How To Tell If Your Smartphone Has Been Hacked

Smartphone hacking is the unauthorized access to and control over a mobile device or its communications. This goes beyond a simple malware infection; it’s a targeted breach aimed at stealing your personal data, spying on your activities, or using your device for malicious purposes. Unlike general viruses that may just slow down your device, a hack can lead to severe real-world consequences. This article aims to increase your awareness about hacking methods, how to prevent it or determine if your phone has been infiltrated, and how to protect your phone moving forward.

Why cybercriminals target smartphones

Your smartphone is a goldmine of personal information, making it a high-value target for cybercriminals whose motivations are typically centered on financial gain and identity theft. Hackers seek banking credentials, credit card numbers, and access to payment apps for direct financial theft. Meanwhile, stealing your personal information—like emails, contacts, and passwords—allows them to commit identity fraud or sell on dark-web markets.

Beyond money, attackers may use your phone for surveillance, secretly activating your camera or microphone to spy on you. In other cases, they may hijack your device’s resources to include it in a botnet for larger attacks or hold your files hostage with ransomware. Understanding these threats is the first step in knowing how to protect yourself from them, so it’s vital to learn the methods hackers use to get into your phone.

Hackers exploit iOS and Android differently

While both iOS and Android are secure, their core philosophies create different opportunities for hackers. Android’s open-source nature allows for greater customization, including the ability to “sideload” third-party apps from outside the official Google Play Store. Unvetted apps with malicious code are a primary vector for malware.

In contrast, Apple’s iOS’s closed ecosystem makes it much harder to install unauthorized software. For this reason, many attacks targeting iPhones rely on social engineering, sophisticated zero-day exploits that target unknown vulnerabilities, or jailbroken devices, which strips away Apple’s built-in protections.

To protect your device, tailor your defense to its ecosystem. The best practice for Android users is to stick to the Google Play Store and ensure Google Play Protect is active, as it continuously scans your apps for harmful behavior. iPhone users concerned about targeted attacks should activate Lockdown Mode, an extreme feature that limits functionality to reduce the potential attack surface. Regardless of your platform, keeping your operating system updated is the single most important step you can take to stay secure.

Common attack vectors

Wondering how your phone gets compromised? Hackers use several common pathways.

Jailbreaking or rooting

A hacker might install spyware after you jailbreak or root your smartphone to bypass the security of their respective stores. Jailbreaking or rooting gives smartphone users more control over their devices, such as removing pre-installed apps and installing third-party apps from unvetted sources. However, this action removes barriers that keep viruses and malware from entering the smartphone’s system and spreading to apps, files, devices and other networks. And because Apple and Google don’t review the apps in those sources, this allows the hacker to post a bad app with relative ease.

Sneaking a malicious app update

Apple has a strict review policy before apps are approved for posting in the App Store. Meanwhile, Google started applying AI-powered threat detection, stronger privacy policies, supercharged developer tools, industry-wide alliances, and other methods in its app reviews. Bad actors, however, could still sneak malware into the stores by uploading infected app versions during updates. Other times, they’ll embed malicious code that triggers only in certain countries or encrypt malicious code into the app they submit, making it difficult for reviewers to sniff out.

Remote hacking

Cybercriminals have several sophisticated methods to hack smartphones remotely. One common technique is phishing, where you might receive a text or email with a malicious link that, when clicked, installs spyware on your device. Another remote hacking vector is through unsecured public Wi-Fi networks, where hackers can intercept your data. Spyware can also be delivered via SMS payloads that require no user interaction.

Text messages

Smishing (SMS phishing) is a common and effective way for hackers to attack your phone, where they send an urgent text with a malicious link, like a fake delivery notification or a bank alert, to trick you into clicking without thinking. Once you click, the link can lead to a fake website designed to steal your login credentials or directly download malware onto your device. Attackers also use MMS messages to send malicious files, like images or videos, which in some rare “zero-click” exploits, can infect your phone without you even opening the message.

To protect yourself, treat all unexpected links in text messages with suspicion. Never click on a link from an unknown sender. A key preventive step is to go into your messaging app’s settings and disable the automatic download of MMS files. This prevents malicious media from loading onto your device automatically. Always verify urgent requests by contacting the company or person directly through a trusted channel, not by using the contact information provided in the suspicious text.

Malicious websites

In this method, hackers use techniques like drive-by downloads, which silently installs malware onto your device the moment a page loads—no click required. Malvertising is where malicious code is hidden in online ads that, if served on a site you visit, can trigger a spyware or ransomware download. These attacks are most effective against devices with outdated web browsers, as they target known security holes that have since been patched. Fake “update required” pop-ups are designed to scare you into installing malicious software disguised as a critical browser update. To protect yourself, always keep your mobile browser and operating system fully updated. Use your browser’s built-in safe-browsing features, and be cautious about granting permissions or clicking links on unfamiliar websites.

SIM-swap and phone cloning

These two sophisticated attacks can give a hacker complete control over your phone number. In a SIM-swap attack, a criminal tricks your mobile carrier into transferring your phone number to a SIM card they control. In phone cloning, they copy the identifying information from your phone to another, making a functional duplicate. In either case, the attacker can then intercept your calls, texts, and two-factor authentication codes.

Proactive defense includes setting up a unique PIN or password on your account for an extra layer of security. Switch to an eSIM if possible, as eSIMs are not as easily swapped as physical cards. If you suspect an attack, immediately report the issue to your carrier and check your financial and email accounts for unauthorized activity. You can also use the dial codes, like *#62#, to see if your calls are being forwarded to an unknown number.

Compromised phone camera

Malicious apps and spyware can secretly access your camera and microphone, potentially livestreaming audio and video to an attacker without your knowledge. Key warning signs include the camera indicator light turning on unexpectedly, significant and unexplained battery drain, or finding unfamiliar photos and videos in your gallery. To protect yourself, regularly audit the apps installed on your phone. Go into your device’s settings to review which apps have permission to access your camera and revoke access for any that don’t need it.

Other methods

Network-based attacks occur over unsecured public Wi-Fi where attackers can intercept your data. Finally, unsecure cloud backups can be a weak point, as a compromised password for your Apple or Google account could give a hacker access to all the data you’ve stored. Knowing these attack vectors is the first step toward understanding how to know if your phone is hacked.

Signs your smartphone has been hacked

Because we spend so much time on our phones, it’s fairly easy to tell when something isn’t working right. Sometimes those issues are symptoms of an infection. Possible signs that your device has been hacked include:

• Performance issues: A slower device, webpages taking way too long to load, or a battery that never keeps a charge can be attributed to your device reaching its retirement. However, these things might also signal that malware has compromised your phone.
• Your phone feels hot: Malware running in the background of your device might burn extra computing power, causing your phone to feel overheated.
• Mysterious calls, texts, or apps: If apps you haven’t downloaded suddenly appear on your screen, or if outgoing calls you didn’t make pop up on your phone bill, these are definite red flags that your device has been hacked.
• Changes or pop-ups crowd your screen: If you are getting an influx of spammy ads or your app organization is suddenly out of order, or your home screen has been reorganized, there is a big possibility that your phone has been hacked.

• Unexpected battery drain: Your phone’s battery dies much faster than usual because malware is constantly running in the background.
• Sudden data spikes: You notice a sharp, unexplained increase in your mobile data usage as spyware sends your information to a hacker.
• Unexplained charges: You find subscriptions or premium service charges on your phone bill or to your account that you never authorized.
• Background noise on calls: You hear clicks, static, or distant voices during phone conversations, which could indicate a call-monitoring app is active.
• Sudden loss of mobile service on your phone, notifications of account changes you didn’t make, or being locked out of your online accounts.

Confirm a breach with built-in diagnostics

If these symptoms are present, use the following tools to verify whether your device has been compromised:

1. For Android, run Google Play Protect: This is your first line of defense on an Android device. Open the Google Play Store app, tap your profile icon in the top right, and select Play Protect. Tap “Scan” to check your installed apps for harmful behavior. Play Protect runs automatically but a manual scan can help confirm if your phone is hacked.
2. For iOS, use Apple’s Safety Check: To check if your iPhone has been hacked, go to Settings > Privacy & Security > Safety Check. This tool helps you review and revoke the access you’ve granted to people, apps, and devices, which is a common way iPhones are compromised.
3. Install a reputable antivirus scanner: For a deeper analysis, install a trusted mobile security app like McAfee to detect a wider range of malware, spyware, and risky settings. Run a full system scan.
4. Interpret the results: If the scan detects a threat, it will typically be labeled with a name and a risk level. The security app will also give you an option to remove or uninstall the malware. If you receive a warning but no option to remove, boot your phone into safe mode and manually uninstall the suspicious app.

Hack attack! Your next steps

The results of the scan are in: your smartphone has clearly been hacked. There is no time to lose. To start the process of blocking the hacker or removing the malware, follow these essential first steps:

1. Remove apps you didn’t install and restart. Check your apps folder for anything unfamiliar and remove them. From there, disconnect from the Internet and restart your phone to halt any malicious activity.
2. If issues persist, reset. If you still have issues, restoring your phone to its factory settings is an option, provided you have backed up photos, contacts, and other vital info in the cloud. A quick online search can show how relatively straightforward it is to wipe and restore your model of phone.
3. Flash the stock firmware. As a last resort for technical users, reinstalling the official operating system will almost certainly remove the hack.
4. Change critical passwords: Using a different, trusted device, immediately change the passwords for your most important accounts—email, banking, and social media.
5. Check your accounts and credit. Some online security solutions like McAfee+ are capable of Identity Monitoring, which alerts you if your info winds up on the dark web, while Credit Monitoring alerts you of unauthorized activity in your accounts.
6. Get expert help. Our Identity Theft Coverage & Restoration service offers $2 million that covers required travel, losses, and legal fees associated with identity theft. It also offers the services of a licensed recovery professional who can repair your credit and your identity after a hack attack.
7. Notify financial institutions: Contact your bank and credit card companies to alert them to the potential breach. Monitor your statements closely for any fraudulent charges.
8. Report the incident: Inform your mobile carrier about the breach and consider filing a report with the appropriate authorities, such as local law enforcement and the FBI’s Internet Crime Complaint Center.

Seek professional help

Persistent problems with your smartphone after a factory reset, may indicate a sophisticated, low-level hack. If you are the victim of significant financial fraud or identity theft, or if the hack involves sensitive legal or corporate data, it is crucial to stop using your smartphone and get assistance. In these cases, continued use could tamper with evidence.

After reporting the hacking incident to your mobile carrier, and authorities, you may need a certified digital forensic analyst for deep analysis, especially in corporate or legal cases. Before you call, gather key information: the make and model of your phone, the date you first noticed issues, a list of suspicious apps or messages, and any known fraudulent activity on your accounts.

Dial codes to detect hidden hacks

Certain dial codes, also known as Unstructured Supplementary Service Data (USSD) or Man-Machine Interface (MMI) codes, can help you check for signs of suspicious activity or hidden configurations. These codes can reveal call forwarding, SIM tracking, or conditional redirects that may indicate a compromise:

• Dial *#21#: This code shows you the status of call forwarding. If calls, messages, or other data are being diverted without your knowledge, this is one of the key signs your phone is hacked. The results should all say “Not Forwarded.”
• Dial *#62#: Use this code to find out where calls are being forwarded when your phone is unreachable (e.g., turned off or out of service area). It should typically go to your carrier’s voicemail number, so check if the number shown is unfamiliar.
• Dial ##002#: This universal code disables all call forwarding. If you suspect your calls are being diverted, dialing this code will reset it. Note that availability and functionality of these codes can vary by carrier and country.

Tips to block hackers from your phone

You can take simple, effective steps to protect yourself and your device from hackers. Here are some practical tips, from the basic to the more layered steps, to help you block hackers from accessing your phone.

Basic best practices

To avoid the hassle of having a hacked phone in the first place, here are some fundamental measures you can do as part of your routine:

• Update your phone and its apps. Promptly updating your phone and apps is a primary way to keep your device safer. Updates often fix bugs and vulnerabilities that hackers rely on to download malware for their attacks.

• Avoid third-party apps from unvetted stores. Apple’s App Store and Google Play have protections in place, unlike third-party sites which sometimes purposely host malicious apps. Avoiding these sites altogether can block hackers from your device.

• Don’t use a jailbroken or rooted phone. Jailbreaking or rooting a phone introduces all kinds of security issues. Your best bet as an everyday internet user is to rely on the built-in security features of iOS and Android.

Layered protection beyond the basics

Beyond the foundational advice, fortifying your smartphone requires a layered defense. We suggest the following actions you can apply:

• Install a reputable mobile security app: A trusted provider like McAfee can scan for malware and alert you to risky websites.
• Enable two-factor authentication: Use this feature on all critical accounts, such as your email, banking, and social media apps. This adds a crucial second layer of verification that protects you even if your password is stolen.
• Disable connective services: Minimize your attack surface by disabling wireless radios like Bluetooth, near field communication (NFC), and location tracking when not in use.

• Leverage hardware security: Rely on built-in hardware features like Apple’s Secure Enclave or Android’s Titan M chip, which protect your biometric data and encryption keys.
• Review app permissions regularly: Make it a monthly habit to check which apps have access to your camera, microphone, location, and contacts, revoking permissions from any that seem unnecessary.
• Adopt a zero-trust mindset: Never automatically trust links or attachments in emails and messages, even if they appear to be from someone you know. Use a VPN on public Wi-Fi to encrypt your connection and protect your data from eavesdroppers. In addition, ensure your device’s storage is always encrypted for a strong baseline of protection.
• Take full advantage of built-in safety features: Apple offers Lockdown Mode for high-risk users, while Google has Play Protect which continuously scans your apps for harmful behavior.

• Avoid using public USB charging stations: These can be used for juice jacking, where hackers steal data from or install malware on your device. It’s best to bring a portable battery pack, especially during travel or long days out.

One-tap checklist: Security settings you can enable today

Securing your device doesn’t have to be complicated or time-consuming. In fact, many powerful protections are just a tap away. This quick checklist offers quick and simple security settings you can enable with minimal effort.

1. Turn on automatic updates: Go to Settings > General > Software Update on iOS or Settings > System > System Update on Android to enable automatic updates and ensure you always have the latest security patches.
2. Enable biometric lock: Set up Face ID or Touch ID (iOS) or Fingerprint Unlock (Android) for a fast, secure way to protect your device from unauthorized physical access.
3. Activate “Find My” feature: Turn on Apple’s “Find My iPhone” or Android’s “Find My Device” to allow you to locate, lock, or remotely erase your phone if it’s lost or stolen.

FAQs about phone hacking

Does dialing *#21# show if I’m hacked?

This code shows if your calls and messages are being forwarded, which can be a sign of a hack, but it doesn’t detect other types of malware or spyware.

Can iPhones get viruses?

While less common due to Apple’s strong security structure, iPhones can still be compromised, especially through malicious apps from outside the App Store or sophisticated phishing attacks.

Will a factory reset remove spyware?

In most cases, yes. A factory reset erases all data and apps on your device, including most forms of malware and spyware, returning it to its original state.

Can my phone be hacked while powered off?

A phone that is truly powered off cannot be hacked remotely. When the device is off, its wireless radios (cellular, Wi-Fi, Bluetooth) are inactive, and the operating system is not running, cutting off any connection for an attacker to exploit. In Airplane Mode, only the radios are disabled, but leaves the OS running.

The myth of a phone being hacked while off often stems from two things: advanced, targeted attacks that fake a shutdown to compromise firmware, or physical attacks like a “cold boot” where a forensics expert with physical access can extract data from the RAM shortly after shutdown. To mitigate these extremely rare risks, always ensure your phone is fully encrypted, a default setting on modern iPhones and Androids, to make data unreadable even if accessed physically.

For everyday security, shutting off your phone is a good first step to sever any potential malicious connection.

Does my iPhone need antivirus?

If your iPhone is not jailbroken, you don’t need antivirus. But your phone should still get extra protection to deal with other cyberthreats such as scammy text messages, phishing and AI-driven attempts. Comprehensive online protection software like McAfee keeps you and your phone safer. It can:

• Block sketchy links in texts, emails, messages, as well as suspicious links during searches, while surfing, and on social media.

• Protect your identity by keeping tabs on your credit and accounts.

• Protect your privacy by removing your personal info from shady data broker sites.

• Make you more private by locking down your privacy settings on social media.

Those are only some of the many McAfee capabilities that protect you and your phone.

Final thoughts

Recognizing the signs your phone is hacked is the critical first step, but swift and correct action is what truly protects you.

You can usually determine your smartphone has been hacked by observing any unusual behavior patterns, such as unexplained battery drain, data usage spikes, a blitz of ad pop-ups, unexplained charges on your banking accounts, and even mysterious calls, texts, or apps. Another way to confirm a breach is by running built-in diagnostics such as security scans and security keys. If any of the odd behaviors listed above sound familiar, don’t wait. Take immediate action and implement a layered defense.

In the first place, you can significantly reduce your risk of being hacked through regular software updates, careful app management, and smart browsing habits. Another important component is installing a complete privacy, identity and device solution like McAfee that provides comprehensive protection.

Don’t wait until you suspect a breach; adopt these protective strategies today to keep your digital life private and secure.

The post How To Tell If Your Smartphone Has Been Hacked appeared first on McAfee Blog.

Report: The Dark Side of Phishing Protection

The transition to the cloud, poor password hygiene and the evolution in webpage technologies have all enabled the rise in phishing attacks. But despite sincere efforts by security stakeholders to mitigate them - through email protection, firewall rules and employee education - phishing attacks are still a very risky attack vector. A new report by LayerX explores the state of

Kinsing Hacker Group Exploits More Flaws to Expand Botnet for Cryptojacking

The cryptojacking group known as Kinsing has demonstrated an ability to continuously evolve and adapt, proving to be a persistent threat by swiftly integrating newly disclosed vulnerabilities to the exploit arsenal and expand its botnet. The findings come from cloud security firm Aqua, which described the threat actor as actively orchestrating illicit cryptocurrency mining

Kimsuky APT Deploying Linux Backdoor Gomir in South Korean Cyber Attacks

The Kimsuky (aka Springtail) advanced persistent threat (APT) group, which is linked to North Korea's Reconnaissance General Bureau (RGB), has been observed deploying a Linux version of its GoBear backdoor as part of a campaign targeting South Korean organizations. The backdoor, codenamed Gomir, is "structurally almost identical to GoBear, with extensive sharing of code between

FBI Seizes BreachForums Again, Urges Users to Report Criminal Activity

Law enforcement agencies have officially seized control of the notorious BreachForums platform, an online bazaar known for peddling stolen data, for the second time within a year. The website ("breachforums[.]st") has been replaced by a seizure banner stating the clearnet cybercrime forum is under the control of the U.S. Federal Bureau of Investigation (FBI).  The operation is the

VMware Patches Severe Security Flaws in Workstation and Fusion Products

Multiple security flaws have been disclosed in VMware Workstation and Fusion products that could be exploited by threat actors to access sensitive information, trigger a denial-of-service (DoS) condition, and execute code under certain circumstances. The four vulnerabilities impact Workstation versions 17.x and Fusion versions 13.x, with fixes available in version 17.5.2 and

New Spectre-Style 'Pathfinder' Attack Targets Intel CPU, Leak Encryption Keys and Data

Researchers have discovered two novel attack methods targeting high-performance Intel CPUs that could be exploited to stage a key recovery attack against the Advanced Encryption Standard (AES) algorithm. The techniques have been collectively dubbed Pathfinder by a group of academics from the University of California San Diego, Purdue University, UNC Chapel

Google Simplifies 2-Factor Authentication Setup (It's More Important Than Ever)

Google on Monday announced that it's simplifying the process of enabling two-factor authentication (2FA) for users with personal and Workspace accounts. Also called 2-Step Verification (2SV), it aims to add an extra layer of security to users' accounts to prevent takeover attacks in case the passwords are stolen. The new change entails adding a second step method, such as an

China-Linked Hackers Suspected in ArcaneDoor Cyberattacks Targeting Network Devices

The recently uncovered cyber espionage campaign targeting perimeter network devices from several vendors, including Cisco, may have been the work of China-linked actors, according to new findings from attack surface management firm Censys. Dubbed ArcaneDoor, the activity is said to have commenced around July 2023, with the first confirmed attack against an unnamed victim

Dropbox Discloses Breach of Digital Signature Service Affecting All Users

Cloud storage services provider Dropbox on Wednesday disclosed that Dropbox Sign (formerly HelloSign) was breached by unidentified threat actors, who accessed emails, usernames, and general account settings associated with all users of the digital signature product. The company, in a filing with the U.S. Securities and Exchange Commission (SEC), said it became aware of the "

New "Goldoon" Botnet Targets D-Link Routers With Decade-Old Flaw

A never-before-seen botnet called Goldoon has been observed targeting D-Link routers with a nearly decade-old critical security flaw with the goal of using the compromised devices for further attacks. The vulnerability in question is CVE-2015-2051 (CVSS score: 9.8), which affects D-Link DIR-645 routers and allows remote attackers to execute arbitrary

BlackTech Targets Tech, Research, and Gov Sectors New 'Deuterbear' Tool

Technology, research, and government sectors in the Asia-Pacific region have been targeted by a threat actor called BlackTech as part of a recent cyber attack wave. The intrusions pave the way for an updated version of modular backdoor dubbed Waterbear as well as its enhanced successor referred to as Deuterbear. Cybersecurity firm Trend Micro is tracking the

Ex-Security Engineer Jailed 3 Years for $12.3 Million Crypto Exchange Thefts

A former security engineer has been sentenced to three years in prison in the U.S. for charges relating to hacking two decentralized cryptocurrency exchanges in July 2022 and stealing over $12.3 million. Shakeeb Ahmed, the defendant in question, pled guilty to one count of computer fraud in December 2023 following his arrest in July. "At the time of both attacks,

Hackers Deploy Python Backdoor in Palo Alto Zero-Day Attack

Threat actors have been exploiting the newly disclosed zero-day flaw in Palo Alto Networks PAN-OS software dating back to March 26, 2024, nearly three weeks before it came to light yesterday. The network security company's Unit 42 division is tracking the activity under the name Operation MidnightEclipse, attributing it as the work of a single threat actor of

Researchers Uncover First Native Spectre v2 Exploit Against Linux Kernel

Cybersecurity researchers have disclosed what they say is the "first native Spectre v2 exploit" against the Linux kernel on Intel systems that could be exploited to read sensitive data from the memory. The exploit, called Native Branch History Injection (BHI), can be used to leak arbitrary kernel memory at 3.5 kB/sec by bypassing existing Spectre v2/BHI mitigations, researchers from Systems and

10-Year-Old 'RUBYCARP' Romanian Hacker Group Surfaces with Botnet

A threat group of suspected Romanian origin called RUBYCARP has been observed maintaining a long-running botnet for carrying out crypto mining, distributed denial-of-service (DDoS), and phishing attacks. The group, believed to be active for at least 10 years, employs the botnet for financial gain, Sysdig said in a report shared with The Hacker News. "Its primary method of operation

U.S. Charges 7 Chinese Nationals in Major 14-Year Cyber Espionage Operation

The U.S. Department of Justice (DoJ) on Monday unsealed indictments against seven Chinese nationals for their involvement in a hacking group that targeted U.S. and foreign critics, journalists, businesses, and political officials for about 14 years. The defendants include Ni Gaobin (倪高彬), Weng Ming (翁明), Cheng Feng (程锋), Peng Yaowen (彭耀文), Sun Xiaohui (孙小辉), Xiong Wang (熊旺), and Zhao Guangzong (

Russian Hackers May Have Targeted Ukrainian Telecoms with Upgraded 'AcidPour' Malware

The data wiping malware called AcidPour may have been deployed in attacks targeting four telecom providers in Ukraine, new findings from SentinelOne show. The cybersecurity firm also confirmed connections between the malware and AcidRain, tying it to threat activity clusters associated with Russian military intelligence. "AcidPour's expanded capabilities would enable it to better

Ukraine Arrests Trio for Hijacking Over 100 Million Email and Instagram Accounts

The Cyber Police of Ukraine has arrested three individuals on suspicion of hijacking more than 100 million emails and Instagram accounts from users across the world. The suspects, aged between 20 and 40, are said to be part of an organized criminal group living in different parts of the country. If convicted, they face up to 15 years in prison. The accounts, authorities said, were

RedCurl Cybercrime Group Abuses Windows PCA Tool for Corporate Espionage

The Russian-speaking cybercrime group called RedCurl is leveraging a legitimate Microsoft Windows component called the Program Compatibility Assistant (PCA) to execute malicious commands. “The Program Compatibility Assistant Service (pcalua.exe) is a Windows service designed to identify and address compatibility issues with older programs,” Trend Micro said in an analysis

Ande Loader Malware Targets Manufacturing Sector in North America

The threat actor known as Blind Eagle has been observed using a loader malware called Ande Loader to deliver remote access trojans (RATs) like Remcos RAT and NjRAT. The attacks, which take the form of phishing emails, targeted Spanish-speaking users in the manufacturing industry based in North America, eSentire said. Blind Eagle (aka APT-C-36) is a financially motivated threat actor&

New APT Group 'Lotus Bane' Behind Recent Attacks on Vietnam's Financial Entities

A financial entity in Vietnam was the target of a previously undocumented threat actor called Lotus Bane as part of a cyber attack that was first detected in March 2023. Singapore-headquartered Group-IB described the hacking outfit as an advanced persistent threat group that's believed to have been active since at least 2022. The exact specifics of the infection chain remain unknown

Urgent: Apple Issues Critical Updates for Actively Exploited Zero-Day Flaws

Apple has released security updates to address several security flaws, including two vulnerabilities that it said have been actively exploited in the wild. The shortcomings are listed below - CVE-2024-23225 - A memory corruption issue in Kernel that an attacker with arbitrary kernel read and write capability can exploit to bypass kernel memory protections CVE-2024-23296 - A memory

Warning: Thread Hijacking Attack Targets IT Networks, Stealing NTLM Hashes

The threat actor known as TA577 has been observed using ZIP archive attachments in phishing emails with an aim to steal NT LAN Manager (NTLM) hashes. The new attack chain “can be used for sensitive information gathering purposes and to enable follow-on activity,” enterprise security firm Proofpoint said in a Monday report. At least two campaigns taking advantage of this

GTPDOOR Linux Malware Targets Telecoms, Exploiting GPRS Roaming Networks

Threat hunters have discovered a new Linux malware called GTPDOOR that’s designed to be deployed in telecom networks that are adjacent to GPRS roaming exchanges (GRX) The malware is novel in the fact that it leverages the GPRS Tunnelling Protocol (GTP) for command-and-control (C2) communications. GPRS roaming allows subscribers to access their GPRS services while they are

Researchers Detail Apple's Recent Zero-Click Shortcuts Vulnerability

Details have emerged about a now-patched high-severity security flaw in Apple's Shortcuts app that could permit a shortcut to access sensitive information on the device without users' consent. The vulnerability, tracked as CVE-2024-23204 (CVSS score: 7.5), was addressed by Apple on January 22, 2024, with the release of iOS 17.3, iPadOS 17.3, macOS Sonoma 14.3, and 

Cybercriminals Weaponizing Open-Source SSH-Snake Tool for Network Attacks

A recently open-sourced network mapping tool called SSH-Snake has been repurposed by threat actors to conduct malicious activities. "SSH-Snake is a self-modifying worm that leverages SSH credentials discovered on a compromised system to start spreading itself throughout the network," Sysdig researcher Miguel Hernández said. "The worm automatically searches through known credential

Anatsa Android Trojan Bypasses Google Play Security, Expands Reach to New Countries

The Android banking trojan known as Anatsa has expanded its focus to include Slovakia, Slovenia, and Czechia as part of a new campaign observed in November 2023. "Some of the droppers in the campaign successfully exploited the accessibility service, despite Google Play's enhanced detection and protection mechanisms," ThreatFabric said in a report shared with The Hacker News.

MoqHao Android Malware Evolves with Auto-Execution Capability

Threat hunters have identified a new variant of Android malware called MoqHao that automatically executes on infected devices without requiring any user interaction. "Typical MoqHao requires users to install and launch the app to get their desired purpose, but this new variant requires no execution," McAfee Labs said in a report published this week. "While the app is

Global Coalition and Tech Giants Unite Against Commercial Spyware Abuse

A coalition of dozens of countries, including France, the U.K., and the U.S., along with tech companies such as Google, MDSec, Meta, and Microsoft, have signed a joint agreement to curb the abuse of commercial spyware to commit human rights abuses. The initiative, dubbed the Pall Mall Process, aims to tackle the proliferation and irresponsible use of commercial cyber intrusion tools by

Hackers Exploit Job Boards, Stealing Millions of Resumes and Personal Data

Employment agencies and retail companies chiefly located in the Asia-Pacific (APAC) region have been targeted by a previously undocumented threat actor known as ResumeLooters since early 2023 with the goal of stealing sensitive data. Singapore-headquartered Group-IB said the hacking crew's activities are geared towards job search platforms and the theft of resumes, with as many as 65

Hands-On Review: SASE-based XDR from Cato Networks

Companies are engaged in a seemingly endless cat-and-mouse game when it comes to cybersecurity and cyber threats. As organizations put up one defensive block after another, malicious actors kick their game up a notch to get around those blocks. Part of the challenge is to coordinate the defensive abilities of disparate security tools, even as organizations have limited resources and a dearth of

Pegasus Spyware Targeted iPhones of Journalists and Activists in Jordan

The iPhones belonging to nearly three dozen journalists, activists, human rights lawyers, and civil society members in Jordan have been targeted with NSO Group's Pegasus spyware, according to joint findings from Access Now and the Citizen Lab. Nine of the 35 individuals have been publicly confirmed as targeted, out of whom six had their devices compromised with the mercenary

AnyDesk Hacked: Popular Remote Desktop Software Mandates Password Reset

Remote desktop software maker AnyDesk disclosed on Friday that it suffered a cyber attack that led to a compromise of its production systems. The German company said the incident, which it discovered following a security audit, is not a ransomware attack and that it has notified relevant authorities. "We have revoked all security-related certificates and systems have been remediated or replaced

INTERPOL Arrests 31 in Global Operation, Identifies 1,900+ Ransomware-Linked IPs

An INTERPOL-led collaborative operation targeting phishing, banking malware, and ransomware attacks has led to the identification of 1,300 suspicious IP addresses and URLs. The law enforcement effort, codenamed Synergia, took place between September and November 2023 in an attempt to blunt the "growth, escalation and professionalization of transnational cybercrime." Involving 60 law

U.S. Feds Shut Down China-Linked "KV-Botnet" Targeting SOHO Routers

The U.S. government on Wednesday said it took steps to neutralize a botnet comprising hundreds of U.S.-based small office and home office (SOHO) routers hijacked by a China-linked state-sponsored threat actor called Volt Typhoon and blunt the impact posed by the hacking campaign. The existence of the botnet, dubbed KV-botnet, was first disclosed by the Black Lotus Labs team at

Telegram Marketplaces Fuel Phishing Attacks with Easy-to-Use Kits and Malware

Cybersecurity researchers are calling attention to the "democratization" of the phishing ecosystem owing to the emergence of Telegram as an epicenter for cybercrime, enabling threat actors to mount a mass attack for as little as $230. "This messaging app has transformed into a bustling hub where seasoned cybercriminals and newcomers alike exchange illicit tools and insights creating a dark and

Microsoft Warns of Widening APT29 Espionage Attacks Targeting Global Orgs

Microsoft on Thursday said the Russian state-sponsored threat actors responsible for a cyber attack on its systems in late November 2023 have been targeting other organizations and that it's currently beginning to notify them. The development comes a day after Hewlett Packard Enterprise (HPE) revealed that it had been the victim of an attack perpetrated by a hacking crew

Kasseika Ransomware Using BYOVD Trick to Disarm Security Pre-Encryption

The ransomware group known as Kasseika has become the latest to leverage the Bring Your Own Vulnerable Driver (BYOVD) attack to disarm security-related processes on compromised Windows hosts, joining the likes of other groups like Akira, AvosLocker, BlackByte, and RobbinHood. The tactic allows "threat actors to terminate antivirus processes and services for the deployment of ransomware," Trend

New iShutdown Method Exposes Hidden Spyware Like Pegasus on Your iPhone

Cybersecurity researchers have identified a "lightweight method" called iShutdown for reliably identifying signs of spyware on Apple iOS devices, including notorious threats like NSO Group's Pegasus, QuaDream's Reign, and Intellexa's Predator.  Kaspersky, which analyzed a set of iPhones that were compromised with Pegasus, said the infections left traces in a file

Zero-Day Alert: Update Chrome Now to Fix New Actively Exploited Vulnerability

Google on Tuesday released updates to fix four security issues in its Chrome browser, including an actively exploited zero-day flaw. The issue, tracked as CVE-2024-0519, concerns an out-of-bounds memory access in the V8 JavaScript and WebAssembly engine, which can be weaponized by threat actors to trigger a crash. <!-- adsense --> "By reading out-of-bounds memory, an attacker might be able to

New Python-based FBot Hacking Toolkit Aims at Cloud and SaaS Platforms

A new Python-based hacking tool called&nbsp;FBot&nbsp;has been uncovered targeting web servers, cloud services, content management systems (CMS), and SaaS platforms such as Amazon Web Services (AWS), Microsoft 365, PayPal, Sendgrid, and Twilio. “Key features include credential harvesting for spamming attacks, AWS account hijacking tools, and functions to enable attacks against PayPal and various

Mandiant's X Account Was Hacked Using Brute-Force Attack

The compromise of Mandiant's X (formerly Twitter) account last week was likely the result of a "brute-force password attack," attributing the hack to a drainer-as-a-service (DaaS) group. "Normally, [two-factor authentication] would have mitigated this, but due to some team transitions and a change in X's 2FA policy, we were not adequately protected," the threat intelligence firm&nbsp;said&nbsp;

Beware! YouTube Videos Promoting Cracked Software Distribute Lumma Stealer

Threat actors are resorting to YouTube videos featuring content related to cracked software in order to entice users into downloading an information stealer malware called Lumma. “These YouTube videos typically feature content related to cracked applications, presenting users with similar installation guides and incorporating malicious URLs often shortened using services like TinyURL and Cuttly,

Microsoft Disables MSIX App Installer Protocol Widely Used in Malware Attacks

Microsoft on Thursday said it’s once again disabling the&nbsp;ms-appinstaller protocol handler&nbsp;by default following its abuse by multiple threat actors to distribute malware. “The observed threat actor activity abuses the current implementation of the ms-appinstaller protocol handler as an access vector for malware that may lead to ransomware distribution,” the Microsoft Threat Intelligence

Reimagining Network Pentesting With Automation

Network penetration testing plays a crucial role in protecting businesses in the ever-evolving world of cybersecurity. Yet, business leaders and IT pros have misconceptions about this process, which impacts their security posture and decision-making.&nbsp; This blog acts as a quick guide on network penetration testing, explaining what it is, debunking common myths and reimagining its role in

Reimagining Network Pentesting With Automation

Network penetration testing plays a crucial role in protecting businesses in the ever-evolving world of cybersecurity. Yet, business leaders and IT pros have misconceptions about this process, which impacts their security posture and decision-making.&nbsp; This blog acts as a quick guide on network penetration testing, explaining what it is, debunking common myths and reimagining its role in

Major Cyber Attack Paralyzes Kyivstar - Ukraine's Largest Telecom Operator

Ukraine's biggest telecom operator Kyivstar has&nbsp;become&nbsp;the victim of a "powerful hacker attack,” disrupting customer&nbsp;access to mobile and internet services. "The cyberattack on Ukraine's #Kyivstar telecoms operator has impacted all regions of the country with high impact to the capital, metrics show, with knock-on impacts reported to air raid alert network and banking sector as

Russian APT28 Hackers Targeting 13 Nations in Ongoing Cyber Espionage Campaign

The Russian nation-state threat actor known as&nbsp;APT28&nbsp;has been observed making use of lures related to the ongoing Israel-Hamas war to facilitate the delivery of a custom backdoor called HeadLace. IBM X-Force is tracking the adversary under the name ITG05, which is also known as BlueDelta, Fancy Bear, Forest Blizzard (formerly Strontium), FROZENLAKE, Iron Twilight, Sednit, Sofacy, and

U.S. Treasury Sanctions Sinbad Cryptocurrency Mixer Used by North Korean Hackers

The U.S. Treasury Department on Wednesday imposed sanctions against&nbsp;Sinbad, a virtual currency mixer that has been put to use by the North Korea-linked&nbsp;Lazarus Group&nbsp;to launder ill-gotten proceeds. "Sinbad has processed millions of dollars' worth of virtual currency from Lazarus Group heists, including the Horizon Bridge and Axie Infinity heists," the department said. "Sinbad is

Iranian Hackers Exploit PLCs in Attack on Water Authority in U.S.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed that it's responding to a cyber attack that involved the active exploitation of Unitronics programmable logic controllers (PLCs) to target the Municipal Water Authority of Aliquippa in western Pennsylvania. The attack has been attributed to an Iranian-backed hacktivist collective known as Cyber Av3ngers. "Cyber threat

Stop Identity Attacks: Discover the Key to Early Threat Detection

Identity and Access Management (IAM) systems are a staple to ensure only authorized individuals or entities have access to specific resources in order to protect sensitive information and secure business assets. But did you know that today over 80% of attacks now involve identity, compromised credentials or bypassing the authentication mechanism? Recent breaches at MGM and Caesars have

AI & Your Family: The Wows and Potential Risks

When we come across the term Artificial Intelligence (AI), our mind often ventures into the realm of sci-fi movies like I, Robot, Matrix, and Ex Machina. We’ve always perceived AI as a futuristic concept, something that’s happening in a galaxy far, far away. However, AI is not only here in our present but has also been a part of our lives for several years in the form of various technological devices and applications.

In our day-to-day lives, we use AI in many instances without even realizing it. AI has permeated into our homes, our workplaces, and is at our fingertips through our smartphones. From cell phones with built-in smart assistants to home assistants that carry out voice commands, from social networks that determine what content we see to music apps that curate playlists based on our preferences, AI has its footprints everywhere. Therefore, it’s integral to not only embrace the wows of this impressive technology but also understand and discuss the potential risks associated with it.

→ Dig Deeper: Artificial Imposters—Cybercriminals Turn to AI Voice Cloning for a New Breed of Scam

AI in Daily Life: A Blend of Convenience and Intrusion

AI, a term that might sound intimidating to many, is not so when we understand it. It is essentially technology that can be programmed to achieve certain goals without assistance. In simple words, it’s a computer’s ability to predict, process data, evaluate it, and take necessary action. This smart way of performing tasks is being implemented in education, business, manufacturing, retail, transportation, and almost every other industry and cultural sector you can think of.

AI has been doing a lot of good too. For instance, Instagram, the second most popular social network, is now deploying AI technology to detect and combat cyberbullying in both comments and photos. No doubt, AI is having a significant impact on everyday life and is poised to metamorphose the future landscape. However, alongside its benefits, AI has brought forward a set of new challenges and risks. From self-driving cars malfunctioning to potential jobs lost to AI robots, from fake videos and images to privacy breaches, the concerns are real and need timely discussions and preventive measures.

Navigating the Wows and Risks of AI

AI has made it easier for people to face-swap within images and videos, leading to “deep fake” videos that appear remarkably realistic and often go viral. A desktop application called FakeApp allows users to seamlessly swap faces and share fake videos and images. While this displays the power of AI technology, it also brings to light the responsibility and critical thinking required when consuming and sharing online content.

→ Dig Deeper: The Future of Technology: AI, Deepfake, & Connected Devices

Yet another concern raised by AI is privacy breaches. The Cambridge Analytica/Facebook scandal of 2018, alleged to have used AI technology unethically to collect Facebook user data, serves as a reminder that our private (and public) information can be exploited for financial or political gain. Thus, it becomes crucial to discuss and take necessary steps like locking down privacy settings on social networks and being mindful of the information shared in the public feed, including reactions and comments on other content.

McAfee Pro Tip: Cybercriminals employ advanced methods to deceive individuals, propagating sensationalized fake news, creating deceptive catfish dating profiles, and orchestrating harmful impersonations. Recognizing sophisticated AI-generated content can pose a challenge, but certain indicators may signal that you’re encountering a dubious image or interacting with a perpetrator operating behind an AI-generated profile. Know the indicators. 

AI and Cybercrime

With the advent of AI, cybercrime has found a new ally. As per McAfee’s Threats Prediction Report, AI technology might enable hackers to bypass security measures on networks undetected. This can lead to data breaches, malware attacks, ransomware, and other criminal activities. Moreover, AI-generated phishing emails are scamming people into unknowingly handing over sensitive data.

→ Dig Deeper: How to Keep Your Data Safe From the Latest Phishing Scam

Bogus emails are becoming highly personalized and can trick intelligent users into clicking malicious links. Given the sophistication of these AI-related scams, it is vital to constantly remind ourselves and our families to be cautious with every click, even those from known sources. The need to be alert and informed cannot be overstressed, especially in times when AI and cybercrime often seem to be two sides of the same coin.

IoT Security Concerns in an AI-Powered World

As homes evolve to be smarter and synced with AI-powered Internet of Things (IoT) products, potential threats have proliferated. These threats are not limited to computers and smartphones but extend to AI-enabled devices such as voice-activated assistants. According to McAfee’s Threat Prediction Report, these IoT devices are particularly susceptible as points of entry for cybercriminals. Other devices at risk, as highlighted by security experts, include routers, and tablets.

This means we need to secure all our connected devices and home internet at its source – the network. Routers provided by your ISP (Internet Security Provider) are often less secure, so consider purchasing your own. As a primary step, ensure that all your devices are updated regularly. More importantly, change the default password on these devices and secure your primary network along with your guest network with strong passwords.

How to Discuss AI with Your Family

Having an open dialogue about AI and its implications is key to navigating through the intricacies of this technology. Parents need to have open discussions with kids about the positives and negatives of AI technology. When discussing fake videos and images, emphasize the importance of critical thinking before sharing any content online. Possibly, even introduce them to the desktop application FakeApp, which allows users to swap faces within images and videos seamlessly, leading to the production of deep fake photos and videos. These can appear remarkably realistic and often go viral.

Privacy is another critical area for discussion. After the Cambridge Analytica/Facebook scandal of 2018, the conversation about privacy breaches has become more significant. These incidents remind us how our private (and public) information can be misused for financial or political gain. Locking down privacy settings, being mindful of the information shared, and understanding the implications of reactions and comments are all topics worth discussing. 

Being Proactive Against AI-Enabled Cybercrime

Awareness and knowledge are the best tools against AI-enabled cybercrime. Making families understand that bogus emails can now be highly personalized and can trick even the most tech-savvy users into clicking malicious links is essential. AI can generate phishing emails, scamming people into handing over sensitive data. In this context, constant reminders to be cautious with every click, even those from known sources, are necessary.

→ Dig Deeper: Malicious Websites – The Web is a Dangerous Place

The advent of AI has also likely allowed hackers to bypass security measures on networks undetected, leading to data breaches, malware attacks, and ransomware. Therefore, being alert and informed is more than just a precaution – it is a vital safety measure in the digital age.

Final Thoughts

Artificial Intelligence has indeed woven itself into our everyday lives, making things more convenient, efficient, and connected. However, with these advancements come potential risks and challenges. From privacy breaches, and fake content, to AI-enabled cybercrime, the concerns are real and need our full attention. By understanding AI better, having open discussions, and taking appropriate security measures, we can leverage this technology’s immense potential without falling prey to its risks. In our AI-driven world, being informed, aware, and proactive is the key to staying safe and secure.

To safeguard and fortify your online identity, we strongly recommend that you delve into the extensive array of protective features offered by McAfee+. This comprehensive cybersecurity solution is designed to provide you with a robust defense against a wide spectrum of digital threats, ranging from malware and phishing attacks to data breaches and identity theft.

The post AI & Your Family: The Wows and Potential Risks appeared first on McAfee Blog.

Cybercriminals Using Telekopye Telegram Bot to Craft Phishing Scams on a Grand Scale

More details have emerged about a malicious Telegram bot called Telekopye that's used by threat actors to pull off large-scale phishing scams. "Telekopye can craft phishing websites, emails, SMS messages, and more," ESET security researcher Radek Jizba said in a new analysis. The threat actors behind the operation – codenamed Neanderthals – are known to run the criminal enterprise as a

New Flaws in Fingerprint Sensors Let Attackers Bypass Windows Hello Login

A new research has uncovered multiple vulnerabilities that could be exploited to bypass Windows Hello authentication on Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X laptops. The flaws were discovered by researchers at hardware and software product security and offensive research firm Blackwing Intelligence, who found the weaknesses in the fingerprint sensors from Goodix,

Zero-Day Flaw in Zimbra Email Software Exploited by Four Hacker Groups

A zero-day flaw in the Zimbra Collaboration email software was exploited by four different groups in real-world attacks to pilfer email data, user credentials, and authentication tokens. "Most of this activity occurred after the initial fix became public on GitHub," Google Threat Analysis Group (TAG) said in a report shared with The Hacker News. The flaw, tracked as CVE-2023-37580 (CVSS score:

U.S. Takes Down IPStorm Botnet, Russian-Moldovan Mastermind Pleads Guilty

The U.S. government on Tuesday announced the takedown of the IPStorm botnet proxy network and its infrastructure, as the Russian and Moldovan national behind the operation pleaded guilty. "The botnet infrastructure had infected Windows systems then further expanded to infect Linux, Mac, and Android devices, victimizing computers and other electronic devices around the world, including in Asia,

Stealthy Kamran Spyware Targeting Urdu-speaking Users in Gilgit-Baltistan

Urdu-speaking readers of a regional news website that caters to the Gilgit-Baltistan region have likely emerged as a target of a watering hole attack designed to deliver a previously undocumented Android spyware dubbed Kamran. The campaign, ESET has discovered, leverages Hunza News (urdu.hunzanews[.]net), which, when opened on a mobile device, prompts visitors of the Urdu version to install its

Zero-Day Alert: Lace Tempest Exploits SysAid IT Support Software Vulnerability

The threat actor known as Lace Tempest has been linked to the exploitation of a zero-day flaw in SysAid IT support software in limited attacks, according to new findings from Microsoft. Lace Tempest, which is known for distributing the Cl0p ransomware, has in the past leveraged zero-day flaws in MOVEit Transfer and PaperCut servers. The issue, tracked as CVE-2023-47246, concerns a path traversal

N. Korea's BlueNoroff Blamed for Hacking macOS Machines with ObjCShellz Malware

The North Korea-linked nation-state group called BlueNoroff has been attributed to a previously undocumented macOS malware strain dubbed ObjCShellz. Jamf Threat Labs, which disclosed details of the malware, said it's used as part of the RustBucket malware campaign, which came to light earlier this year. "Based on previous attacks performed by BlueNoroff, we suspect that this malware was a late