As Google continues to ramp up pressure on ad blocking methods like browser extensions and VPNs, the cat-and-mouse game between the blockers and Mountain View has grown in breadth and complexity.

What are the best ways to block ads on YouTube?

First, we should establish the two platforms you can access YouTube on: mobile and desktop.

If you’re accessing YouTube via desktop, you have several options to block YouTube ads including web browser extensions and VPNs.

Meanwhile, if you access YouTube through the mobile app, your only effective ad blocking method will be a VPN. But those results may be spotty, as we’ll get into later.

How can you block ads on desktop YouTube?

The fastest, and generally most reliable way to block ads on YouTube while browsing on your desktop is to use an extension that’s embedded in your web browser.

The two most popular options at the time of this writing are AdBlock Plus, and uBlock Origin, however the latter comes with a catch. Since uBlock has proven incredibly effective at getting around Google’s efforts to show ads on desktop YouTube, the company has disabled access to the extension entirely if you’re trying to install it on a Google Chrome browser.

That said, ABP is still available on Chrome as of this writing, and is just as effective in most instances. You can also continue to use uBlock Origin on alternative browsers, such as Firefox, Microsoft Edge, and Opera.

The second method of blocking ads on YouTube using your desktop is to install a virtual private network, or VPN.

VPNs come in many shapes and sizes, at every price point from free, up to around $15 per month. And while most of the top options in the category, like NordVPN, Surfshark VPN, and Windscribe VPN, all have ad blockers built in, dozens of others don’t.

This is why we suggest carefully reviewing the feature list of your preferred VPN before committing to a subscription, to ensure the service offers some level of ad blocking on its network. This issue is further compounded by the fact that even though your VPN may offer an ad blocker, the only way to find out if it will successfully block a YouTube ad (some do, some don’t) is to try the service out for yourself.

If you’re worried about compatibility, some VPNs offer a short trial period that allows you to test the service ahead of time. Most also support a 30- to 90-day money-back guarantee in case the VPN doesn’t perform as expected.

How can you block ads on mobile YouTube?

As mentioned earlier, the primary method for blocking YouTube in the mobile app is via a VPN.

Because the YouTube app is developed and maintained directly by Google, there’s no way to install an extension on top of the app that could capably block ads.

Previously, there had been a number of third-party ad blocking apps that were available on iOS and Android, but since Google's latest crackdown users have reported that most of them have lost all functionality.

Mobile VPNs, meanwhile, take control of the internet pipe for the entire device. This means it can filter out certain types of traffic, including ads, before they’re delivered to your device through the YouTube app.

However, a word of caution. As spotty as ad blocking can be for VPNs on desktops, it’s even spottier on mobile. Due to limitations on what parts of your device the VPN can access, especially on iOS, the success rates for VPN-based ad blocking are even lower than on desktop. Once again, the only way to find out if VPN ad blocking will work for your device, in your region, is to sign up for a subscription and try it out yourself.

Which VPNs are best for blocking ads?

As we’ve said, no VPN is ever a 100% surefire method for getting around Google’s ads on the YouTube platform. That said, a rule of thumb in the VPN space is, generally, “bigger = better.”

This means the larger a VPN company is, the more resources it will have to bolster its ad blocking efforts while also adding more features alongside ad blocking that make for a more holistic online privacy experience.

At LaptopMag, we’re especially partial to some of the biggest names in the game including NordVPN and Surfshark VPN. Both VPNs are deeply rich in features (including ad blocking), and also support massive global networks of servers.

The more servers the VPN supports, the more likely you are to find an option that’s close to you. The closer a VPN server is, the faster it will be, and the higher your bandwidth stays while doing everything from streaming videos on YouTube or Netflix, to gaming, and more.

Right now NordVPN is running a special deal for new subscribers, and you can click here to find out more about the money you might save on your next VPN!

MORE FROM LAPTOP MAG

• ROG Ally X vs. Xbox Ally X: Real differences or clever rebranding?
• Cheap laptops aren't always a great value — here are 3 budget laptops I love
• Microsoft just threw Windows 10 users a free lifeline — but it could test your loyalty

Android malware remains a massive danger in 2025, with a June 5 mobile threat report from Kaspersky revealing that 12.1 million attacks were conducted on Android devices running Kaspersky software between January and March 2025.

Now, considering that number doesn't include the majority of the world's 3.3 billion Android OS devices that aren't using Kaspersky, you get an idea of the scale of this concern.

Trojans were the most common threat, accounting for 40% of the total malware infections. Trojans are viruses that trick you into installing them on your phone to steal data, gain access to your banking apps, spy on you, or drain cryptocurrency accounts, so they should not be taken lightly.

Let's examine the current malware landscape on Android and learn how to protect yourself against the most common threats.

The most vulnerable Android devices

Keeping your software and operating system up to date is one of the easiest ways to stay safe. Before delving deeper into the report's findings, it's worth noting that anyone running Android 12 (or earlier) on their device is particularly vulnerable. Google ended security updates for that version in March 2025. Since then, Google has patched 133 high-severity and four critical-severity threats.

Android 12 was launched in October 2021 and is currently installed on approximately 12% of all Android devices, according to Statcounter's May 2025 figures. That's nearly 400 million Android devices worldwide, including popular phones such as the Samsung Galaxy S10 lineup (released in March 2019) and Google's Pixel 3 (released in October 2018).

So, if you are someone who likes to hang onto your phone for a long time, this is the moment to let that old phone go and make the upgrade. Devices without security software updates pose a significant threat to your safety. The good news is that it doesn't have to be that expensive. Check our best phone deals for options starting as low as $169.

Mamont banking Trojan was the biggest threat in early 2025

Mamont is off to a banner year in 2025, which is not something you want to hear when it comes to malware. Between January and March, it accounted for three of the top five mobile malware threats, an increase of more than 15 percent compared to October to December of 2024.

How is Mamont spreading so fast? Social engineering is the key, as these Trojans masquerade as legit apps to gain high-level permissions on the victims' devices.

Mamont is a threat to anyone who sideloads apps, so be particularly wary if you’ve done so lately. Double-check your permissions and keep one eye on your bank account. Mamont can pose as the Chrome app, a delivery tracking app, or a video file, among numerous alternatives.

Don't buy that off-brand Android phone

Motorola offers affordable Android phones for under $200, so please don't bite on extreme budget Android phones.

See also: The Trump Mobile T1 phone: A ridiculous claim may doom it to fail

Kaspersky has found several off-brand phones loaded with a backdoor Trojan called Triada so far this year. The Trojan is active from the moment a user powers on their phone.

It can replace browser links, steal your login data, steal cryptocurrency, or inject malicious code into apps without you realizing it. The people behind Triada have stolen over a quarter of a million dollars in crypto from victims.

Your phone is your most valuable possession

In 2025, your phone will undoubtedly be the most valuable thing you own, as it has access to virtually everything else.

Again, this means ensuring you don't skip the operating system updates that your phone is prompting you about. Stop putting them off and update now; it'll only take a few minutes.

Only download apps from the Play Store. Although there have been instances of malware infiltrating the Play Store, it is vastly safer than installing apps from the open web.

Go to Settings and search for Permission Manager to review the permissions you've granted to every app on your phone. Pay careful attention to any apps with Accessibility or Device Admin rights, as these are often critical for malware.

Use a mobile antivirus app to protect your phone from malware further. These apps can move faster against attackers than a software update from Google or Samsung, so it's a sound early defense system.

Finally, for any critical accounts, enable two-factor authentication, as this can potentially stop cybercriminals from gaining access to your accounts even if your device is infected with malware.

MORE FROM LAPTOP MAG

• The Trump Mobile T1 phone: A ridiculous claim may doom it to fail
• Windows 11 'bug' throws shade at Apple's Liquid Glass, but Microsoft is playing innocent
• Rumors hint at a major redesign for the MacBook Pro in 2026. Here's what we know so far.

In the world of virtual private networks (VPNs), company marketing is crucial for customer acquisition. Because the products of different providers are so similar, many VPN companies will do anything and everything to stand out. This includes boasting about the number of servers offered on their VPN network.

But just how important is this figure, and should it be the determining factor in your next purchase decision? VPN juggernaut Nord thinks maybe not.

How we got here

Because VPNs aren’t the most technically complex products to create and maintain, there has been a flood of providers over the years.

In such a crowded field with a low barrier to entry, any metric worth mentioning is likely to be picked up by the marketing department and plastered on the home page or any other available advertising channel.

Historically, these metrics have often been related to things like speeds, server counts, the number of supported devices, and extra features. However, as most of those are easy for each VPN to match against others, the advertising arms race for “bigger number = better” has focused almost entirely on server counts.

Why is a high server count good?

In essence, the larger a VPN network is and the more servers it offers, the more likely it is you’ll be able to find one close to your geographical location.

Overall the closer a server is to you, or the larger number of servers you have to choose from in a particular region, the better performance you can expect from the service. This is because each server has a particular load amount, and the more people that are trying to use a single server, the slower the speeds will be.

However, one company, NordVPN, is trying to change this longstanding narrative. In a recent interview with TechRadar, the company’s CEO Marijus Briedies was quoted on the issue, stating, "The idea that the more VPN servers you have, the better you are, is basically not very true. So, we have to start talking about this.”

Briedies argues that server quality, over quantity alone, is more indicative of the experience VPN users can expect. Briedies claims his company caps every server at just 30% load volume, which means more bandwidth is available for each user connected at one time.

That said, in general, if a VPN offers more servers, the more broadly the network can spread those users when connecting in high-traffic areas like Tokyo or New York City. So, in most cases, yes, a bigger number is better in the long run.

What should you look for in your next VPN?

So, what does this all add up to? While server count shouldn’t be the only metric you consider when picking a VPN, it’s still one of the most important, regardless of what a single CEO says.

Looking at everything from price to supported device count, user reviews, and more should give you the best picture of which VPN will best fulfill your needs.

Server counts are an important part of this total package, and while they may be less relevant for users who live in moderately populated areas of the world, anyone in very rural settings or densely packed cities will want to keep server count and quality at the top of their list of considerations when shopping for a new VPN.

More from Laptop Mag

• Best VPN services in 2025
• 6 things you could (and should) use a VPN for
• 5 reasons why you need a VPN — cheap flights, fast internet and more

Phishing attacks are not new, especially with Gmail. There are constant warnings from email companies about what to watch out for when receiving a weird email.

That still doesn't stop hackers. Some do keep with the painfully obvious phishing attacks using emails supposedly from Apple, Amazon, and Facebook, yet use random email handles to send the fake messages. Others, however, have gotten smarter and sneakier with their attacks, so now, it's close to impossible to tell if an email is fake or not.

Software developer Nick Johnson created a thread on X about a new kind of phishing attack. He received an email from an attacker that said Google had been served with a subpoena and that he needed to provide a copy of his Google account content.

An email like this would seemingly be easy to dismiss simply by looking at who sent it. In this case, the email did come from a valid, signed Google email account, no-reply@google.com. This email also passed a DomainKeys Identified Mail (DKIM) check, which reaffirms it is legit, and in Gmail, this email sorted itself with other Google security alerts within the inbox.

Clicking on the link also led to a legit-looking Google sign-in page with the subtle difference that the URL was "sites.google.com" instead of "accounts.google.com." Johnson didn't proceed further as he believed that would have been where the hackers would have harvested his data.

So how did these hackers create an email that appears to be a completely valid email from Google and create a fake site that is still a Google website? Johnson came up with a theory.

The first task was to create a site using an old Google product.

"The fake portal is fairly straightforward. http://sites.google.com is a legacy product from before Google got serious about security; it allows users to host content on a http://google.com subdomain, and crucially it supports arbitrary scrips and embeds," Johnson tweeted.

After this fake page is made, they create a Google account using a fake domain that is registered. Johnson used the email of "me@domain."

They can create a Google OAuth application, which, for a knowledgeable developer, can be done in mere minutes. The application is given the name of the phishing message with all the spacing and wording found on a Google email, including a line for "Google Legal Support" in Johnson's case.

From here, they grant OAuth app access to the Google account they created, "me@domain," in the case of Johnson's example. This then causes a "Security Alert" message from Google to be generated, which has all the phishing wording in it. The attacker then forwards that email to the victim, and it passes a DKIM check, appears to come from a legitimate Google email, and has a link to the fake site.

Google is on it.

At the end of his thread, Johnson said he sent this issue to Google, and their response wasn't ideal.

"I've submitted a bug report to Google about this; unfortunately they closed it as 'Working as Intended' and explained that they don't consider it a security bug. Obviously I disagree - but until they change their mind, be on the lookout for deceptive security alerts from Google," Johnson wrote.

He later posted another message saying the company changed its stance.

"Outstanding news: Google has reconsidered and will be fixing the oauth bug," he tweeted.

Google confirmed it is working on a solution with Newsweek.

"We're aware of this class of targeted attack from the threat actor, Rockfoils, and have been rolling out protections for the past week. These protections will soon be fully deployed, which will shut down this avenue for abuse," the company told Newsweek. "In the meantime, we encourage users to adopt two-factor authentication and passkeys, which provide strong protection against these kinds of phishing campaigns."

When you’re heading back to school, I’d assume that internet safety is the last thing on your mind. Then again, what do I know? I’m English, and the only thing on my mind when I go back to school is the brickwork of King’s Cross Station as I fail once again to find my way onto the platform for the train to Hogwarts.

However, while internet safety isn’t as cool as a new MacBook Pro, it should register pretty high up on your to-do list as you prepare for the year ahead. After all, you’ll likely be spending a lot of time on shared networks — a hotbed of potential security abuses that could see you gravely regretting prioritizing that dorm room essential iced coffee maker over investing in the ultra-affordable subscriptions of one of the best VPN services. 

What is a VPN? 

A Virtual Private Network (or VPN) is a security tool designed to protect your privacy as you surf the internet in search of ways to watch blocked content, whether that’s because of your location or network restrictions.

VPNs offer an encrypted tunnel by which all of your internet traffic can flow, making your IP address and activity along the way to ensure you remain as anonymous as possible while online.

While you can’t simply ghost your way around the internet, you can set your virtual location to any number of virtual servers to fool websites, services, and apps into thinking you’re somewhere you aren’t. This lets you bypass everything from ISP firewalls to geo-restrictions in your quest to freely explore the internet without roadblocks.

Why do I need a VPN? 

Picture this: your entire class has become enraptured by a hot new TV show on Netflix, and you’re the only one who isn’t up to speed. Filled with dread and a sense of impending social stigma, you rush to your dorm and open Netflix only to find that the show in question is exclusive to the British Netflix library. Oh no. Whatever will you do?

Well, you could use a VPN to set your virtual location to London, England, and binge-watch your way to group acceptance. That’s what I’d do. After all, I don’t want to become a social pariah in my first week of school.

Another thing to keep in mind is your potential reliance on open Wi-Fi networks. While having quick and easy access to the internet while on campus, in libraries, or in local coffee shops is an incredible boon, it does come with its downsides. If it’s quick and easy for you to access, it’s just as quick and easy for somebody with less than good intentions to do so.

Public or shared Wi-Fi networks are a minefield of potential security threats. Thankfully, VPNs help mask your presence on the network and ensure the data passing back and forth between your machine and the internet isn’t intercepted and snooped on by any potential nosey ne’er-do-wells who become overly curious about what you might get up to on the privacy of your own devices.

VPNs keep you and your data safe from prying eyes at all levels of your internet access while also giving you the freedom to access the net in all the ways you choose. Security, privacy, and freedom: three of the most compelling reasons you need to invest in the VPN this back-to-school season.

Which VPN is right for me as a student? 

Choosing a VPN service is a lot easier than deciding between spec-heavy laptops. But it can still be tough to judge if you’re unfamiliar with services like this.

Thankfully, we’re here to help. We know the importance of a good VPN at Laptop Mag, which means we stay abreast of the best services available so you don’t have to spend your every waking hour flipping back and forth between websites trying to make sure you get the best deal.

Let's look at some of the VPNs we recommend this back-to-school season.

1. ExpressVPN

Whether you’ve never used a VPN or want to move to a more reliable service, ExpressVPN is our top pick for staying secure online. It’s easy to use and available across a number of your devices, meaning you can secure your laptop, smartphone, tablet, and even game consoles with up to eight devices able to share the same protections at once.

Better still, ExpressVPN provides a speedy pathway through its network, ensuring you won’t be bogged down by a connection that’s as slow as it is secure. ExpressVPN’s network contains over 3,000 servers spread across 105 countries and offers 24/7 support for anyone encountering issues with its service. It’s an ideal option for those looking for an all-around internet safety solution, and highly recommended.

2. NordVPN

Even if you’ve never used a VPN, you’ll likely have heard of Nord, whose sponsorships appear in a wide selection of YouTube videos. It’s one of the most popular VPNs you’ll come across, with good reason. Its 6,400+ servers spread across 111 countries are impressively fast and reliable, which makes it ideal for those who are perpetually downloading, streaming, or gaming.

However, NordVPN doesn’t solely rely on its speeds. It’s also an impressively secure service that takes user privacy incredibly seriously. To facilitate its users with the most secure online experience, Nord supports up to 10 simultaneous devices per account and supports all major operating systems and mobile platforms. NordVPN also offers incredible value to long-haul subscribers, with its two-year plans starting at just $5.99 per month.

3. Surfshark

While I might not be an American, there’s one thing that’s typically universal among students: being broke and appreciating a good deal when you find one. That’s where Surfshark comes into play nicely. Surfshark’s annual plans are some of the cheapest around, but that doesn’t mean it’s willing to compromise on safety or features to get there.

In fact, you’ll get access to several bonus features by upgrading to some of its broader tiers and still save money compared to more premium services like NordVPN and ExpressVPN. To make things even more outstanding in terms of value, Surfshark has no limits on the number of devices you can use with the service. This allows you to protect yourself but freely offer your roommates the same levels of protection and security.

More from Laptop Mag

• Best VPN services in 2024
• 6 things you could (and should) use a VPN for
• Has your email or password been stolen? Here's how to find out

Researchers from security firm IOActive warn that a major flaw in AMD processor firmware could give attackers access to deep control over a computer, leading to "unfixable" infections. Firmware is a type of software that helps the hardware to run as expected, essentially making this "software for hardware" a major target for hackers who want near-complete control over your PC.

As reported by Wired, the "sinkclose" flaw in AMD's firmware exists in almost every AMD chip since 2006 and presents a significant threat under the right conditions. If hackers did gain access to your laptop via the Sinkclose vulnerability, researchers indicated that "You would basically have to throw your computer away." 

IOActive researchers Enrique Nissim and Krzysztof Okupski identified the flaw, referring to the vulnerable AMD chips as "Sinkclose." The duo plans to present the vulnerability in the AMD chipsets on August 10 at the Defcon hacker conference in Las Vegas, Nevada.

Laptop Mag contacted AMD for further comment on Sinkclose but did not receive a response in time for publication.

What does the "Sinkclose" flaw do?

The firmware vulnerability identified by Nissim and Okupski would allow hackers to run their own code in AMD's System Management Mode, which is intended to run the processor's firmware. This "Sinkclose" vulnerability would allow an attacker to infect the computer with a "bootkit" type of malware that targets the Master Boot Record. Bootkit malware can evade antivirus software and is potentially invisible to the operating system. 

A hacker must have already gained access to a PC or server to exploit the System Management Mode controls, which is one reason AMD is downplaying the concern. In a background statement to Wired, AMD company compared the Sinkclose method to "accessing a bank's safe-deposit boxes after already bypassing its alarms, the guards, and vault door." 

However, the vulnerability would allow a hacker such deep control of a PC that it would be functionally impossible to salvage it, and the vulnerability affects nearly all AMD chips manufactured since 2006, if not earlier. So while hackers would only likely attempt this on high-value targets, it should not be completely ignored.

AMD has acknowledged IOActive's findings in a statement to Wired, noting that the company had released mitigation options for the "Sinkclose" flaw in EPYC server processors and Ryzen consumer processors and that the vulnerability has been patched out of the EPYC server CPUs earlier this year. 

AMD has released a list of all affected processors on its security page, including the Ryzen 3000 through 7000 series for laptop owners. 

What this means for you

Unfortunately, because the vulnerability lies in AMD's firmware, users can only wait for a firmware update to patch it. As most affected systems will be Windows machines, those firmware updates will likely be rolled into future Windows system updates. 

Once those patches become available, any AMD PC owner should install the updates immediately.

More from Laptop Mag

• You might accidentally fall in love with ChatGPT's advanced Voice Mode
• iPhone 16 rumors: release date speculation, design leaks, price outlook, and more
• An 18-year-old browser exploit leaves MacBooks and Linux laptops vulnerable — but a fix is coming

Recent malware attacks have become more advanced, and the advice to keep your device safe is no longer as easy as "Don't click on any random links sent to you." Threat actors are seeking victims out with more concealed measures, like this fake ad for Google Authenticator that looks like the real deal, identified in a July 30 report by Malwarebytes.

After users click on the fake ad, they're redirected multiple times until finally landing on a fake site for Google Authenticator hosted on GitHub. If people aren't paying close attention, it's easy to miss these redirects and not notice they're on a malicious site before innocently clicking that 'Download' button.

If this fraudulent Google Authenticator is successfully downloaded on your device, the malware — known as DeerStealer and originally discovered by @anyrun_app on X — will have access to your personal data, specifically via an "attacker-controlled website hosted at vaniloin[.]fun."

With such well-concealed malware floating around on the internet, how are you supposed to protect yourself? Well, there are a few specific tips to prevent this malware and an all-encompassing solution that could keep you protected without needing to manually vet all links.

How to notice DeerStealer malware

Most of us are familiar with what a sponsored ad on Google looks like, and looking at the malicious ad Malwarebytes took screenshots of, it's hard to spot the differences. The ad shows Google's official website as the URL, and when you expand details about the advertiser, it convincingly reads "Advertiser identity verified by Google."

Even if you accidentally click on this fake ad from 'Larry Marr,' your device isn't compromised just yet. The DeerStealer malware only gains access to your personal data if you don't recognize the suspicious URL — chromeweb-authenticators[.]com — and download the malicious Authenticator[.]exe file.

Unfortunately, your browser's built-in security measures will not recognize this fake site and file as malicious because they are hosted on GitHub, a trusted cloud resource. 

So what is a security-conscious user to do?

The only solution that could protect you from this advanced malware without needing to diligently check every URL yourself is antivirus software. Malwarebytes points out that its own antivirus software detected the malicious payload as "Spyware.DeerStealer," and there are multiple other antivirus solutions available that would work similarly.

Even taking precautions the modern internet is a hazardous place, so investing in one of the best antivirus apps that is available for desktop and mobile is the best solution to keep yourself as safe as possible.

More from Laptop Mag

• Snapdragon X PCs to rival MacBook Air in more than performance from 2025
• Logitech considers releasing a mouse you buy once and pay for 'forever'
• How to change Apple ID password: Cybersecurity experts say to do it every 90 days (but now is better than never)

On July 27, Microsoft released a detailed security report on the cause of the CrowdStrike crash that triggered one of the biggest IT outages in history. 

Microsoft's report came just a few days after CrowdStrike's post-incident report. Both investigations concluded the same thing: the outage that impacted millions of Windows devices was caused by a bugged driver. 

The CrowdStrike outage was effectively triggered by Channel File 291, a file containing problematic data, incorrectly passing validation through the bugged driver, the "Content Validator," part of CrowdStrike's Content Configuration System. 

The problematic data in Channel File 291 triggered an out-of-bounds memory read, which led to the crash. An out-of-bounds memory read occurs when a program tries to access data that's out of reach beyond the end of some type of buffer. For example, if a program tried to access data beyond the end of an index, that could cause an out-of-bounds memory read error. 

In this case, the error resulted in the infamous Blue Screen of Death (BSOD) Windows operating system crash on July 19, which impacted millions of devices worldwide. 

While the outage has mostly been resolved as of this writing, the results of Microsoft and CrowdStrike's investigations could have a more long-lasting impact on everyday users. The way antivirus and anti-cheat apps work might be changing soon. 

The role of kernel-level access in the CrowdStrike outage

Part of the underlying cause of the CrowdStrike outage was that CrowdStrike's software requires kernel-level access, like many other antivirus programs. 

Kernel mode is the deepest level of the Windows operating system. It's often used in cybersecurity software since it can scan for malware more deeply, and kernel-level programs are more complex for hackers to disable. 

By operating on the kernel level, antivirus programs can monitor all the activity on a device to cast the widest net for identifying suspicious activity or files. 

For example, the driver involved in the CrowdStrike outage was a file system filter driver. This type of driver is prevalent in antivirus programs and typically monitors new files saved to a device. They can also monitor system behavior, which appears to be the case with the "Content Validator" involved in the CrowdStrike outage. 

Unfortunately, the downside of allowing a program to run on such a deep level in the Windows operating system is a higher risk of system crashes if a glitch does slip through. 

Microsoft explains in its incident report, "Since kernel drivers run at the most trusted level of Windows, where containment and recovery capabilities are constrained by nature, security vendors must carefully balance needs like visibility and tamper resistance with the risk of operating within kernel mode."

How the CrowdStrike outage could impact kernel-level apps for security and gaming

Microsoft's full report on the CrowdStrike outage is pretty lengthy, but one of the most important sections is at the end, where Microsoft mentions "reducing the need for kernel drivers to access important security data" moving forward. 

This is important to note since CrowdStrike is far from the only developer to require kernel-level access for its software. Many consumer cybersecurity apps and anti-cheat programs also require this deep access into users' operating systems. 

In recent years, kernel-level anti-cheat software has faced significant controversy in the gaming community. Many gamers see it as a privacy and security risk since hackers could get kernel-level access to their devices if these anti-cheat programs were ever compromised. Hackers have even found ways to bypass kernel-level anti-cheat programs. 

However, game developers seem reluctant to abandon kernel-level anti-cheat programs due to the growing difficulty of stopping cheating in competitive games. 

The CrowdStrike outage may mark a turning point in this issue since it sheds new light on the potential dangers of kernel-level programs. This incident is evidence that gamers may be right to be concerned about the safety of their devices with kernel-level anti-cheat. It also highlights the drawbacks of kernel-level consumer cybersecurity apps. 

We could see some of these apps move away from kernel-level access. Microsoft may begin putting more research and development into finding alternative ways to protect users' devices (and stop gamers from cheating) without needing kernel-level permissions. 

AI could offer one potential solution. For example, developers have suggested using AI "Human Behavior Detection" to spot cheating in competitive gaming. This approach relies on identifying suspicious behavior in-game rather than scanning every file on a user's device for potential cheating software. 

Could similar AI-powered solutions provide alternatives to kernel-level cybersecurity software? That's unclear, but AI will likely play a major role in Microsoft's research efforts in the aftermath of the CrowdStrike outage. 

The CrowdStrike outage may have been the most high-profile IT issue caused by a kernel-level program, but it's certainly not the first time kernel-level errors have led to BSOD crashes for users. Kernel-level software has benefits, but the risks are clearly significant. Users need an alternative that can keep their Windows devices safe without the risk of critical system crashes. 

More from Laptop Mag

• Windows/CrowdStrike outage recap: Today's 'Blue Screen of Death' error explained
• The CrowdStrike outage spotlights major vulnerabilities in the global information ecosystem
• 10 billion passwords compromised in largest leak of all time — what you need to know

The global information technology outage on July 19, 2024, which paralyzed organizations ranging from airlines to hospitals and even the delivery of uniforms for the Olympic Games, represents a growing concern for cybersecurity professionals, businesses, and governments.

The outage is emblematic of the way organizational networks, cloud computing services, and the Internet are interdependent — and the vulnerabilities this creates. In this case, a faulty automatic update to the widely used Falcon cybersecurity software from CrowdStrike caused PCs running Microsoft’s Windows operating system to crash.

Unfortunately, many servers and PCs need to be fixed manually, and many of the affected organizations have thousands of them spread around the world.

Microsoft's problem was made worse because the company released an update to its Azure cloud computing platform at roughly the same time as the CrowdStrike update. Microsoft, CrowdStrike, and other companies like Amazon have issued technical workarounds for customers willing to take matters into their own hands.

But for most global users, especially companies, this isn’t going to be a quick fix.

Modern technology incidents, whether cyberattacks or technical problems, continue to paralyze the world in new and interesting ways. Massive incidents like the CrowdStrike update fault not only create chaos in the business world but disrupt global society itself.

The economic losses resulting from such incidents — lost productivity, recovery, disruption to business and individual activities — are likely to be extremely high.

As a former cybersecurity professional and current security researcher, I believe that the world may finally be realizing that modern information-based society is based on a very fragile foundation.

The bigger picture

Interestingly, on June 11, 2024, a post on CrowdStrike’s own blog seemed to predict this very situation — the global computing ecosystem compromised by one vendor’s faulty technology — though they probably didn’t expect that their product would be the cause.

Software supply chains have long been a serious cybersecurity concern and potential single point of failure. Companies like CrowdStrike, Microsoft, Apple, and others have direct, trusted access to organizations’ and individuals’ computers.

As a result, people have to trust that the companies are not only secure themselves but that the products and updates they push out are well-tested and robust before they’re applied to customers’ systems.

The 2019 SolarWinds incident, which involved hacking the software supply chain, may well be considered a preview of today’s CrowdStrike incident.

CrowdStrike CEO George Kurtz posted on X that “this is not a security incident or cyberattack” and that “the issue has been identified, isolated and a fix has been deployed.”

While perhaps true from CrowdStrike’s perspective — they were not hacked – it doesn’t mean the effects of this incident won’t create security problems for customers. It’s quite possible that in the short term, organizations may disable some of their internet security devices to try and get ahead of the problem, but in doing so, they may have opened themselves up to criminals penetrating their networks.

Various scams are also likely to target people, preying on their panic or ignorance regarding the issue. Overwhelmed users might either take offers of faux assistance that lead to identity theft or spend money on bogus solutions to this problem.

What to do

Organizations and users will need to wait until a fix is available or try to recover on their own if they have the technical ability. After that, I believe there are several things to do and consider as the world recovers from this incident.

Companies will need to ensure that the products and services they use are trustworthy. This means doing due diligence on the vendors of such products for security and resilience.

Large organizations typically test any product upgrades and updates before releasing them to their internal users, but that may not happen for some routine products, like security tools.

Governments and companies alike will need to emphasize resilience in designing networks and systems. This means taking steps to avoid creating single points of failure in infrastructure, software, and workflows that an adversary could target or that a disaster could make worse.

It also means knowing whether any of the products organizations depend on are themselves dependent on certain other products or infrastructures to function.

Organizations will need to renew their commitment to best practices in cybersecurity and general IT management. For example, having a robust backup system in place can make recovery from such incidents easier and minimize data loss. Ensuring appropriate policies, procedures, staffing, and technical resources is essential.

Problems in the software supply chain like this make it difficult to follow the standard IT recommendation to always keep your systems patched and current.

Unfortunately, the costs of not regularly updating systems now have to be weighed against the risks of a situation like this happening again.

This article was originally published in The Conversation.

In what is being referred to as one of the largest and most significant data leaks to date, July 4 bore witness to the release of a massive data dump containing nearly 10 billion unique passwords.

The data breach was released on a leading hacking forum by a threat actor under the pseudonym "ObamaCare," with the list itself being dubbed "RockYou2024" — an updated compilation of passwords that builds upon the "RockYou2021" document containing information to over eight billion accounts.

The original "RockYou.txt" data breach occurred in 2009 when the now defunct social application site RockYou was hacked, resulting in the release of 32 million user accounts to the net. Since then, the original list has been added to with further data breaches, reportedly making it one of the largest known repositories of stolen passwords of all time.

With exactly 9,948,575,739 unique passwords freely available to all in plain text format, the publication of this list is a threat to netizens and a call to action on checking the security of accounts old and new.

RockYou2024: How serious is it?

Speaking in a blog post published yesterday, Pieter Amtz of Malwarebytes highlights the threat posed by the updated RockYou document, stating: "The list has some value because it contains real-world passwords."

Amtz continues, "This means if an attacker tried this list of passwords to try to break into an account (known as a brute force attack) they’s be more likely to get in than just trying a list of any old letters and words [sic]."

While a ten billion list of real-world passwords poses a serious threat to some users, it by no means suggests that ten billion users are now at direct risk. The list, while enormous in size, is only half of the information required to access an account.

The contents of RockYou2024 will serve threat actors hoping to purposefully target individual accounts by allowing them the option of checking each password from the breach by trial and error — though most websites would never tolerate brute force attempts like this at a scale offered by the RockYou2024 list.

That's not to say that there's no threat at all, however. The data contained within the ten billion-strong list still has plenty of application in pass-the-hash attacks and the offline cracking of stolen password databases.

RockYou2024: Some have their doubts

While the breach is considerate in size, and a genuine threat to many, Malwarebyte's Amtz points out that those who "Don’t reuse passwords and never use 'simple' passwords, like single words" probably have little to worry about. 

However, Amtz also wisely insists people take the necessary safety precautions of enabling multi-factor authentication (MFA) on all accounts possible to protect against unwanted intrusions.

Elsewhere on the internet, security sleuths are questioning the updated RockYou2024 content, claiming much of the additions to the list to be mostly uncracked hashed passwords and random company names among other junk data and over one billion lines of text that are beyond 32 characters in length — which indicates they may not be passwords at all. 

How to check if your information was leaked

Despite reassurances from various in-the-know voices, data breaches like RockYou2024 are a notable threat to be aware of. While it may not be the most dangerous breach in recent history, it's a considerable example of how much stolen data is out there on the internet waiting to be misused.

It's estimated that there are over 24 billion stolen credentials to be found online and circulating the dark web, with lists being traded daily containing millions or more combinations of in-use and active user accounts.

With that in mind, with the release of breaches like the updated RockYou list, it's always better to be safe than sorry and check to see if your information is secure by using several free and trusted online services that can let you know if your password is secure or if any of your accounts have been included in prior breaches.

One trusted site we can recommend would be HaveIBeenPwned.com, one of the largest and most reliable repositories of stolen accounts and data breaches online. Here you can search by email to see if any of your accounts have appeared in breaches, and the site's Pwned Passwords Tool search lets you know if the password you're using at present has been found within numerous lists like RockYou2024 found online.

Check out the following article about staying safe against data breaches and checking to see if your email or password has been stolen for more information about HaveIBeenPwned and similar services.

• Has your email or password been stolen? Here's how to find out

More from Laptop Mag

• Best antivirus apps in 2024
• OpenAI hack revealed as ChatGPT flaws exposed: Is your data at risk?
• Data shows deceitful Android malware is on the rise: Take this one step to keep your phone safe

OpenAI, the developer of ChatGPT, is facing concerns about its security after a 2023 breach came to light this week. News of the breach comes just days after ChatGPT users reported a serious glitch in the chatbot and a major security vulnerability within the ChatGPT macOS app. 

As the developer of the world's most popular AI chatbot, it's no surprise that OpenAI is a target for hackers. The company has been quick to respond to recent security issues, but it's still important for users to know how they might be affected and how they can keep their data safe moving forward. 

Here's a look at OpenAI's recent security controversies and what you can do to stay safe while using ChatGPT. 

OpenAI was hacked in 2023 and kept it quiet: What users should know

On July 4, the New York Times reported that OpenAI experienced a breach in early 2023, but chose not to tell the public about it. A hacker accessed OpenAI's internal messaging forums, where they were able to view conversations about the inner workings of OpenAI's technologies. 

Anonymous OpenAI employees told Cade Metz of the New York Times that OpenAI's executives decided against revealing the incident to the public since the hacker didn't access any of the company's actual systems, such as customer data. One of OpenAI's employees, Leopold Aschenbrenner, raised concerns about the company's lack of adequate security measures in the aftermath of the incident but was fired shortly after for sharing information with researchers outside the company. 

This is important to note since Aschenbrenner was part of OpenAI's Superalignment team, the group of engineers and researchers tasked with ensuring OpenAI's products are ethical and safe. The Superalignment team has seen a few other major exits over the past few months due to similar concerns about security and safety. 

In fact, OpenAI's Head of Alignment, Jan Leike, specifically outlined his safety concerns on X after resigning in May 2024. Leike said in an X post that "over the past years, safety culture and processes have taken a backseat to shiny products." 

While the April 2023 OpenAI breach likely had no direct effect on end users, the way OpenAI handled it demonstrates a lack of transparency. It could also have long-term ramifications if the hacker, and any others that might duplicate their strategy, accessed information that would allow them to jailbreak or hack ChatGPT itself. 

ChatGPT security flaws spotted by users on Reddit and macOS

Unfortunately for OpenAI, the 2023 internal messaging hack wasn't the only security vulnerability to come to light this week.

On June 30, Reddit user F0XMaster posted on r/ChatGPT about a strange glitch they experienced while using the chatbot. After greeting the chatbot with a simple "Hi," ChatGPT replied with an outline of its system instructions, which are only intended to be visible to developers. 

The system instructions revealed the inner workings of ChatGPT, including some of the guardrails in place to regulate the chatbot's behavior. For example, it instructs ChatGPT to only generate one image per prompt, even if a user asks for more. 

Other users quickly replied to the post with workarounds they figured out, allowing them to get around the chatbot's system instructions. OpenAI patched the issue within a day of the post going live so these "jailbreak" tactics no longer work. 

As if that wasn't bad enough, OpenAI is also facing concerns from Mac users after a Threads user revealed the macOS ChatGPT app was storing conversations as plain text files. That means a hacker, malicious app, or anyone curious enough could freely access a victim's entire conversations from the macOS ChatGPT app. 

OpenAI has since patched the app to encrypt saved conversations. So, these files should be secure moving forward. However, it is possible the text files containing users' ChatGPT conversations were vulnerable prior to the most recent app update. 

How do these security vulnerabilities affect users?

It's certainly not a good time to be OpenAI, between news of its 2023 internal messaging breach, a concerning glitch on ChatGPT, and a major security flaw in the ChatGPT macOS app. However, if you're a ChatGPT user, only one of these issues could potentially directly impact you. 

The 2023 breach only affected OpenAI's internal messaging forums, likely to place company secrets at risk but not user data. Similarly, the glitch revealed on Reddit last weekend has been patched and seems to have only exposed ChatGPT's own instructions. 

The macOS ChatGPT app vulnerability is concerning, though. If you've been using the Mac app, the good news is that your conversations are encrypted as of the latest app update. Before this update, it's possible those conversations were vulnerable to hacking. 

However, unless your Mac was hacked between when you downloaded the Mac ChatGPT app and this week when the encryption patch rolled out, you probably don't have anything to worry about. If you're not sure whether or not your Mac was exposed to malware recently, you can use an antivirus program to check for any suspicious activity or downloads. 

You can also protect your data in the ChatGPT app moving forward by deleting conversations when you no longer need them. It may also be a good idea to turn off the "Improve the model for everyone" feature in the app. This feature allows OpenAI to use your conversations to train ChatGPT. If you're concerned about privacy, it's probably a good idea to opt out of this program. 

You may also want to keep an eye out for macOS 15 and Apple Intelligence, which will allow you to use ChatGPT on your Mac without sharing your data with OpenAI. This will likely be the most private and secure way to access ChatGPT once the feature launches later this year. 

More from Laptop Mag

• A timeline of OpenAI controversy: November 2023 to May 2024
• OpenAI employees sound the alarm ahead of Apple partnership
• Apple warns against cloud-AI data collection, leans into on-device AI

Updated 5/29/24 at 6:11 p.m. ET with comment from Google representative.

This month, a banking trojan claiming to be an official Google Play Store update wrought havoc on Android users.

The Antidot Android Banking Trojan discovered by Cyble uses VNC (virtual network computing), keylogging, and overlay techniques to steal sensitive information and login credentials from unsuspecting Android owners.

The problem could have been avoided, though. But first, let's get into what happened when the deceptive malware collected bank information from Android users.

How does Antidot work?

As the Cyble report explains, the Antidot software functions using an accessibility feature and then establishes a connection with its command and control server. That server registers the device and identifies target applications. Using an overlay injection, the Antidot software sends a message claiming to be from Google which tells users to update the Google Play Store.

The Antidot software then logs keystrokes and transmits that information to the control server, allowing the trojan to steal sensitive information and login credentials. The software can also access text messages and control the camera and screen lock.

Because the Antidot download is prompted from a false popup message, the Antidot software is sideloaded rather than downloaded directly from the Play Store. This should indicate that the software isn't a legitimate Play Store update.

Other malicious applications are out there

While the Antidot Android Banking Trojan is sideloaded, it may not be the only malicious application targeting Android phones.

According to a new report by Zscaler ThreatLabz, "over 90 malicious applications (have been) uploaded to the Google Play store. These malware-infected applications have collectively garnered over 5.5 million installs."

So Android malware applications are potentially on the rise.

How to stop trojan applications

There is a way to protect yourself from malicious applications like the Antidot Android Banking Trojan.

A spokesperson for Google tells Dark Reading that Google Play Protect can protect against this kind of malware. "Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services. Google Play Protect can warn users or block apps known to exhibit malicious behavior, even when those apps come from sources outside of Play."

We reached out to Google for comment and a representative got back to us with the following statement regarding Google Play Protect:

This suggests that Zscaler's 5.5 million installations figure may not be an accurate account, but Google would not confirm or deny that specific figure.

If you're worried you may have downloaded the Antidot Android Banking Trojan or a similarly malicious application, Google Play Protect rolled out a virus scan function in October. Play Protect's scans will protect against malware pushed to the Google Play store or sideloaded as an APK like the Antidot trojan.

Can you believe it's already World Password Day? Seems like it arrives earlier every year.

Created by Intel in 2013, World Password Day is held on the first Thursday in May each year. The reason for the season is security, folks.

Google opted to make a little news this WPD by announcing it would broaden the set of tools and services it offers to help people leave passwords behind for more secure login tech. When World Password Day is free of passwords, we will truly be living in a more secure world.

Here's a look at everything Google announced for WPD — and how you can use these updates to improve your web security. 

Google announces passkey updates for World Password Day

In Google's annual blog post for World Password Day, its security team highlighted some updates to the passkey program it announced in 2022. These updates will help both high and low-risk users improve their web security so they can keep all of their online accounts and data safe. 

The first highlight of Google's World Password Day announcements is the expansion of cross-account protection. This program allows users to protect non-Google accounts connected to their Google account. When Cross-Account Protection is active, Google will share security notifications with the apps and websites connected to your account. This makes it much more difficult for hackers to use one compromised account to gain access to all your apps and websites. 

Google is now expanding the apps and services eligible to connect to Cross-Account Protection. So, you'll soon be able to use it to monitor and secure more of your accounts. 

Google also announced that its passkey sign-in option will soon be available to users enrolled in its Advanced Protection Program. The app is for high-risk users, people who are at an above-average risk of being targeted by hackers, such as politicians, public figures, journalists, executives, and others with high visibility. Starting in 2024, app users will have the option to use passkeys in addition to hardware security keys. 

Users who are not enrolled in APP are also getting an upgrade. Google will now allow users to store passkeys within more security apps, such as the popular password manager 1Password. Users can also store their passkeys on existing security keys for greater login convenience. 

How you can use Cross-Account Protection and Google Passkeys

World Password Day isn't just about passwords — it's about improving web security on every level. Today that means leaving passwords behind, which is precisely what Google is helping millions of people do with passkeys and cross-account protection. You can also use these security tools to protect your accounts and data, and it only takes a few steps. 

If you haven't used a passkey before, they are similar to passwords but use stronger authentication methods to prevent hacking. For example, when you attempt to log in to your account, you might be prompted to scan your fingerprint on your phone instead. Passkeys can also be PIN numbers or your face ID. They're more secure, and they allow you to log in without needing to remember a lengthy password. 

To start using a passkey for your Google Account, head to the passkey setup page and log in like normal. After logging in, you should see an option to "Create a passkey." Select it and follow the steps on the screen to create your passkey. If this option isn't appearing in your Google account, double-check Google's hardware and software requirements to make sure your device is eligible. 

Setting up Cross-Account Protection on apps and services connected to your Google account is also a good idea. This tool isn't available for every app or website yet, but Google announced on Thursday that it will soon expand the number of compatible third-party apps and services. 

Setting up Cross-Account Protection is very straightforward. All you have to do is connect the accounts you want to protect to your Google account. You can do this by either signing into the app or service using your Google account or allowing the app to share access to your Google account. Once you connect them, Google will automatically share security notifications with eligible connected apps, sites, and services. 

With these easy steps, you can utilize all the latest security updates Google announced for World Password Day. Switching to a passkey will make signing into your Google account more straightforward and secure, and setting up Cross-Account Protection will give you extra security for third-party apps and services thanks to Google's security notifications. 

Whether you are a current subscriber or had an AT&T account in the past, your personal data could be part of a massive breach that according to a note from AT&T to customers impacts up to 73 million account holders (via WP).

The 7.6 million current subscribers involved in the breach have had their passcodes reset and should have received communication from AT&T already notifying them of the breach. The stolen data is all from 2019 or earlier and also includes 65.4 million former account holders. While according to AT&T there is no financial or call history information, it may include full names, email addresses, mailing addresses, Social Security numbers, date of birth, AT&T account numbers and passcodes.

Naturally, that is a recipe for identity theft, so all impacted account holders need to be aware of the situation and what to do from here.

What should you do?

If your data was part of the breach you can expect an email or letter from AT&T with additional details and your full options. 

While you wait for that to arrive your first step should be to reset your passcode to avoid anyone gaining access to your account to steal additional information. Now to be clear this is your numerical PIN for your AT&T account, not your password. 

Unfortunately, there isn't much else you can do to proactively protect yourself against the breach as the data was released onto the dark web around two weeks ago. 

What AT&T will offer those impacted is complimentary identity theft and credit monitoring services, hopefully allowing you to quickly catch any potentially damaging activities carried out using your information.

What happened?

It's unclear at this point if AT&T is actually responsible for the lost data. The company claims that it has no "evidence of unauthorized access to its systems resulting in theft of the data set." 

It is entirely possible that a third party working with AT&T is to blame, but obviously, the end result is the same, so that's cold comfort to account holders that now need to worry about identify theft.

MORE FROM LAPTOP MAG

• Out of touch: Windows loses Android app support
• Best laptop 2024: 10 best laptops tested and rated
• Walmart is having a huge sale this weekend — here's 21 deals I recommend

Phishing attacks are on the rise, with these nefarious security threats breaching your accounts, stealing your credit information, or accessing your private files. Scams like these see you simultaneously play the part of an active (yet unwitting) co-conspirator in attempts to hijack your most sensitive data.

Far beyond the simplistic and often easy-to-spot cold-calling techniques of supposed Microsoft Tech support agents or Amazon customer service employees, a new phishing threat has arisen whereby iPhone users are being targeted by the misuse of Multi-Factor Authentication (MFA) in efforts to trick them into handing over complete control of their Apple account.

Unlike other phishing attacks that might require a user to divulge passwords, personal details, or banking information, all this attack requires to successfully rob you of your Apple account (and all of the information and banking details linked to it) is a simple tap on the wrong notification.

Gone phishing: How 'Push Bombing' and 'MFA' fatigue attacks target iPhone users

This kind of phishing is known as "Push bombing" or "MFA fatigue," a method that continually harasses victims with a stream of notifications that are otherwise (ironically) used to protect people from this exact kind of attack.

As reported by KrebsOnSecurity, a bug (or potential oversight) in Apple's password reset feature has seen cyber-criminals spam their victims with password reset request notifications that force users to tap "Allow" or "Don't Allow" before proceeding.

While it's easy enough for users to tap "Don't Allow," attempting to clear out hundreds of these messages before regaining access to your phone can result in the fatigue part of MFA fatigue, whereby a user might absentmindedly select the wrong option or simply hit "Allow" just to be done with them.

The risk of users doing so is all the more likely when the notification in question merely asks if you'd like to "Use this iPhone to reset your Apple ID password" — a weak and vague form of phrasing that could lead some to believe that they are accepting the option to control their passwords only from this device.

But hitting "Allow" will grant the phishing hopefuls control of your password, leaving you in the dark about how to sign in to your own account once they complete the reset. Leaving users targeted by this form of attack helpless but to continually and carefully choose "Don't Allow" each time. However, even after that, the risk persists.

If at first you don't succeed...

A second stage of the attack is then likely to follow, whereby the scammers then call their target, spoofing the Apple Support phone number in the process, to inform them that there is a fault or a third-party attack in process and that Apple Support needs to verify a one-time code in order to resolve it.

Of course, Apple Support is not prone to making outbound calls to customers unless it is specifically requested, and that one-time code that's requested of you would give the attackers the 2FA (Two-factor authentication) blessing to change your password and lock you out of your account.

How to prevent phishing attacks against your Apple account

Sadly, protecting yourself from this form of attack can't be prevented by ticking a checkbox or enabling a setting somewhere on your device. It's up to Apple to implement some form of measure that impedes an attacker's ability to disrupt its users in this way.

Until then, you'll have to rely on your own vigilance when it comes to avoiding being duped by ne'er-do-wells seeking to abuse this security feature in their attempts to catch you off-guard.

Always stay alert to the kind of notifications you're receiving, especially when it has anything to do with passwords or device permission. And, as with any type of cold-calling, you should never divulge personal information over the phone — no matter how a person identifies themselves to you and no matter how much accurate information they have to hand about you in their attempts to verify themselves.

If you're ever asked to share a one-time code, click a link in a dodgy-looking email, or hand over personal information in any way over the phone (or through email) then break the line of contact and reach out to that company directly. This ensures that you know with 100% certainty that who you are speaking to is actually whom they claim to be.

More from Laptop Mag

• Has your email or password been stolen? Here's how to find out
• Your phone is listening to you — here's how to stop it
• How to switch from a passcode to an iPhone password — boost your security in seconds

Update (March 5, 2024 @ 12:25 a.m.): Reports of service disruption on DownDetector are dipping as Meta addresses the issues on its platforms. Andy Stone of Meta Communications is now reporting that service should now resume as normal.

Update (March 5, 2024 @ 11:52 a.m.): Meta's service tracker is now showing "Recovering from disruptions" against a number of affected services, indicating that the issue is in the process of being resolved.

Update (March 5. 2024 @ 11:45 a.m.): Meta's service tracker is now reporting "Major Disruptions" across more services linked with Facebook, Instagram, and WhatsApp. As a result, users will have trouble logging into services and sending messages on Meta platforms.

Is Facebook down? Yes it is! Along with several other Meta-owned social platforms such as Instagram and even WhatsApp. If you're unable to access Facebook or Instagram, the problem (thankfully) isn't on your end! Early reports are indicating that the Meta-owned social media platforms are both down globally amid a potential service outage.

Website outage tracker DownDetector is currently reporting issues with Facebook, Instagram, Facebook messenger, and riding reports of issues with WhatsApp as parent company Meta are seemingly being struck by some form of issue.

Facebook lacks its own outage tracker, but Meta for Business does not, and it's currently reporting "Major Disruptions" across the Meta Admin Center, Facebook Login, WhatsApp Business API, and Marketing API.

It's not all doom and gloom, however. Amid the outage Elon Musk has taken to Twitter/X to add a slight bit of levity to Meta's ongoing problems:

Meta website outage: Has my account been hacked?

There is no reason to believe that the current outages are any form of cyber attack or hacking incident. Outages like this are common for many websites online and there is likely no need to panic or assume the worst.

If you want to be doubly sure, once you can log into Facebook once more, be sure to follow our guide on how to log all of your devices out of your Facebook account, to be certain that only the devices you've authorized are able to access your profiles.

Meta website outage: How do I log back in to Facebook or Instagram?

If you've been logged out of your social media accounts due to the outage and are struggling to log back in, don't panic!

There's nothing wrong with your account, but the websites themselves are currently experiencing issues. This appears to stretch to Facebook and WhatsApp messenger also, so don't be alarmed if messages aren't currently sending.

The current issue appears to lie with Meta (the owner of Facebook and Instagram), which will no doubt be aware of the issue and working to resume normal service as soon as possible. Until then, there's not a great deal you can do but wait.

Thankfully, service disruptions for Facebook or Instagram are relatively short-lived and we expect normal service to resume shortly.

This story is currently breaking and we will update this article as the story develops.

More from Laptop Mag

• How to log all devices out of your Facebook account
• Facebook making strange noises? It's not just you! How to fix Meta's chirping bug
• How to change your name on Facebook

Epic Games Store users may want to keep their eyes peeled on a developing story that sees a dark-web ransomware group by the name of Mogilevich claiming to have stolen nearly 200GB of data from the platform including emails, passwords, full names, payment information, and source code.

News of the potential hack comes from social media site X's Dark Web Informer, a user known for providing Cyber Threat Intelligence (CTI) to the platform to spread awareness of potential breaches to consumers and businesses after threat actors reveal their actions on the Dark Web or wider internet.

Data breaches like the one Mogilevich claims to have pulled off involve threat actors gaining access to private information before holding that information to ransom, usually until a company agrees to pay them to prevent further distribution of the stolen information.

According to BleepingComputer's Lawrence Abrams, Mogilevich is looking to sell the data for just $15K, and won't be providing evidence of the breach to anyone who isn't looking to purchase the data and show "proof of funds" in the process. Abrams believes this claim sounds fishy, and he's not alone.

What does Epic Games have to say?

In a follow-up to the news of the breach, Abrams reached out to Epic Games for comment who had the following to say: "We are investigating but there is currently zero evidence that these claims are legitimate."

Epic would also go on to state that, in a move uncommon for most threat actors looking to profit from their actions, "Mogilevich has not contacted Epic or provided any proof of the veracity of these allegations."

Outlook

Mogilevich doesn't have a long and storied history of proving its claims but has been previously linked to breaches involving Ireland's Department of Foreign Affairs and Infinity USA.

As a relatively unknown group, it's somewhat of an unknown quantity in terms of being viewed as a credible threat. However, with Epic Games having found no evidence of a breach (as of the time of writing) and with such a small ransom posted for an otherwise large sampling of stolen information, it's likely that the group could be scamming companies with fake data.

Facing the negative press or stock backlash of data breaches can be enough to force the hand of certain companies into offering up the ransom to make the problem go away fast. This could be the same case here, and if so, users have very little to be concerned about.

However, as a general rule of thumb, if a service you're subscribed to is alleged to be part of a breach, no matter how credible of a threat (and in this case, it seems that Mogilevich may be telling tall tales) it's often a great reminder to refresh your passwords on these platforms to be extra vigilant against breaches.

More from Laptop Mag

• Has your email or password been stolen? Here's how to find out
• Your phone is listening to you — here's how to stop it
• 5 Windows security settings you should change now to protect your laptop

Heads up! Google Chrome is gearing up for a new security feature aimed at safeguarding your home network. Code-named "Private Network Access for Navigation Requests," this innovation aims to shield your connected devices from potential threats lurking on websites. Thanks to a report at Ghacks.net, we can share Google’s plans to safeguard your home network. 

The feature blocks navigation requests initiated by websites, acting as a security barricade for your home network. This proactive approach minimizes the risk of infections or intrusions, making your online experience safer. While details are still emerging (thanks to the eagle eyes at XDA!), I'm grateful to see Google prioritizing home network security. 

Google Private Network Access — how it works

Blocking Malicious Redirects: Traditionally, clicking a link or navigating to a new website triggers a smooth transition. However, some websites can sneakily redirect you to dangerous pages. This feature acts as a security checkpoint, blocking navigation requests initiated by malicious websites before they can harm your devices.

Double-Checking Destinations: Before granting access, Chrome verifies both the request's origin and the target website's security status. Think of it as a double-lock system ensuring both websites are clean before allowing the page to load.

Transparent Communication: If access is blocked, Chrome displays a clear error message, informing you about the potential threat and protecting your privacy. Additionally, developers get informed through Chrome's DevTools, helping them improve their websites.

While initially a warning-only system, future updates will allow users to disable it on a per-site basis. Mozilla and Apple support the feature's functionality but suggest a less confusing name like "Local Network Access" instead.

Final thoughts

This enhanced security measure arrives in Chrome 123, launching in Beta on February 21st and Stable on March 13th. While not foolproof, it's a significant step towards a safer online experience. Remember, vigilance is key – always use a reliable ad blocker, or antivirus, and practice safe browsing habits. You can read the official documentation Google released here. Enjoy safer browsing, my friends — well, soon enough.

A new malware by the name of GoldPickaxe is affecting Android and iOS devices in a big way. Spotted by Group-IB (via BleepingComputer), the GoldPickaxe malware tricks users into installing fraudulent apps and scanning their faces and ID documents. This sensitive information is then used to create deepfakes that allow the threat actors to gain unauthorized access to your banking app.

The GoldPickaxe malware is developed by GoldFactory, a Chinese hacker group that's also responsible for GoldDigger, GoldDiggerPlus, and GoldKefu malware. Right now, the group seems to be primarily targeting Thailand and Vietnam, but these techniques could be used to target other countries, either by GoldFactory or other malicious groups.

With that said, here's how the GoldPickaxe malware works and what to be cautious of over the next few months.

How GoldPickaxe malware works on Android and iOS

Between June 2023 and now, the GoldFactory malware group has distributed multiple threat packages, most of which targeted only Android users. However, its newest GoldPickaxe malware that started in Oct. 2023 targets both Android and iOS users.

Currently, victims are being targeted through phishing or smishing messages on the LINE app, which is a popular messaging app in Japan, Taiwan, and Thailand. These messages—written in the user's local language—impersonate government authorities and con victims into installing fraudulent apps, like the Digital Pension app below, from websites that look like Google Play.

The GoldPickaxe malware can target iPhone users in two ways. First, it directs victims to open a TestFlight URL that installs a legitimate TestFlight app in addition to the malware. If the TestFlight method doesn't work, the GoldFactory group sends out a malicious Mobile Device Management (MDM) profile, and if the iPhone user downloads it, the threat group gains control over the device.

Once someone has unknowingly installed the trojan horse, it can read incoming SMS messages, control background functions on the phone, request ID documents, and capture the victim's face. BleepingComputer points out that "use of the victims' faces for bank fraud is an assumption by Group-IB," but this is "corroborated by the Thai police."

Despite the fact that the GoldPickaxe malware can capture the faces of its victims and steal images, it can't access your official biometric data on Android or iOS. Your biometric data is encrypted and kept separate from running apps.

According to Group-IB, Android users are at a higher risk than iOS users, partly because Apple has higher security restrictions and partly because GoldPickaxe uses over 20 different fake apps on Android. Plus, with the iOS 17 update, these 3 game-changing security features were added to many iPhones.

Update 2/16/2024: A Google spokesperson offered this comment in regard to the threat posed by GoldPickaxe malware: "Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services. Google Play Protect can warn users or block apps known to exhibit malicious behavior, even when those apps come from sources outside of Play."

An updated version of the XLoader malware for Android devices doesn't require any user interaction to launch once installed, according to researchers at McAfee (via BleepingComputer). Of course, you still need to click the malicious link in an SMS message to download and install the malware, but this XLoader variant doesn't require users to manually launch the malware anymore.

Right now, the malware is being distributed through SMS texts on Android devices. If you're targeted, the SMS text will include a shortened URL that, if clicked on, will direct you to a website to download an Android APK installation file for a mobile app.  McAfee says that, "While the app is installed, their malicious activity starts automatically."

The malware will run silently in the background, gaining access to all kinds of personal, private data on your Android device, including photos, messages, contacts, and potentially banking information. Luckily, the malware is pretty easy to spot and you might already be protected if Google's Play Protect service is enabled on your Android device. Here's what to look for, and how to see if Play Protect is active.

How to spot the new XLoader malware

XLoader—also known as MoqHao malware—is likely created by 'Roaming Mantis,' a financially-motivated threat actor, and McAfee identified some malicious pop-up messages in the malware's code in English, Korean, French, Japanese, German, and Hindi, which indicates the malware's current targets.

If you're in an area that primarily speaks one of those languages, you might be at risk, but the warning signs that something's off are pretty clear. In permission requests during the malicious app's first launch, it'll masquerade as Google Chrome, but you'll notice some letters are bolded while others aren't.

After those initial requests, the malicious app will ask you to set "chrome" as your default SMS app, citing the reason "to prevent spam" to convince you it's the right decision. Again, you'll spot randomly bolded letters here as a warning sign that something's off.

You should be on the lookout for suspicious-looking phishing URLs from Pinterest profiles, as this is a primary way the XLoader malware is targeting victims and evading detection right now. There are about 20 commands outlined by McAfee that the malware can execute right now. These 5 pose the biggest threat to your personal data:

• get_photo: Sends all photos on your device to the hacker's command and control (C2) server
• getSmsKW: Sends all SMS messages on your device to the C2 server, which could possibly contain sensitive information sent to family and friends
• sendSms: Lets the XLoader malware send SMS messages from your device, potentially spreading phishing links to your friends and family
• gcont: Exports your contacts list to the C2 server, giving the hackers direct contact info for targeted phishing attacks
• getPhoneState: Grabs your device's identifying information, like its IMEI, SIM number, Android ID, and serial number

In its recent report, McAfee explains that it has told Google about the XLoader malware's technique of bypassing manual user launch to start running the app, and that Google is "already working on the implementation of mitigations to prevent this type of auto-execution in a future Android version." 

McAfee then goes on to explain that "Android users are currently protected by Google Play Protect, which is on by default on Android devices with Google Play Services." 

To see if Play Protect is active, open the Google Play app, tap on your profile icon in the top right corner, select Settings, and tap About to open the dropdown menu. At the very bottom, under Play Protect Certification, there should be a short message that reads Device is certified. 

A reader of ArsTechnica was receiving the personal data of other users, including account passwords and unpublished research papers. According to the latest report from Ars Technica, the cause of those ChatGPT histories were caused by a compromised account.

A representative from OpenAI told ArsTechnica, "we consider it an account take over in that it’s consistent with activity we see where someone is contributing to a ‘pool’ of identities that an external community or proxy server uses to distribute free access. The investigation observed that conversations were created recently from Sri Lanka. These conversations are in the same time frame as successful logins from Sri Lanka.”

If your OpenAI account is hacked, any personal data shared in your chat histories can be mined by hackers. This makes perfect sense, but the idea that you could access information from other compromised accounts is out of the ordinary when it comes to security threats.

How to protect your OpenAI account

As OpenAI does not provide multi-factor authentification, you need to make sure you use a strong password to keep your ChatGPT history protected.

Like with any online account, you want to follow the basic password security steps for your OpenAI account like you would with any other online account.

• at least 12-16 characters in length
• use a combination of upper and lower case, numbers, and symbols
• unique - not shared with any other accounts
• use a passphrase that is easy to remember but hard to guess
• change your password frequently

Of course, most people don't want to memorize a lengthy passphrase using a combination of letters, numbers, symbols, and cases. Not to mention a new passphrase for every account.

Which is why password managers exist. If you don't use the built-in password manager for your phone, laptop, or browser – take a look at our Best password managers page for help finding the best possible solution for your needs.

If you suspect any account may be compromised, be sure to change your password immediately to a long, unique passphrase.

Hacking, malware, and phishing attacks are just some of the ways your private accounts can become compromised. When they are, your personal data is exposed — including your private communications and financial information. That makes the theft of these credentials big business for cyber criminals. After all, in the digital age, nothing is more valuable than your data.

The most clear example of this is the big tech data economy. Companies like Google or Meta hope to mine relevant data from your age, location, and online activities — information we willingly give up through accepting the terms of service that allow us to make use of their search or social media platforms. This will typically be used to target you with more relevant ads, and is generally seen as a fair compromise to make use of their services for free.

However, there exists a darker side to the data economy that profiteers off of the private data of users, sold and traded across the darker corners of the World Wide Web. In these places, your private information (typically compromised through unethical hacking and phishing methods) can be used as a launch pad for further illegal activities like identity theft or to gain access to your financial information — and it all starts with your username and password.

How to check if your email or password has been compromised

Lists of user credentials sold and traded online can contain millions of entries, with one of the largest data breaches like this containing username and password information for over 727 million accounts. As of 2022, it's estimated that there are over 24 billion credentials circulating on the dark web and online.

Recent examples of these data dumps include the 100,000 OpenAI accounts that were compromised and sold on the dark web last year. More recently, a cache of user credentials was uncovered containing the usernames and passwords of over 70 million users across sites like Facebook, eBay, and more.

Data dumps like this pose a significant threat to anyone with an online presence, no matter how big or small. That's why it's vital that services exist to help inform you if your information is currently circulating within them.

Below are some of the options available online that provide such services.

1. HaveIBeenPwned.com

Credential breach repository "Have I Been Pwned?" is one of the most expansive and up to date libraries of compromised email addresses online. It currently holds records of nearly 13 billion emails that have appeared in data breaches.

After navigating to the website, enter your email into the search bar and hit search to check if it features in any known breaches. If it does, the site will inform you of which breaches, and when.

This information is vital to tracking where your information became compromised, and how long ago it happened. If it was recent, then a change of password is urgently needed.

• Visit HaveIBeenPwned now to check if your email has been compromised

2. Hasso-Plattner-Institut Identity Leak Checker

Similar to "Have I Been Pwned," the Hasso-Plattner-Institut is another credential breach repository with over 13 billion compromised accounts tracked across nearly 2,000 data dumps.

Every day, Hasso-Plattner-Institut adds over a million compromised accounts to its records and is the most comprehensive lists available online. To check if your information is found in this database, you'll need to enter your email address on the HPI Identity Leak Checker page.

Unlike "Have I Been Pwned," the results of your search will be sent to the email address in question, where you'll be informed of any threats including where they came from and when.

• Visit the Hasso-Plattner-Institut Identity Leak Checker now to check if your email has been compromised

3. Leakpeek.com

LeakPeek has a smaller library of data breaches to its name, but it does offer an expanded search that includes usernames, passwords, phone numbers, full names, and even images of your face.

The LeakPeak database is still over 8 billion entries strong, and the ability to search by username or password can help you gain more insight on how to better protect yourself and your data online.

If you use the same password across multiple logins, then being able to check if that is a part of the compromised data lets you know its time to retire it and start over with something fresh and more secure.

Using the LeakPeek website is similar to "Have I Been Pwned" and the Hasso-Plattner-Institut. Simply navigate to the Leakpeek homepage and select your search option, before entering your email, username, password, or full name into the search box and hitting search.

• Visit LeakPeek now to check if your email, username, password, name, or phone number has been compromised

Whether through phishing, cracking, or malware attacks, your usernames and passwords to websites, apps, and services are at constant risk from online ne'er-do-wells looking hijack, misuse, and profit from your credentials.

Sadly, this is less of an uncommon occurrence and more of a fact of life. While there are plenty of steps we can take to keep ourselves safe, the threat is persistent and all too easy to succumb to.

Sometimes, victims won't even be aware that their login details have been compromised and are being traded and sold across the shadier corners of the internet until it's too late — and that could be the case for over 70+ million people after a cache of usernames and passwords for popular sites, apps, and services like eBay, Facebook, and Coinbase was unearthed.

Naz.API: A 70 million strong repository of stolen credentials

New of this massive credential cache comes by way of Troy Hunt, the creator of popular website breach tracking site "Have I Been Pwned", who was informed of the credential stuffing list by an unnamed but 'well-known' tech company.

The list, known as Naz.API, was hosted on a well-known hacking forum, and was attached to a post dating back nearly 4 months. Typically, something like this passing by without causing too much fuss would likely mean it's recycled information. However, after investigating further, Hunt came across the startling revelation that almost a third of the information he sampled had never appeared online before.

Meaning, out of a list of over 70 million unique email addresses, there could be up to 23 million new accounts compromised as part of this one list.

Am I affected by this?

According the the original forum post, the information contained within the Naz.API list was sourced from "stealer logs," meaning information pilfered and snatched from machines infected with various forms of malware.

Once a machine is infected by a piece of malware, it can begin to siphon away credentials stolen through methods like keylogging, where every keyboard input registered by the machine is recorded and sent back to an attacker.

The full Naz.API list is a mix of older and newer information, though both are relevant if you have accounts included within the list — especially if those accounts are tied to bank cards with purchasing capabilities.

The emails found within Naz.API have since been compiled with the rest of the database on HaveIBeenPwned.com, where it is free to search by your email and see if your data was a part of this most recent uncovering.

HIBP is a safe and free service that only stores the email portion of information from breaches and lists. Performing a search will let you know if your email has been included in any data breaches or credential stuffing lists, giving you a heads up to change your passwords as soon as possible.

According to a recent report by Trend Micro researchers (via TechRadar), your Windows PC could be vulnerable to new malware known as Phemedrone Stealer. This malware is taking advantage of a vulnerability in Microsoft Windows Defender SmartScreen, and it's capable of working around your PC's built-in Defender antivirus software.

Officially, the malware is tracked as CVE-2023-36025 and has a vulnerability score of 8.8/10. If your PC is targeted, the Phemedrone Stealer malware can take sensitive data, like passwords and authentication codes, from your web browsers, cryptocurrency wallets, and even messaging platforms, like Steam, Discord, or Telegram. 

The attackers are also capable of seeing your PC's hardware, location, and operating system data. Your data can be stolen and/or screenshot, and then sent back to the hackers through Telegram or their command-and-control (C&C) server. Luckily, Microsoft has issued a patch for this vulnerability flaw—you just need to update your PC.

Is your Windows PC at risk?

Whereas Microsoft's Windows Defender SmartScreen typically performs checks and pops up prompts, this Phemedrone Stealer malware can work around all of these security measures. Trend Micro explained in its report that "various demos and proof-of-concept codes have been circulated on social media, detailing the exploitation of CVE-2023-36025."

As the vulnerability is shared more, more people become aware of the flaw, but this also means more attackers become aware of how to use the flaw to their advantage. Trend Micro writes, "Since details of this vulnerability first emerged, a growing number of malware campaigns, one of which distributes the Phemedrone Stealer payload, have incorporated this vulnerability into their attack chains."

Microsoft issued a patch for this vulnerability flaw in mid-November 2023, but plenty of hackers are seeking out Windows PCs that haven't been updated yet. If you haven't updated your computer in a while, now is definitely the time to do so. 

To see if your computer has any updates ready to be downloaded and installed, head to the search bar next to the Start button and type "Update." Select Check for updates from the menu options. 

Here, you can see which updates, if any, your Windows PC is ready for. It can take some time for Microsoft or other major companies to issue a fix or patch for malware, but keeping your system up to date is the best way to protect yourself against attacks.

If you use a Google account, you might also want to check out this sneaky malware that lets hackers access Google accounts without login information or two-factor authentication.

Most websites you visit in your browser will ask you to accept or reject cookies, and for the most part, these cookies can be helpful and they're supposed to have a limited lifespan. Browser cookies can remember what's in your shopping cart or save your login status on a website, making your browsing experience easier.

Unfortunately, a recent report from CloudSEK researchers (via BleepingComputer and Android Police) outlines how hackers have been using a zero-day exploit to restore expired Google authentification cookies. Put simply, this exploit means that hackers can use your expired browser cookies to bypass two-factor authentication and gain access to your Google account.

How can you protect your Google account login details?

Six malware groups are currently selling this exploit, and with no word from Google yet on the exploit or their plans to combat it, there's no way to know how long your login details will be vulnerable or even if you've been affected.

According to a discussion between BleepingComputer and CloudSEK researcher Pavan Karthick, the company was able to reverse-engineer the exploit and "use it to regenerate expired Google authentication cookies, as shown below." 

Although Karthick and other CloudSEK researchers were able to successfully regenerate authentication cookies for Google account login details (thus verifying the exploint), here's some good news. Karthick explained to BleepingComputer that "the authentication cookie can only be regenerated once if a user resets their Google password." 

This means that if you reset your Google account password, hackers can still gain access one more time by regenerating authentication cookies, but not after that. If you don't change your password, the authentication cookie can be regenerated multiple times, giving hackers continuous access to your account. Simply signing out of your account won't prevent authentication cookies from being used to access your account. 

And unfortunately, until the exploit is addressed by Google and fixed, hackers could repeat the process again with your new login credentials after you change your password. Google hasn't officially said anything about this security exploit, but the company issued countermeasures to seemingly fight off hackers, but malware group Lumma issued an updated exploit that bypassed Google's countermeasures.

There doesn't seem to be a permanent fix to protect yourself from this vulnerability. Your best chance will be changing your Google account password regularly, and hoping that Google updates its users soon with a plan of action. Check out the best password managers to keep track of all your passwords.

Stepping into the digital world feels like a carefree experience.

After all, can malicious code even make it past walls of security offered by Apple’s Privacy Platform?

And who would dare attempt a ransomware attack on the four billion devices Google protects with the “world’s most advanced security?”

While cybersecurity experts grind to keep us safe from threats, hackers work just as hard to break down our vaults. That’s where antivirus software comes in: continuously scanning for malware, spyware, ransomware, and adware to defend against immediate threats. It's even more critical now that AI is in the mix, using several methods to trick unsuspecting netizens, such as voice cloning.

Antivirus apps will protect your devices from malicious cyber threats that swipe your personal information, ransomware that holds your data hostage, and sneaky phishing attempts ⁠without impacting their performance.

Better yet, the best come bundled with extra security features such as password managers, VPNs, and more. Whether you need top-notch security for your smartphone or want better protection for your MacBook, these reputable antivirus apps will keep your data safe.

What is antivirus software? 

Antivirus software is designed to detect, prevent, and eradicate any form of malware on your device. Its main goal is to scan all kinds of data, including software, applications, files, and even web pages. It should also notify you about suspicious entities, allowing you to block or remove emerging cyber threats.

These threats can consist of different types of malware, including computer viruses, spyware, adware, ransomware, Trojans, spam — anything that could cause mayhem to your system. Think of it as your personal CIA team doing background checks on every person, er, I mean program, you encounter.

The software will perform different types of analysis, including specific analysis, which pinpoints familiar malware; generic analysis, which recognizes parts of known malware code; and heuristic analysis, which searches for unknown, threatening malware that follows the usual malicious routine.

The best antivirus apps take protection a step further, offering everything from VPN services to stay anonymous online and password managers to keep your private credentials secure to cloud backups, multi-platform compatibility, and even parental controls, including GPS tracking and alerts. Find out the best ones below.

The best antivirus apps

Bitdefender has been in the antivirus game for a while, and it continues to thrive by being a reliable, award-winning antivirus app not just for Windows but also for macOS, Android, and even iOS. It’s hard to beat the level of malware protection and extensive security features it provides, especially at its competitive subscription prices (which are regularly discounted).

Whether you own a Windows laptop, MacBook, Android phone, iPhone, or all of the above, you can expect automatic protection, thanks to its numerous anti-malware and threat prevention solutions. Expect multi-layer ransomware protection, anti-phishing and anti-fraud tools, webcam protection and microphone monitoring, web attack prevention to keep you from entering harmful sites, vulnerability assessments — the list goes on.

It isn’t just fortified security, as Bitdefender also boasts exclusive Photon technology to adapt to your system and keep things running smoothly. Antivirus apps are known to slow down your devices due to their constant detection protocols, so an app that barely hinders performance is ideal. The antivirus software adds a OneClick Optimizer on its Total Security subscription plan to boost performance on your devices.

Bitdefender also throws in a bundle of extra noteworthy features you would otherwise need to get separately, including a password manager and VPN. However, its VPN service is limited to 200MB, which is fine for browsing the web and looking through email, but anything else will quickly eat through the data limit. It also has a limitless VPN Premium service, but its $29.99/£29.99 first-year subscription costs as much as antivirus plans, making it a pricey venture. Plus, not all devices get the plentiful features Bitdefender offers for Windows, such as the macOS option not offering a password manager.

Still, at just $29.99/£24.99 a year for up to three devices, Bitdefender is a brilliant choice for keeping all your devices malware-free.

Norton is a household name in the antivirus industry, and for good reason. Not only does it offer one of the best anti-malware protection services around, but it does it all without impacting your device’s performance and even boasts a brilliant array of added security features at lower prices than its competition.

At just $25.99/£19.99, Norton 360 includes an unlimited, no-log VPN service users can turn on freely, meaning their identity is safe no matter where they go online. Plus, it comes with real-time threat detection, password manager, smart firewall for PC and Mac, SafeCam for PCs, and a 100% virus protection promise with 24/7 customer support. This is only for one device, however, but you’ll find its Deluxe and Advanced plans can add up to five or ten devices, respectively.

On the higher-priced plans, users will also get dark web and social media monitoring, parental control features, and even device optimizers to help gamers stay safe without impacting gaming performance. One of its more notable features is that users can back up their data safely with up to 50GB of online storage.

Unfortunately, this is only for Windows devices, meaning those mainly using macOS, Android, and iOS can’t access this, which is disappointing. That said, anyone opting for an antivirus app mostly wants to stay protected online, and Norton 360 (at any price plan) will get the job done.

Trend Micro is a solid choice if you’re a single user looking for a standard antivirus protection service, especially if you’re not looking for all the bells and whistles found on other antivirus apps and are looking to keep the price down to just under £10 (only under $40 for three devices for U.S. pricing).

Although the service lacks cloud storage in its subscription plans (along with webcam protection), it still offers a limitless VPN, One Proxy Pro, password manager, and 24/7 support. While Trend Micro’s site claims that it protects explicitly against ransomware, this also expands to other types of malware. Plus, its “Advance AI Learning” will keep all your devices, including Windows, macOS, iOS, Android, and even Chrome OS for Chromebooks, squeaky clean.

Unfortunately, Trend Micro’s basic plan is only for Windows or Mac; users must pay around $60/£30 to get protection for mobile devices and Chromebooks. This is more for families with multiple devices, including parental control features to keep the little ones safe online.

While it offers flawless antivirus protection, devices can suffer performance issues during full scans. This isn’t a deal breaker, but compared to other antivirus apps that work fine alongside other system functions, it can be annoying. If you are just looking for simple but strong malware protection, Trend Micro aims and delivers.

If you haven’t encountered pre-installed McAfee antivirus software on your laptop before ... it’s only a matter of time.

McAfee is a widely known antivirus app that’s easy to use and usually the go-to for protecting your device. However, it isn’t the most robust anti-malware protection service.

With McAfee, you can expect speedy checkups, a firewall, web protection, and a protection score rating. You’ll also get a password manager, a file shredder, and multi-platform compatibility for five or ten devices for $34.99/£34.99 and $39.99/£39.99 per year (on a two-year subscription plan).

The McAfee app makes things simple with one-click fixes on its UI. The Windows version is always up to date, but the macOS or iOS versions are a bit dated. McAfee will be updating these soon. While McAfee offers brilliant security, it sometimes scores under what its rivals offer.

It also offers a VPN service limited to 500MB per month unless you enroll in its auto-renewal payment method. Plus, you’ll lose the identity theft protection feature if auto-renew isn’t switched on. McAfee makes a 100% guaranteed virus protection pledge, or you get your money back, which is always a good sign.

FAQs

Q: What's the best mobile antivirus app?

Based on our testing, some of the best mobile antivirus apps include Norton, McAfee, Certo, Avira, Trend Micro, and Bitdefender. Some of these are available for free, and all of them will protect you from a wide range of threats, from malware to dangerous websites and nuisance adverts.

Q: What's the best free antivirus?

Most antivirus apps come with free tiers or trials. One of our favorites is Bitdefender, which has a free tier that covers most users' needs.

According to 404 Media (via Gizmodo) marketing team under Cox Media Group (CMG) is claiming that "your devices are listening to you" and collecting relevant data to sell to advertisers. While this sounds like a terrifying invasion of privacy, you can rest easy knowing that it's not true.

CMG makes this "Active Listening" feature sound glamorous to potential clients, asserting that they can collect voice data clips like "The car lease ends in a month- we need a plan" or "Do I see mold on the ceiling?" In reality, CMG's claims that your devices are recording voice data are baseless, and the company has since redirected the website page containing these dubious claims.

Gizmodo points out that past research shows "very little evidence that your phone's microphone is listening to you." It's much easier and more cost-effective for advertisers to collect your web data—like your search queries, browser cookies, and social media posts—rather than use AI to comb through hours of audio files to find helpful content to sell to businesses.

Plus, with modern security protections built into Android phones and iPhones, you'd know if your device was listening to you. Here's how to check your phone's permissions to make sure no unwanted apps have microphone permissions.

Is your device listening to you? Here's how to check

With modern versions of Android OS and iOS, your smartphone has an indicator that shows when your microphone is in use. When an app is using your microphone, iOS users will see an orange dot in the status bar, and Android users will see a green dot in the top right corner.

If this isn't enough assurance for you that your phone isn't currently listening to you, you can dive into your phone's Permission settings to double check which apps have access to your microphone.

To check permissions by type on Android, head to your Settings app and select Security & Privacy > Privacy > Permission manager in order. From this screen, you can select Microphone to see which apps are allowed to use your microphone. For most people, any apps with permission to use your microphone will show up under the heading Allowed only while in use, and not Allowed all the time. 

It's just as easy to check permissions by type on an iPhone. Similarly, you'll head to your Settings app and select Privacy & Security from the menu. From here, select the Microphone category to see which apps are currently allowed to use your microphone, and under what conditions.

If you want to further protect your phone, check out these game-changing security features in iOS 17 and Google's new real-time malware scan feature for Androids.

Make sure your Google Chrome browser is updated as soon as possible to avoid potential malicious attacks by remote hackers. On November 24, Benoît Sevens and Clément Lecigne of Google's Threat Analysis Group discovered an integer overflow bug (called CVE-2023-6345) in Skia, the graphics engine for Google Chrome and ChromeOS (via Android Central). 

According to the National Vulnerability Database, this integer overflow bug "allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file." In simple terms, this bug could allow hackers to execute a virus on your laptop via Chrome or access your sensitive in-browser data. 

The bug has a Chromium security severity of high, and in Google's recent release notes, the company notes that it's "aware that an exploit of CVE-2023-6345 exists in the wild." Automatic updates will roll out to Mac, Linux, and Windows users "over the coming days/weeks," but many people are able to update to the new browser version now.

Here's how to check your Chrome browser's version number, as well as how to manually check for updates if you don't have the most recent update yet.

How to update your Google Chrome Browser

If you don't have Google Chrome set to automatically update, you'll need to manually check for updates to get the patch for this integer overflow bug. For Mac and Linux users, the stable channel will be updated to 119.0.6045.199, and for Windows users, it'll be updated to 119.0.6045.199/.200. 

To see your Chrome browser's current version number, click on the three vertical dots in the top right corner of your open browser window. Select Settings from the dropdown menu, and then scroll all the way down to find About Chrome in the left-side menu.

Underneath the Google Chrome header, you'll see Version followed by a string of numbers. Compare the numbers you see to the ones above specific to your computer's operating system. 

Above my current version number, there's a message that reads "Nearly up to date! Relaunch Chrome to finish updating." If you see this message, it means your browser has automatically been updated with the most recent patch, and you just need to restart the browser to complete the process. Any tabs you currently have open will reopen once your browser restarts.

If your version number isn't up to date, it's possible the patch might not have reached you yet. Once there's an update to install, it'll either be automatically installed if you have auto-updates enabled, or you'll see a button that reads Update Google Chrome.

This is Chrome's sixth zero-day vulnerability this year, but it looks like Google is acting quickly and rolling out a patch before any major harm can be done. Plus, a month ago, Google boosted its privacy game with a tool that can hide your IP address. It might not be as privacy-focused as FireFox or DuckDuckGo yet, but it's a step in the right direction.

While small in numbers, the Google Play Store has been subjected to a wave of Versioned-in malware attacks of late — and infections stemming from third-party Android Packages (APKs) is an ever-present threat for Android users.

While Google are hard at work playing whack-a-mole with the former, the company's ability to protect users from third-party apps installed beyond the Google Play Store has just been given a notable boost thanks to a recent Google Play Protect update.

Google Play Protect: What is it?

Google Play Protect is the Android app store's bulwark when it comes to safeguarding against spyware and malware intrusions. It's built-in to Google Play services already, and has been protecting millions of users from bad-faith apps for years.

Play Protect scans ~125 billion Play Store apps daily on the Google backend to ensure its databases are always up to date. An essential task given the latest Versioning tactic used by malicious developers to sneak apps past Google's malicious code detection systems.

Should Play Protect find a malicious app, it can then take actions, either by warning users, preventing the app from installing, or disabling apps automatically.

Google Play Protect: real-time scanning keeps Android users safer

Play Protect historically keeps install numbers of malicious apps through the Play Store down to a fraction of a percent. However, this has led to a rise in harmful apps being pushed onto Android users outside of the Play Store through direct downloads of APKs by using links in SMS messages, websites, and messaging apps.

While Play Protect can still warn users if the malicious app is already known to Google, these apps exist "off the grid" to the Play Store, and typically never pass through Google's rigorous checks — leaving users exposed to potentially harmful attacks.

In response, Google have enhanced Play Protect to keep users installing apps inside and outside of the Google Play Store safer than ever. The update, which began rolling out to users yesterday, sees Play Protect now offer real-time, code-level scanning of unknown apps in order to detect malicious intent or variations of harmful code.

This real-time analysis will then be able to inform users if a third-party APK is safe to install and pass this information back to Google's servers to keep others safe in future.

Google Play Protect: How to enable Google Play Protect

Google Play Protect is enabled by default on Android Phones making use of Google Play Services. However, if you want to make sure you're protected let's go through the steps of making sure this feature is currently active.

Step 1: Open the Google Play Store.

Step 2: At the top right, tap on your profile icon.

Step 3: Tap Play Protect, and then Settings.

Step 4: Make sure "Scan Apps with Play Protect" is set to On. 

Outlook

While this seems like a minor update on the surface, the enhancement to Google Play Protect is a notable leap in security for Android phones. Not only will more Google Play Store users be safer from unknown threats, but so too will those making use of unregistered APKs.

Each app scanned by Play Protect aids in training Google's machine learning algorithms, helping it recognize threats easier. This includes advanced threats such as polymorphic and AI incursions that prove both difficult to detect and even more difficult to remove from a user's device.

As an update to this piece, a Google representative has informed us that Google Play Protect is aware of the core SpyNote threat and users are protected against its installation. "Google implemented user protections for this spyware ahead of this report's publication. Users are protected by Google Play Protect, which can warn users or block apps known to exhibit malicious behavior on Android devices with Google Play Services."You can read more about Google Play Protect's new real-time scanning feature for unknown applications here.

Android users have been put on spyware high-alert as a banking trojan by the name of SpyNote has recently returned to the limelight.

The Android-based malware has been a background security threat for users since 2022. However, now in its third revision and with source code of of one of its variants (known as 'CypherRat') having leaked online in January of 2023, detections of this spyware have spiked throughout the year.

SpyNote isn't like many of the threats Android users face. You won't find it tucked away inside of an innocuous app on the malware infected hellscape that is Google Play — at least not for now.

Instead, its primary method of spreading is through 'Smishing' or SMS phishing. These SMS messages can range from government updates to social media alerts with links to malicious apps. Here users will be misled into downloading an Android Package file (.APK), that works outside of the Google Play Store to infect a device and begin it's nefarious deeds.

SpyNote: What does it do?

As stated, SpyNote's primary method of infection is through SMS phishing attacks. However, variants of the spyware do exist and its methods of infection may evolve over time.

If you're unlucky enough to fall foul of these attempts, the third-party app (while posing as an official update or legitimate service) tricks the user into accepting various permissions — after which, it will hide itself from view and begin to work behind the scenes at collecting user data in the following ways.

• Audio recording: Including microphone access and phone calls.
• Camera recording: Being able to access a victims camera for pictures or video.
• Keylogging: Recording every input and tap you make on your device.
• Credential theft: Stealing user logins (usernames, passwords, passkeys, and more) by intercepting banking, crypto wallets, and social media apps.
• Screen recording: Through screenshot captures and device streaming.
• GPS tracking: Accessing location services to track a victims location.

SpyNote: Do I have it, and how do I remove it?

SpyNote's presence is hard to detect, and even harder to remove. If you've accessed a link to an app through SMS at any point, one of the ways you can tell if SpyNote is present on your device is by seeing if it reacts to you opening your device's Settings menu.

The purpose of any piece of spyware is to collect as much information as possible, as such it needs to stay on the device for as long as possible. One of SpyNote's methods of ensuring this is to repeatedly close the settings menu whenever it is opened — preventing users from uninstalling the third-party app through the usual menus.

Amit Tembe, a researcher at security firm F-Secure, SpyNote is a particularly difficult piece of software to remove from your device "often necessitating a factory reset, resulting in data loss."

Sadly, this seems like it's often the best way of removing the troublesome spyware from your system, before changing any and all logins you may use afterwards to prevent the spread, sale, and use of your credentials without permission.

Outlook

SpyNote's pervasive pilfering of your information runs incredibly deep. Meaning removing it from your phone will be only half the journey when it comes to recovering from its effects.

As always, to avoid instances like this, Laptop Mag recommend only downloading apps through verified channels such as the Google Play Store. While it might not be perfect and security vulnerabilities will happen from time to time. It's the much safer alternative to downloading third-party Android Packages (.APKs) that bypass Google's security steps altogether.

Earlier this year, Google made a huge step towards a "passwordless future" and introduced passkeys, which are more secure, faster to use, and easier to remember than traditional passwords. A passkey could be your PIN, face, or fingerprint used to unlock your device.

Starting today, passkeys will be the new default (via The Verge). Google users will be prompted to create a passkey for their account if they haven't already, making it easier to switch from password to passkey.

If you're not ready to make the change, don't worry. Although it's an industry-wide goal for passkeys to eventually phase out traditional passwords, Google says that "new technologies take time to catch on — so passwords may be around for a little while." You can opt out of creating a passkey, and stick with your trusty password for now. 

What makes passkeys more secure?

Alongside Apple and Microsoft, Google announced last year that it would support a new sign-in standard that was created by the Fast IDentity Online (FIDO) Alliance to embark on a journey towards a password-free future. Google says "this joint effort to create a safer alternative to passwords is rooted in passkeys." 

Put simply, "a passkey is a FIDO credential stored on your computer" that you use to unlock your online accounts. Because a passkey requires proof that you are who you say you are, it's much safer than a traditional password. 

Traditional passwords typically contain pet names, important dates, family member names, or favorite books, sports teams, or movies—this is all information that can easily be guessed for malicious reasons or forgotten by the user over time. 

To combat the vulnerability of traditional passwords, we've seen fixes like multi-factor authentication or authenticator apps. Google thinks passkeys will replace traditional passwords and all the extra security measures placed on top.

You can have more than one passkey on multiple devices, and you don't have to worry about someone else gaining access to everything that requires a passkey on your device if you lose it because your passkeys are only useful to you. Google says passkeys "authenticate that you are in posession of your device, and that you are the one accessing your account."

Passkeys are phishing-resistant and 40% faster to use than traditional passwords. Plus, you'll never have to remember which numbers or special characters you added to your password to make it different from your previous password.

If you haven’t been prompted yet to switch from your old password to a new passkey, check out our guide on how to use passkeys to sign into your Google account to manually make the switch. 

If you've recently downloaded Bitwarden as your go-to password manager, you might want to double check that it's not masquerading as password-stealing malware. Proofpoint researchers identified a new malware they're calling ZenRAT that's prompting unsuspecting users to download fake installation packages of Bitwarden. 

This malware seems to only be affecting Windows users, while users on other platforms are only sent to a benign webpage. Proofpoint was tipped off to this malicious software by Jérôme Segura at Malwarebytes, but it's unclear at the moment how people are stumbling across the malware in the first place.

How to avoid this password-stealing malware

If you're not using Windows, you're safe from this malware attack. Anyone using a different OS who clicks on the fake Bitwarden site is sent to a webpage containing a cloned article from opensource.com, but there's no malware in sight.

For Windows users, clicking on the fake Bitwarden site opens up a page that looks almost identical to the real Bitwarden site. If you look at the address bar, however, you'd see that the site address reads bitwariden[.]com rather than the real bitwarden.com. 

On this fake Bitwarden site, clicking the Download button or the Desktop installer for Windows Download button would send a request to crazygameis[.]com to grab the malicious Bitwarden installation package. Proofpoint notes that crazygameis[.]com no longer appears to be hosting the malware, and the names and versions of the malware have changed a few times over the past few months.

Only Windows users can access this fake Bitwarden site, but links for Linux and macOS downloads are still clickable. If someone clicks on a non-Windows download link, they're redirected to the actual Bitwarden site.

When Proofpoint looked at the installer details for the malware package, they found the installer posing as Speccy, a software used to gather system specifications, and claiming to be signed by Tim Kosse, known for developing the Filezilla FTP/SFTP software. 

According to Proofpoint, "The installer file copies itself to C:\Users\[username]\Appdata\Local\Temp, and creates a hidden file, named .cmd in the same directory that launches a self-deletion loop for both itself, and the installer file." This self-deletion loop means that the file will automatically remove both it and the installer as soon as it finishes running.

It looks like ZenRAT is collecting host data once it's installed, including your computer's CPU Name, GPU Name, OS Version, installed RAM, IP address and gateway, installed antivirus programs, and installed applications. 

Right now, Proofpoint doesn't have any leads on how traffic is being directed to the fake Bitwarden site in the first place. Historically, fake software installers catch victims through SEO Poisoning, adware bundles, or email phishing. 

SEO Poisoining, or phishing through fake sites and ads in search engine results, seems to be growing in popularity, so be extra careful to read the site's address before clicking on it, downloading anything, or inputting personal information. For extra security in the future, be sure to check out these Windows security settings you should change. 

A ransomware newcomer is advertising its recent hack of all Sony systems. Reported by Cyber Security Connect, this ransomware group “has racked up an impressive amount of victims” despite starting operations as Ransomed.vc only a month ago. 

If the ransomware group’s claims are to be believed, Sony is the latest victim. Unlike the 2011 Sony hack that left personal details of 77 million PlayStation Network users exposed, this hack includes all Sony systems, not just the PlayStation sector. Sony hasn’t confirmed yet whether its systems were hacked by Ransomed.vc, but here’s what we know so far.

The proof behind the hack isn't substantial

Ransomed.vc is claiming they’ve “successfully compromissed [sic] all of sony systems,” but the proof to back up this claim is lacking. There are screenshots of an internal login screen and an internal PowerPoint presentation with test bench details. Then, there’s a file tree of the stolen data, which includes less than 6,000 files. 

Among these files, there are build log files, some HTML files, and various Java resources. For a hack that involves “all of sony systems,” the number of stolen files used as proof is pretty small. After all, Sony is a multinational conglomerate corporation with a ton of divisions, subdivisions, and employees, so the company likely has millions of files—not just 6,000.

Of course, these 6,000 files used as proof-of-hack information could just be a snippet of what Ranssomed.vc stole, but we won’t know for sure until Sony confirms or denies the attack. In the message attached to the leaked attack, Ransomed.vc adds “We won’t ransom them! We will sell the data. Due to Sony not wanting to pay. DATA IS FOR SALE.”

According to Cyber Security Connect, Ransomed.vc listed a “post date” of September 28. There’s no price attached to the stolen data, but the ransomware group left its contact details. If the data doesn’t sell before the posted date, the group will likely publish it wholesale rather than wait for an individual buyer.

It's worth mentioning again that Sony hasn't officially confirmed this ransomware attack, but the company has been hacked before. In the meantime, if you're worried about how ransomware works and how it could affect you, check out our helpful guide. 

Pause before you open that incoming Skype message on your mobile device. As reported by PCWorld, a recent flaw in the Skype mobile app reveals your IP address and location to threat agents without your knowledge. Sadly, all you have to do is open the message with a link, and you're now vulnerable. 

According to the report, the odd thing is that Microsoft knows about this flaw, but is taking a lackadaisical approach to coming up with and releasing a fix. Although the tech giant knows of the spot, it has supposedly decided the flaw doesn't meet the criterion of a severe security threat or vulnerability. Apparently, giving away your location and IP address isn't a severe privacy issue for them. 

Microsoft's flawed reaction to security threat

According to 404 Media Report, you don't have to click the link within the message. All you have to do to give away your IP and location is open the message. An independent security researcher named Yossi discovered the flaw and reached out to Microsoft, and in emails, he shared with 404 Media Report, the tech giant stated, "The issue did not require immediate servicing and did not indicate that it plans to fix the security hole."

Although Microsoft did say it would patch the hole in the future with an upcoming update, no timeline was given. A fear some have is the security flaws' ability to give away a person's physical location, which is a significant privacy and personal security risk. How Microsoft has deemed this non-concern is very concerning. Using Skype to locate someone you may have issues with to escalate or exacerbate the problems is a huge danger, especially with lax gun laws in the United States of America and the daily mass shootings. 

Microsoft's stance that, "This report does not appear to identify a weakness in a Microsoft product or service that would enable an attacker to compromise the integrity, availability, or confidentiality of a Microsoft offering," is reckless and endangers the wellbeing of anyone using the Skype mobile application. 

Since Microsoft has yet to fix the issue, Skype, which has been losing much ground in recent years, seems to be further burying itself as a communication platform. How does one use Skype knowing that it is unsafe? Since there is no fix, not even using a VPN, which usually hides your location, will not protect you from this massive security flaw. 

The only advice I would suggest is, until Microsoft addresses this issue with an update, don't use Skype as you could be giving away your location. As developments happen with this story, we will keep you updated. 

Duolingo is in hot water after it's been revealed that hackers scraped data of 2.6 million users from the language-learning app, according to BleepingComputer. Duolingo confirmed to TheRecord that it's investigating a post on Breached, a hacking forum, that offered $1,500 in exchange for its customers' details.

Interestingly, however, a Duolingo spokesperson denies that a data breach or hack occurred. "These records were obtained by data scraping public profile information," a Duolingo spokesperson said.

However, BleepingComputer isn't convinced; users' email addresses were exposed in the breach, which are not available to the public.

How it all went down

In January 2023, a malicious actor was selling scraped data of 2.6 million Duolingo users on a now-defunct version of Breached. As mentioned, the price tag for the exposed information was $1,500.

According to BleepingComputer, this data includes users' real names, public login, email addresses, and even their language-learning progress. On Monday, X user VX-Underground spotted that the Duolingo data leak was released on a new version of the Breached forum.

The threat actor claims that he snagged Duolingo users' information by scraping an exposed API. Pundits suspect that the threat actor fed this API email addresses leaked in previous breaches. Next, the API likely confirmed whether the email addresses are connected with an active Duolingo account. Consequently, the threat actor had the opportunity to create a Duolingo customer data collection that features a mélange of both public and non-public information.

How to check if you've been compromised

Interestingly, Have I Been Pwned, a site that lets you check whether you've been compromised in data leaks, tweeted that 100% of the details scraped from the Duolingo breach were already in its database.

Have I Been Pwned added the Duolingo data breach to its system, so click here to see whether your information fell into the wrong hands.

It feels like we are reporting on a new hacking incident daily and it's easy to see why with tools like Raccoon Stealer out in the wild.

The subscription-based malware tool is designed to give hackers an easy interface to aid them in their quest to relieve you of your private data, while also evading the authorities (via Bleeping Computer).

Trash panda hackers

The aptly named Raccoon Stealer is nothing new, but after its main developer was arrested in October of 2022 it seemed like it may simply disappear. Of course, with money to be made, someone else took up the reins and the subscription hacking app is back to help hackers forage through your private data in over 60 apps to reveal treasures like your credit card details, login info, browsing history, cookies, and of course the ever-popular crypto wallets.

For $200 a month, newer hackers get access to these updated tools which give an easier interface from which to launch nefarious data thievery. 

A new dashboard allows them to quickly search through large breached datasets. It also offers enhanced protection with a feature that attempts to identify security measures in hacked PCs so that it can delete any potentially incriminating evidence on those machines. An activity profile shows the hackers the potential threat posed to them by any given PC with a red, yellow, and green emoji. Another new system identifies IP addresses associated with crawlers and bots typically used by cyber-security firms and blocks them. Last, but not least a Log Stats panel gives the hacker a look at how their digital crime spree is faring with how many PCs they've infiltrated and their success rate in specific regions.

How to avoid being hacked

Unfortunately, malware-as-a-service isn't going away, which means hacking is just getting easier and the threats are going to continue to grow. So you need to arm yourself against the modern web with a couple of handy tips.

First, you need to be using a password manager, and while the one built into your browser is terribly convenient, it is a large piece of software that can end up with a hole that exposes your login info. That's not to say that password managers are never breached, but select from one of the best and it is far less likely to happen and may even give you tools to rapidly change passwords en masse if a breach does happen.

Secondly, you should be using two-factor authentication, it's going to seem annoying at first and please do not use the versions that use a text or email as the confirmation, but ultimately proper 2FA will save you the massive time suck and headache of dealing with a significant breach of your data.

Stay safe out there!

Not a week goes by without the Google Play Store playing some part in delivering a strange new malware designed to steal from or spy on Android users — if it’s a good week, it’ll even manage both.

Many have been left puzzled by how the Google Play Store became more riddled with viruses than a sailor on shore leave — but not Google, who seem to have figured out how hackers are manipulating its platform to their benefit.

Google Play Store: A weakness exposed

A recent threat report published by Google’s Cybersecurity Action Team indicated that, in spite of a recent spike in cases, less than 1% of all downloads from Google Play are what the company calls Potentially Harmful Applications (or PHAs).

Google thoroughly evaluates all apps before release onto the Google Play Store and when PHAs are detected they’re quick to act — promptly removing apps and terminating developer accounts.

However, knowing this to be the case, dastardly developers have switched tactics. Instead of allowing a harmful app to go through Google’s evaluation process and risk getting flagged as a PHA, malicious actors will submit an innocuous and seemingly legitimate app for Play Store evaluation at first to gain Google’s trust.

However, once the app is on the Play Store it will receive an update from a third-party server — altering the app's code and functionality, allowing malicious extensions to execute freely.

Versioning: How good apps go bad

This process is called versioning — a circumvention of Google Play’s policy against any apps that can “modify, replace, or update itself using any other method than Google Play’s update mechanism.”

Google has identified one instance of versioning as Dynamic Code Loading (or DCL). DCL apps have the potential to download and run code from untrusted sources beyond the walled garden of the Google Play environment. This allows previously legitimate apps to bypass Google’s PHA checks and convert themselves into malware or spyware right under Google’s noses.

Google does state that apps making use of DCL “violate Google Play Deceptive Behavior policy and may be categorized as a backdoor.” 

Outlook

While Google has identified one of the main pipelines to malicious apps appearing on its platform, the report fails to indicate exactly how they plan to combat it. However, it’s highly unlikely that the Cybersecurity Action Team behind the report are willing to allow malicious actors to continue with their efforts for much longer.

Could we see a Play Store crackdown on DCL apps in the near future? Quite possibly. Google will no doubt be keen to patch up its app platform's biggest security flaw and hard at work on sealing shut any backdoor vulnerabilities currently being exploited.

For news, rumors, and updates on all things cybersecurity and tech, follow Laptop Mag on Twitter, Facebook, and Flipboard for the latest word as it arrives.

Nothing is worse than Googling yourself and discovering invasive information you wish you could erase. Fortunately, a collective sigh of relief rang around the world when Google debuted its "Results about you" tool last year. It lets users easily remove their phone number, home address, and email from Google Search.

On Thursday, Google announced that it's rolling out a few updates to the "Results about you" tool, including a new dashboard that alerts you of any web results displaying invasive information about you. How cool is that?

How to access the updated "Results about you" tool

As mentioned, the updated "Results about you" tool gives you an overview of existing web results that are displaying your private information. On top of that, it will also send you notifications about any new results that have your contact information. 

Don't know how to access this tool? Follow the steps below.

1. Go to the Google app. (If you don't have it installed, you can get it here if you're an iPhone user or here if you're an Android owner.)

2. Tap on your Google account photo or icon on the top-right corner.

3. Tap on Results about you. 

Here, you should see a new dashboard that makes it easier for you to see a better overview of your online footprint, making the removal process more seamless. Again, you'll be notified about any new results about you, too.

If you don't see the new dashboard yet, don't worry. Google said it will roll out within the next few days, starting with U.S. users.

Keep in mind that while your information may be removed from Google Search, it will not be scrubbed from the internet. You'll have to reach out to the website directly for this.

WhatsApp, Telegram, Signal, and Facebook Messenger users have been put on high alert as the latest threat to their chat data has emerged in the form of “Safe Chat” — a fake instant messaging app.

The impostor app is convincingly designed but has no intention of allowing peer-to-peer communication — instead, the app’s primary goal is to spread the “CoverIm” malware, previously weaponized across the murky gizzards of the Google Play Store by APT (Advanced Persistent Threat) group ‘DoNot’.

Safe Chat: It’s anything but 

According to CYFIRMA, the analysts who exposed the Android security threat, the spread of the fake messaging app is done primarily through social engineering across instant messaging services like WhatsApp. Here, a victim will be tricked into believing they are downloading a more secure platform with which to talk over — unsuspectingly opening themselves up to further exploitation.

Safe Chat’s convincing user interface tricks victims into accepting a series of permissions under the guide of setting up a secure and safe chat environment. However, in actuality, the imposter app uses these permissions to begin the act of data extraction before the victim is even aware something is wrong.

The malware housed within the Safe Chat app will then begin to capture screen activity including keystrokes — and thanks to previously accepted permissions to ignore battery optimization and background usage it will continue to do so even while minimized or closed.

CoverIm Malware — How bad is it? 

This particular instance of the CoverIm malware is particularly nefarious, especially when paired with its expanded privileges through the accepted Safe Chat permissions. As well as acting as a keylogger for keystrokes the malware is also capable of accessing precise locations through GPS, accessing your contacts list, SMS messages, call logs, and even external storage on your device.

The malware will also begin monitoring other messenger apps like WhatsApp, Signal, Telegram, and even Facebook Messenger for further data — all of which can then be transmitted to a C&C (Command and Control) server where attackers can then obtain all gathered information.

Outlook

Due to Safe Chat’s social engineering delivery method, there’s no clear indication of how many users may be affected by the malware, though it is believed that the majority of those infected reside in South Asia.

That being said, successful campaigns like this will often breed copycat attempts, so ensure you start alert across instant messaging apps and only install apps from trusted sources and storefronts.

If you have the Safe Chat app on your device delete it immediately before clearing your cache and running a full scan with an antivirus app of your choice.

For news, rumors, and updates on all things security and tech, follow Laptop Mag on Twitter, Facebook, and Flipboard for the latest word as it arrives.  

If you have an Android phone, your crypto wallet is regularly at risk from bad actors with fake apps that steal your information. Two new malware families have been discovered — named ‘CherryBios’ and ‘FakeTrade.’

They were both on Google Play for a while, and being widely shared across social media and fake websites. Here is a little more about how they work, but please make sure you delete them immediately, and keep that wallet safe.

Popping the Cherry (Bios)

Discovered by Trend Micro, these two new Android malware families have one goal in mind: steal your cryptocurrency details to conduct scams or nab your funds. 

CherryBios has been distributed since April 2023, and is commonly found across social media, disguised as an AI tool or coin miner. To access your cryptocurrency funds, it manipulates your Accessibility service permissions to gain access to configuration files from the C2 server — a backdoor that can be used to automatically grant permissions without any user interaction.

With that, the user isn’t able to kill the app’s process of taking your crypto credentials. More concerning is the fact it also uses OCR (optical character recognition) to extract any text from images saved on your device. So if you screenshot your recovery phrase for your cryptocurrency wallet, that’s not safe when CherryBios is around!

FakeTrade is a separate campaign that uses the same nefarious means, but seems to be a little more widespread, given that 31 fraudulent apps were identified. These are posted like shopping-related programs or money-making offers to trick people into downloading them.

Outlook

Luckily, Google confirmed the CherryBios malware-infected apps have been removed from the Play Store. But there is still a cause for concern here, given that the APK is being spread through social media and fake websites.

If you’re worried about these malicious APKs, check whether you downloaded from the following websites:

• chatgptc[.]io
• happyminer[.]com
• robot999[.]net
• Synthnet[.]ai

And as we always say, check your phone and delete them promptly if you have them. Either that or stay away from unofficial APKs from websites, and stick to the Play Store. It may take Google a little bit to remove malicious apps, but it’s a far more reliable place than going outside the system.

Thanks to a Switzerland-based hacker, maia arson crimew, it's been revealed that thousands of Android devices have shared personal user data (contacts, messages, call logs, recordings, and location) with an Iranian stalkerware company for over seven years. As reported by TechRadar, over 60,000 Android users have had their data exposed since 2016, thanks to a phone surveillance app called Spyhide. 

Spyhide (a.k.a. Spouseware) is an app many have used to spy on their significant others. A spouseware app is used when someone suspects their significant other of cheating, being downloaded onto the victim's phone and running silently and sneakily in the background so that the suspecting spouse can track the activities of the person they think is stepping out. 

However, users spying on their partners weren't the only ones collecting data; so was an Iranian software company Virsys, which may also go by Virsis. 

This Stalkerware is dangerous

TechCrunch, which did a deep dive into how much data was collected, discovered that the victim's personal data was completely compromised, with call logs, text messages, and precise location history that dated back for years, being shared with threat actors worldwide. Spyhide's loose source code allowed access via its web-based dashboard, which allowed the victim's data to be exploited. 

Using the information released by maia arson crimew, the team at TechCrunch was able to show how vast Spyhide's surveillance network is and how it reached around the world. Thousands of victims from Europe, Brazil, and the U.S. had more than 3,100 compromised devices sharing location data. One U.S.-based victim device had shared more than 100,000 location data points over several years. 

What's terrifying is over 750,000 users have signed up to Spyhide to spy on someone or a romantic partner.  Oddly enough, it was found that in several cases, it wasn't just one person stalking a singular victim, but several to thousands of individuals were following the activities of certain victims. In one case, 4,000 people were surveilling one individual. 

Although TechCrunch tried to reach the developers of Spyhide, nobody responded. For its part, Google banned such spying devices from its app store long ago, but you can download Spyhide from the company's website. 

To avoid this issue, go to Google Settings and check which apps share your data, especially your location. You can also turn off location sharing, and when an app requests you share location, deny it faster than me saying no to a fruit salad.

Lastly, here's some advice from a wise, experienced person who has had many relationships in adulthood. If your gut tells you you can't trust your partner, then end the relationship and save yourself the trouble. Don't go behind their backs and download spyware to their phone.  Trust is the central cog in any healthy relationship. If you have good, logical, fact-based reasons not to trust someone, then do yourself and them a favor and move on. 

Thanks to a report in TheHackerNews, we know that Microsoft Word documents are being used to exploit known remote code execution flaws. The flaws are used as phishing lures to sneak the LokiBot malware onto compromised computers. 

These so-called "LokiBots, " also known as Loki PWS, have stolen users' information since 2015 and remain a well-known trojan. Cara Lin, a security researcher with Fortinet FortiGuard, said, "It primarily targets Windows systems and aims to gather sensitive information from infected machines."

Fortinet first noticed the attack campaign in May 2023; the company released a statement saying the attacks take advantage of CVE-2021-40444 and CVE-2022-30190 (aka Follina) to achieve code execution.

How it's done

According to the folks at Fortinet, the Word file that activates CVE-2021-40444 uses an external GoFile link that's embedded within an XML file which leads to the download of an HTML file that exploits Follina to download a next-stage payload, an injector module written in Visual Basic that decrypts and launches LokiBot.

On top of all this, and not to add to your worry, the injector also uses evasion techniques to check your system for the presence of debuggers and determine if it's running in a virtualized environment. So this malware is super smart and invasive. 

Discovered towards the end of May, an alternative chain starts with a Word document incorporating a VBA script which then executes a macro immediately when users open the document using the "Auto_Open" and "Document_Open" functions.

This macro script subsequently delivers a payload from a remote server, which also functions as a way to load LokiBot and connect to a command-and-control (C2) server.

LokiBot's, yes there are several

This is not the first LokiBot or the last. Like the deity of mischief, who can conjure up multiple versions of themself, there appear to be many variants that affect every OS imaginable. This current one is not confused with the LokiBot, a known Android banking trojan that can log your keystrokes, capture screenshots and gather your login information. That filthy trickster will siphon your financials, especially your cryptocurrency. 

Cara Lin from Fortinet states, "LokiBot is a long-standing and widespread malware active for many years," Lin said. "Its functionalities have matured over time, making it easy for cybercriminals to use it to steal sensitive data from victims. The attackers behind LokiBot continually update their initial access methods, allowing their malware campaign to find more efficient ways to spread and infect systems."

So please remember to remain diligent about not opening suspicious emails, and do not open Word documents from email addresses you do not recognize. Also, you should look at our best antivirus page to see if you can increase your security level. 

ChatGPT has taken the world by storm, racking up over 100 million users since its launch late last year. OpenAI’s chatbot has put artificial intelligence on the map in a big way, sparking a number of follow-ups like Microsoft Bing Chat and Google Bard in its wake. However, there’s a new AI in town — WormGPT, and it’s not here to make your life any easier.

WormGPT isn’t an AI chatbot developed to amusingly offer the invertebrate AI assistance of a wriggly invertebrate ala the feline-focused CatGPT. Instead, it’s a far more malicious tool designed without ethical boundaries for the sole purpose of bolstering productivity, raising effectiveness, and lowering the bar for entry of your common garden variety cybercriminal. 

WormGPT: Artificial iniquity

Shamelessly presented as a blackhat alternative to current GPT models, WormGPT could potentially become the most useful tool in the criminal arsenal since the invention of the Jimmy bar or balaclava.

Doing away with all of that ethical bottlenecking of generative AI models, WormGPT provides anyone with a spare €60 the gateway to AI-assisted criminalities including phishing attacks, social engineering techniques, and even the creation of custom malware.

Powered by GPTJ (Generative Pre-trained Transformer model with JAX) language model, WormGPT has similar capabilities to other Large Language Models (LLMs) — making it able to generate human-like answers to queries and questions along with providing generative responses on trained data.

It’s believed the primary focus of WormGPT’s training revolved around malware and phishing, with one of the tool’s primary features being its ability to compose convincing and sophisticated phishing communications in order to further business email compromise (BEC) attacks.

In plain old human speak, the bar for entry when it comes to cybercrime has now been lowered to such a degree that if you were listening closely over the weekend you might have heard the distant echo of said bar bouncing off of Satan’s skull.

The dark side of the boom

It was only a matter of time before it happened, and you’d have been nigh on crazy to assume the AI boom would only include friendly chatbots, generative art, and easy ways to cheat on your homework.

In fact, the list of disturbing ways AI is currently being used grows larger every day, and the release of WormGPT could be the first undeniable proof that we’re flying headfirst into a cybersecurity hellscape of epic proportions.

Security analysts have been in a tizzy about the potential of cybercriminals weaponizing AI for some time, with just a thin buffer zone of oft-easily skirted ethical roadblocks standing in the way of the intent of bad actors. A buffer zone increasingly eroding due to mass attempts to “jailbreak” the ChatGPT software into acting without restrictions.

Juhani Hintikka, CEO of cyber security firm WithSecure, recently confirmed in an interview that the company has observed malware samples being generated by ChatGPT already — and that the generative nature of LLMs like it allows for the results to be generated in “many different variations,” with these tools spawning mutated versions of malicious code that makes it “harder for defenders to detect.”

In essence, our ability to defend against a potential tsunami of security threats could be pushed to its very limits as highly customized, unique, and varied malware is generated in mere moments by AI tools like ChatGPT, and WormGPT.

Outlook

With the first AI chatbot specifically for criminal and nefarious deeds being so brazenly announced, there’s no doubt it's just the first of many ever-advancing, ever-improving models ne'er-do-wells will have to choose from in the near future.

Ironically, AI will increasingly become a vital tool to prevent the flood of AI-generated cybercrime over the coming years — an AI arms race to see which side is more proficient in its prompts.

The doomsday clock currently sits at 90 seconds to midnight, pushed part of that way by our rapid adoption of disruptive technologies. Meanwhile, the digital doomsday clock that monitors our internet security might as well be seconds away from midnight.

So maybe it's time to all climb into our antivirus Anderson shelters, and fill our bellies with MRE Malwarebytes as we await the only likely outcome as two disruptive forces come together on the digital landscape — mutually assured destruction.

According to a report on Neowin, a member of the US Navy exploited a flaw in Microsoft Teams' code. Hypothetically it could be used by hackers to send malicious attachments to a Teams group from an outside source. 

Alex Reid, a member of the US Navy's Red Team (a cybersecurity team within the Navy), published the "TeamsPhisher" tool on GitHub. The Red Team's stated purpose is to simulate hacker attacks and then create solutions to use in defense against these hacker attacks. 

How to protect against this Microsoft Teams exploit

According to the README file on GitHub, businesses using Teams can circumvent exploits like the TeamsPhisher and block it from accessing user meetings" by managing the options related to external access via the Microsoft Teams admin center under Users -> External access." Teams admins can set up a "universal block as well as allowing only specific external tenants for communications."

For its part, a Microsoft spokesperson responded to Bleeping Computer, stating that they were aware of the report, but noted the exploit relies on social engineering to be successful. Then Microsoft encouraged its users "to practice good computing habits online, including exercising caution when clicking on links to web pages, opening unknown files, or accepting file transfers."

To me, it sounds like Microsoft doesn't see this as a major issue, and that it is up to users of Microsoft Teams to police themselves and not accept or open files or links of unknown origins.

This is good basic advice for any time you're using the internet, but it seems a little dismissive in the grand scheme of things because it's been proven by the US Navy your product is broken and needs to be fixed.

The Google Chrome Web Store is the most popular destination for extensions, which lets users to extend the functionality of their browsers. For example, the Teleparty extension lets me host a Netflix party with friends, allowing us to watch the same show or movie simultaneously.

However, according to a new report from Kaspersky, you may want to be careful about what you download on the Chrome Web Store. Cybersecurity researchers discovered that the search-engine giant was inadvertently hosting over 30 malicious Chrome Extensions in the popular online store.

34 malicious Chrome Extensions invaded the Web Store

The malicious Chrome extensions were uploaded to the Chrome Web Store in 2021 and 2022. In other words, these extensions were sitting the Web Store for at least six months before cybersecurity researchers stepped in to analyze them for the aforementioned Kaspersky report.

Many of them are ad blockers and VPNs; take a look at the list below:

• Autoskip for Youtube
• Soundboost
• Crystal Adblock
• Brisk VPN
• Clipboard Helper
• Maxi Refresher
• Quick Translation
• Easyview Reader view
• PDF Toolbox
• Epsilon Ad blocker
• Craft Cursors
• Alfablocker ad blocker
• Zoom Plus
• Base Image Downloader
• Clickish fun cursors
• Cursor-A custom cursor
• Amazing Dark Mode
• Maximum Color Changer for Youtube
• Awesome Auto Refresh
• Venus Adblock
• Adblock Dragon
• Readl Reader mode
• Volume Frenzy
• Image download center
• Font Customizer
• Easy Undo Closed Tabs
• Screence screen recorder
• OneCleaner
• Repeat button
• Leap Video Downloader
• Tap Image Downloader
• Qspeed Video Speed Controller
• HyperVolume
• Light picture-in-picture

Fortunately, Google took them all down, but Kaspersky noted that it took two big-name cybersecurity firms, including itself, before the search engine giant took action to remove these malicious Chrome Extensions.

Among some of the reviews, there were complaints from users about the extensions swapping out addresses in search results with adware links, but according to Kaspersky, "ordinary users' complaints generally go unheeded."

What can these malicious extensions do?

Kaspersky said that browser extensions are breeding grounds for malicious cybercriminal activity because users give them high-level access. Most browser plugins ask your permission to read and change your data on all websites. In other words, ill-intentioned actors can see everything you do and follow all the sites you visit. Plus, they can change the contents of any page.

As such, malicious browser extensions can do the following

• Track your activity to collect and sell information about you
• Steal card details and account credentials
• Embed ads in web pages
• Substitute links in search results
• Replace the browser's home page with an advertising link

What's worse is that a browser extension may play an innocent game at first, but with the owner's command, it can transform into a malicious plugin. 

How did these malicious Chrome Extensions get caught?

A Chrome extension named PDF Toolbox alarmed cybersecurity investigator Vladimir Palant when he, upon close inspection, discovered a suspicious extraneous functionality. It had the ability to access a site that "loaded arbitrary code on all pages viewed by the user," according to the Kaspersky report.

Interestingly, PDF Toolbox has a large user page, good reviews, two million downloads, and an average score of 4.2.

This deceptive Chrome extension impelled Palant to see if there were any more infected plugins hiding out in the Web Store, and of course, he found plenty — an additional 33 to be exact.

How to delete a Chrome Extension

Kaspersky said that Google's moderators do an awful job at vetting the security and safety of the extensions that it hosts in the Google Chrome Web Store. If you're concerned about an extension you currently have installed, here are the steps you can take to remove it:

1. Click on the the triple-dot Settings icon

2. Go to Extensions.

3. Click on Manage Extensions.

Here, you can click Remove on any suspicious extensions you feel have malicious intent.

If you are wondering how to find and remove stalkerware on Android, you may have caught the recent news that a popular Android spyware app was hacked. Or perhaps you're wary of your mobile privacy and you want to tighten up as many security holes as you can.

Android devices keep us connected, help us navigate, and are an indispensable daily tool in our lives, but that also makes them the perfect target for stalkerware and spyware.

While some of these apps can be quite devious about how they hide on your device, our guide will help you find and remove stalkerware on Android no matter which method they try to use. So follow along and we'll make sure no one is snooping on your mobile activities.

How to make sure you aren't being tracked by stalkerware on Android

There are a few simple ways to find and remove stalkerware from your Android device. (If you are an iPhone user, we have a guide on how to find and remove stalkerware on iPhone). One thing to be aware of is that the apps often won't use their full name to help them stay hidden, in that aforementioned spyware hack the "LetMeSpy" app for example showed as "LMS" on the victim's device, so keep that in mind when you are searching for spyware.

Google Play Protect

For Android users, the first step is to make sure Google Play Protect is active. This is a feature introduced on Android over ten years ago now that scans apps both on install and periodically on your device to ensure that they aren't doing anything malicious. It's turned on by default, so if it is turned off, that is a strong indicator right away that someone has been tampering with your device. 

To check whether Google Play Protect is enabled, go to Settings > Security > Play Protect. If it's active you'll see a "Scan" button in the middle of the screen, if not you'll see a button that says "Turn on."

Device Admin apps

Next up, you'll want to check for a device admin app installed on your phone. These profiles can give an app essentially full control over the device without your knowledge. This one is simple to check as well, just navigate to Settings > Security > Device admin apps. In almost all cases it should say "No active apps." The only case where there would be something here is if you have a legitimate device admin through your work, school, or a parental control app. Assuming one of those doesn't apply to you and you see a device admin app listed just tap on it to remove it from your device.

Accessibility settings

Finally, you can take a peek at Accessibility, this would be an alternative path for an app to gain the kind of sweeping permissions it needs to track all of the activities on your phone. Navigate to Settings > Accessibility and ensure that you know every app listed under "Downloaded apps" or "Accessibility services." If you see anything out of the ordinary there toggle it to off and then go to Settings > Apps > See all apps and then select that app from the list and tap "Uninstall."

That's it, if you've made it through without spotting anything nefarious then you can feel confident that your device is free of stalkerware, and if not then we've squashed whatever app was trying to peep on your private phone pursuits. Either way, you can now enjoy your mobile privacy in peace.

Stalkerware is often used in cases of domestic abuse. For anonymous and confidential help, the National Domestic Violence Hotline can be reached 24/7 at 1-800-799-7233.

There's a faux Telegram app masquerading as the real messaging app, and according to researchers at Check Point, it's convincing, too. From the identical launch page to the authentication process, the imposter app flows similarly to the original version. "The user has no reason to suspect anything out of the ordinary is happening on the device," the Check Point report said.

Unfortunately, this Telegram app can fool the best of us, and according to Check Point, once it gets a hold of your device, it can unleash malware hell on your Android phone via a trojan called "Triada."

Triada is lurking in 'Telegram'

There's a malware campaign in which malicious actors are disguising Triada as Telegram Messenger version 9.2.1. Unwitting victims, believing that they're using a trusted apps, end up granting it permissions to access their call logs and phone calls. 

In the background, according to Check Point researchers, the following steps are taking place:

1. The malware gathers your device's information.

2. It sets up a communication channel.

3. It downloads a configuration file and awaits the reception of a payload from a remote service.

4. The payload is decrypted and launched; Triada can now wreak havoc on your device.

What can Triada do?

Once Triada gets its claws on your Android device, it can perform the following malicious tasks:

• Sign you up for various paid subscriptions
• Perform in-app purchases using your SMS and phone number
• Display advertisements, including invisible ads running secretly in the background
• Steal login credentials
• Snag sensitive device information

To keep Triada at bay, make sure to never download apps from standalone websites nor third-party app stores. There's a chance that the apps in these unofficial stores may be maliciously modified. If you want Telegram, download it directly from the Google Play Store.

If you suspect that your Telegram app isn't legit, delete it immediately and download one of the best mobile antivirus apps for your device.

According to a report in arsTechnica, Apple, along with other organizations and tech companies, are opposing the Online Safety Bill brought forth by conservative members of Parliament. According to Apple, the new bill is a threat to end-to-end encryption that protects the privacy of personal messages. 

Apple, in a statement given to the BBC, said " "End-to-end encryption is a critical capability that protects the privacy of journalists, human rights activists, and diplomats," The company went on to say, "It also helps everyday citizens defend themselves from surveillance, identity theft, fraud, and data breaches. The Online Safety Bill poses a serious threat to this protection and could put U.K. citizens at greater risk. Apple urges the government to amend the bill to protect strong end-to-end encryption for the benefit of all."

The BBC quoted a U.K. government rep saying, "companies should only implement end-to-end encryption if they can simultaneously prevent abhorrent child sexual abuse on their platforms." The bill in question hasn't been finalized yet, and the U.K. regulator, who would be in charge of Ofcom, discussed its preparations for this newly expanded role stating, "the bill is in "the final stages of the parliamentary process." The bill, which includes criminal penalties like imprisonment, was approved by the House of Commons in January and is nearing approval in the House of Lords."

As negotiations continue, there are changes expected to the bill. However, whether the mandatory scanning of encrypted messages will be addressed or removed from the account is unknown. However, conservatives fiercely oppose any changes, as they feel they're trying to protect the world from terrorists and child sexual predators.

It's not just Apple that's concenred

Apple isn't alone in its opposition to the bill; WhatsApp and Signal also oppose the nose, with Signal saying they would stop offering services in the U.K. if it becomes law and they're pushed to lower the level of privacy its encryption provides. WhatsApp, part of Meta, told the BBC last year it would not reduce its security or encryption standards. 

Oddly enough, Apple 2021 got into a heap of trouble when they said they would scan iPhones for illicit images of children, as security experts balked at such a notion, and eventually, Apple strayed from its plan. According to the Open Rights Group, the UK law would be the first to allow the scanning of people's private messages. 

They said that changes could be made to the law that improves the integrity of personal privacy. One change would be in how the law is worded, stating, " Removing the word 'privately' from the draft legislation could preserve the security and privacy of billions of messaging app users," the Open Rights Group said, referring to a requirement to identify illegal content in private messages." 

The proposed U.K. law could also set off a storm of new rules the world over, which could find the users of encrypted messaging apps very uncomfortable and also create a massive landscape filled with lawsuits that will be battled out in the courts for years to come.

Especially when you consider that  Ofcom would be allowed to issue notices to service providers that will force them to "use accredited technology to identify CSEA [child sexual exploitation and abuse] content, whether communicated publicly or privately using the service, and to take down that content swiftly." 

However, if the content in question is being sent between two private citizens, how did they find out in the first place? The blurry lines, loopholes, and loose definitions left open to interpretation are dangerous to personal privacy. 

Final Thoughts

The U.K. law does have some merit, as we have seen a massive upswing in child trafficking and sexual abuse. Also, the law focuses on the messages of possible terrorists, which we all hate terrorism. However, where are these conservatives regarding all speech shared and used to harm the LGBTQIA community? Where are these conservatives when encrypted messages are used to set up crimes against minorities and people of color? Racism is enormous on the internet, so I find this child sex crime and terrorism focus of conservatives in the UK or the US to be pure unadulterated nonsense and talking points they can sell to their conservative constituents. 

If you create laws to protect children or prevent terrorism, you must also fight for and make laws that protect all people from these acts. It's a known fact that more minority children and children of color are abducted and are being sex trafficked the world over. It's also known that racist groups are committing crimes against minorities and using the internet to plot and execute these horrific crimes. 

Also, who is to say such laws will not be abused and misused by those in power to go on witch hunts? It is a very slippery slope, and these are substantial privacy issues entangled in massive human and civil rights issues. Let's face it, neither the UK nor the US has an exemplary record. 

In the end, yes, we need ways to identify terrorists and sexual abusers. Yes, we need ways to find human rights violators too. Still, when Conservatives, who are doing their level best worldwide to overturn every civil and human right possible, start pushing for laws that would invade your privacy, it's a major red flag. If you're a student of history and have ever read up on the "Red Scare" or McCarthyism," this should frighten you to death. All they have to do is accuse you or anyone, hack into your phone or device, and create messages. Hell, they can have AI make a video of you committing crimes if they want. 

I'm not siding with giant corporations either, as they need to be held accountable for not having the courage and infrastructure to regulate the content shared on their sites or via harmful messaging apps. 

We have reached a level of technological advancement that our legal system and laws have not kept up with, and it is time for the generations of us who grew up with the technology to start crafting and creating the legal structure to protect each and every one of us now and in the future.  

Define irony: This hidden spyware app was hacked revealing its snooping customers' data. 

Apps for tracking what someone is doing on their phone are a big business, typically they are marketed to parents or companies for monitoring their children's or employees' activities on their devices. However, these apps are also ripe for abuse by domestic partners and spouses, which is why these apps are sometimes called "stalkerware" or "spouseware."

LetMeSpy is a tracking app on Android that seems designed for this kind of misuse as it deliberately tries to avoid detection on the device and then quietly sends all of the text messages, call logs, and location data from the phone to the account holder. But now those account holders need to worry about being watched as LetMeSpy reported on June 21 that it was hacked and among the leaked data is information on 26,000 customers that used the free or paid version of the app (via TechCrunch).

What exactly was leaked?

Unfortunately, the leak included not only the data regarding the app's customers but also its victims. For the customers, it appears to be simply the email address associated with their account, although given the use case for this app that is still something many of them don't want to get out.

For the victims, the leaked data set includes text messages, call logs, and location data from at least 13,000 distinct devices. The call logs and text messages in some cases go all the way back to 2013, so it's a considerable trove of information regarding these individuals. While LetMeSpy has notified law enforcement and the Polish Data protection authority (that is where the developer is based), it is unclear at the moment whether the company can or will notify the victims of the data breach.

How to make sure you aren't being tracked by stalkerware on Android

There are a few simple ways to find and remove stalkerware from your Android device. (If you are an iPhone user, we have a guide on how to find and remove stalkerware on iPhone). One thing to be aware of is that the apps often won't use their full name to help them stay hidden "LetMeSpy" for example only shows as "LMS" on the victim's device, so keep that in mind as we go spyware hunting.

For Android users, the first step is to make sure Google Play Protect is active. This is a feature introduced on Android over ten years ago now that scans apps both on install and periodically on your device to ensure that they aren't doing anything malicious. It's turned on by default, so if it is turned off that is a strong indicator right away that someone has been tempering with your device. 

To check whether Google Play Protect is enabled just go to Settings > Security > Play Protect. If it's active you'll see a "Scan" button in the middle of the screen, if not you'll see a button that says "Turn on."

Next up, you'll want to check for a device admin app installed on your phone. These profiles can give an app essentially full control over the device without your knowledge. This one is simple to check as well, just navigate to Settings > Security > Device admin apps. In almost all cases it should say "No active apps." The only case where there would be something here is if you have a legitimate device admin through your work, school, or a parental control app. Assuming one of those doesn't apply to you and you see a device admin app listed just tap on it to remove it from your device.

Finally, you can take a peek at Accessibility, this would be an alternative path for an app to gain the kind of sweeping permissions it needs to track all of the activities on your phone. Navigate to Settings > Accessibility and ensure that you know every app listed under "Downloaded apps" or "Accessibility services." If you see anything out of the ordinary there toggle it to off and then go to Settings > Apps > See all apps and then select that app from the list and tap "Uninstall."

That's it, hopefully you didn't find anything, but if you did we've got your device spyware-free again now.

Despite the many safeguards in the Google Play Store, it is once again playing host to a dangerous Android trojan posing as legitimate productivity apps to escape detection — once installed the hackers deploy their malware. This time the threat was identified by security researchers at ThreatFabric, who revealed the latest incarnation can take over nearly 600 different banking apps to siphon off money from victims.

That's one of the most dangerous aspects of this particular trojan — it isn't just stealing your login credentials — it is taking over the banking apps on your Android phone so the transactions appear to be coming from you (via Bleeping Computer).

The targeted apps include numerous major banks and stock trading apps like TD Bank, J.P. Morgan, Capital One, E-Trade, Schwab Mobile, and hundreds more, so the threat is substantial.

Delete these five apps now!

Per Bleeping Computer, Google reached out to confirm that it has removed the following apps from Google Play and the developers have been banned, but it is worth confirming that you didn't have any of these apps installed on your phone prior to their removal.

Not the most exciting list of apps, but the hackers are counting on a PDF reader being something that a user may need to quickly download to read a document without vetting the app carefully.

Once installed on the Android phone the dropper apps then download the actual Anatsa malware which begins stealing your credit card details, bank account information, and payment information through a combination of phishing pages and keylogging.

That information is in turn used to gain access to any of the almost 600 financial apps detected on the user's device. The security researchers at ThreatFabric indicated that "Since transactions are initiated from the same device that targeted bank customers regularly use, it has been reported that it is very challenging for banking anti-fraud systems to detect it." 

The stolen money is converted into cryptocurrency and distributed through a network of accounts that keep a smaller portion before sending the rest on to the hackers.

How to avoid becoming a victim of a banking trojan

We still stress that downloading your apps from Google Play is far safer than any other source, but as the apps in question came from Google Play, here's what to look for even when downloading from Android's official app store.

Make sure you are downloading apps from known publishers that have substantial downloads and positive reviews. The truth is that apps like this do not typically last long in the Google Play Store and once they are caught, Google removes them and bans the developer as seen in this case. Will they pop up again? Of course, but it means that they don't have the time to build up a substantial track record so even if they pay for fake reviews they won't have years of positive reviews.

It's also important to note that Google Play Protect, which is on any device with Google Play Services, doesn't just try to detect malware when you install an app, but runs periodic scans of your apps to ensure that none of them have become infected with malware. If it detects a threat it can either disable or remove the app automatically from your device.

Combine this advice with one of the best antivirus apps and you should be able to keep your device safe from almost any malware threat.