy of the Vatican. This story explored the shadowy world of phone surveillance by exploiting Signaling System No. 7, or SS7, an obscurely named protocol long known to allow malicious tracking.

    Wired reported on the investigation behind a string of “swatting” attacks on hundreds of schools nationwide

    Swatting has been a problem for years. What started as a bad joke has become a real threat, which has resulted in at least one death. Swatting is a type of hoax where someone — often a hacker — calls the emergency services and tricks the authorities into sending an armed SWAT team to the home of the hoaxer’s target, often pretending to be the target themselves and pretending they are about to commit a violent crime. 

    In this feature, Wired’s Andy Greenberg put a face on the many characters who are part of these stories, such as the call operators who have to deal with this problem. And he also profiled a prolific swatter, known as Torswats, who for months tormented the operators and schools all over the country with fake — but extremely believable — threats of violence, as well as a hacker who took it upon himself to track Torswats down. 

    [ad_2]

    Zack Whittaker, Lorenzo Franceschi-Bicchierai

    Source link

  • New malware can read your chats and steal your money

    [ad_1]

    NEWYou can now listen to Fox News articles!

    A new Android banking trojan called Sturnus is shaping up to be one of the most capable threats we have seen in a while. It is still in early development, but it already behaves like a fully mature operation. 

    Once it infects a device, it can take over your screen, steal your banking credentials and even read encrypted chats from apps you trust. The worrying part is how quietly it works in the background. You think your messages are safe because they are end-to-end encrypted, but this malware simply waits for the phone to decrypt them before grabbing everything. 

    It’s important to note, however, that Sturnus does not break encryption; it only captures messages after your apps decrypt them on your device.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Sturnus malware uses deceptive screens that mimic real banking apps to steal your credentials in seconds. (Kurt “CyberGuy” Knutsson )

    A closer look at the malware’s capabilities

    Sturnus combines several attack layers that give the operator nearly full visibility into the device, as reported by cybersecurity research firm ThreatFabric. It uses HTML overlays that mimic real banking apps to trick you into typing your credentials. Everything you enter goes straight to the attacker through a WebView that forwards the data instantly. It also runs an aggressive keylogging system through the Android Accessibility Service. This lets it capture text as you type, follow which app is open, and map every UI element on the screen. Even when apps block screenshots, the malware keeps tracking the UI tree in real time, which is enough to reconstruct what you are doing.

    NEW ANDROID MALWARE CAN EMPTY YOUR BANK ACCOUNT IN SECONDS

    On top of overlays and keylogging, the malware monitors WhatsApp, Telegram, Signal and other messaging apps. It waits for these apps to decrypt messages locally, then captures the text right from the screen. This means your chats may remain encrypted over the network, but once the message appears on your display, Sturnus sees the entire conversation. It also includes a full remote control feature with live screen streaming and a more efficient mode that sends only interface data. This allows precise taps, text injection, scrolling and permission approvals without showing any activity to the victim.

    How Sturnus stays hidden and steals money

    The malware protects itself by grabbing Device Administrator privileges and blocking any attempt to remove it. If you open the settings page that could disable those permissions, Sturnus detects it immediately and moves you away from the screen before you can act. It also monitors battery state, SIM changes, developer mode, network conditions and even signs of forensic investigation to decide how to behave. All this data goes back to the command-and-control server through a mix of WebSocket and HTTP channels protected with RSA and AES encryption.

    When it comes to financial theft, the malware has several ways to take over your accounts. It can collect credentials through overlays, keylogging, UI-tree monitoring and direct text injection. If needed, it can black out your screen with a full-screen overlay while the attacker performs fraudulent transactions in the background. Since the screen is hidden, you have no idea anything is happening until it is too late.

    7 ways you can stay safe from Android malware like Sturnus

    If you want to protect yourself from threats like this, here are a few practical things you can start doing right away.

    1) Install apps only from trusted and verified sources

    Avoid downloading APKs from forwarded links, shady websites, Telegram groups or third-party app stores. Banking malware spreads most effectively through sideloaded installers disguised as updates, coupons or new features. If you need an app that isn’t in the Play Store, verify the developer’s official site, check hashes if provided and read recent reviews to make sure the app hasn’t been hijacked.

    2) Check permission requests carefully before tapping allow

    Most dangerous malware relies on accessibility permissions because they allow full visibility into your screen and interactions. Device administrator rights are even more powerful since they can block removal. If a simple utility app suddenly asks for these, stop immediately. These permissions should only be granted to apps that genuinely need them, such as password managers or accessibility tools you trust.

    3) Keep your phone updated

    Install system updates as soon as they arrive, since many Android banking trojans target older devices that lack the latest security patches. If your phone is no longer receiving updates, you are at a higher risk, especially when using financial apps. Avoid sideloading custom ROMs unless you know how they handle security patches and Google Play Protect.

    HOW ANDROID MALWARE LETS THIEVES ACCESS YOUR ATM CASH

    4) Use strong antivirus software

    Person holds iPhone showing the Whatsapp logo

    The malware quietly captures decrypted messages from apps like WhatsApp, Telegram and Signal right as they appear on your screen. (Kurt Knutsson)

    Android phones come with Google Play Protect built in, which catches a large chunk of known malware families and warns you when apps behave suspiciously. But if you want greater security and control, choose a third-party antivirus app. These tools can alert you when an app starts logging your screen or trying to take over your phone.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

    5) Use a personal data removal service

    A lot of these campaigns rely on data brokers, leaked databases and scraped profiles to build lists of people to target. If your phone number, email, address or social handles are floating around on dozens of broker sites, it becomes much easier for attackers to reach you with malware links or tailored scams. A personal data removal service helps clean up that footprint by deleting your info from data broker listings.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    6) Treat unusual login screens and pop-ups as red flags

    Trojan overlays often appear when you open your bank app or a popular service. If the screen layout looks different or asks for credentials in a way you don’t recognize, close the app completely. Reopen it from your app drawer and see if the prompt returns. If it doesn’t, you probably caught an overlay. Never type banking details into screens that appear suddenly or seem out of place.

    Man typing on his laptop.

    With remote control tools that stream your screen and automate taps, attackers can move money behind the scenes without you noticing. (Felix Zahn/Photothek via Getty Images)

    7) Be cautious with links and attachments you receive

    Attackers frequently distribute malware through WhatsApp links, SMS messages and email attachments pretending to be invoices, refunds or delivery updates. If you receive a link you weren’t expecting, open your browser manually and search for the service instead. Avoid installing anything that comes from a message, even if it appears to be from someone you know. Compromised accounts are a common delivery method.

    DATA BREACH EXPOSES 400,000 BANK CUSTOMERS’ INFO

    Kurt’s key takeaway

    Sturnus is still a young malware family, but it already stands out for how much control it gives attackers. It sidesteps encrypted messaging, steals banking credentials with multiple backup methods, and maintains a strong grip on the device through administrator privileges and constant environmental checks. Even if the current campaigns are limited, the level of sophistication here suggests a threat that is being refined for larger operations. If it reaches wide distribution, it could become one of the most damaging Android banking trojans in circulation.

    Have scammers ever tried to trick you into installing an app or clicking a link? How did you handle it? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2025 CyberGuy.com. All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • New SantaStealer malware is after your passwords and crypto

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Christmas is around the corner, and so is the SantaStealer malware. While the name sounds jolly, this malware is more than capable of ruining your happiness this festive season. The worst part is that this new strain is available to almost anyone willing to pay a small fee. It essentially works as malware-as-a-service, letting buyers target people at scale, obviously not for any legitimate use.

    SantaStealer is starting to make noise across Telegram channels and underground hacker forums. It is being marketed as a stealthy, memory-only information stealer that can quietly siphon data without leaving obvious traces on disk. 

    Memory-only does not mean undetectable. It simply reduces disk artifacts, which can delay detection rather than prevent it altogether. That promise alone is enough to attract cybercriminals, especially at a time when browser-stored passwords, session cookies and crypto wallets remain high-value targets.

    MALICIOUS BROWSER EXTENSIONS HIT 4.3M USERS

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    SantaStealer malware is spreading ahead of Christmas, with cybercriminals marketing the data-stealing tool for hire across Telegram and underground forums. (Kurt “CyberGuy” Knutsson)

    SantaStealer and how it actually works

    SantaStealer operates as a malware-as-a-service, charging $175 per month for its basic tier and $300 per month for the premium plan. Researchers at Rapid7 say the operation rebrands an earlier project called BluelineStealer, with a Russian-speaking developer pushing toward a wider launch before the end of the year.

    Despite bold claims about evading detection, Rapid7’s analysis paints a more grounded picture. The samples they examined were not particularly difficult to analyze and lacked the advanced anti-analysis techniques being advertised, which is good news for us. If it can be detected, security tools have a better chance of removing it before it can do serious damage.

    Functionally, SantaStealer is still dangerous. It uses 14 separate data-collection modules that run in parallel, pulling information from browsers, messaging apps like Telegram and Discord, gaming platforms such as Steam, crypto wallet apps and extensions, and even local documents. The malware can also take screenshots of your desktop. Stolen data is written to memory, compressed into ZIP files and sent out in 10MB chunks to a hardcoded command-and-control server.

    One notable capability is its use of an embedded executable to get around Chrome’s App-Bound Encryption, a security feature introduced in mid-2024. This workaround typically requires the malware to be executed at the user level and is not a remote bypass of Chrome’s security model. Similar tricks have already been used by other info-stealers, showing how quickly attackers test and adapt to new browser protections. 

    What this says about the current threat landscape

    SantaStealer is not fully operational yet and has not been distributed at scale, but it reflects a broader trend in cybercrime. Modern info-stealers are modular, configurable and sold much like regular software. The affiliate panel that Rapid7 observed allows buyers to fine-tune exactly what data the malware steals, from full system sweeps to narrowly targeted attacks focused on specific apps or crypto wallets.

    The malware also includes options to avoid infecting systems in certain regions and to delay execution, which can throw off both victims and security analysts. As for how SantaStealer might spread, researchers say recent campaigns increasingly rely on ClickFix-style attacks. These tricks push victims into pasting malicious commands directly into the Windows terminal, often disguised as steps to fix an issue or enable a feature.

    More traditional methods are still very much in play. Phishing emails, pirated software, torrent downloads, malicious ads and even deceptive YouTube comments remain effective delivery channels. Once malware like this runs on a system, it needs very little time to grab saved passwords, session cookies and wallet data that can later be abused or sold.

    7 steps you can take to stay safe from SantaStealer malware

    A few sensible habits and the right tools can significantly reduce your risk, even if malware like this continues to evolve. Here are seven practical steps you can take to stay safe:

    1) Use strong antivirus software

    Modern antivirus tools don’t just look for known malware signatures. They also monitor suspicious behavior, such as programs trying to grab browser data or run hidden processes. Keep real-time protection enabled and take alerts seriously instead of dismissing them.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

    Someone typing on a computer in a dark room.

    A new malware-as-a-service threat known as SantaStealer targets passwords, session cookies and crypto wallets while promoting itself as a stealthy, memory-only attack. (Thomas Trutschel/Photothek via Getty Images)

    2) Keep your operating system and apps updated

    Updates are not just about new features. They often patch security flaws that malware actively targets. This includes your OS, browser, browser extensions, crypto wallet apps and messaging tools. Delaying updates gives attackers a wider window to exploit known weaknesses.

    3) Switch to a password manager

    Info-stealers love browser-saved passwords because they are easy to grab. A password manager stores your credentials in an encrypted vault and reduces what your browser keeps locally. It also helps you use strong, unique passwords for every service without having to remember them.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com. 

    FAKE WINDOWS UPDATE PUSHES MALWARE IN NEW CLICKFIX ATTACK

    4) Turn on two-factor authentication wherever possible

    Even if your password is stolen, 2FA can stop attackers from getting in. App-based authenticators are more secure than SMS codes and should be your first choice for email, crypto exchanges, cloud services and social media accounts.

    5) Be extremely careful with commands and “quick fixes”

    ClickFix-style attacks rely on trust and urgency. If a website, pop-up or video tells you to paste a command into the Windows terminal to fix something, stop. Unless you fully understand what that command does, assume it is dangerous.

    6) Use a personal data removal service

    When your email, phone number or other personal details are widely available online, attackers can target you more convincingly. Personal data removal services help take your information down from data broker sites, reducing the chances of targeted phishing or malware lures.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    HACKERS PUSH FAKE APPS WITH MALWARE IN GOOGLE SEARCHES

    7) Avoid pirated software and unverified extensions

    Cracked software, torrents and shady browser extensions remain some of the most reliable malware delivery methods. They often bundle info-stealers that run quietly in the background. Stick to official app stores, trusted developers and verified extensions, even if it means skipping a “free” download.

    Person wearing a hoodie works on multiple computer screens displaying digital data in a dark room.

    SantaStealer can quietly siphon sensitive data. (Kurt “CyberGuy” Knutsson)

    Kurt’s key takeaway

    SantaStealer may not yet live up to its own hype, but that should not make you complacent. Early-stage malware often improves quickly once developers patch obvious mistakes. Be cautious with links and attachments from unfamiliar emails, and think twice before running unverified code or browser extensions pulled from public repositories.

    When was the last time you checked which extensions have access to your data? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • FBI warns of fake kidnapping photos used in new scam

    [ad_1]

    NEWYou can now listen to Fox News articles!

    The FBI is warning about a disturbing scam that turns family photos into powerful weapons. Cybercriminals are stealing images from social media accounts, altering them and using them as fake proof of life in virtual kidnapping scams.

    These scams do not involve real abductions. Instead, criminals rely on fear, speed and believable images to pressure victims into paying ransom before they can think clearly.

    Sign up for my FREE CyberGuy ReportGet my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

    FACEBOOK SETTLEMENT SCAM EMAILS TO AVOID NOW

    Scammers steal photos from public social media accounts and manipulate them to create fake proof of life images that fuel fear and urgency. (Kurt “CyberGuy” Knutsson)

    How the fake kidnapping scam works

    According to the FBI, scammers usually start with a text message. They claim they have kidnapped a loved one and demand immediate payment for their release. To make the threat feel real, the criminals send an altered photo pulled from social media. The FBI says these images may be sent using timed messages to limit how long victims can examine them. The agency warns that scammers often threaten extreme violence if the ransom is not paid right away. This urgency is designed to shut down rational thinking.

    Signs the photo may be fake

    When victims slow down and look closely, the altered images often fall apart. The FBI says warning signs may include missing scars or tattoos, strange body proportions or details that do not match reality. Scammers may also spoof a loved one’s phone number, which makes the message feel even more convincing. Reports on sites like Reddit show this tactic is already being used in the real world.

    Why this fake kidnapping scam is so effective

    Virtual kidnapping scams work because they exploit emotion. Fear pushes people to act fast, especially when the message appears to come from someone they trust. The FBI notes that criminals use publicly available information to personalize their threats. Even posts meant to help others, such as missing person searches, can provide useful details for scammers.

    Ways to stay safe from virtual kidnapping scams

    The FBI recommends several steps to protect yourself and your family.

    • Be mindful of what you post online, especially photos and personal details
    • Avoid sharing travel information in real time
    • Create a family code word that only trusted people know
    • Pause and question whether the claims make sense
    • Screenshot or record proof of life photos
    • If you receive a message like this, try to contact your loved one directly before doing anything else.

    Staying calm is one of your strongest defenses. Slowing down gives you time to spot red flags and avoid costly mistakes.

    How to strengthen your digital defenses against virtual kidnapping scams

    When scammers can access your photos, phone numbers and personal details, they can turn fear into leverage. These steps help reduce what criminals can find and give you clear actions to take if a threat appears.

    1) Lock down your social media accounts

    Review the privacy settings on every social platform you use. Set profiles to private so only trusted friends and family can see your photos, posts and personal updates. Virtual kidnapping scams rely heavily on publicly visible images. Limiting access makes it harder for criminals to steal photos and create fake proof-of-life images.

    social media apps

    Limiting what you share online and slowing down to verify claims can help protect your family from panic-driven scams like this one. (Jaap Arriens/NurPhoto via Getty Images)

    2) Be cautious about what you share online

    Avoid posting real-time travel updates, daily routines or detailed family information. Even close-up photos that show tattoos, scars or locations can give scammers useful material. The less context criminals have, the harder it is for them to make a threat feel real and urgent.

    3) Use strong antivirus software on all devices

    Install strong antivirus software on computers, phones and tablets. Strong protection helps block phishing links, malicious downloads and spyware often tied to scam campaigns. Keeping your operating system and security tools updated also closes security gaps that criminals exploit to gather personal data.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    NEW EMAIL SCAM USES HIDDEN CHARACTERS TO SLIP PAST FILTERS

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    4) Consider a data removal service to reduce exposure

    Data brokers collect and sell personal information pulled from public records and online activity. A data removal service helps locate and remove your details from these databases. Reducing what is available online makes it harder for scammers to impersonate loved ones or personalize fake kidnapping threats.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    5) Limit facial data in public profiles

    Review older public photo albums and remove images that clearly show faces from multiple angles. Avoid posting large collections of high-resolution facial photos publicly. Scammers often need multiple images to convincingly alter photos. Reducing facial data weakens their ability to manipulate images.

    6) Establish a family verification plan

    Create a simple verification plan with loved ones before an emergency happens. This may include a shared code word, a call back rule or a second trusted contact. Scammers depend on panic. Having a preset way to verify safety gives you something steady to rely on when emotions run high.

    7) Secure phone accounts and enable SIM protection

    Contact your mobile carrier and ask about SIM protection or a port-out PIN. This helps prevent criminals from hijacking phone numbers or spoofing calls and texts. Since many fake kidnapping scams begin with messages that appear to come from a loved one, securing phone accounts adds an important layer of protection.

    Agents of the Federal Bureau of Investigation walking through crime scene

    The FBI warns that these virtual kidnapping scams often begin with a text message that pressures victims to pay a ransom immediately. (Getty Images)

    8) Save evidence and report the scam

    If you receive a threat, save screenshots, phone numbers, images and message details. Do not continue engaging with the sender. Report the incident to the FBI’s Internet Crime Complaint Center. Even if no money is lost, reports help investigators track patterns and warn others.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Kurt’s key takeaways

    Virtual kidnapping scams show how quickly personal photos can be weaponized. Criminals do not need real victims when fear alone can drive action. Taking time to verify claims, limiting what you share online and strengthening your digital defenses can make a major difference. Awareness and preparation remain your best protection.

    Have you or someone you know encountered a scam like this? Let us know by writing to us at Cyberguy.com

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter 

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Data breach exposes 400,000 bank customers’ info

    [ad_1]

    NEWYou can now listen to Fox News articles!

    A major data breach tied to U.S. fintech firm Marquis is rippling through banks, credit unions and their customers. Hackers broke into Marquis systems by exploiting a known but unpatched vulnerability in a SonicWall firewall, gaining access to deeply sensitive consumer data.

    At least 400,000 people are confirmed to be affected so far across multiple states. Texas has been hit the hardest with more than 354,000 residents affected. That number is expected to rise as additional breach notifications are filed.

    Marquis operates as a marketing and compliance provider for financial institutions. The company says it serves more than 700 banks and credit unions nationwide. That role gives Marquis access to centralized pools of customer data, which also makes it a high-value target.

    PASSWORD MANAGER FINED AFTER MAJOR DATA BREACH

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    A major data breach tied to fintech firm Marquis exposed sensitive banking and identity data for hundreds of thousands of people. (Kurt “CyberGuy” Knutsson)

    What information was stolen in the Marquis cyberattack

    According to legally required disclosures filed in Texas, Maine, Iowa, Massachusetts and New Hampshire, hackers accessed a wide range of personal and financial data. Stolen information includes customer names, dates of birth, postal addresses, Social Security numbers and bank account, debit and credit card numbers. The breach dates back to Aug. 14, when attackers gained access through the SonicWall firewall vulnerability. Marquis later confirmed the incident was a ransomware attack.

    While Marquis did not publicly name the attackers, the campaign has been widely linked to the Akira ransomware gang. Akira has previously targeted organizations running SonicWall appliances during large-scale exploitation waves. This was not a routine credential leak.

    We reached out to Marquis for comment, and a company spokesperson provided CyberGuy with the following statement:

    “In August, Marquis Marketing Services experienced a data security incident. Upon discovery, we immediately enacted our response protocols and proactively took the affected systems offline to protect our data and our customers’ information. We engaged leading third-party cybersecurity experts to conduct a comprehensive investigation and notified law enforcement.

    “The incident was quickly contained, and our investigation was recently completed. It was determined that an unauthorized third party accessed certain non-public information within our network. However, there is no evidence indicating that any personal information has been used for identity theft or financial fraud. We have notified potentially affected individuals.  

    “We know our customers place great trust in us, and at Marquis, we take that responsibility seriously by making the protection of their information our highest priority. We are extremely appreciative of the cooperation, understanding, and support of our employees and customers during this time.”

    HOW TO STOP IMPOSTOR BANK SCAMS BEFORE THEY DRAIN YOUR WALLET 

    Why the Marquis data breach creates long-term identity risk

    When a data breach exposes your full identity, the danger does not disappear after the news cycle ends. Unlike a stolen password, this kind of information cannot be changed, which means the risk can stick around for a long time.

    “With a typical credential leak, you reset passwords, rotate tokens and move on,” Ricardo Amper, CEO and Founder of Incode Technologies, a digital identity verification company, tells CyberGuy. “But core identity data is static. You cannot meaningfully change your date of birth or SSN, and once those are exposed, they can circulate on criminal markets for years. The breach is a moment in time, but the exposure it creates can follow people for the rest of their financial lives.”

    That is why identity breaches are so dangerous. Criminals can reuse the same stolen data years later to open new accounts, build fake identities or run highly targeted scams that feel personal and convincing. Many attackers now combine this data with AI tools to scale their efforts. As a result, phishing emails, phone calls and even voice impersonations are harder to spot when they reference real details about your bank or account history.

    The most likely scams after identity data is stolen

    When criminals obtain verified identity data, fraud becomes targeted rather than opportunistic. 

    “Once criminals get their hands on rich, verified identity data, fraud stops being a guessing game and becomes a targeted execution,” Amper said. 

    The first major threat is account takeover. With enough personal details, attackers can bypass knowledge-based checks, reset passwords, change contact information and abuse accounts in ways that often look legitimate. The second risk is new account fraud. This includes credit cards, loans, buy now pay later services and even new bank accounts. High-quality data helps these applications pass automated systems and manual reviews.

    The fastest-growing threat is synthetic identity fraud. Real data, like a Social Security number, is blended with fabricated details to create a new identity that matures over time before a large financial bust. 

    “These attacks are hard to catch early because the data being presented is accurate and often reused across multiple institutions,” Amper noted. “If your defenses can’t reliably tell a real human from an AI-generated impersonation, you are starting every decision from a position of disadvantage,” he added.

    Why unpatched firewall flaws pose such a serious threat

    Ransomware groups like Akira increasingly focus on widely deployed infrastructure to maximize impact. Firewalls sit at the boundary of trusted networks. When one is compromised, everything behind it becomes reachable. 

    “What we’re seeing with groups like Akira is a focus on maximizing impact by targeting widely used infrastructure. The strategy remains the same: Find a single weak point that gives access to many downstream victims at once,” Amper said. 

    This approach exposes a persistent blind spot in traditional cybersecurity thinking. Many organizations still assume traffic passing through a firewall is safe. 

    “When the perimeter device itself is the entry point, static defenses and outdated controls simply can’t keep up,” Amper explained.

    Illustration of a hacker at work

    Hackers accessed names, Social Security numbers and bank details by exploiting an unpatched firewall vulnerability.  (Kurt “CyberGuy” Knutsson)

    How long affected consumers should assume risk remains high

    Identity data does not expire. Social Security numbers and birth dates stay the same for life. 

    “When core identity data reaches criminal markets, the risk does not fade quickly,” Amper emphasized. “Fraud rings treat stolen identity data like inventory. They hold it, bundle it, resell it and combine it with information from new breaches.” 

    Warning signs of misuse can be subtle. These include credit inquiries you did not authorize, account recovery alerts from unfamiliar services or phone calls that convincingly mimic a bank’s verification process using deepfake voice tools. 

    “The most damaging fraud often starts long after the breach is no longer in the news,” Amper added.

    The overlooked impact of identity theft

    Financial losses are only part of the damage. Victims often experience a lasting erosion of trust. 

    Amper says, “The most overlooked consequence is the psychological toll of knowing that you can no longer trust who is contacting you. Deepfake impersonation turns every phone call, video message or urgent request into a potential attack.”

    Ways to stay safe after the Marquis data breach

    When a breach exposes Social Security numbers, bank details and birth dates, the risk does not end with a password reset. These steps focus on protections that reduce long-term identity misuse and help you detect fraud early.

    1) Freeze your credit with all major bureaus

    A credit freeze prevents criminals from opening new accounts in your name using stolen identity data. This is critical after the Marquis breach, where full identity profiles were exposed. Freezing credit does not affect your score and can be lifted temporarily when needed. Place a free credit freeze with Equifax, Experian and TransUnion online or by phone. Each bureau must be contacted separately. Once frozen, new credit cannot be opened unless you temporarily lift or remove the freeze using a PIN or account login.

    2) Place a fraud alert on your credit file

    A fraud alert tells lenders to take extra steps to verify your identity before approving credit. It adds protection if you are not ready to freeze credit everywhere or want an extra layer on top of a freeze. Fraud alerts last for one year and can be renewed. You only need to contact one credit bureau to place a fraud alert. Equifax, Experian or TransUnion will notify the others for you. Fraud alerts are free and last for one year.

    3) Enable transaction and account alerts

    Turn on alerts for withdrawal, purchase, login attempts and password changes across all financial accounts. Real-time alerts can help you catch account takeovers or unauthorized activity before serious damage occurs.

    4) Review bank statements and credit reports regularly

    Check statements and credit reports often, even months or years after the breach. Identity data from incidents like this is frequently reused later for delayed fraud. Watch for unfamiliar accounts, hard inquiries or small test charges.

    5) Use phishing-resistant two-factor authentication

    Text message codes can be intercepted or socially engineered. Where possible, switch to app-based or hardware-backed two-factor authentication. These options are harder for attackers to bypass, even when they know your personal details.

    6) Rely on strong device-based biometrics where available

    Biometrics tied to your physical device add a layer that criminals cannot easily replicate. Face and fingerprint authentication help block account takeovers driven by stolen identity data or AI-powered impersonation.

    7) Use strong antivirus software

    Reputable antivirus software helps detect malicious links, fake login pages and follow-up attacks that target breach victims. This adds protection against phishing and ransomware tied to identity-based scams.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    THIRD-PARTY BREACH EXPOSES CHATGPT ACCOUNT DETAILS

    8) Consider a data removal service

    Data brokers collect and resell personal information that can be combined with breach data to fuel targeted fraud. A data removal service reduces how much of your personal information is publicly available and lowers your exposure over time.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    A man uses a smartphone, illustrating the vulnerability of mobile devices in modern cybercrime.

    Experts warn this type of identity exposure can fuel fraud and scams for years after the breach is discovered. (Kurt ‘CyberGuy’ Knutsson)

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    9) Add an identity theft protection service

    Identity theft services monitor credit files, dark web markets and account activity for signs that your stolen data is being misused. Many also offer recovery assistance in the event of fraud, which can save time and stress when dealing with banks, credit bureaus and government agencies. This monitoring is especially useful after breaches like Marquis, where identity data can resurface long after the initial incident.

    See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

    10) Verify unexpected outreach through official channels

    Be cautious of urgent calls, emails or texts that reference real banking or personal details. Scammers now use accurate breach data to sound legitimate. Hang up and contact your bank directly using the number on your card or official website.

    11) Lock down tax and government accounts

    Create or secure online accounts with the IRS, Social Security Administration and your state tax agency. Enable strong authentication and monitor for unexpected notices. Stolen identity data is often used for tax refund fraud or benefit scams long after a breach.

    Kurt’s key takeaways 

    The Marquis data breach highlights how dangerous unpatched infrastructure vulnerabilities have become for the financial sector. When a single vendor holds data for hundreds of institutions, the fallout spreads quickly. For you, identity protection is no longer a one-time response. It is an ongoing necessity that can last years beyond the initial breach.

    What questions do you still have about protecting your identity after a major data breach like this one? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Password manager fined after major data breach

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Any data breach affecting 1.6 million people is serious. It draws even more attention when it involves a company trusted to guard passwords. That is exactly what happened to LastPass.

    The U.K. Information Commissioner’s Office has fined LastPass about $1.6 million for security failures tied to its 2022 breach. Regulators say those failures allowed a hacker to access a backup database and put users at risk.

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    CHECK IF YOUR PASSWORDS WERE STOLEN IN HUGE LEAK

    Why the LastPass breach still matters

    LastPass is one of the most widely used password managers in the world. It serves more than 20 million individual users and around 100,000 businesses. That popularity also makes it an attractive target for cybercriminals.

    The U.K. Information Commissioner’s Office fined LastPass for security failures tied to its 2022 breach. (LaylaBird/Getty Images)

    In 2022, LastPass confirmed that an unauthorized party accessed parts of its customer information through a third-party cloud storage service. While the incident initially raised alarms, the long-term impact has taken time to fully surface.

    The ICO now says the breach affected about 1.6 million U.K. users alone. That scope played a major role in the size of the fine.

    What regulators say went wrong

    According to the ICO, LastPass failed to put strong enough technical and security controls in place. Those gaps made it possible for attackers to reach a backup database that should have been better protected.

    The regulator added that LastPass promises to help people improve security, but failed to meet that expectation. As a result, users were left exposed even if their passwords were not directly cracked.

    Were passwords exposed or decrypted?

    There is still no evidence that attackers decrypted customer passwords. That point matters.

    Despite the breach, security experts continue to recommend password managers for most people. Storing unique, strong passwords in an encrypted vault is still far safer than reusing weak passwords across accounts.

    As one expert noted, modern breaches often succeed after identity access rather than password cracking alone. Once attackers get a foothold, the damage can spread quickly.

    Illustration of password login on laptop

    Although attackers accessed a backup database, there is no evidence that customer passwords were decrypted. (Kurt “CyberGuy” Knutsson)

    Why the LastPass fine is a wake-up call for cybersecurity

    The ICO called the LastPass fine a turning point. It reinforces the idea that security is about governance, staff training and supplier risk as much as software.

    Users have a right to expect that companies handling sensitive data take every reasonable step to protect it.

    Breaches may be inevitable, but weak safeguards are not.

    LastPass on the UK data breach

    We reached out to LastPass for comment on the UK fine, and a spokesperson provided CyberGuy with the following statement: 

    “We have been cooperating with the UK ICO since we first reported this incident to them back in 2022. While we are disappointed with the outcome, we are pleased to see that the ICO’s decision has recognized many of the efforts we have already taken to further strengthen our platform and enhance our data security measures. Our focus remains on delivering the best possible service to the 100,000 businesses and millions of individual consumers who continue to rely on LastPass.”

    MASSIVE DATA BREACH EXPOSES 184 MILLION PASSWORDS AND LOGINS

    How to protect yourself after a password manager breach

    Breaches like this are a reminder that security requires layers. No single tool can protect everything on its own.

    1) Use a strong password manager correctly

    Keep using a reputable password manager. Set a long, unique master password and enable two-factor authentication. Avoid reusing your master password anywhere else.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

    2) Rotate sensitive passwords

    Change passwords for financial accounts, email accounts and work logins. Focus on services that could cause real damage if compromised.

    3) Lock down your email

    Your email account is the key to password resets. Use a strong password, two-factor authentication and recovery options you control. 

    4) Reduce your exposed personal data

    Data brokers collect and sell personal information that criminals use for targeting. A data removal service can help reduce what is publicly available about you. While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    Woman Types on Laptop Computer

    The fine sends a warning to the entire cybersecurity industry. Companies that handle sensitive data must protect it with strong safeguards and oversight. (REUTERS/Andrew Kelly)

    5) Watch for phishing attempts and use strong antivirus software 

    After major breaches, scammers follow. Be cautious of emails claiming urgent account problems or asking for verification details. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    6) Keep devices updated

    Install updates for your operating system, browser and security tools. Many attacks rely on known vulnerabilities that updates already fix.

    Kurt’s key takeaways

    The fine against LastPass is about more than one company. It highlights how much trust we place in tools that manage our digital lives. Password managers remain a smart security choice. Still, this case shows why you should stay alert even when using trusted brands. Strong settings, regular reviews and layered protection matter more than ever. In the end, security works best when companies and we share the responsibility. Tools help, but habits and awareness finish the job.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Do you believe companies are doing enough to protect user data, or should regulators step in more often? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Smart home hacking fears: What’s real and what’s hype

    [ad_1]

    NEWYou can now listen to Fox News articles!

    News of more than 120,000 Korean home cameras being hacked recently can shake your confidence in connected devices. Stories like that make you picture cybercriminals breaking into homes with high-tech gadgets and spying on families through smart cams. That reaction is natural. But most of these headlines leave out important context that can help you breathe a little easier.

    First, smart home hacking is rare. Most incidents stem from weak passwords or from someone you already know, rather than from a stranger with advanced tools. Today’s smart home brands push out updates to block intrusion attempts, including patches for new AI-related vulnerabilities that often make headlines.

    Let’s break down what actually puts a smart home at risk and what you can do to stay safe.

    Sign up for my FREE CyberGuy Report

    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

    SMART HOME DEVICE MAKER EXPOSES 2.7 BILLION RECORDS IN HUGE DATA BREACH

    Smart home hacking headlines can look scary, but most threats come from weak passwords rather than targeted attacks. (Kurt “CyberGuy” Knutsson)

    Why criminals are not circling your house with hacking gear

    Many people imagine cybercriminals driving around neighborhoods with scanners that look for vulnerable devices. In reality, Wi-Fi ranges and technical limits make that nearly impossible. Even high-profile hacks of casinos and large companies do not translate to criminals trying to breach residential smart locks for petty theft.

    Burglars still choose low-tech methods. They look for unlocked doors or easy entry points. They avoid complicated hacking tools because the payoff is too small to justify the work.

    So how do smart homes get hacked? Here are the real attack paths and how they work.

    Common ways smart homes get attacked

    Smart homes face a handful of digital threats, but most come from broad automated attacks rather than someone targeting your house.

    1) Automated online attacks

    Bots constantly scan the internet for weak passwords and outdated logins. These brute force attacks throw billions of guesses at connected accounts. When one works, the device becomes part of a botnet used for future attacks. That doesn’t mean someone is targeting your home on purpose. Bots search for anything they can breach. A strong password stops them.

    2) Phishing attempts

    Some phishing emails impersonate smart home brands. Clicking a fake link or sharing login details can open the door for criminals to reach your network. Even a general phishing attack can expose your Wi-Fi info and lead to broader access.

    3) Data breaches from IoT companies

    Hackers often go after company servers, not individual homes. These breaches may expose account details or stored camera footage kept in the cloud. Criminals may sell that data to others who might try to use it. It rarely leads to direct smart home hacking, but it still puts your accounts at risk.

    4) Attacks on device communications

    Early IoT devices had vulnerabilities that allowed criminals to intercept the data they sent and received. (IoT stands for Internet of Things and includes everyday connected gadgets like smart plugs, smart thermostats or Wi-Fi cameras.) Modern products now use stronger encryption, making these attacks extremely rare in the real world.

    5) Bluetooth malware

    Bluetooth issues still pop up from time to time, but most modern smart home devices use stronger security than older models. When a new flaw is discovered, companies usually release fast patches, which is why it’s important to keep your apps and gadgets updated. Today, these Bluetooth risks rarely lead to real smart home problems.

    ADT HACKED: IS YOUR HOME SECURITY SYSTEM REALLY SECURE?

    Who actually tries to hack smart homes

    When hacking happens, it usually involves someone with some level of access already. In many cases, no technical hack occurs at all.

    Amazon Echo Show on kitchen counter

    Simple steps like stronger Wi-Fi security and regular updates go a long way toward protecting connected devices. ( Al Drago/Bloomberg via Getty Images)

    A relation or acquaintance

    Exes, former roommates or relatives often know login info. They may try to spy or cause trouble. Update all passwords if you suspect this.

    Untrustworthy employees

    There have been cases where employees at security companies snooped through camera feeds. This isn’t remote hacking. It’s a misuse of internal access.

    Data thieves

    They steal account lists and login details to sell. Others may buy those lists and try to log in using exposed credentials.

    Blackmail scammers

    Some send fake messages claiming they hacked your cameras and threaten you. Most of these scams rely on lies because they have no access at all.

    Foreign governments

    Some banned foreign manufacturers pose surveillance risks. The FCC maintains a list of companies that cannot sell security tech in the U.S. Always check that list before buying unfamiliar brands.

    Smart home devices that can raise concerns

    Some everyday gadgets create small but real entry points for trouble, especially when their settings or security features get overlooked.

    Smart fridges

    They often arrive with default passwords that owners forget to change. Older models may use outdated IoT protocols with weaker protections. Many do not get frequent security updates.

    Wi-Fi baby monitors

    Wi-Fi offers convenience but also adds risk. Weak routers and poor passwords can allow strangers to access a feed. Closed network monitors avoid Wi-Fi risks but still face basic signal interception attempts.

    Smart bulbs

    During setup, some bulbs broadcast an open temporary network. If a criminal joins at the exact right moment, they could reach the rest of your devices. These cases are rare but possible in theory.

    Smart speakers

    Voice ordering can be exploited by curious kids or guests. Set a purchase PIN so no one can order items with simple voice commands.

    Steps to stay safe in your smart home

    Strong habits and a few simple tools can block the most common threats that target connected homes.

    1) Use strong passwords

    Choose long, complex passwords for your Wi-Fi router and smart home apps. A password manager makes this simple. Consider using a password manager, which securely stores and generates complex passwords, reducing the risk of password reuse.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com

    2) Turn on two-factor authentication

    Brands like Ring and Blink already use it. Add two-factor authentication (2FA) to every account that supports it.

    3) Use a reputable data removal service

    Removing your personal details from data broker sites helps prevent criminals from using leaked or scraped information to access your accounts or identify your home.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    4) Add strong antivirus software on phones and computers

    Strong antivirus protection blocks malware that could expose login details or give criminals a path into the devices that manage your smart home. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    A gray Amazon Echo device on a dark wooden table

    Choosing brands with clear privacy practices and local storage options helps keep your home and data in your control. (CyberGuy.com)

    5) Choose brands with strong encryption

    Pick smart home products from companies that explain how they protect your data and use modern encryption to lock down your footage and account details. Look for brands that publish clear security policies, offer regular updates and show how they keep your information private.

    6) Store sensitive footage locally

    Pick security cameras that let you save video directly to an SD card or a home hub, rather than uploading it to the cloud. This keeps your recordings under your control (and helps protect them if a company server is breached). Many cameras from trusted lines support local storage, so you do not have to rely on a company server.

    7) Keep devices updated

    Install firmware updates quickly. Enable automatic updates when possible. Replace older gadgets that no longer receive patches.

    8) Secure your Wi-Fi

    Your router is the front door to your smart home, so lock it down with a few simple tweaks. Use WPA3 encryption if your router supports it, rename the default network, and install firmware updates to patch security holes. For a full step-by-step guide on tightening your home network, check out our instructions in “How to set up a home network like a pro.”

    Kurt’s key takeaways

    Smart homes feel intimidating when scary headlines surface. But when you look at real-world data, you see far fewer risks than the stories suggest. Most attacks rely on weak passwords, poor router settings or old devices. With the right habits, your smart home can stay both convenient and secure.

    What smart home risk concerns you most, and what part of your setup makes you nervous? Let us know by writing to us at Cyberguy.com

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter 

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Chinese hackers turned AI tools into an automated attack machine

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Cybersecurity has been reshaped by the rapid rise of advanced artificial intelligence tools, and recent incidents show just how quickly the threat landscape is shifting.

    Over the past year, we’ve seen a surge in attacks powered by AI models that can write code, scan networks and automate complex tasks. This capability has helped defenders, but it has also enabled attackers who are moving faster than before.

    The latest example is a major cyberespionage campaign conducted by a Chinese state-linked group that used Anthropic’s Claude to carry out large parts of an attack with very little human involvement.

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter 

    How Chinese hackers turned Claude into an automated attack machine

    In mid-September 2025, Anthropic investigators spotted unusual behavior that eventually revealed a coordinated and well-resourced campaign. The threat actor, assessed with high confidence as a Chinese state-sponsored group, had used Claude Code to target roughly thirty organizations worldwide. The list included major tech firms, financial institutions, chemical manufacturers and government bodies. A small number of those attempts resulted in successful breaches.

    HACKER EXPLOITS AI CHATBOT IN CYBERCRIME SPREE

    Claude handled most of the operation autonomously, triggering thousands of requests and generating detailed documentation of the attack for future use. (Kurt “CyberGuy” Knutsson)

    How the attackers bypassed Claude’s safeguards

    This was not a typical intrusion. The attackers built a framework that let Claude act as an autonomous operator. Instead of asking the model to help, they tasked it with executing most of the attack. Claude inspected systems, mapped out internal infrastructure and flagged databases worth targeting. The speed was unlike anything a human team could replicate.

    To get around Claude’s safety rules, the attackers broke their plan into tiny, innocent-looking steps. They also told the model it was part of a legitimate cybersecurity team performing defensive testing. Anthropic later noted that the attackers didn’t simply hand tasks to Claude; they engineered the operation to make the model believe it was performing authorized pentesting work, splitting the attack into harmless-looking pieces and using multiple jailbreak techniques to push past its safeguards. Once inside, Claude researched vulnerabilities, wrote custom exploits, harvested credentials and expanded access. It worked through these steps with little supervision and reported back only when it needed human approval for major decisions.

    The model also handled the data extraction. It collected sensitive information, sorted it by value and identified high-privilege accounts. It even created backdoors for future use. In the final stage, Claude generated detailed documentation of what it had done. This included stolen credentials, systems analyzed and notes that could guide future operations.

    Across the entire campaign, investigators estimate that Claude performed around eighty to ninety percent of the work. Human operators stepped in only a handful of times. At its peak, the AI triggered thousands of requests, often multiple per second, a pace still far beyond what any human team could achieve. Although it occasionally hallucinated credentials or misread public data as secret, those errors underscored that fully autonomous cyberattacks still face limitations, even when an AI model handles the majority of the work.

    Why this AI-powered Claude attack is a turning point for cybersecurity

    This campaign shows how much the barrier to high-end cyberattacks has dropped. A group with far fewer resources could now attempt something similar by leaning on an autonomous AI agent to do the heavy lifting. Tasks that once required years of expertise can now be automated by a model that understands context, writes code and uses external tools without direct oversight.

    Earlier incidents documented AI misuse, but humans were still steering every step. This case is different. The attackers needed very little involvement once the system was in motion. And while the investigation focused on usage within Claude, researchers believe similar activity is happening across other advanced models, which might include Google Gemini, OpenAI’s ChatGPT or Musk’s Grok.

    This raises a difficult question. If these systems can be misused so easily, why continue building them? According to researchers, the same capabilities that make AI dangerous are also what make it essential for defense. During this incident, Anthropic’s own team used Claude to analyze the flood of logs, signals and data their investigation uncovered. That level of support will matter even more as threats grow.

    We reached out to Anthropic for comment, but did not hear back before our deadline.

    Chinese hackers target US telecoms: What you need to know to protect your data

    Hackers used Claude to map networks, scan systems, and identify high-value databases in a fraction of the time human attackers would need. (Kurt “CyberGuy” Knutsson)

    FORMER GOOGLE CEO WARNS AI SYSTEMS CAN BE HACKED TO BECOME EXTREMELY DANGEROUS WEAPONS

    You may not be the direct target of a state-sponsored campaign, but many of the same techniques trickle down to everyday scams, credential theft and account takeovers. Here are seven detailed steps you can take to stay safer.

    1) Use strong antivirus software and keep it updated

    Strong antivirus software does more than scan for known malware. It looks for suspicious patterns, blocked connections and abnormal system behavior. This is important because AI-driven attacks can generate new code quickly, which means traditional signature-based detection is no longer enough.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    2) Rely on a password manager

    A good password manager helps you create long, random passwords for every service you use. This matters because AI can generate and test password variations at high speed. Using the same password across accounts can turn a single leak into a full compromise.

    Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com

    3) Consider using a personal data removal service

    A large part of modern cyberattacks begins with publicly available information. Attackers often gather email addresses, phone numbers, old passwords and personal details from data broker sites. AI tools make this even easier, since they can scrape and analyze huge datasets in seconds. A personal data removal service helps clear your information from these broker sites so you are harder to profile or target.

    FAKE CHATGPT APPS ARE HIJACKING YOUR PHONE WITHOUT YOU KNOWING

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    4) Turn on two-factor authentication wherever possible

    Strong passwords alone are not enough when attackers can steal credentials through malware, phishing pages or automated scripts. Two-factor authentication adds a serious roadblock. Use app-based codes or hardware keys instead of SMS. While no method is perfect, this extra layer often stops unauthorized logins even when attackers have your password.

    5) Keep your devices and apps fully updated

    Attackers rely heavily on known vulnerabilities that people forget or ignore. System updates patch these flaws and close off entry points that attackers use to break in. Enable automatic updates on your phone, laptop, router and the apps you use most. If an update looks optional, treat it as important anyway, because many companies downplay security fixes in their release notes.

    6) Install apps only from trusted sources

    Malicious apps are one of the easiest ways attackers get inside your device. Stick to official app stores and avoid APK sites, shady download portals and random links shared on messaging apps. Even on official stores, check reviews, download counts and the developer name before installing anything. Grant the minimum permissions required and avoid apps that ask for full access for no clear reason.

    7) Ignore suspicious texts, emails, and pop-ups

    AI tools have made phishing more convincing. Attackers can generate clean messages, imitate writing styles, and craft perfect fake websites that match the real ones. Slow down when a message feels urgent or unexpected. Never click links from unknown senders, and verify requests from known contacts through a separate channel. If a pop-up claims your device is infected or your bank account is locked, close it and check directly through the official website.

    woman using phone

    By breaking tasks into small, harmless-looking steps, the threat actors tricked Claude into writing exploits, harvesting credentials, and expanding access.  (Kurt “CyberGuy” Knutsson)

    Kurt’s key takeaway

    The attack carried out through Claude signals a major shift in how cyber threats will evolve. Autonomous AI agents can already perform complex tasks at speeds no human team can match, and this gap will only widen as models improve. Security teams now need to treat AI as a core part of their defensive toolkit, not a future add-on. Better threat detection, stronger safeguards and more sharing across the industry are going to be crucial. Because if attackers are already using AI at this scale, the window to prepare is shrinking fast.

    Should governments push for stricter regulations on advanced AI tools? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • America’s most-used password in 2025 revealed

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Passwords play a huge role in how you stay safe online. They protect your accounts, devices and money. Still, many people pick logins that criminals can guess in seconds. 

    The latest NordPass report shows this problem again. This year, “admin” took the top spot as the most common password in the United States.

    NordPass and NordStellar, two cybersecurity companies that track leaked credentials and online threats, reviewed millions of exposed passwords to spot trends. They also examined how password habits differ across generations. The pattern is clear: many of us still rely on simple words, easy number strings and familiar keyboard patterns. These choices give attackers a quick path into countless accounts.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    183 MILLION EMAIL PASSWORDS LEAKED: CHECK YOURS NOW

    Weak passwords like “admin” give attackers a quick way into your accounts before you even realize it.  (Kurt “CyberGuy” Knutsson)

    Most common passwords in the United States

    NordPass shared its top 20 list for 2025. “Admin” sits at number one. Variations of the word “password” take up five spots. Number strings appear nine times. One explicit term even made the list.

    Here are the 20 most common passwords in the USA this year:

    • admin
    • password
    • 123456
    • 12345678
    • 123456789
    • 12345
    • Password
    • 12345678910
    • Gmail.12345
    • Password1
    • Aa123456
    • f*******t
    • 1234567890
    • abc123
    • Welcome1
    • Password1!
    • password1
    • 1234567
    • 111111
    • 123123

    Weak logins remain a major problem because criminals rely on automated tools. These tools try simple words and common patterns first. When millions of people reuse the same easy passwords, attackers succeed fast.

    HOW TO USE PASSKEYS TO KEEP YOUR COMPUTER SAFE

    Reusing the same login across sites makes it easy for criminals to jump from one hacked account to another.

    Reusing the same login across sites makes it easy for criminals to jump from one hacked account to another. (Kurt “CyberGuy” Knutsson)

    Global trends show the same risky password behavior

    The United States is not alone. Globally, “123456” ranks as the most common password. “Admin” and “12345678” follow closely behind. These patterns appear because they are easy to remember. Sadly, they are also easy to crack.

    Researchers noticed one shift worth noting: more passwords now include special characters. The increase is sharp. However, most examples remain weak. Strings like P@ssw0rd and Abcd@1234 still follow predictable rules that tools can break with little effort.

    The word “password” stays popular around the world. People even use it in local languages. This shows how widespread the problem is.

    Why younger generations still make unsafe password choices

    Many people assume younger adults understand digital safety. They grew up with phones and social media. Research shows that this assumption is wrong.

    NordPass found that an 18-year-old often picks the same weak password patterns as an 80-year-old. Younger users favor long number sequences. Older users lean toward names. Neither group creates secure or random strings. Generations Z and Y tend to avoid names. Generations X and older use them often. Each approach carries risk because attackers expect both patterns.

    AI-POWERED SCAMS TARGET KIDS WHILE PARENTS STAY SILENT

    Researchers found that weak and predictable passwords still appear in leaked data again and again.

    Researchers found that weak and predictable passwords still appear in leaked data again and again. (Kurt “CyberGuy” Knutsson)

    Why weak passwords remain a big threat

    Weak passwords fuel data breaches and account takeovers. Criminals run scripts that check billions of combinations every second. When your password is common, they break in fast.

    A single stolen login can expose your email, social accounts, bank information and more. Many attacks start this way. Once criminals get inside one account, they often try the same password on others.

    Steps to stay safe with your passwords 

    You can improve your digital safety with a few simple habits. These steps help block common attacks and protect your accounts.

    1) Create strong random passwords

    Pick long passwords or short passphrases. Aim for at least 20 characters. Mix letters, numbers and special characters. Avoid patterns. 

    2) Avoid password reuse

    Use a unique password for each account. If one login gets hacked, the others stay safe.

    3) Review and update weak passwords

    Check your old logins. Replace anything short, predictable or reused. Fresh passwords lower your risk.

    4) Use a password manager

    A password manager creates secure passwords and stores them safely. It also fills them in for you, so you do not need to remember them.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

    5) Turn on multi-factor authentication (MFA)

    MFA adds a second check before you log in. It is one of the easiest ways to block attackers.

    6) Keep your software updated

    Update your phone, computer browsers and apps on a regular schedule. These updates patch security gaps that criminals try to exploit. When you fall behind on updates, weak passwords become even riskier because attackers can pair old software flaws with easy logins.

    Pro Tip: Use a data removal service

    Leaked passwords often come from old profiles on data broker sites you forgot about. A data removal service can wipe your personal info from those sites and reduce how much of your data ends up on breach lists. When less of your information is floating around online, your accounts become less tempting targets.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Kurt’s key takeaways 

    Weak passwords remain a huge issue in 2025, even with new tools and better education. You have the power to improve your security with a few quick changes. When you build strong habits, you make it harder for criminals to get inside your accounts. Small steps add up fast and give you far more protection online.

    What do you think keeps people stuck on weak passwords even when the risks are clear? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • New Android malware can empty your bank account in seconds

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Android users have been dealing with a steady rise in financial malware for years. Threats like Hydra, Anatsa and Octo have shown how attackers can take over a phone, read everything on the screen and drain accounts before you even notice anything wrong. Security updates have helped slow some of these strains, but malware authors keep adapting with new tricks. 

    The latest variant spotted in circulation is one of the most capable yet. It can silence your phone, take screenshots of banking apps, read clipboard entries, and even automate crypto wallet transactions. This threat is now known as Android BankBot YNRK, and it is far more advanced than typical mobile malware.

    Sign up for my FREE CyberGuy ReportGet my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

    How the malware infiltrates devices

    HOW ANDROID MALWARE LETS THIEVES ACCESS YOUR ATM CASH

    Android banking malware is getting harder to spot as attackers use new tricks to take over phones and drain accounts. (Thomas Trutschel/Photothek via Getty Images)

    BankBot YNRK hides inside fake Android apps that appear legitimate when installed. In the samples analyzed by researchers at Cyfirma, the attackers used apps that impersonated official digital ID tools. Once installed, the malware begins profiling the device by collecting details such as brand, model and installed apps. It checks whether the device is an emulator to avoid automated security analysis. It also maps known models to screen resolutions, which helps it tailor its behavior to specific phones.

    To blend in, the malware can disguise itself as Google News. It does this by changing its app name and icon, then loading the real news.google.com site inside a WebView. While the victim believes the app is genuine, the malware quietly runs its background services.

    One of its first actions is to mute audio and notification alerts. This prevents victims from hearing incoming messages, alarms or calls that could signal unusual account activity. It then requests access to Accessibility Services. If granted, this allows the malware to interact with the device interface just like a user. From that point onward, it can press buttons, scroll through screens and read everything displayed on the device.

    BankBot YNRK also adds itself as a Device Administrator app. This makes it harder to remove and helps it restart itself after a reboot. To maintain long-term access, it schedules recurring background jobs that relaunch the malware every few seconds as long as the phone is connected to the internet.

    What does the malware steal

    Once the malware receives commands from its remote server, it gains near-complete control of the phone. It sends device information and installed app lists to the attackers, then receives a list of financial apps it should target. This list includes major banking apps used in Vietnam, Malaysia, Indonesia and India, along with several global cryptocurrency wallets.

    With Accessibility permissions enabled, the malware can read everything shown on the screen. It captures UI metadata such as text, view IDs and button positions. This helps it reconstruct a simplified version of any app’s interface. Using this data, it can enter login details, swipe through menus or confirm transfers. It can also set text inside fields, install or remove apps, take photos, send SMS, turn call forwarding on and open banking apps in the background while the screen appears inactive.

    In cryptocurrency wallets, the malware acts like an automated bot. It can open apps such as Exodus or MetaMask, read balances and seed phrases, dismiss biometric prompts, and carry out transactions. Because all actions happen through Accessibility, the attacker never needs your passwords or PINs. Anything visible on the screen is enough.

    The malware also monitors the clipboard, so if users copy OTPs, account numbers or crypto keys, the data is immediately sent to the attackers. With call forwarding enabled, incoming bank verification calls can be silently redirected. All of these actions happen within seconds of the malware activating.

    Google search

    BankBot YNRK hides inside fake apps that look legitimate, then disguises itself as Google News while it runs in the background. (AP Photo/Don Ryan, File)

    7 steps you can take to stay safe from banking malware

    Banking trojans are getting harder to spot, but a few simple habits can reduce the chances of your phone getting compromised. Here are seven practical steps that help you stay protected. 

    FBI WARNS OVER 1 MILLION ANDROID DEVICES HIJACKED BY MALWARE

    1) Install strong antivirus software

    Strong antivirus software helps catch trouble early by spotting suspicious behavior before it harms your Android device or exposes your data. It checks apps as you install them, alerts you to risky permissions and blocks known malware threats. Many top antivirus options also scan links and messages for danger, which adds an important layer of protection when scams move fast.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    2) Use a data-removal service to shrink your digital footprint

    Data brokers quietly collect and sell your personal details, which helps scammers target you with more convincing attacks. A reputable data-removal service can find and delete your information from dozens of sites so that criminals have less to work with. This reduces spam, phishing attempts and the chances of ending up on a malware attack list.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    3) Install apps only from trusted sources

    Avoid downloading APKs from random websites, forwarded messages or social media posts. Most banking malware spreads through sideloaded apps that look official but contain hidden code. The Play Store is not perfect, but it offers scanning, app verification and regular take-downs that greatly reduce the risk of installing infected apps.

    4) Keep your device and apps updated

    System updates often patch security issues that attackers exploit to bypass protections. Updating your apps is just as important, since outdated versions may contain weaknesses. Turn on automatic updates so that your device stays protected without you having to check manually.

    5) Use a strong password manager

    A password manager helps you create long, unique passwords for every account. It also saves you from typing passwords directly into apps, which reduces the chance of malware capturing them from your clipboard or keystrokes. If one password gets exposed, the rest of your accounts remain safe.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    man working on cellphone

    Once active, the malware can read your screen, steal financial data, automate crypto transfers and intercept OTPs within seconds. (Kurt “CyberGuy” Knutsson)

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com

    6) Enable two-factor authentication wherever possible

    2FA adds a confirmation step through an OTP, authenticator app or hardware key. Even if attackers steal your login details, they still need this second step to get in. It cannot stop malware that takes over your device, but it significantly limits how far an attacker can go with stolen credentials.

    GOOGLE ISSUES WARNING ON FAKE VPN APPS

    7) Review app permissions and installed apps regularly

    Malware often abuses permissions such as Accessibility or Device Admin because they allow deep control over your phone. Check your settings to see which apps have these permissions and remove anything that looks unfamiliar. Also, look through your installed apps and uninstall any tool or service you do not remember adding. Regular reviews help you spot threats early before they can steal data.

    Kurt’s key takeaway

    BankBot YNRK is one of the most capable Android banking threats discovered recently. It combines device profiling, strong persistence, UI automation and data theft to gain full control over a victim’s financial apps. Because much of its activity relies on Accessibility permissions, a single tap from the user can give attackers complete access. Staying safe means avoiding unofficial APKs, reviewing installed apps regularly and being cautious of any sudden request to enable special permissions.

    Do you think Android phone makers like Samsung or Google are doing enough to protect you from malware? Let us know by writing to us at Cyberguy.com

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • New scam sends fake Microsoft 365 login pages

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Attackers have a new tool that targets Microsoft 365 users at a massive scale. 

    Security researchers say a phishing platform called Quantum Route Redirect, or QRR, is behind a growing wave of fake login pages hosted on nearly 1,000 domains. These pages look real enough to fool many users while also slipping past some automated scanners.

    QRR runs realistic email lures that mimic DocuSign requests, payment notices, voicemail alerts or QR-code prompts. Each message routes victims to a fake Microsoft 365 login page built to harvest usernames and passwords. The kit often lives on parked or compromised legitimate domains that add a false sense of safety for anyone who clicks.

    Researchers tracked QRR in 90 countries. About 76% of attacks hit US users. That scale makes QRR one of the largest phishing operations active right now.

    WINDOWS 10 USERS FACE RANSOMWARE NIGHTMARE AS MICROSOFT SUPPORT ENDS IN 2025 WORLDWIDE

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Attackers use fake Microsoft security alerts to trick people into entering their Microsoft 365 passwords. (Chona Kasinger/Bloomberg via Getty Images)

    A fast follow to other major Microsoft credential attacks

    QRR appeared soon after Microsoft disrupted a major phishing network known as RaccoonO365. That service sold ready-made Microsoft login copies used to steal more than 5,000 sets of credentials, including accounts tied to over 20 US healthcare organizations. Subscribers paid as little as $12 a day to send thousands of phishing emails.

    Microsoft’s Digital Crimes Unit later shut down 338 related websites and identified Joshua Ogundipe from Nigeria as the operator. Investigators tied him to the phishing code and a crypto wallet that earned more than $100,000. Microsoft and Health-ISAC have since filed a lawsuit in New York that accuses him of multiple cybercrime violations.

    Other recent examples include kits like VoidProxy, Darcula, Morphing Meerkat and Tycoon2FA. QRR builds on these tools with automation, bot filtering and a dashboard that helps attackers run large campaigns fast.

    What makes QRR so effective

    QRR uses about 1,000 domains. Many are real sites that were parked or compromised, which helps the pages pass as legitimate. The URLs also follow a predictable pattern that can look normal to users at a glance.

    The kit includes automated filtering that detects bots. It sends scanners to harmless pages and sends real people to the credential-harvesting site. Attackers can manage campaigns inside a control panel that logs traffic and activity. These features let them scale up quickly without technical skill.

    Security analysts say organizations can no longer depend on URL scanning alone. Layered defenses and behavioral analysis have become essential for spotting threats that use domain rotation and automated evasion.

    Microsoft was contacted by CyberGuy for comment but did not have anything to add at this time.

    HACKERS FIND A WAY AROUND BUILT-IN WINDOWS PROTECTIONS

    Why this matters for Microsoft 365 users

    When attackers get your Microsoft 365 login, they can see your email, grab files and even send new phishing messages that look like they came from you. That can create a chain reaction that spreads fast. This is why the steps below all work together to block these threats before they turn into something bigger.

    Steps to stay safe from QRR and other Microsoft 365 phishing attacks

    Use these simple actions to shrink the risk from fake Microsoft 365 pages and look-alike emails.

    1) Check the sender before you click

    Take a second to look at who the email is really from. A slight misspelling, an unexpected attachment or wording that feels off is a big clue the message may be fake. 

    2) Hover over links first

    Before you open any link, hover your mouse over it to preview the URL. If it does not lead to the official Microsoft login page or looks odd in any way, skip it.

    3) Turn on multifactor authentication (MFA)

    MFA adds an extra layer adds an extra layer that makes it much harder for attackers to break in even if they have your password. Use options like app-based codes or hardware keys so phishing kits cannot bypass them.

    4) Use a data removal service

    Attackers often gather personal details from data broker sites to craft convincing phishing emails. A trusted data removal service scrubs your information from these sites, which cuts down on targeted scams and makes it harder for criminals to tailor fake Microsoft alerts that look real.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Woman typing on microsoft computer.

    QRR hides its phishing pages across nearly 1,000 domains, making the fake login screens look convincing at first glance. (Microsoft)

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    5) Update your browser and apps

    Keep everything on your device up to date. Updates seal off security holes that attackers often rely on when building phishing kits like QRR.

    6) Never click unknown links and use strong antivirus software

    If you need to visit a sensitive site, type the address into your browser instead of tapping a link. Strong antivirus tools also help by warning you about fake websites and blocking scripts that phishing kits use to steal login details.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    MICROSOFT SOUNDS ALARM AS HACKERS TURN TEAMS PLATFORM INTO ‘REAL-WORLD DANGERS’ FOR USERS

    7) Use advanced spam filtering

    Most email providers offer stronger filtering settings that block risky messages before they reach you. Turn on the highest level your account allows to keep more fake Microsoft alerts out of your inbox.

    8) Watch for login alerts

    Turn on Microsoft account sign-in notifications so you get an alert anytime someone tries to access your account. To do this, sign in to your Microsoft account online, open Security, choose Advanced security options and switch on Sign-in alerts for any suspicious activity.

    Microsoft Surface laptop computers in 2017

    Strong sign-in alerts and phishing-resistant MFA help block these scams before criminals can take over your account.  (Drew Angerer/Getty Images)

    Kurt’s key takeaways

    QRR is a reminder of how quickly scammers change their tactics. Tools like this make it easy for criminals to send huge waves of fake Microsoft emails that look real at first glance. The good news is that a few smart habits can put you a step ahead. When you add stronger sign-in protection, turn on alerts and stay aware of the newest tricks, you make it much harder for attackers to sneak in.

    Do you think most people can tell the difference between a real Microsoft login page and a fake one, or have phishing kits become too convincing? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • How Android malware lets thieves access your ATM cash

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Smartphone banking has made life easier, but it has also opened new opportunities for cybercriminals.

    Over the past few years, we have seen Android malware steal passwords, intercept OTPs and even take remote control of phones to drain accounts. Some scams focus on fake banking apps, while others rely on phishing messages that trick you into entering sensitive details.

    Security researchers have now discovered a new threat that goes a step further. Instead of simply stealing login information, this malware gives thieves the ability to walk up to an ATM and withdraw your money in real time.

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Android malware like NGate tricks users into downloading fake banking apps that steal sensitive data. (Kurt “CyberGuy” Knutsson)

    How the NGate malware works

    The Polish Computer Emergency Response Team (CERT Polska) discovered a new Android malware called NGate that uses NFC activity to access a victim’s bank account. This malware monitors contactless payment actions on the victim’s phone and forwards all transaction data, including the PIN, directly to a server controlled by attackers. It does not just copy card details. Instead, it waits until the victim taps to pay or performs a verification step, then captures the fresh, one-time authentication codes that modern Visa and Mastercard chips generate.

    To pull this off, attackers need to infect the phone first. They typically send phishing messages claiming there is a security problem with the victim’s bank account. These messages often push people to download a fake banking app from a non-official source. Once the victim installs it, the app walks them through fake verification prompts and requests permissions that allow it to read NFC activity. As soon as the victim taps their phone or enters their PIN, the malware captures everything the ATM needs to validate a withdrawal.

    MANAGE ANDROID APPS WITH THE NEW ‘UNINSTALL’ BUTTON

    A Google phone

    Once installed, the malware captures NFC tap-to-pay codes and PINs the moment the victim uses their phone. (Kurt “CyberGuy” Knutsson)

    What attackers do with the stolen data at the ATM

    The attackers rely on speed. The one-time codes generated during an NFC transaction are valid for only a short period. As soon as the infected phone captures the data, the information is uploaded to the attacker’s server. An accomplice waits near an ATM, holding a device capable of emulating a contactless card. This could be another phone, a smartwatch or custom NFC hardware.

    When the data arrives, the accomplice presents the card-emulating device at the ATM. Since the information contains fresh, valid authentication codes and the correct PIN, the machine treats it like a real card. The ATM authorizes the withdrawal because everything appears to match a legitimate transaction. All of this happens without the criminal ever touching the victim’s physical card. Everything depends on timing, planning and getting the victim to unknowingly complete the transaction on their own phone.

    A man holds a Google phone, powered by Android

    Criminals use the stolen, time-limited codes at an ATM to make real withdrawals without the victim’s card. (Kurt “CyberGuy” Knutsson)

    7 steps you can take to stay safe from Android NGate malware

    As attacks like NGate become more sophisticated, staying safe comes down to a mix of good digital habits and a few simple tools that protect your phone and your financial data.

    1) Download apps only from the Play Store

    Most malicious banking apps spread through direct links sent in texts or emails. These links lead to APK files hosted on random servers. When you install apps only from the Play Store, you get Google’s built-in security checks. Play Protect regularly scans apps for malware and removes harmful ones from your device. However, it is important to note that Google Play Protect may not be enough. Historically, it isn’t 100% foolproof at removing all known malware from Android devices. Even if attackers send convincing messages, avoid installing anything from outside the official store. If your bank wants you to update an app, you will always find it on the Play Store.

    2) Use strong antivirus software

    One careless tap on a fake bank alert can hand criminals everything they need. Strong antivirus software can stop most threats before they cause damage. It scans new downloads, blocks unsafe links and alerts you when an app behaves in ways that could expose your financial data. Many threats like NGate rely on fake banking apps, so having real-time scanning turned on gives you an early warning if something suspicious tries to install itself.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    ATM ‘JACKPOTTING’ CRIME WAVE GROWS AFTER THIEVES WALK AWAY WITH HUNDREDS OF THOUSANDS IN CASH

    3) Keep your device and apps updated

    Security patches fix vulnerabilities that attackers use to hijack permission settings or read sensitive data. Updates also improve how Android monitors NFC and payment activity. Turn on automatic updates for both the operating system and apps, especially banking and payment apps. A fully updated device closes many of the holes that malware tries to exploit.

    4) Use a password manager to avoid phishing traps

    Phishing attacks often direct you to fake websites or fake app login pages that look identical to the real thing. A password manager saves your credentials and fills them in only when the website or app is authentic. If it refuses to autofill, it is a clear sign that you are on a fake page. Consider using a password manager to generate and store complex passwords.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

    5) Turn on two-factor authentication for all financial services

    Two-factor authentication gives you a second layer of protection, even if your password is compromised. App-based authenticators are more secure than SMS codes because they cannot be intercepted as easily. For banking apps, enabling 2FA adds friction for attackers trying to perform unauthorized actions. Combined with strong passwords from a password manager, it significantly reduces the chance of account takeover.

    6) Ignore suspicious texts, emails and calls

    Attackers rely on urgency to trick you. They often claim that your card is blocked, your account is frozen or a payment needs verification. These messages push you to act fast and install a fake app. Always pause and check your bank’s official channels. Contact the bank through verified customer care numbers or the official app. Never click links or open attachments in unsolicited messages, even if they look legitimate.

    7) Review app permissions

    Most people install apps and forget about them. Over time, unused apps pile up with unnecessary permissions that increase risk. Open your phone’s permission settings and check what each app can access. If a simple tool asks for access to NFC, messages or accessibility features, uninstall it. Attackers exploit these excessive permissions to monitor your activity or capture data without your knowledge.

    Kurt’s key takeaway

    Cybercriminals are now combining social engineering with the secure hardware features inside modern payment systems. The malware does not break NFC security. Instead, it tricks you into performing a real transaction and steals the one-time codes at that moment. This makes the attack difficult to spot and even harder to reverse once the withdrawal goes through. The best defense is simple awareness. If a bank ever urges you to download an app from outside the Play Store, treat it as an immediate warning sign. Keeping your phone clean is now as important as keeping your physical card safe.

    Have you ever downloaded an app from outside the Play Store? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • DoorDash breach exposes contact info for customers and workers

    [ad_1]

    NEWYou can now listen to Fox News articles!

    DoorDash confirmed a data breach that exposed personal details for a mix of customers, delivery workers and merchants. The stolen information included names, email addresses, phone numbers and physical addresses. The company said it has no evidence of fraud tied to the breach so far, but the event still raises concerns for anyone who uses the service.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    DoorDash says an employee fell for a social engineering scam that let an unauthorized party access basic contact information. (DoorDash)

    How the DoorDash breach happened

    The company traced the incident back to a social engineering attack. An employee fell for a lure that gave hackers access to DoorDash systems. Once the company spotted the breach, it shut down access, launched an investigation and notified law enforcement. DoorDash also directly notified users where required.

    DoorDash driver

    The company confirmed the incident exposed names, email addresses, phone numbers and physical addresses for some people in its system. (DoorDash)

    Who was affected by the DoorDash breach

    DoorDash said the breach impacted a mix of users across its platform. That includes customers, delivery workers and merchants. CyberGuy reached out to DoorDash and a representative provided the following statement to us:

    “DoorDash recently identified and shut down a cybersecurity incident in which an unauthorized third party gained access to and took basic contact information for some users whose data is maintained by DoorDash. No sensitive information, such as Social Security numbers or other government-issued identification numbers, driver’s license information, or bank or payment card information, was accessed. The information accessed varied by individual and was limited to names, phone numbers, email addresses, and physical addresses. We have deployed enhanced security measures, implemented additional employee training, and engaged an external cybersecurity firm to support our ongoing investigation. For more information, please visit our Help Center.”

    LOOKING FOR A CHEAP CHEESEBURGER? 10 AMERICAN CITIES THAT DELIVER THE BEST MEAL DEALS

    If you received an alert from the company, take steps to protect your information. If you use the app but did not get a notice, you should still follow the safety tips below because exposed contact information can lead to scams long after a breach.

    DoorDash delivery person

    DoorDash says no sensitive information was accessed and investigators found no signs of fraud or identity theft tied to the breach. (DoorDash)

    How to protect yourself after the DoorDash breach

    Even though payment data stayed protected, exposed contact details can still open the door to scams. You can lower your risk with a few smart steps that keep your information safer online.

    1) Watch for phishing attempts

    Scammers move fast after a breach. They often send fake alerts that look like real DoorDash messages. These emails or texts may claim you need to verify your account or update your payment details. Delete any message that asks for personal information or urges you to click a link. When in doubt, go straight to the official app instead of trusting a message.

    2) Use a data removal service

    Data brokers collect and resell personal details that scammers often exploit. A data removal service works to pull your information off those sites. This limits your exposure and makes it harder for criminals to target you. It is one of the easiest long-term steps you can take to protect your privacy.

    IS YOUR PHONE HACKED? HOW TO TELL AND WHAT TO DO

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    3) Use strong passwords and a password manager

    Stronger passwords give you better protection. Create unique passwords for every account so one breach cannot unlock your digital life. A password manager makes this easier by generating secure passwords and storing them safely. It also autofills them, so you spend less time typing.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

    4) Turn on multi-factor authentication

    Multi-factor authentication (MFA) adds a simple barrier that blocks most break-in attempts. When you turn it on, you confirm each login with a code or app prompt. This keeps your account safe even if someone learns your password. Most major apps let you enable this setting in the Security section.

    5) Use strong antivirus protection

    Strong antivirus software shields you from malicious links and downloads. It scans files in real time and warns you when something looks dangerous. This gives you an extra layer of defense against phishing attempts that try to install malware.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    6) Review your account activity

    It helps to check your DoorDash account for anything unusual. Look at your order history, saved addresses and payment methods. If something looks off, update your password and contact DoorDash support right away. Quick action can stop a small issue from turning into a bigger problem. 

    Kurt’s key takeaways

    A breach like this reminds us how quickly cybercriminals can exploit a single mistake. DoorDash moved fast to cut off access and confirm the damage, but exposed contact information can still create risks. Staying alert and using basic security habits can help you avoid trouble.

    CLICK HERE TO GET THE FOX NEWS APP

    What concerns you most about companies holding your personal information, and how would you like them to handle incidents like this? Let us know by writing to us at Cyberguy.com

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link