Normal view

5 Scams to Watch for This Memorial Day Weekend

22 May 2026 at 12:00

Memorial Day weekend officially kicks off summer, and for millions of Americans, that means road trips, flights, cookouts, and a little online shopping for the deals. 

Unfortunately, scammers know this. They count on the fact that you’re distracted, you’re moving fast, and you’re probably connected to a network you don’t own. 

Here are five scams surging this holiday weekend, what they look like, and how to stay ahead of them.

1. Fake Travel Alerts from “Your Bank” or Hotel

You’re packing your bag when a text arrives: “Unusual activity detected on your account. Verify now to avoid suspension.”  

It looks like it’s from your bank, or maybe your hotel loyalty program. There’s a link. There’s urgency. And that’s exactly the point. 

These are brand impersonation scams, and they’re a dominant tactic year-round, but they spike around travel holidays when people are actively monitoring reservations and accounts.  

Example of a fraudulent AMEX message.
Example of a fraudulent AMEX message.

According to McAfee research, trusted brands like banks, airlines, and hotels are among the most commonly impersonated, and email scams impersonating retail and financial brands have surged up to 85% as major holidays approach. 

The message will typically ask you to click a link and “confirm your details” to secure your account or honor a reservation. That link leads to a convincing-looking fake site designed to capture your login credentials, payment info, or both. 

How to Avoid Travel Alert Scams:  

  • Don’t click links in unsolicited texts or emails.  
  • Go directly to the company’s app or website by typing the URL yourself.  
  • Remember: pressure is a tactic, not customer service.  

McAfee’s Scam Detector can flag suspicious messages before you interact with them, whether they come via text, email, or social media. 

2. Fake Memorial Day Weekend “Deals”

Memorial Day is one of the biggest shopping weekends of the year. Scammers treat it like an open invitation. 

Fraudulent retailers flood social feeds with too-good-to-be-true deals on everything from patio furniture to electronics, often impersonating legitimate brands with copycat websites and paid ads. 

According to McAfee’s holiday shopping research, 91% of shoppers see ads from unfamiliar retailers, 37% say they might buy from a brand they don’t recognize, and a full 40% of consumers have abandoned a purchase out of fear that the deal wasn’t real. 

The most impersonated brands in McAfee’s research span luxury labels (Coach, Dior, Gucci) to mainstream favorites (Apple, Samsung, Nintendo, Disney), exactly the kind of items that show up in “blowout sale” ads. Fake storefronts have grown significantly, with technology URL scams rising nearly 50%. 

Once shoppers enter their payment details on a fraudulent site, that information goes directly to criminals. The average scam loss during the holiday shopping period runs around $840 per victim. 

How to Avoid Shopping Scams:  

  • Type retailer URLs directly into your browser instead of clicking through ads or social posts.  
  • Look for HTTPS and double-check the domain carefully before entering any payment info.  
  • If a deal looks unbelievably good, verify it on the retailer’s official app before buying.  

McAfee’s Web Protection blocks malicious and suspicious sites before they load, including fake checkout pages. 

3. QR Code Scams at Gas Stations and Travel Stops

If you’re road-tripping this weekend, you may scan a QR code somewhere. It could be at the gas pump, a rest stop, a parking meter, or a roadside attraction. Scammers know this too. 

Criminals increasingly place fake QR codes over legitimate ones on gas station pumps, parking kiosks, and public signs. When you scan, you’re redirected to a convincing-looking payment or login page that captures your financial information. This is known as “quishing” or phishing via QR code. 

McAfee research shows just how widespread this risk has become: 68% of people scanned a QR code in the past three months, and 18% ended up on a suspicious or unsafe page after scanning. Among those who did, more than half took a risky action like entering personal information, installing an app, or connecting a digital wallet. 

How to Avoid Sketchy QR Codes:   

  • Before scanning any QR code in public, look closely at the sticker or sign.  
  • If it looks like it’s been placed over something else, skip it.  
  • If you do scan, check the URL before proceeding.  

McAfee’s Scam Detector now includes instant QR code safety checks that assess risk before you tap, so you’re not flying blind at the gas pump. 

QR Scan Example
This shows how McAfee blocks unsafe QR codes.

4. Public Wi-Fi Traps at Airports, Hotels, and Coffee Shops

Whether you’re waiting at the airport or grabbing coffee before hitting the highway, free Wi-Fi can feel like a gift. But not every “free Wi-Fi” network is what it appears to be. 

Hackers set up what are called “evil twin” networks, hotspots with names designed to look exactly like the legitimate network at the airport, hotel, or café you’re in.  

The moment you connect, they can use tools called packet sniffers to capture the data you send and receive: passwords, banking credentials, credit card numbers, email logins.  

According to McAfee’s travel research, 63% of travelers connect to public Wi-Fi, and 49% use airport Wi-Fi, making these among the riskiest behaviors travelers engage in without realizing it. 

Some of these fake networks go further, presenting a phony login screen that captures your username and password for popular services like Google or Apple before you even realize you’ve been compromised. 

How to Avoid Malicious Wi-Fi : 

  • Always confirm the exact Wi-Fi network name with staff before connecting.  
  • Turn off auto-join for Wi-Fi on your devices.  
  • And most importantly: use a VPN.  

A VPN creates an encrypted tunnel for your internet traffic, so even if a hacker intercepts it, they’ll only see scrambled data. McAfee’s VPN is included in McAfee+ plans and automatically connects when you join public Wi-Fi, exactly the protection you want when you’re traveling and connecting everywhere.

5. Toll Road and Parking Text Scams (Expect a Surge After the Weekend)

You may have seen these already: a text that says you owe an unpaid toll or parking fee, with a link to pay before penalties kick in. These scams have been circulating for a while, and there’s a good chance Memorial Day weekend is about to make them worse. 

Scammers track news cycles and know that millions of Americans will be driving this weekend, many of them through toll roads and unfamiliar areas.  

That means they can blast out fake “unpaid toll” texts after the holiday and a significant percentage of recipients will think: “Actually, I did drive somewhere new this weekend.” That uncertainty is exactly what they’re counting on. 

Fake court notices threatening parking and toll violations have been making the rounds this spring.

These texts typically impersonate EZPass, SunPass, or state transportation departments and create urgency around a small fee to avoid larger fines. The link leads to a fake payment page designed to steal your credit card details. 

How to Avoid Toll Scams:   

  • Don’t click links in unsolicited toll or parking texts.  
  • If you think the charge might be legitimate, go directly to your state’s official toll authority website and look up your account there.  
  • Real toll agencies will not threaten immediate penalties over text with a payment link.  
  • If you receive one of these texts after this weekend, treat it as suspicious by default. 

Have a Safe Memorial Day Weekend 

Scammers don’t take holidays. If anything, long weekends are peak season. The good news: a little awareness goes a long way. Slow down before you click, verify before you scan, and protect your connection before you log on. 

McAfee+ Advanced comes with layered protection across all the moments where scams are most likely to strike, from the gas station to the hotel lobby to your inbox.  

Stay safe out there. 

The post 5 Scams to Watch for This Memorial Day Weekend appeared first on McAfee Blog.

1 in 3 Targeted by Travel Scams and Rising Costs are Making it Worse

19 May 2026 at 12:00

You’re comparing airfare on your phone, watching prices climb by the hour, when a deal pops up that feels just good enough to grab. The timer’s ticking. The price looks right. You don’t want to miss it. 

You’re comparing airfare on your phone, watching prices climb by the hour, when a deal pops up that feels just good enough to grab. The timer’s ticking. The price looks right. You don’t want to miss it. 

That moment, when you’re rushing to lock something in, is exactly where scams thrive. 

New McAfee research shows that more than 1 in 3 Americans have encountered a travel-related cyberthreat, and 41% of those impacted lost money, often exceeding $500. 

This shows a screenshot of a fake Booking.com website detected by McAfee that was attempting to trick users into running malicious script/code
This shows a screenshot of a fake Booking.com website detected by McAfee that was attempting to trick users into running malicious script/code

At the same time, rising travel costs and time pressure are pushing people to make faster, riskier decisions. Those are the exact conditions scammers rely on. 

That’s where protection has to show up earlier. 

McAfee’s Scam Detector lets you check suspicious links, messages, and booking sites before you click, so you can pause and verify instead of giving scammers the edge. 

Travel Scams, Red Flags, and How McAfee Protects You 

Travel Scam Type  Key Red Flags  How McAfee Helps 
Fake travel deals  Prices far below market, pressure to “book now,” sites you’ve never heard of  Scam Detector flags suspicious links and explains why they’re risky, so you can avoid fake deals before you book 
Fake booking confirmations  Unexpected messages about bookings you didn’t make, mismatched sender details  Scam Detector analyzes messages before you engage, helping you avoid fake confirmations 
Fake airline/hotel websites  Slight URL changes, poor design, being pushed to pay immediately or off-platform  Safe Browsing helps block risky sites before you enter payment details, reducing the chance of fraud 
Payment requests outside platforms  Asked to pay via wire transfer, crypto, or direct payment instead of official platforms  Scam Detector flags suspicious payment requests, helping you avoid sending money to scammers 
QR code scams  QR codes posted in public with no clear source or context  Scam Detector checks QR links before they open, so you don’t land on malicious sites 
Customer service impersonation  Calls or messages asking for login credentials or payment info  Scam Detector detects deepfake AI audio impersonation attempts, helping you avoid sharing sensitive information 
AI-generated listings  Photos that look overly polished, details that don’t quite match up  Scam Detector identifies suspicious content patterns, helping you spot listings that aren’t real 
Public Wi-Fi attacks  Open networks with no password or security prompts  VPN helps protect your data on public networks, keeping your personal information private 

The Findings From Our 2026 Travel Research 

McAfee Labs found that many travel scams work because they look familiar and spread fast.  

TripAdvisor was the most commonly impersonated travel app, cloned at roughly three times the rate of other major platforms like Kayak, Expedia, and Booking.com.  

In some cases, thousands of scam detections traced back to just a handful of fake apps, showing how quickly a convincing scam can take off when travelers are racing to book. 

Top 5 Ways Rising Travel Costs Are Driving Risky Decisions 

Our 2026 travel survey shows how rising prices and lastminute pressure are changing traveler behavior, often in ways scammers exploit. 

1. Booking faster than usual
90% feel pressure to act quickly  

2. Choosing cheaper deals without verifying
32% would book before confirming legitimacy  

3. Ignoring red flags
33% admit they’ve done it  

4. Trusting messages that look legitimate
41% trust airline/hotel messages without verifying  

5. Clicking links without checking the source
20% click first, verify later (or not at all)  

Top 5 Ways Costs Drive Risk

The Travel Scams People Are Most Likely to Fall For

According to our consumer survey findings, those who reported falling for a travel scam said these were the methods scammers used to trick them:

1. Fake travel deals or promotions (15%)

2. Scam booking confirmations or updates (15%)

3. Manipulated accommodation listings or photos (15%)

4. Payment requests outside official platforms (11%)

5. Fake vacation rental listings (10%)

6. Fake airline or hotel websites (9%)

7. Customer service impersonation (9%)

The Travel Scams People Are Most Likely to Fall For

8 Ways Travelers Put Themselves at Risk Without Realizing It

These common traveler behaviors are popular avenues for criminals to steal your information, data, and money.

1. Connecting to public Wi-Fi (63%)  

2. Scanning QR codes without verifying (62%)  

3. Using airport Wi-Fi (49%)  

4. Trusting travel-related messages (41%)  

5. Logging into financial apps on public Wi-Fi (22%)  

6. Sharing travel plans in real time (22%)  

7. Clicking travel links without verifying (20%)  

8. Using shared/public computers (15%)  

8 Ways Travelers Put Themselves at Risk Without Realizing It

How McAfee Protects You Before, During, and After Your Trip 

As prices rise and decisions happen in real time, it’s easy to prioritize convenience over caution. But that’s exactly the moment when small checks matter most. 

Stage of Travel  What’s Happening  How McAfee Helps 
Before You Book  Comparing deals, clicking promotions, booking flights and hotels under time pressure  Scam Detector checks links, messages, and booking sites before you click, helping you avoid fake deals and scam listings 
During Your Trip  Connecting to public Wi-Fi, scanning QR codes, receiving travel updates and alerts  VPN helps secure your connection on public Wi-Fi, while Scam Detector flags suspicious messages and unsafe links in real time 
After Your Trip  Accounts remain active, travel data stored across platforms, potential exposure from breaches  Identity Monitoring alerts you if your personal information appears online, helping you act quickly before damage spreads 

With McAfee+ Advanced, multiple layers work together so you’re not left figuring it out after the damage is done.  

Spend more time on your vacation, and less time worrying about scammers who want your vacation fund. 

The post 1 in 3 Targeted by Travel Scams and Rising Costs are Making it Worse appeared first on McAfee Blog.

McAfee Ranks #1 in AV-Comparatives PC Performance Test — Again

18 May 2026 at 15:27

McAfee Total Protection just took first place in the latest AV-Comparatives PC Performance Test, the gold standard for measuring how much (or how little) security software slows down your computer.  

With an overall impact score of 3.3 out of a possible 100, McAfee outperformed all 19 other security products tested and earned the highest possible rating: 3 Stars ADVANCED+. 

The industry average? 12.8. McAfee came in nearly 4x lower than that. The lower the impact score, the less the software gets in your way 

What Is the AV-Comparatives PC Performance Test? 

AV-Comparatives is an independent cybersecurity testing lab that has been rigorously evaluating security software since 1999. Unlike a review written by a single journalist or a score based on a company’s own claims, AV-Comparatives tests are: 

  • Independent: delivers unbiased, datadriven evaluations of security products  
  • Standardized: every product is tested under the same conditions 
  • Widely trusted: regularly cited in product roundups, expert reviews, and buying guides that shape how consumers choose security software 

The PC Performance Test specifically measures how much a security product impacts your computer’s everyday speed. Testing is conducted on a real Windows 11 machine (Intel Core i3, 8GB RAM, SSD) with all default settings enabled and an active internet connection. That’s the same setup millions of everyday users have at home. 

AV-Comparatives evaluates real-world tasks including: 

  • Copying and moving files 
  • Installing and launching apps 
  • Downloading files from the web 
  • Browsing websites 

The lower the impact score, the less the software gets in your way.

What McAfee’s Score Actually Means 

McAfee Total Protection scored 3.3the lowest impact score of all 20 products tested, and well below the industry average of 12.8. 

Here’s a simple way to think about it: if the average security product takes a measurable toll on your machine while it works in the background, McAfee barely registers. You get full, always-on protection without the sluggishness that frustrates so many users. 

This result earned McAfee the ADVANCED+ rating, the highest tier AV-Comparatives awards, reserved for products that deliver top-tier performance with minimal system impact. 

Why “Lightweight” Protection Matters More Than You Think 

There’s a common misconception that stronger protection means a heavier, slower product. McAfee’s results prove otherwise. 

When your security software is slow, you notice it: 

  • Apps take longer to open 
  • Downloads feel sluggish 
  • Your machine lags during everyday tasks 
  • You’re tempted to disable protection to get your speed back, leaving yourself exposed 

A lightweight product means protection that works quietly in the background, without making you choose between safety and performance. That’s the promise behind McAfee’s result, and it’s now independently verified. 

AV-Comparatives Test Results
AV-Comparatives Test Results

 

First Place, But Not for the First Time 

This isn’t a one-off result. McAfee has earned the ADVANCED+ rating consistently across multiple rounds of AV-Comparatives testing, demonstrating that this level of performance isn’t luck. It’s the result of deliberate, sustained engineering. 

Independent, repeatable results like these are what separate marketing claims from proven performance. 

With McAfee, you get award-winning protection and award-winning performance, so your devices stay secure without slowing you down. 

Which McAfee Plans Include This Protection? 

The same AI-powered threat protection validated in this test is built into every major McAfee plan: 

  • McAfee+ Premium 
  • McAfee+ Advanced 
  • McAfee+ Ultimate 
  • McAfee Total Protection 
  • McAfee LiveSafe 

Whether you’re protecting one device or an entire household, you’re getting the same industry-leading, independently verified performance under the hood. 

Ready to get protection that doesn’t slow you down? Explore McAfee+ Plans → 

The post McAfee Ranks #1 in AV-Comparatives PC Performance Test — Again appeared first on McAfee Blog.

How to Spot Fake Court Texts and Celebrity Deepfake Ads: This Week in Scams

15 May 2026 at 12:00

A text that looks like it came straight from a courthouse is making the rounds across the U.S. And yes, I got it too. 

First things first, that’s a scam. And to be clear: DON’T SCAN THAT QR CODE. 

It’s the same playbook as last year’s toll road scams, just dressed up with a little more authority and a lot more pressure. 

Before doing anything, our team ran it through McAfee’s Scam Detector. It immediately flagged the message as suspicious, and that’s exactly the kind of moment this tool is built for. When something feels just real enough to second guess, it gives you a clear signal before you click, scan, or spiral. 

This shows how Scam Detector immediately flagged the text message and court image as suspicious.  
A screenshot showing Scam Detector in action.

This court notice scam has ramped up and changed shape since we first covered it in March. So let’s get into how it works: 

How the scam works 

The text claims you’ve missed a payment, violated a law, or have some kind of outstanding “case.” It then pushes you to scan a QR code or click a link to resolve it quickly. 

From there, one of two things usually happens: 

  1. You’re taken to a fake payment page designed to steal your money, or 
  2. You’re prompted to download something that gives scammers access to your device or data  

Either way, the goal is the same: get you to act fast before you have time to question it. 

Here's the fake text our author received
Here’s the scam text I got in California. You’ll notice it looks exactly like the others across the country. 

The red flags in this message 

  • Urgent, threatening language about fines, penalties, or legal action  
  • Vague accusations with no real details about what you supposedly did  
  • Official-looking formatting like case numbers, clerk signatures, and judge names  
  • Copy-paste consistency across states: McAfee employees in New York and California received nearly identical messages with the same names  

There are reports of this scam popping up nationwide, but the rule is simple: law enforcement does not text you to demand payment or resolve legal issues. 

What to do if you scanned the QR code 

First, don’t panic. Then: 

  • Do not pay anything or enter personal information  
  • Do not delete apps you were told to install (this can make it harder to detect what happened)  
  • Run a device scan using a trusted security tool like McAfee’s free antivirus  
  • Keep an eye on your financial accounts and logins for unusual activity  

And that, my friends, is scam number one in this week’s This Week in Scams (new format, we’re experimenting a little).  

Let’s get into what else is on our radar. 

Deepfake Celebrity Ads Are Targeting Seniors on Social Media. Here’s What a New Study Found.  

If you saw our story last year about Al Roker speaking out after scammers used an AI-generated version of him to promote a fake hypertension cure, or the shocking case of a French woman who lost nearly $900,000 to fraudsters posing as Brad Pitt, you already know just how convincing celebrity deepfake scams have become. 

Now, new reporting suggests these scams are reaching older adults at enormous scale. 

According to a new study from the Center for Countering Digital Hate, just 30 of the most active scam advertisers on Facebook generated an estimated 215 million ad impressions over the past year. Nearly 73% of those impressions were shown to adults over 65. 

The fake ads used AI-generated versions of well-known figures including Donald Trump, Joe Biden, Oprah Winfrey, Steve Harvey, and Brad Pitt to promote fake government benefits, miracle health products, and bogus financial offers. 

These are some of the AI-generated and photoshopped images used by scammers last year to convince a woman she was dating Brad Pitt.
These are some of the AI-generated and photoshopped images used by scammers last year to convince a woman she was dating Brad Pitt.

What McAfee’s Data Says About Celebrity Deepfake Scams 

This aligns closely with McAfee’s 2025 Most Dangerous Celebrity: Deepfake Deception List. 

Our research found that: 

  • 72% of Americans have seen a fake celebrity or influencer endorsement online  
  • 39% have clicked on one of these ads or posts  
  • 1 in 10 lost money or personal information  
  • Average losses reached $525 per victim  

The celebrities most commonly exploited in the U.S. included Taylor Swift, Scarlett Johansson, Jenna Ortega, and Sydney Sweeney, while Brad Pitt also ranked prominently on the global list.  

Why These Scams Work So Well 

Celebrity deepfake scams exploit something simple: trust. 

When a familiar face appears in your social feed, whether it is Al Roker recommending a health product or Brad Pitt asking for help, your guard naturally drops. 

And AI is making these fakes harder to detect. 

McAfee’s 2026 State of the Scamiverse found that Americans now encounter an average of three deepfakes every day, yet more than one in three say they are not confident they can identify one. 

In other words, scammers are weaponizing the faces people know best to make fraud feel familiar. 

How to Spot a Deepfake on Social Media 

Celebrity deepfakes are designed to look convincing, but there are still clues that something is off. If you see a video of Oprah Winfrey, Al Roker, or Brad Pitt promoting a miracle cure, government benefit, or investment opportunity, pause before you click. 

Here are some of the biggest red flags to watch for: 

Red Flag   What to Look For   
Too-good-to-be-true offers  The video promises free grocery money, secret Medicare benefits, guaranteed investment returns, or miracle health cures. 
Out-of-character endorsements  A celebrity appears to promote a random supplement, financial opportunity, or government program that seems unrelated to their normal work. 
Robotic or unnatural voice  The speech sounds overly smooth, lacks natural pauses, or has strange pacing and tone. 
Lip-sync issues  The celebrity’s mouth movements do not perfectly match the words being spoken. 
Unnatural facial expressions  Blinking, smiling, and head movements appear stiff, overly polished, or slightly off. 
Urgent language  The ad pressures you to “Act now,” “Claim your benefits today,” or “Limited spots available.” 
Suspicious links  Clicking leads to a website you do not recognize or that does not match the company or organization being referenced. 
No confirmation elsewhere  Trusted news outlets and the celebrity’s verified accounts do not mention the same announcement or offer. 

When in doubt, go directly to the celebrity’s verified social account or search trusted news sources to confirm the information. And if something feels off, trust your instincts. In the age of AI, seeing is no longer believing. 

How McAfee Helps You Stay Ahead of These Scams 

McAfee+ Advanced gives you multiple layers working together so you’re not left figuring it out in the moment: 

  • Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage  
  • Safe Browsing helps block risky sites if you do click or scan  
  • Device Security helps detect and remove malicious apps or downloads  
  • Identity Monitoring alerts you if your personal info shows up where it shouldn’t, so you can act fast  
  • Personal Data Cleanup helps remove your information from data broker sites, making you a harder target in the first place  
  • Secure VPN keeps your data private, especially on public Wi-Fi  

Safety tips to carry into next week 

  • Slow down when a message creates urgency. That’s the hook  
  • Don’t scan QR codes or click links from unexpected texts  
  • Go directly to official websites instead of using links sent to you  
  • Use tools that flag scams in real time so you don’t have to guess  
  • Don’t trust celebrity endorsements posted to social media unless they come directly from a celebrity’s official page 

The reality is, these scams are designed to look normal. You shouldn’t have to be an expert to spot them. That’s why McAfee’s here to help. 

We’ll be back next week with more scams making headlines. 

The post How to Spot Fake Court Texts and Celebrity Deepfake Ads: This Week in Scams appeared first on McAfee Blog.

Sinkholing CountLoader: Insights into Its Recent Campaign

13 May 2026 at 10:00

Authored by Harshil Patel and Sakshi Jaiswal 

McAfee Labs has recently uncovered a large scale CountLoader campaign that uses multiple layers of obfuscation and staged payload delivery to evade detection and maintain persistence in infected systems. The infection process relies on several layers of loaders, including PowerShell scripts, obfuscated JavaScript executed through mshta.exe, and in memory shellcode injection, each stage decrypting and launching the next. The attackers employ a custom encrypted communication protocol to interact with their C2 servers. By registering a backup domain used by the malware, we were able to sinkhole the traffic and observe thousands of infected machines connecting to the C2 infrastructure. Final payload deployed in this campaign is a cryptocurrency clipper, which monitors clipboard activity and replaces copied wallet addresses with attacker controlled ones to redirect cryptocurrency transactions. 

Sinkholing 

Sinkholing is a defensive technique in which researchers take control of malicious domains or infrastructure used by malware. Instead of allowing infected systems to communicate with attacker controlled C2 servers, the traffic is redirected to a researcher controlled server. This approach enables researchers to monitor infected hosts, collect telemetry, measure the scale and spread of a campaign. 

Key Findings 

  • McAfee researchers identified a large-scale CountLoader campaign using multi-stage payload delivery and heavy obfuscation techniques. 
  • Researchers successfully sinkholed malware communication using a backup C2 domain, enabling visibility into the campaign’s infrastructure and infected hosts. 
  • The sinkhole received approximately 5,000 connections per minute from infected systems. 
  • Telemetry collected during the investigation revealed around 86,000 unique infected machines. 
  • The malware also spreads through USB drives, with approximately 9,000 infections attributed to removable media. 
  • The final payload deployed in this campaign is cryptocurrency clipper malware that hijacks clipboard data to redirect cryptocurrency transactions. 

C2 Sinkholing and Geographical Prevalence  

As the malware contacts the C2 servers in the reverse order and only hell1-kitty[.]cc was used by attackers, we were able to register hell10-kitty[.]cc and were able to gain insights into the campaign. 

Figure 3 : Sinkholing malware communication
Figure 1: Sinkholing malware communication

On average, around 5,000 infected clients contacted our server every minute. 

In total, we observed approximately 86,000 unique infections. 

Telemetry collected revealed that this CountLoader campaign has a broad global footprint. The highest number of infections were observed in India, followed by Indonesia, the United States, and several countries across Southeast Asia. 

Figure 2 : Global distribution of CountLoader infections.
Figure 2: Global distribution of CountLoader infections.

Conclusion 

CountLoader is a multistage malware loader that uses obfuscated JavaScript and trusted Windows utilities to deliver additional payloads. It ensures persistence via scheduled tasks and uses multiple fallback C2 domains to maintain reliability. Malware employs in-memory execution and security bypass techniques to evade detection.  

In recent campaigns, it has been observed deploying cryptocurrency clipper malware to silently hijack transactions.  

McAfee Researchers identified a flaw in its communication mechanism and were able to exploit it to gain insights into the campaign. 

Technical Analysis 

The following diagram illustrates the complete infection chain used in this CountLoader campaign, from the initial execution to the deployment of the final payload. 

Figure 3 : Infection Chain
Figure 3: Infection Chain

The infection begins when an EXE file is executed. This file launches a PowerShell command, which downloads and executes an obfuscated JavaScript loader known as CountLoader. The loader is executed using mshta.exe, a legitimate Windows utility often abused by malware to run scripts. 

Once executed, it performs several tasks: 

  • Establishes persistence by creating a scheduled task that runs every 30 minutes. 
  • Contacts multiple C2 servers, trying them in reverse order until a connection is successful. 
  • Attempts to spread via USB drives by replacing files with malicious LNK shortcuts that execute the malware when opened. 
  • Wait for the C2 server to issue commands to download and execute payloads. 

The payload execution chain consists of several stages: 

Launcher: A secondary JavaScript component creates another scheduled task that runs every 60 minutes, ensuring long term persistence. 

PowerShell Packer: The launcher executes an obfuscated PowerShell script that acts as a packer. This script decrypts and launches the next stage. 

Injector: The next PowerShell stage disables security mechanisms such as AMSI and injects shellcode into a legitimate process. 

Shellcode Execution: The injected shellcode unpacks the final payload directly in memory. 

Final Payload: The final payload is executed under the process systeminfo.exe. In this campaign, the deployed payload was identified as a cryptocurrency clipper malware, which monitors clipboard activity and replaces copied cryptocurrency wallet addresses with attacker controlled addresses. 

Stage 1 Exe 

The infection chain begins with the execution of a malicious EXE file, it immediately runs a PowerShell one-liner as shown in the below image. 

Example of the execution chain

Stage 2 – PowerShell 

The PowerShell script fetched from the URL decodes a Base64-encoded string and executes the resulting content. It also employs an unusual obfuscation technique, where the variable names are crafted to resemble the highlighted pattern, making the script harder to read and analyze.

Power Shell

Multiple such variables are used to create a complete base64 string which is then decoded and executed through Invoke-Expression. 

Payload 2

Stage 3 – CountLoader 

The file is a HTA file with JavaScript that uses string obfuscation technique to evade detection. 

Countloader

It starts by hiding the mshta window to ensure that the malicious activity runs silently in the background without alerting the user. 

The script then attempts to delete its own file in case it was executed locally. If the script determines that it is not being executed from a URL, it terminates immediately.  

Countlaoder 2

Then the script tries to contact C2 serversiterating through the list in reverse order.

Countloader 3

Figure 4: C2 communication protocol.
Figure 4: C2 communication protocol.

A handshake process is performed to verify connectivity with the server. The client sends an encrypted “checkStatus” message, and the server responds with an encrypted “success” message if the connection is valid 

All communications between the client and the server are encrypted, with slightly different encryption schemes used for each direction: 

  1. Client to Server:  text → (key+(base64encode(utf16le(xor(text, key))))) 
  2. Server to Client:  text → (key+(base64encode(xor(text, key)))) 

The key is a randomly generated six digit number created for each message. 

The key is a randomly generated six digit number created for each message. If the handshake is successful, the corresponding domain is selected as the active C2 server, which is used for all subsequent communications. 

To maintain persistence on the infected system, the malware creates a scheduled task if one does not already exist. 

To maintain persistence on the infected system, the malware creates a scheduled task if one does not already exist.

The scheduled task command line is slightly different if it detects CrowdStrike or Reason AV installed on the system, likely as an attempt to evade detection from these AVs. 

After establishing persistence, the malware gets a JWT token from the C2 server, which is used to authenticate further requests. 

The get_jwt_token function sends system information about the infected host to the server.

The get_jwt_token function sends system information about the infected host to the server.

This includes details related to cryptocurrency usage, such as installed wallets and browser extensions, allowing the attackers to determine whether the victim is likely involved with cryptocurrency.

This includes details related to cryptocurrency usage, such as installed wallets and browser extensions, allowing the attackers to determine whether the victim is likely involved with cryptocurrency. 

Finally, the malware gets commands from the C2 server, which is then executed on the compromised system. 

command from the C2 server

Each command contains a taskType value that determines the action to be performed on the infected system. 

The table below shows the command codes and their actions. 

Code   Command 
1  execute exe file 
2  execute python file 
3  execute dll file 
4  uninstall itself 
5  send domain info to C2 
6  execute msi file 
9  spread by infecting usb files 
10  execute HTA file 
11  execute powershell file 

We observed two commands from the above list being sent to the malware as highlighted below: 

Spreading via USB drives (taskType – 9) 

When instructed by the C2 server to spread via USB drives, the malware replaces certain file types on all connected external drives with LNK shortcut files. These shortcuts are crafted so that when a user opens them, the malware executes while simultaneously opening the original file to avoid suspicion. 

Targeted file types are  exe , pdf , doc and docx. 

The build ID of the malware is appended with “_usb”. 

The build ID of the malware is appended with “_usb”.

Deploying payload using powershell (taskType – 11) 

The CountLoader is capable of running many types of executable files, In this campaign, it deploys a separate execution chain that ultimately leads to a clipper malware. 

CountLoader launches the next stage using the following command line: 

CountLoader launches the next stage using the following command line:

Payload Launcher 

The Payload Launcher is very similar to CountLoader in terms of both functionality and obfuscation techniques. 

However, unlike CountLoader, which retrieves tasks from the C2 server, the launcher contains hard-coded task information. 

For persistence, it creates a scheduled task which executes "mshata.exe {domain}/{name}" every 60 minutes.

For persistence, it creates a scheduled task which executes  “mshata.exe {domain}/{name} every 60 minutes. 

For persistence, it creates a scheduled task which executes  "mshata.exe {domain}/{name}" every 60 minutes. 

In the task configuration: 

“url” specifies the url of the payload. 

“taskType” is set to 11, indicating that the payload should be executed as a PowerShell script. 

"taskType" is set to 11, indicating that the payload should be executed as a PowerShell script.

Powershell Packer 

The PowerShell script executed by the launcher acts as a simple packer. It is obfuscated using the same obfuscation technique mentioned earlier. Its primary function is to decrypt and execute another PowerShell script. 

Powershell Packer

Injector 

The next stage is another PowerShell script responsible for injecting shellcode into a running process. 

Before performing the injection, the script disables AMSI (Antimalware Scan Interface) using script from GitHub – S3cur3Th1sSh1t/Amsi-Bypass-Powershell.  

powershell script

After disabling AMSI, the script executes code that performs shellcode injection, 

After disabling AMSI, the script executes code that performs shellcode injection,

And injects in one of these legitimate processes: 

And injects in one of these legitimate processes:

Shellcode 

The injected shellcode unpacks and loads the final payload directly into memory, 

Final Payload 

The payload observed in this campaign is a clipper malware. This type of malware changes cryptocurrency address in clipboard to that of attacker’s when user copies any address. 

It starts by fetching the C2 server address, which it gets by a technique called EtherHiding, where the C2 server address is fetched from Ethereum blockchain. 

It starts by fetching the C2 server address, which it gets by a technique called EtherHiding, where the C2 server address is fetched from Ethereum blockchain.

Once the C2 server address is obtained, the malware begins reporting system activity to the server. 

It then continuously monitors the clipboard contents. 

Once the C2 server address is obtained, the malware begins reporting system activity to the server. It then continuously monitors the clipboard contents.

It then continuously monitors the clipboard contents.

McAfee Coverage 

McAfee provides extensive coverage against CountLoader:  

Trojan:Script/CountLoader4.DES
Trojan:Script/JSBackdoor.HELK!2
Trojan:Shortcut/LNKDownloader.HK
Trojan:Shortcut/Worm.HELK
Trojan:Script/ObfuPS.HELK
Trojan:Script/AMSIBypass.STS!1
Ti!5F9FF671955A
Ti!DC602CB53A9C

Indicators Of Compromise 

 IOC   
EXE (stage 1)  5f9ff671955a6d551595f9838aed063c496da5039be0d222fe84f96cb3e1d32a 
PS url (stage 2)  https://memory-scanner[.]cc/Presentation[.]pdf 
PS (stage 2)  3c278499c5e3ced3bf1a6a7287808c5267075f1dec0aa5c7be2c4c444f33f2bc 
CountLoader download URLs  https://memory-scanner[.]cc/ 
https://hell1-kitty[.]cc/update1_usb_usb_usb[.]VOcx4wEV8 
CountLoader v3.3  c68e436d4cb984db026210806f50d0c81eec5f6e4860197dab91fab6f31ef796 
CountLoader v4.1  e2faad8111e7d47349cbc549b85e62231b8678057906bc813aad7242fa95ae63 
e5e1d8ec4cd109df290752ee3d4b2cbc9de6df4360e9983548f1bc6b1d088540 
CountLoader C2 Domains  hell1-kitty[.]cc 
alphazero1-endscape[.]cc 
api-microservice-us1[.]com 
bucket-aws-s1[.]com 
bucket-aws-s2[.]com 
fileless-storage-s3[.]cc 
globalsnn1-new[.]cc 
globalsnn2-new[.]cc 
globalsnn3-new[.]cc 
handle-me-sv1[.]com 
hardware-office[.]cc 
health-smooth-eu1[.]com 
health-smooth-eu2[.]com 
health-smooth-eu3[.]com 
holiday-updateservice[.]com 
memory-protection-layer1[.]cc 
memory-protection-layer2[.]cc 
microservice-update-s1-bucket[.]cc 
microservice-update-s2-bucket[.]cc 
my-smart-house1[.]com 
polystore9-servicebucket[.]cc 
s3-updatehub[.]cc 
usb lnk files  10593dbe9edfde7943fdaadd7882f190216b2f6502667daf701088a6e810deaf 
0a69a9cc75d65774e5eb90a4a739bd4335d33b176dc4923acb691bd45af66bdf 
27c6a6bda2c0ef3ecb78dad9c6bb7c3abaf2e32b3ad96f372a0102c0c9c0f08d 
2cd449f1bb24f05d2e240812a74bd62f2583bbbe4d0ccc9ae5736240e29a0068 
30dcd5c71beb76d2f8df768d5fd9e9145cb8fbbfc951a63b969d26d3b64002b9 
dd4c7f5aae404816cf447b8090b620c1a1971a35c6791116aa3f871f00ae011b 
42a1fc74334c9a3b8720c79df55f84c7398bd31609eb10581e8c7155835498e3 
9c0d334aac5a6f66016dc5ce8df75c46d519a4e6d16c68cf2b1405c81189186d 
44f6313e9542c0d51937a70160fe4137012905d8c79ad27ccc0021788ecfaa4e 
payload launcher url  https://hell1-kitty[.]cc/gamecenter[.]fileManager 
https://hardware-office[.]cc/foundation[.]halflife 
payload launcher  cbdfb46b9265a3dfb3bc6b0aade472dde28b1660dbd3ded3b67b1530b4497cca 
packer url  http://45[.]156[.]87[.]118:3015/select 
http://45[.]156[.]87[.]62:3443/production 
http://104[.]253[.]1[.]137/content 
packer  4a5e1d6ee1217e1fbacf54fc6017fbf9d24a25078266b02358d56a9c7437ceb7 
injector  05becb67d8bf1e49fcfccb0d346b82368a2b1c2bf07316078c364c7b020154de 
shellcode  44daa1b68737b55a711963eec211c7c018bcba4cb6d68c286a4b45ea781a7d73 
payload  dc602cb53a9c24abfcdaadf0ca8256b5fb5cac6d91d20ed8431bdaaf51c0cafe 
payload C2  https://edr-security-bucket1[.]cc/ 

The post Sinkholing CountLoader: Insights into Its Recent Campaign appeared first on McAfee Blog.

The New Grad’s Guide to Job and Recruitment Scams

12 May 2026 at 12:10
blogging on social media

Graduation season should be about launching your career, not dodging scams.

But for many new grads, the job search now comes with a hidden risk: fake recruiters, fraudulent job offers, and convincing messages designed to steal money, personal information, or both.

The threat is larger than many people realize. According to McAfee’s 2026 State of the Scamiverse report, 76% of Americans have encountered a scam, and the average person receives 14 scam messages every day through text, email, and social media. Americans now spend an estimated 114 hours each year trying to figure out what is real online and what is not.

Young adults are among the most heavily targeted groups. Nearly 3 in 10 people ages 18 to 24 (28%) report receiving conversational scams that begin with casual outreach such as “Hey, how are you?” or a “wrong number” text. Those same tactics increasingly appear in fake recruiter messages, LinkedIn outreach, and texts promoting remote job opportunities.

Today’s job scams can look highly professional. Scammers build polished LinkedIn profiles, clone legitimate company websites, and even use AI-generated interviews to appear credible. Many scams unfold quickly, with nearly half completed in less than an hour, creating pressure to act before candidates have time to verify what is real.

That’s where tools like McAfee’s Scam Detector come in—flagging suspicious emails, texts, links, and messages before you engage, so you can tell what’s real before you click. 

Here’s how to avoid job scams and stay safe with McAfee: 

How Job Scams Actually Work

Step

What Happens

Red Flags

What Scammers Want

1. The Outreach

You’re contacted via email, text, or social media about a job

Unsolicited offer, vague role, overly enthusiastic recruiter

Your attention

2. The Build-Up

They walk you through interviews or onboarding steps

No video calls, inconsistent details, fast timeline

Your trust

3. The Ask

They request personal info or payment

SSN requests, bank info, “training fees”

Identity + money

4. The Trap

They escalate the situation or disappear

More payment requests or sudden silence

Continued financial gain

A Real Example: How People Get Pulled In

Even experienced professionals fall for these scams.

In one case, a tech expert with decades of experience lost $13,000 after accepting what looked like a legitimate part-time role reviewing products.

The opportunity seemed real:

  • A polished website
  • Structured onboarding
  • A small initial payout

Then came the shift. He was told he needed to deposit money to continue working and kept paying more to “unlock” earnings that never came.

This type of advance fee scam is increasingly common in job fraud, and it works because it builds trust first.

What the Data Says

Recent graduates are entering the workforce at a time when scams are more sophisticated, more personalized, and harder to spot than ever before. McAfee’s 2026 State of the Scamiverse report highlights why younger job seekers should be especially cautious.

Young Adults Face Higher Risk

  • Younger adults report the highest rates of repeat scam victimization. McAfee’s research found that scam victims under 35 are more likely than older adults to be targeted again, suggesting that early-career professionals may be especially vulnerable as they navigate job searches, salaries, and onboarding for the first time.

Scam Messages Are Constant

  • Americans receive 14 scam messages per day on average.
  • 76% of Americans say they have encountered an online scam.
  • People spend 114 hours per year, nearly three full workweeks, trying to determine what is real and what is fake online.

Professional Platforms Are Not Immune

  • 7% of respondents reported encountering scams on LinkedIn.
  • 44% have replied to suspicious messages that contained no link at all.

Many modern scams begin with a simple message such as “I came across your profile” or “We’d like to discuss an opportunity,” rather than an obviously suspicious URL.

Job Scams Move Fast

  • The average scam unfolds in just 38 minutes.

Scammers often create urgency by claiming a role is limited, an offer will expire quickly, or onboarding must begin immediately.

AI Makes Fake Recruiters More Convincing

  • 35% of Americans are not confident they can spot deepfake scams.
  • McAfee predicts job scams will become increasingly personalized as scammers use AI to create tailored outreach, onboarding documents, and contracts that closely match a candidate’s background.

Job Scams Are a Growing Financial Threat

  • FTC-reported job scam losses rose nearly 40% year over year, increasing from $543 million in 2024 to $752 million in 2025.

For new graduates eager to land their first job, the lesson is simple: if an opportunity seems rushed, asks for money, or feels too good to be true, take a step back and verify before you respond.

Where McAfee Comes In

Job scams don’t just happen in one moment. They unfold in stages—first a message, then a conversation, then a request for information or money.

That’s why protection needs to work the same way: across the entire experience. McAfee’s comprehensive protection helps you stay ahead of job scams at every step:

McAfee+ Advanced gives you multiple layers working together so you are not left figuring it out after the damage is done:

  • Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast
  • Personal Data Cleanup helps remove your information from data broker sites, making you harder to target in the first place
  • Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage
  • Safe Browsing helps block risky sites if you do click
  • Device Security helps detect malicious apps or downloads
  • Secure VPN keeps your data private, especially on public Wi-Fi   

The Biggest Red Flags to Watch For

These patterns show up again and again in job scams:

Red Flag

What It Looks Like

Why It’s a Problem

What to Do Instead

Requests for Sensitive Information Too Early

Asked for your Social Security number, banking info, or ID details early in the process

Scammers use this to steal your identity or access your accounts

Only share sensitive info after accepting a verified job—and through secure onboarding systems

You’re Asked to Pay to Work

Fees for training, equipment, onboarding, or background checks

Legitimate employers don’t charge candidates to get hired

Walk away immediately—this is one of the clearest signs of a scam

The Job Sounds Too Good to Be True

High pay, low hours, minimal experience required, vague responsibilities

Designed to hook attention and lower your guard

Research typical salaries and ask detailed questions about the role

The Hiring Process Moves Too Fast

Immediate job offers or rushed decisions without interviews

Real hiring processes involve multiple steps and evaluations

Be cautious of offers that skip standard hiring steps

No Real Interaction

Communication only via email or chat, refusal to do video or phone calls

Scammers avoid real-time interaction to stay anonymous

Request a video call or verify the recruiter through official company channels

How to Protect Yourself

You don’t need to overcomplicate it. Stick to a few grounded habits:

  • Verify the company independently: Search the company, check official sites, confirm recruiter identities
  • Keep communication on trusted platforms: Be cautious with offers coming from unexpected channels
  • Never pay upfront for a job: That’s a dealbreaker
  • Pause before sharing personal information: Especially early in the process
  • Use tools that flag risks automatically: Scam Detector helps catch what looks legitimate, but isn’t

What to Do If You Think It’s a Scam

If something feels off:

  • Stop communication immediately
  • Do not send money or personal information
  • Report the scam to the FTC
  • Monitor your accounts for suspicious activity

If you’ve already shared sensitive information, act quickly to secure your accounts.

With McAfee’s comprehensive protection, you’re not left to figure it out on your own.

From blocking risky links to monitoring your identity and helping you respond quickly, it’s designed to help you stay one step ahead, and recover faster if needed. Because job searching is stressful enough without scammers, and you deserve to land your next job with confidence.

The post The New Grad’s Guide to Job and Recruitment Scams appeared first on McAfee Blog.

How to Protect Yourself After the Canvas Education Data Breach + Fake Amazon Recall Texts

8 May 2026 at 12:10

If you have ever checked your child’s grades online, submitted a college paper through a school portal, downloaded homework assignments, or received messages from a teacher through a classroom app, there is a good chance you have used Canvas, a nationwide learning management system that was just in a massive data breach. 

This is exactly the moment McAfee+ Advanced was built for. With our built-in Scam Detector to flag risky links, QR codes, and deepfakes; Identity Monitoring that alerts you when your data appears where it shouldn’t; and Personal Data Cleanup that removes your information from the dark web and data brokers, McAfee+ Advanced is an all-in-one solution for protection after a data breach.

Now let’s get into what you need to know about this breach: 

Who Is Behind the Canvas Breach? 

The ransomware group ShinyHunters is claiming responsibility for the attack. The group alleges it stole roughly 275 million records tied to nearly 9,000 schools and educational institutions worldwide. 

How Did the Canvas Cyberattack Happen? 

Instructure, the company behind Canvas, confirmed a cyber incident affecting its cloud-hosted environment. The attackers later posted claims about the breach on their leak site, where ransomware groups pressure organizations into paying by threatening to release stolen data publicly. 

What Information Was Stolen in the Canvas Breach? 

The stolen data reportedly includes: 

  • Student names  
  • Teacher and staff names  
  • Email addresses  
  • Student IDs  
  • Course and enrollment information  
  • School-related records  

ShinyHunters claims the breach exposed roughly 275 million records and more than 231 million unique email addresses. 

How Could the Canvas Data Breach Impact Families and Students? 

Even if financial information was not exposed, this kind of data can still be extremely valuable to scammers. Criminals can use real school names, real classes, teacher names, and student information to create highly convincing phishing emails, fake school alerts, scholarship scams, tuition scams, or password reset messages. 

A scam message referencing your child’s actual school or assignment is much harder to spot as fake. 

This is what a Canvas message might look like when forwarded to your email inbox. Hackers claim to have millions of these types of messages.
This is what a Canvas message might look like when forwarded to your email inbox. Hackers claim to have millions of these types of messages.

This is a real message from Canvas from a community college professor after yours truly took an anthropology class for fun during the pandemic. It’s full of links to apply for programs and reach out to professors. It has exact details about courses I’ve taken.  

While this correspondence is real, it’s exactly the type of messaging that scammers could fake and replicate, replacing real links with fake “paid” opportunities to pursue degrees.  

Now think of the millions of messages and specific scenarios scammers have access to, to create dubious and convincing scams. That’s why protecting yourself after a breach is key.  

What To Do Right Now 

Here are some actions you can take immediately ot protect yourself after this breach:

  • Change you or your child’s Canvas password immediately, and update any other accounts where they reuse that password 
  • Turn on multi-factor authentication (2FA) on parent and student accounts wherever the school permits it — Instructure’s own post-incident guidance specifically called out enforcing MFA as a recommended precaution 
  • Ask your school what identity protection is being offered if sensitive data was involved 
  • Consider placing a credit freeze on your or your child’s file to block new accounts from being opened in their name 
  • Avoid clicking links in any messages that reference the breach, go directly to the official site instead 

And that, my friends, is issue number one in this week’s This Week in Scams. Let’s get into what else is on our radar in cybersecurity and scam news. 


Fake Amazon Recall Texts Are Targeting Shoppers  

Your phone buzzes. It’s a text from an unknown number, but the message looks official. 

“Dear Amazon Customer, we are writing to inform you that an item from your March 2026 order has been identified for recall.” There’s an order number. A link at the top of the message. A note about quality standards and a refund waiting for you. 

It looks real. It has the Amazon logo, the branded formatting, even a reference to the “Amazon Customer Safety Team.” The only thing it doesn’t have? Any connection to Amazon at all. 

A photo of a scam recall text I received this week. Luckily Scam Detector flags the link as risky if you try to click.
A photo of a scam recall text I received this week. Luckily Scam Detector flags the link as risky if you try to click.

This is a fake Amazon recall scam, and it is making the rounds right now. The goal is to get you to click that link, which takes you to a site designed to harvest your login credentials, payment information, or both.  

If you get a text like this, do not click the link. Go directly to amazon.com in your browser, log in, and check your orders and messages from there. Amazon does not initiate recall or refund processes through unsolicited texts with outside links. 

What Is a Fake Amazon Recall Scam And How Does It Work? 

A fake Amazon recall scam is a text message or email in which criminals impersonate Amazon to convince you that one of your recent orders has been flagged for a product recall. The message directs you to an external link leading to a phishing site designed to steal your Amazon credentials, credit card details, or personal information. 

Red Flags To Watch For 

  • The text comes from an unknown number, not a short code or verified sender 
  • The link goes to a domain that is not amazon.com 
  • The message asks you to complete a refund through an external link 
  • Small typos or awkward phrasing appear in what looks like official communication 
  • The greeting says “Dear Amazon Customer” rather than your actual name 

What To Do If You Get One 

  • Do not click the link 
  • Go to amazon.com directly and check your orders and account notifications 
  • Report the text to Amazon at stop-spoofing@amazon.com 
  • Block the number 

Where McAfee Steps In (So You Don’t Have to Guess)  

Scams today are layered.  A fake email leads to stolen credentials. A breach leads to targeted phishing. And those follow-ups are getting harder to spot.  

With McAfee+ Advanced, multiple layers work together so you’re not left figuring it out after the damage is done: 

  • Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast  
  • Personal Data Cleanup helps remove your information from sites selling it. 
  • Scam Detector flags suspicious texts, emails, links, QR codes, and even deepfake videos before you engage  
  • Safe Browsing helps block risky sites, even if you do accidentally click  
  • Device Security helps detect malicious apps or downloads  
  • Secure VPN keeps your data private, especially on public Wi-Fi    

McAfee Safety Tips This Week 

Our advice based on this week’s scams and stories: 

  • If your child’s school uses Canvas, update their password now and enable multi-factor authentication if available 
  • Consider a credit freeze for your child’s identity, especially if sensitive identifiers were part of the breach 
  • Never click links in unsolicited texts about refunds, recalls, or account issues — go directly to the official site instead 
  • Treat any message that references your recent orders or personal account details with extra skepticism, even if it looks legitimate 
  • Use Scam Detector to check suspicious links before engaging, and stay alert in the weeks and months after a breach, not just the first few days 

And we’ll be back next week with more scams and cybersecurity news making headlines. 

The post How to Protect Yourself After the Canvas Education Data Breach + Fake Amazon Recall Texts appeared first on McAfee Blog.

Now Available: Use ChatGPT with McAfee to Spot Scams Faster

7 May 2026 at 11:55

Scam messages are getting smarter and faster. 

According to McAfee’s 2026 State of the Scamiverse report, Americans now spend 114 hours a year trying to figure out what’s real and what’s fake online. That’s nearly three full workweeks lost to second-guessing messages, alerts, and links. 

And when scams do succeed, they move quickly. The typical scam unfolds in about 38 minutes, leaving little room for hesitation. 

That creates a gap: People want to check before they act, but the tools haven’t always met them in that moment. 

ChatGPT + McAfee is designed to close that gap, bringing scam detection directly to a platform people are already using to ask questions and make decisions. 

And it’s available to anyone. You don’t have to be a McAfee subscriber. 

This isn’t just detection. It’s guidance in the exact moment you’re deciding what to do.  

Instead of guessing, you can paste a message or drop in a screenshot and get a clear explanation of what’s riskyand what to do nextpowered by McAfee’s threat intelligence. 

What You Can Do with ChatGPT + McAfee 

With this integration, checking something suspicious becomes as simple as asking a question. 

Paste a message. Drop in a link. Upload a screenshot. 

McAfee analyzes it and explains what’s going on clearly and in context. 

Here’s how it works: 

Feature  What it does  How it protects you 
Link safety check  Paste a suspicious URL and get a reputational analysis based on McAfee threat intelligence  Scam links are often designed to look legitimate. A quick check helps avoid phishing and malware 
Message analysis  Submit texts, emails, or social messages for evaluation  Many scams now rely on urgency and tone. Analysis helps surface subtle red flags 
Screenshot uploads  Upload screenshots of messages, emails, or posts for review  Scams don’t always come as clean text. This makes it easier to check what you’re actually seeing 
Clear explanations  Get a breakdown of why something is flagged as risky or safe  Not just a warning—an explanation that helps you recognize patterns next time 
Guided next steps  Receive recommendations on what to do next  Helps prevent escalation, especially in moments of uncertainty 

It’s a quick, accessible way to get answers in the moment. But it’s just one part of a broader system designed to protect you more comprehensively. 

Add the app to your ChatGPT account here. 

McAfee's ChatGPT extension
McAfee’s ChatGPT extension

Built on McAfee’s Threat Intelligence 

Behind the scenes, ChatGPT + McAfee is powered by the same intelligence that fuels McAfee’s broader scam protection ecosystem. 

When you submit something for review: 

  • Links are checked against known threat signals  
  • Messages are analyzed for scam patterns and language cues  
  • Results are translated into clear, human-readable explanations  

The goal isn’t just to flag risk. It’s to help you understand it. 

A New Way to Stay Ahead of Scams 

Scams aren’t slowing down. If anything, they’re becoming more convincing, more personalized, and harder to detect. 

That’s where ChatGPT + McAfee comes in. But this is only one part of a much bigger system designed to protect you before, during, and after a scam attempt. 

With McAfee+ Advanced, multiple layers work together so you’re not left figuring it out after the damage is done: 

  • Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast  
  • Personal Data Cleanup helps remove your information from sites selling it. 
  • Scam Detector flags suspicious texts, emails, links, QR codes, and even deepfake videos before you engage  
  • Safe Browsing helps block risky sites, even if you do accidentally click  
  • Device Security helps detect malicious apps or downloads  
  • Secure VPN keeps your data private, especially on public Wi-Fi    

The ChatGPT experience gives you a fast, intuitive way to check something in the moment. 

McAfee+ Advanced makes sure you’re protected across everything else.

The post Now Available: Use ChatGPT with McAfee to Spot Scams Faster appeared first on McAfee Blog.

The New Grad’s Guide to Student Loan Scams: How to Stay Safe

5 May 2026 at 12:10

Graduating should feel like a fresh start, a time when the whole world is at your fingertips.   

Unfortunately, scammers often see graduates and think “student loans.” Or more specifically “student loan scams.” 

As student loan payments resume or repayment plans shift, scammers move in fast; posing as loan servicers, promising forgiveness, or offering to “simplify” your loans for a fee. 

The tricky part? These messages often look real. 

That’s where tools like McAfee’s Scam Detector come in. It flags suspicious emails, texts, links, and even deepfake-style messages, helping you spot what’s real before you click, respond, or pay. 

Here’s how to spot these scams and stay safe with McAfee: 

What Is a Student Loan Consolidation Scam? 

Student loan consolidation itself is a legitimate option. It allows you to combine multiple federal loans into one, often to simplify payments. 

Scammers exploit that confusion. 

Instead of helping, they pose as government partners or “relief experts” and charge you for services you can do yourself…for free. 

According to Federal Student Aid, you never have to pay for help managing or consolidating your federal student loans.  

That’s the baseline truth most scams try to blur. 

How These Scams Actually Work 

Step  What Happens  Red Flags  What Scammers Want 
1. The Outreach  You get an email, text, or call about “loan consolidation” or “forgiveness”  Urgent tone, unfamiliar sender, “final notice” language  Your attention and quick reaction 
2. The Hook  They claim you qualify for a special program or limited-time offer  “Act now,” “guaranteed forgiveness,” or “new law” claims  Your trust 
3. The Ask  They request payment or personal info  Upfront fees, requests for FSA ID or bank info  Money + account access 
4. The Control  They may ask for authorization to manage your loans  Power of attorney forms, account takeover steps  Full control of your loan account 

Luckily, for McAfee+ Advanced users, they have access to Scam Detector which alerts users to suspicious emails, messages, links, and deepfakes that are often employed by scammers in these student loan fraud scenarios.  

The Most Common Lies to Watch For 

Scammers tend to recycle the same scripts. Federal Student Aid warns about messages like: 

  • “Act immediately to qualify for student loan forgiveness before the program is discontinued.”  
  • “You’re eligible for total loan discharge. Call now.”  
  • “Your loans are flagged for forgiveness pending verification.”  

These messages are designed to create urgency, not clarity. 

And importantly, they are not coming from the U.S. Department of Education or its partners. 

Image Courtesy of FTC and Student Aid.Gov
Image Courtesy of STUDENTAID.GOV.

Where McAfee’s Scam Detector Comes In 

This is exactly the kind of gray-area messaging that trips people up. 

McAfee’s Scam Detector helps cut through that by: 

  • Flagging suspicious loan-related messages before you engage  
  • Identifying risky links in emails or texts  
  • Highlighting signs of impersonation or manipulation  
  • Helping you understand why something looks off  

Instead of relying on gut instinct alone, you get a second layer of analysis, right in the moment decisions happen. 

The Biggest Red Flags (Don’t Ignore These) 

Federal Student Aid highlights a few consistent warning signs, and they’re worth memorizing: 

1. They Charge You for “Help”

If a company asks for upfront or monthly fees to consolidate or manage your loans, that’s a major red flag. 

Free help is always available through your official loan servicer.  

2. They Promise Immediate Forgiveness

No legitimate program guarantees instant or total loan forgiveness. 

Most real programs require years of qualifying payments or specific eligibility criteria. 

3. They Ask for Your FSA ID

This is a hard line. 

Your FSA ID is legally equivalent to your signature—and no legitimate organization will ask for your password. 

4. They Pressure You to Act Fast

Urgency is a tactic, not a requirement. 

Scammers often claim deadlines tied to “new laws” or expiring programs to push quick decisions. 

5. They Want Control of Your Account

Requests for power of attorney or third-party authorization can allow scammers to: 

  • Change your account details  
  • Redirect communications  
  • Make decisions without your knowledge 

How to Protect Yourself Without Overthinking It 

You don’t need to become a cybersecurity expert. Just follow a few grounded rules: 

  • Go directly to official sources: Always use StudentAid.gov—not links sent to you  
  • Don’t pay for what’s free: Loan consolidation and repayment help are available at no cost  
  • Pause before clicking or responding: Most scams rely on speed  
  • Use tools that flag risk for you: Scam Detector adds a layer of protection when things look legitimate, but aren’t  

What to Do If You Think You Fell for a Student Loan Scam 

Act quickly to limit damage: 

  • Contact your loan servicer and revoke any third-party access  
  • Call your bank or credit card company to stop payments  
  • Change your FSA ID password immediately  
  • Report the incident to the Federal Trade Commission here 

Federal Student Aid also recommends reviewing your account activity and confirming no unauthorized changes were made.  

The Bottom Line 

Student loan consolidation scams don’t look like scams anymore. 

They look like helpful emails. Official notices. Last chances. 

That’s why protection today isn’t just about knowing the rules, it’s about having backup when something feels off. 

With McAfee, you’re not left guessing. You can spot suspicious messages, understand the risks, and move forward with confidence, without handing your time, money, or identity to someone who doesn’t deserve it. 

Because starting your post-grad life shouldn’t come with a scam attached. 

The post The New Grad’s Guide to Student Loan Scams: How to Stay Safe appeared first on McAfee Blog.

Ad Impersonation Scams and Record-Breaking Social Media Fraud Losses: This Week in Scams

1 May 2026 at 12:01

You’re scrolling through Facebook or TikTok and see it. 

A flash sale from a brand you recognize. A limited-time investment opportunity. A job posting that promises quick money. 

The ad has comments. The account looks polished. Maybe someone you follow even liked it. 

So you click. 

From there, things move fast. You’re pushed to act quickly, enter your information, or send payment before the “deal” disappears. And just like that, the money is gone or your account is compromised. 

This isn’t an edge case anymore. According to new FTC data, nearly 30% of people who reported losing money to a scam in 2025 said it started on social media, with total losses hitting $2.1 billion. 

That’s why McAfee+ Advanced includes comprehensive protection designed to help you spot and stop scams at every step, including McAfee’s Scam Detector, which flags suspicious links and messages and explains why they may be risky, along with identity and privacy tools that help protect your information if a scam slips through. 

How Social Media Ad Scams Work 

A social media ad scam is when scammers use paid ads, fake profiles, or hijacked accounts on platforms like Facebook, Instagram, or TikTok to promote fake products, services, or investment opportunities in order to steal money or personal information. 

Step  What happens  What to do  How McAfee helps 
1  You see an ad, post, or DM promoting a deal, job, or investment  Don’t engage immediately, even if it looks legitimate  Scam Detector flags suspicious links and messages before you interact 
2  The ad links to a website or moves you into DMs  Avoid clicking unfamiliar links or continuing off-platform  Safe Browsing helps block risky or newly created websites 
3  You’re pressured to act quickly or “secure your spot”  Slow down and verify the company independently  Scam Detector explains urgency tactics and why they’re risky 
4  You’re asked to pay, share login info, or download something  Never send money or credentials based on a social media interaction  Identity Monitoring helps protect your personal data if exposed 
5  The product never arrives, the investment disappears, or your account is compromised  Report the scam and secure your accounts immediately  Personal Data Cleanup and monitoring help reduce ongoing exposure 

Red Flags To Watch For 

  • Deals that feel unusually cheap or urgent  
  • Ads linking to unfamiliar or slightly misspelled websites  
  • Requests to move conversations off-platform quickly  
  • Payment requests via apps, crypto, or wire transfer  
  • Accounts with limited history or inconsistent engagement  

And that is the first part of This Week in Scams! This Friday we’re taking a different format to talk about this new FTC data and all that it reveals.  

Let’s keep digging in: 

FTC Report: Social Media Scams Are Now The Most Costly Fraud Channel 

New data from the FTC shows just how dominant social media has become in the scam landscape. 

  • Social media scams drove $2.1 billion in reported losses in 2025  
  • Losses have increased eightfold since 2020  
  • Investment scams alone accounted for $1.1 billion of those losses 

Where Scams Are Happening And What’s Changing 

Category  What to know 
Most common scams  Shopping scams lead, with over 40% of victims reporting purchases from social media ads that never arrived 
Most costly scams  Investment scams drive the biggest losses, often starting with ads or group chats showing fake success 
What’s changing  Scammers are using platform tools like ads, targeting, and profile data to reach people more precisely than ever 

How Scams Play Out Across Platforms 

Platform  How scams typically start  What to watch for 
Facebook  Ads, Marketplace listings, hacked accounts  Fake stores, duplicate listings, urgent purchase pressure 
Instagram  Sponsored posts, influencer impersonation  “Limited drop” scams, fake brand collaborations 
TikTok  Ads, stolen videos/profiles, comment links, bio links,   “Get rich quick” schemes, external link funnels, reselling via TikTok 
WhatsApp  Group chats, investment communities  Fake testimonials, coordinated pressure to invest 

 How McAfee Protects You from Scams and Cyber Threats 

McAfee+ Advanced gives you multiple layers working together so you are not left figuring it out after the damage is done:   

  • Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast  
  • Personal Data Cleanup helps remove your information from data broker sites, making you harder to target in the first place  
  • Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage  
  • Safe Browsing helps block risky sites if you do click  
  • Device Security helps detect malicious apps or downloads  
  • Secure VPN keeps your data private, especially on public Wi-Fi    

McAfee Safety Tips This Week 

Our advice based on this week’s scams and schemes: 

  • Treat social media ads like any other unknown source, not a trusted recommendation  
  • Pause before clicking, especially when urgency is involved  
  • Verify brands by going directly to their official website  
  • Avoid sending money or personal information through social media  
  • Use tools like Scam Detector to check suspicious links before engaging  

And we’ll be back next week with more scams making headlines.

The post Ad Impersonation Scams and Record-Breaking Social Media Fraud Losses: This Week in Scams appeared first on McAfee Blog.

Fake USPS QR Code Text Scams and a Major Health Data Breach: This Week in Scams

24 April 2026 at 12:15

A new scam making the rounds takes a familiar delivery trick and upgrades it with hyperrealistic messaging and a QR code that looks safe to scan. 

But don’t be fooled. 

It’s the same delivery scam playbook scammers have relied on for years, just repackaged with better design and more convincing details. 

You get a message with a notice that looks something like this, a real message received by our team and tested against McAfee’s Scam Detector. 

A real image of a scam message impersonating the USPS
This is an example of the scam message we received, impersonating the USPS.

 

That added layer of realism is what makes this version more dangerous. But it doesn’t hold up under scrutiny. McAfee’s Scam Detector flagged both the suspicious language and the QR code in this message before any interaction. 

If you receive something like this, pause. Do not scan the code. 

You can also protect yourself with McAfee’s Scam Detector, which flags suspicious links and messages, including delivery scams and QRbased attacks, and explains why they may be risky. 

What is the USPS QR Code Scam and How Does it Work? 

The USPS QR code scam is a phishing attempt where scammers impersonate postal services and use QR codes instead of clickable links to direct victims to malicious websites. 

Once scanned, the QR code can lead to a fake USPS page that asks for payment, login credentials, or personal information. 

How the scam works 

Step  What happens  The red flags  What to do  How McAfee helps 
You receive a text about a delivery issue or missed package  Urgency, you’re not tracking a package  Be skeptical of unsolicited delivery messages  Scam Detector flags suspicious messages 
The message includes a QR code instead of a link  QR codes instead of official tracking links  is a red flag  Do not scan QR codes from unknown sources  QR scanning protection warns before opening risky destinations 
You scan the code and land on a fake USPS page  Generic or slightly off branding on the webpage  Do not enter any information  Safe Browsing blocks known malicious sites 
The page asks for payment or personal details  Requests for small “redelivery” or “processing” fees  are not normal  Exit immediately and do not submit anything  Scam Detector explains why the page is risky, and Identity Monitoring supports you when if your info gets out. 

What To Do If You Get This Message 

  • Do not scan the QR code  
  • Go directly to the official USPS website to check tracking  
  • Delete the message  
  • Report it as spam  
  • Monitor your accounts if you interacted with it  

And that, my friends, is scam number one in this week’s This Week in Scams. 

Let’s get into what else is on our radar. 

A Major Health Data Breach Exposes 500,000 Records 

A massive health data incident is raising new concerns about how sensitive information is handled and shared. 

According to reporting from the Associated Press, data tied to 500,000 participants in a major U.K. health research project was found listed for sale online. The dataset included biological and health-related information, though it did not contain direct identifiers like names or contact details. 

Access to the data had been granted to research institutions, but that access has since been revoked. Authorities say no purchases were made, and the listing has been removed. 

Still, the situation highlights a growing reality: once data is accessed or shared, control over it becomes harder to guarantee. 

What This Breach Says About Data Privacy 

Scams are no longer isolated events. They are layered. 

A data breach does not just stay a breach. It becomes fuel for future scams. Exposed information can be used to make phishing messages more convincing, personalize attacks, and build trust with targets. 

That is why detection alone is not enough anymore. Protection has to account for both incoming threats and what happens when data is already out there. 

How McAfee Protects You In A World of Scams and Data Breaches  

McAfee+ Advanced gives you multiple layers working together so you are not left figuring it out after the damage is done:  

  • Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast 
  • Personal Data Cleanup helps remove your information from data broker sites, making you harder to target in the first place 
  • Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage 
  • Safe Browsing helps block risky sites if you do click 
  • Device Security helps detect malicious apps or downloads 
  • Secure VPN keeps your data private, especially on public Wi-Fi   

McAfee Safety Tips This Week  

As always, we have some best practices and safety tips for navigating life online:  

  • Pause before clicking, especially when a message creates urgency   
  • Go directly to websites or apps instead of using email links   
  • Be skeptical of routine account alerts that push immediate action   
  • Double-check sender addresses and URLs closely   
  • Use tools like McAfee’s Scam Detector to flag suspicious links and messages before interacting   
  • Turn on identity monitoring so you’re alerted if your data is exposed  

And we’ll be back next week with more scams making headlines.

The post Fake USPS QR Code Text Scams and a Major Health Data Breach: This Week in Scams appeared first on McAfee Blog.

Cyberbullying Prevention: How to Protect Kids & Teens Online

By: McAfee
25 March 2026 at 13:00

For many families around the world, the digital spaces where children learn and play have also become venues for relentless harassment. According to a 2025 survey of nearly 3,500 U.S. teens by the Cyberbullying Research Center, about 58% have been cyberbullied at least once, a significant jump from 34% in 2016.

Experts warn that this issue is now a constant crisis and impacting the well-being of children and teens.

In this guide, we will clarify exactly what counts as cyberbullying. We will explore how new platforms and artificial intelligence are reshaping the landscape. Most importantly, we will provide you with practical steps to protect your family. Together, we can take actionable steps to keep our digital lives safe and positive.

What Is Cyberbullying?

Cyberbullying is not a vague term for online drama. It has specific characteristics that separate it from a simple disagreement between friends. Similar to bullying, cyberbullying has standard elements of unwanted aggressive behavior, an observed or perceived power imbalance, and behavior that is repeated or likely to be repeated.

Common cyberbullying behaviors include name-calling, severe insults, rumor spreading, direct threats, impersonation through fake accounts, intentional exclusion from group chats, non-consensual sharing of private photos, and doxxing, publishing someone’s private information like their home address or phone number without consent. We also frequently see pile-on attacks, where dozens or hundreds of users flood a person’s comments section with hate statements.

The Cyberbullying Research Center notes that in recent national surveys, about 26.5% of U.S. students reported being cyberbullied in the last 30 days, underscoring the ongoing nature of online harassment as a daily reality for many.

Why Cyberbullying is Different (and More Harmful)

While the core intent to harm is the same as traditional bullying, cyberbullying operates differently:

  • Platform: Bullying takes place in the physical world, while cyberbullying occurs in digital spaces such as text messages, direct messages, social media platforms, group chats, online gaming environments, email, and photo-sharing applications.
  • Anonymity: Another major difference is anonymity. Cyberbullies often hide behind fake profiles or anonymous accounts, making it difficult to know who is launching the attacks.
  • Constancy: A significant difference with cyberbullying is the constant nature of the internet. Online harassment can follow teens home and continue late into the night via phones and apps.
  • Audience and permanence: A hurtful comment made in a school hallway is heard by a few people and eventually fades, while a similar post online can spread to thousands of people in minutes. It can be screen-captured and may resurface years later. Once it is out there, it is incredibly difficult to remove.

Despite these differences, there is a strong overlap in how bullying and cyberbullying impact individuals. Many youths who are bullied online are also bullied at school, and experience anxiety or depression.

Types and Examples of Cyberbullying

Cyberbullying takes many forms, from classic harassment tactics to emerging AI-powered threats. The most frequently reported forms of cyberbullying include being excluded from group chats, mean or hurtful comments posted online, public embarrassment or humiliation, and rumors spread online, according to the Cyberbullying Research Center’s 2025 survey. Understanding these methods helps you recognize and stop them.

Common Cyberbullying Methods

  • Harassment: Sending repeated offensive messages through texts, direct messages, or comments, or intentionally leaving someone out of group chats and online activities where they can see what they’re missing.
  • Flaming: An online fight conducted through angry, vulgar exchanges via emails, messages, social media, or chat rooms. Unlike harassment, flaming is often a heated back-and-forth exchange rather than one-sided attacks.
  • Impersonation and Fake Accounts: Creating fake profiles or hacking into someone’s account to post damaging content as if the victim wrote it themselves, destroying reputations quickly
  • Outing and Doxing: Sharing private photos, messages, or personal information (like addresses or phone numbers) publicly without consent to embarrass, humiliate, or intimidate
  • Cyberstalking: Persistent online monitoring accompanied by threatening messages that make someone fear for their safety, which is a federal crime. Examples include tracking someone’s location through social media check-ins, obsessively monitoring their online activity, or sending relentless, threatening messages.

Where Cyberbullying Occurs Most

To protect our kids, we need to know where the risks are highest. Recent analyses find that cyberbullying mainly happens on social media platforms, including YouTube, TikTok, and Facebook, as well as in messaging apps and online games, where teens commonly interact.

If you are a parent, take an inventory of the apps your child uses most frequently and ask them to show you how the messaging and commenting features work. Familiarizing yourself with these digital environments will help them navigate these platforms safely.

Emerging AI-Driven Threats

Artificial intelligence (AI) has fundamentally changed the internet, and has, unfortunately, introduced alarming new tactics:

  • Deepfake Images and Videos: AI-generated content can be misused to create highly realistic images or videos called deepfakes. Entirely fake videos can be created showing a student doing or saying something they never did, which complicates evidence gathering. These are then shared in group chats or posted publicly to spread false narratives and destroy reputations.
  • Voice Cloning: Students are using AI to mimic classmates’ voices, generating audio that makes someone sound like they said something offensive or embarrassing, with no easy way to prove it wasn’t real. About 11% of U.S. high schoolers have experienced this.
  • AI-Generated Harassment: AI chatbots are being used to generate spam, threats, and hate speech at scale, flooding a victim’s inbox or comment sections across platforms.
  • Body-Shaming with AI Filters: AI-altered images and filters are being weaponized to body-shame and humiliate targets, often shared widely before victims can respond.

AI Can Also Be a Safety Tool

However, platforms have also begun using AI as a safety tool to detect hate speech, harassment, and predatory behavior in real time. Newer safety reports show that AI-driven comment filtering and think-before-you-post nudges successfully reduce toxic comments and repeat harassment on major platforms.

How Common Is Cyberbullying Today?

The statistics show that cyberbullying is a widespread issue requiring immediate attention. In a 2024 study, the World Health Organization revealed that 15% of surveyed adolescents have experienced cyberbullying.

In the U.S., the Centers for Disease Control and Prevention (CDC) Youth Risk Behavior Survey reports that 16% of high school students were electronically bullied in the previous 12 months, about 38.3% of whom were girls compared to 29.9% of boys.

Another study showed that about 53.9% of teens aged 13 to 17 reported being cyberbullied. These statistics demonstrate that cyberbullying is a mainstream experience, making digital safety education relevant to almost every family.

The Most Affected Groups

Aside from gender, identity plays a key role in who is targeted for cyberbullying. Gender minorities reported much higher rates of harassment at 47.1% compared with their heterosexual peers at 30%, as did students with developmental disabilities.

How Cyberbullying Affects Mental Health

There is evidence that online harassment causes profound psychological harm. A CDC report links frequent social media use with higher rates of both in-person and cyberbullying, as well as constant sadness, hopelessness, and suicidal thinking among teens.

This is supported by the 2025 announcement from mental health experts highlighting the connection between cyberbullying and increased anxiety, depression, and trauma-like symptoms. Even though incidents seem minor, parents and teens must acknowledge that emotional reactions to cyberbullying are valid and serious. Early support and intervention can significantly reduce long-term harm.

Platform Safety Updates for Teens

Social media companies are facing intense pressure to protect younger users, leading to significant updates. In 2025, Meta tightened default messaging and commenting settings for teens, automatically assigning the strictest safety options to teen accounts to filter inappropriate interactions from unknown users.

In addition, the company’s Instagram and Facebook platforms now provide more information about users contacting teens, showing details such as the age of the account and providing a way to block and report abusive users.

Help your child utilize these settings by ensuring their accounts are set to private to restrict direct messages from strangers. Enable each platform’s built-in AI comment filtering to hide offensive words automatically.

Signs Your Child May Be Cyberbullied

As a parent, one of your most powerful tools is simply paying attention. Cyberbullying often leaves visible traces in your child’s behavior, emotions, and device habits, if you know what to look for. The good news is that early recognition means early intervention, and that can make all the difference.

Behavioral Changes to Watch For

  • Sudden withdrawal from social activities or friends
  • Reluctance to go to school or participate in usual activities
  • Anxiety or nervousness when using devices or checking messages
  • Changes in sleep patterns or appetite

Emotional Warning Signs

  • Increased sadness, anxiety, or irritability, especially after being online
  • Low self-esteem or negative self-talk (“nobody likes me,” “I’m stupid”)
  • Reluctance to discuss online activities or what’s happening at school

Device and Online Behavior

  • Extreme changes in screen time, either excessive checking or complete avoidance
  • Suddenly deleting social media accounts without explanation
  • Being secretive about online activity or quickly hiding screens
  • Receiving unusual volumes of messages or calls, especially at odd hours

If you notice several of these signs together, it’s time for a conversation. The key is approaching with empathy and making it clear they won’t be punished for opening up.

How to Prevent Cyberbullying: Guidance for Families

Knowing the impact of cyberbullying is only half the battle. The most important step is being proactive to protect your family. Here is how you can build a resilient defense against online harassment and empower your children.

Build Open Communication and Digital Citizenship Skills

The foundation of digital safety is trust. Encourage regular, judgment-free check-ins on your child’s online activities. Ask them what they are doing, seeing, and feeling related to the ongoing online issues. Assure them you will not confiscate their phone when they report a problem.

In addition, teach your kids to recognize cyberbullying and to support their peers who are being targeted. Underscore the importance of not joining in on the comment pile-ons, and let them know that it is perfectly acceptable to block, mute, or simply leave harmful digital spaces. Research suggests that strong parent-teen communication can buffer some negative effects of social media use and encourage teens to ask for help sooner.

Enable Safety Settings

Every major platform has tools designed to stop harassment. Teach your child to use keyword filters to automatically hide comments that contain specific insults, slurs, and other forms of hate speech. Help them set their accounts to private to restrict direct messages from strangers, and enable each platform’s built-in AI comment-filtering features.

How to Report Cyberbullying

Alongside safety features, teach them to block and report harassers on the platform. You can end cyberbullying quickly if you know how to use platforms’ tools effectively.

1. Document Everything First

Before blocking, deleting, or reporting anything, save evidence. Create a digital safety plan and agree with your family that if anyone receives a threatening or highly abusive message, they should document the incident with screenshots before blocking, deleting, or responding to it. These screenshots will serve as important pieces of evidence if the school or platforms need to take action.

2. Use Platform Reporting Tools

Most importantly, teach your child to block and report harassers on the platform. Here’s how on major platforms:

Instagram, Facebook, and Threads:

  1. Tap the three dots on the post or message
  2. Select “Report” and choose the violation type (bullying or harassment)
  3. Follow prompts to block the account
  4. Use “Restrict” to limit interactions without full blocking

TikTok:

  1. Long-press the comment or video
  2. Select “Report” and choose “Bullying and harassment”
  3. Block the account from their profile page

Snapchat:

  1. Press and hold on the message or username
  2. Tap “Report” and select the issue
  3. Block the user to prevent further contact

YouTube:

  1. Click the three dots next to the comment or video
  2. Select “Report” and choose “Cyberbullying or harassment”

Gaming Platforms (Xbox, PlayStation, Discord, and Roblox)

  1. Use in-game or platform reporting options, typically found in user profiles or chat menus
  2. Many platforms now offer real-time abuse detection that automatically flags harassment

Text Messages:

  1. Block the number through your phone settings
  2. Report spam to your carrier (forward to 7726/SPAM for most U.S. carriers)
  3. Save screenshots before blocking

3. Escalate for More Help

Sometimes, platform tools are not enough. You need to know when to escalate the situation to the appropriate authorities. Follow the steps below when you see signs of ongoing harassment, physical threats, identity-based or other forms of hate, the sharing of private images, as well as changes in your child’s mood, sleep patterns, or school attendance.

  1. Save all evidence, including screenshots, URLs, usernames, and timestamps.
  2. Contact school officials, such as a counselor or principal, and provide them with specific documentation.
  3. Seek professional mental health support to address your child’s distress.
  4. Contact local law enforcement immediately if there are threats of physical harm or illegal content involved.

How Technology Can Help Prevent Cyberbullying

While technology is the medium for cyberbullying, it is also a tool for prevention and protection. Using the right software can give parents peace of mind and help teens navigate the web.

Device-Level Protection and Parental Controls

Cyberbullying is frequently accompanied by other digital threats, such as sending malicious links, stealing passwords, or tricking victims into downloading scam apps. This is where robust security software becomes essential to help block phishing links and compromised websites.

Additionally, parental control tools allow you to manage screen time, filter inappropriate web content, and monitor or limit certain types of app usage for age-appropriate scenarios. These tools help protect younger children from platforms they are not emotionally ready to handle.

Digital Well-Being Tools that Signal Distress

Modern security solutions offer digital well-being tools that track app usage and highlight sudden changes in behavior, such as late-night device use, massive spikes in messaging, or the sudden downloading of new, unfamiliar apps. These changes can be early warning signs of distress or harassment.

It is crucial to use these tools transparently by introducing them to your teens as conversation starters rather than secret surveillance. Saying that you noticed they were on their phone very late last night and asking if everything is okay builds trust. Spying breaks it.

Legal Grounds to Deal with Cyberbullying

Cyberbullying is not just a behavioral issue. It intersects heavily with school policies, community safety, and the law. Understanding this context will help your family deal with severe harassment.

Laws and School Responsibilities

Globally, many countries are adopting frameworks to protect digital citizens against cyberbullying. In the United States, all 50 states have anti-bullying laws, most of which now explicitly include electronic or cyberbullying in their definitions and guidance. These include laws and district policies that allow schools to address online behavior that creates a hostile environment or substantially disrupts a student’s learning. This means that even if the harassment happens on a weekend via a smartphone, the school has the authority and the responsibility to intervene if it impacts the victim’s ability to feel safe in the classroom.

Cyberbullying as a Crime

Certain cruel online behaviors may cross the line into criminal activity and to be considered crimes. For instance, credible threats of violence, stalking, extortion, hate-motivated harassment, and the non-consensual sharing of intimate images may violate criminal laws.

If a situation escalates to this level, it is time for legal and law enforcement to intervene. When this happens, families should document all evidence and consider contacting law enforcement or civil rights agencies.

Look up your local school district’s specific cyberbullying policies and legal obligations, and find out who to contact. This will save you valuable time if you need to report an incident.

Final Thoughts

Cyberbullying is intentional, repeated online harm, and a serious issue that leverages the constant nature of the internet to follow young children, teens, and certain groups into their homes and bedrooms.

While social media platforms, school policies, and laws are steadily improving, families still hold the most powerful tools. You can significantly reduce the harm to your children caused by online harassment by initiating open and non-judgmental conversations, utilizing built-in device protections and app privacy settings, partnering with your local schools, and seeking mental health support when needed.

Talk with your kids this week about their online experiences. Sit down together and review the safety and privacy settings on their favorite apps. Finally, consider using a trusted security partner such as McAfee+ as part of a broader, proactive digital safety plan.

A McAfee+ family plan helps protect your household’s devices from the malware and malicious links that often accompany harassment or sextortion attempts and sets healthy boundaries around apps, web content, and screen time. Furthermore, it provides educational resources on digital citizenship and safe social media use beyond basic antivirus software.

When you work with trusted tools, you can help keep the internet a place of connection and creativity.

The post Cyberbullying Prevention: How to Protect Kids & Teens Online appeared first on McAfee Blog.

Why Hackers Are Collecting Data They Can’t Read Yet. And How to Stay Safe

21 April 2026 at 12:10

Co-Authored by Luiz Parente 

Your data might be safe today. But that doesn’t mean it’s safe forever. 

A growing number of sophisticated actors are collecting encrypted data now, with the goal of decrypting it later, when more powerful technology becomes available. 

This strategy is known as Harvest Now, Decrypt Later (HNDL). And it’s not a future problem. It’s already happening, according to research from our McAfee VPN team. 

For everyday people, that means private messages, financial records, and sensitive documents could be exposed years from now if protections don’t evolve today. 

That’s why security teams, including McAfee’s VPN engineers, are already working on ways to strengthen encryption for both today and what comes next. 

What “Harvest Now, Decrypt Later” Means 

At its core, HNDL is simple: Attackers collect encrypted data now, store it, and wait until they have the tools to unlock it later. 

Even though today’s encryption is incredibly strong, the strategy doesn’t rely on breaking it today. It relies on patience.  

A Simple Way to Think About It 

You put valuable belongings and documents in a safe at home that’s locked and secured. This works at preventing crimes of opportunity. But let’s say there’s a thief who steals the entire safe, knowing they have tools they can use later to access what’s inside. They wait, and once the tools are available, they break into your safe and access everything inside. 

That’s one way to think of HNDL. The safe is the encryption. The quantum computing is the tool they can use later.  

But in real life, you’d probably notice if your safe is gone. In the case of HNDL, if you’re not monitoring your data, you may not even notice encrypted information has been stolen to be decrypted.  

Key Terms Explained 

Term  What it means 
Encryption  Scrambling data so others can’t read it 
Quantum computing  A new type of computing that can break some encryption 
HNDL  A strategy to collect encrypted data now and decrypt it later 

Why This Matters Right Now 

This isn’t about whether your data is valuable today. It’s about whether it might be valuable later. 

Data with a long shelf life is especially at risk, including: 

  • Financial records  
  • Medical information  
  • Private messages  
  • Legal or identity documents  

Even something that feels low-stakes today could become sensitive in the future. 

And because the collection phase is already happening, the risk isn’t hypothetical. It’s already in motion. 

How This Affects VPNs (and what doesn’t change) 

VPNs remain one of the most effective ways to protect your data today. That hasn’t changed. 

But HNDL introduces a new layer of complexity. 

  • What’s still strong: The encryption that protects your data in transit remains highly resilient.  
  • Where the risk is: The “handshake” process (how a secure connection is established) is more vulnerable to future quantum attacks.  

In simple terms: Your data is well protected today, but parts of how that protection is set up may need to evolve for the future. 

What Quantum Computing Changes 

Traditional computers process information in a linear way. 

Quantum computers work differently. They can solve certain types of problems much faster, including the kinds of mathematical challenges that protect today’s encryption. 

That’s why attackers are willing to wait. 

Once quantum computing reaches a certain level, it could unlock data that was previously considered secure. 

Image shows a phone connecting to VPN

What McAfee’s VPN Team is Working On 

McAfee’s VPN team is already preparing for this shift. 

  • Evaluating quantum-safe encryption approaches  
  • Exploring hybrid models that protect both now and long-term  
  • Building toward a more resilient VPN experience  

This work builds on a broader privacy-by-design approach, where systems are designed to minimize risk from the start, not react after the fact. 

Because with HNDL, waiting isn’t an option. 

What You Can Do Now 

You don’t need to wait for quantum computing to take steps today. 

  • Use a trusted VPN to encrypt your connection  
  • Be mindful of long-term sensitive data you share online  
  • Avoid unsecured public Wi-Fi when possible  
  • Keep your apps and devices updated  

These steps help protect your data now while the industry builds toward future-ready security. 

How McAfee Helps Protect You 

McAfee+ Advanced gives you multiple layers working together so you are not left figuring it out after the damage is done:  

  • Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast 
  • Personal Data Cleanup helps remove your information from data broker sites, making you harder to target in the first place 
  • Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage 
  • Safe Browsing helps block risky sites if you do click 
  • Device Security helps detect malicious apps or downloads 
  • Secure VPN keeps your data private, especially on public Wi-Fi   

Frequently Asked Questions (FAQs) 

FAQ 
Q: Is my data safe right now?  

A: In most cases, yes—today’s encryption is extremely strong and is designed to protect your data from current threats. If you’re using trusted security tools like a VPN, safe browsing protections, and device security, your data is actively protected while it’s in transit and in use. However, no system is risk-free. Data exposed through phishing, weak passwords, breaches, or unsecured networks may still be vulnerable. And with “Harvest Now, Decrypt Later,” even properly encrypted data could be collected today and targeted for decryption in the future. 

Q: What is quantum-safe encryption? 

A: Quantum-safe (or post-quantum) encryption refers to new types of cryptography designed to remain secure even against future quantum computers. Today’s encryption relies on math problems that are extremely difficult for classical computers to solve, but quantum computers could eventually solve some of them much faster. Quantum-safe approaches use different mathematical foundations that are believed to resist those capabilities. In practice, many companies are moving toward hybrid encryption, combining today’s proven methods with newer quantum-resistant techniques to protect data both now and long-term. 

Q: Should I still use a VPN? 

A: Yes. A VPN remains one of the most effective ways to protect your data today, especially on public or unsecured networks. It encrypts your internet traffic and helps prevent interception by hackers, internet providers, or other third parties. While VPN protocols are evolving to address future quantum risks, they still provide strong, essential protection against today’s threats. 

Q: When will this become a real threat? 

A: The risk unfolds in two phases. The collection phase is already happening today, where sophisticated actors gather encrypted data and store it. The decryption phase depends on when quantum computing advances far enough to break certain types of encryption, which could take years but is actively progressing. This means data with a long lifespan, such as financial records, personal communications, and sensitive documents, is most at risk because it only needs to remain valuable until those capabilities exist. 

The post Why Hackers Are Collecting Data They Can’t Read Yet. And How to Stay Safe appeared first on McAfee Blog.

Cloud Storage Scam Emails and Record-Breaking Fraud Losses: This Week in Scams 

17 April 2026 at 11:00
Fake cloud email example

You open your inbox and see it: Your cloud storage is full. 

There’s a warning about photos being deleted, your account being suspended, or a renewal failing. There’s a button to “fix it now.” Or a warning to “act today.” 

It looks routine. Maybe even urgent enough to click. 

That’s exactly the point. 

An example of a cloud storage scam detected by McAfee.
An example of a cloud storage scam detected by McAfee.

Cloud storage scams are making headlines again, building on patterns we flagged earlier this year in our State of the Scamiverse research.  

These emails have circulated steadily since 2025, often impersonating trusted brands like Apple, Microsoft, and Google. Many are timed to moments when people are already thinking about storage, backups, or subscriptions. 

The safest move is simple: pause and don’t click. If there’s a real issue, go directly to your account through the official app or website. 

You can also protect yourself with McAfee’s Scam Detector, which flags suspicious links and messages, including cloud storage scams, and explains why they may be risky. 

What Is A Cloud Storage Scam And How Does It Work? 

Cloud storage scams are phishing attacks designed to trick you into believing there’s an issue with your account so you’ll click a malicious link.

They often look like this, and include 3 key red flags:  

  • Messages that create urgency like “act now or lose your data”  
  • Generic greetings instead of your name  
  • Links that don’t match the official domain  

How the scam works (step-by-step) 

Step  What happens  What to do  How McAfee helps 
1. You receive a message  Email or text claims your storage is full or your account has an issue  Don’t click links directly from the message  Scam Detector flags suspicious messages before you interact 
2. Urgency is introduced  Warning that files or photos will be deleted if you don’t act  Pause. Urgency is a red flag  Scam Detector identifies pressure-based scam patterns 
3. You’re pushed to a link  Link mimics a real login or billing page  Go directly to the official website instead  Safe browsing tools help block malicious sites 
4. You’re asked for info  Login credentials or payment details requested  Never enter info from a link you didn’t verify  Scam Detector explains why a page or link is risky 
5. Data is captured  Scammers collect your data or payment  Monitor accounts and report suspicious activity  Identity monitoring alerts you if your data is exposed 

 Why This Scam Works 

  • Familiar brands: Messages often appear to come from trusted platforms like Apple iCloud or Google Drive  
  • Emotional pressure: The threat of losing photos or files triggers quick decisions  
  • Routine context: Storage alerts feel normal, so people don’t question them  

And that, my friends, is scam number one in this week’s This Week in Scams. 

Let’s get into what else is on our radar. 

FBI Report: Over $20 Billion Lost to Scams in 2025

New data from the FBI’s Internet Crime Complaint Center (ICC) shows just how large the scam economy has become. 

 Accessibility description: Chart describes the number of complaints filed with IC3.gov from 2001 – 2025. 2 Accessibility description: Chart describes the losses of complaints filed with IC3.gov from 2001 – 2025. (Image Courtesy, FBI)
Cybersecurity-related fraud losses topped $20 billion in 2025. (Image Courtesy, FBI)

In 2025 alone: 

  • Americans reported over $20.8 billion in losses  
  • More than 1 million complaints were filed  
  • That’s roughly 3,000 complaints per day  
(Image Courtesy, FBI)
Investment-related fraud topped the charts, with over $8.5 billion lost to investment cybercrime in 2025. And that’s just losses that were reported. Not everyone reports when they were scammed. (Image Courtesy FBI)

This is where layered protection matters. It’s not just about catching one bad link. It’s about recognizing patterns across messages, platforms, and moments when something feels slightly off. 

How McAfee Protects You From Scams and Cyber Threats 

McAfee+ Advanced gives you multiple layers working together so you are not left figuring it out after the damage is done:  

  • Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast 
  • Personal Data Cleanup helps remove your information from data broker sites, making you harder to target in the first place 
  • Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage 
  • Safe Browsing helps block risky sites if you do click 
  • Device Security helps detect malicious apps or downloads 
  • Secure VPN keeps your data private, especially on public Wi-Fi   

McAfee Safety Tips This Week 

As always, we have some best practices and safety tips for navigating life online: 

  • Pause before clicking, especially when a message creates urgency  
  • Go directly to websites or apps instead of using email links  
  • Be skeptical of routine account alerts that push immediate action  
  • Double-check sender addresses and URLs closely  
  • Use tools like McAfee’s Scam Detector to flag suspicious links and messages before interacting  
  • Turn on identity monitoring so you’re alerted if your data is exposed 

And we’ll be back next week with more scams making headlines. 

The post Cloud Storage Scam Emails and Record-Breaking Fraud Losses: This Week in Scams  appeared first on McAfee Blog.

Can Your Wearable Health Monitors Be Compromised?

13 April 2026 at 20:00

Wearable health devices are designed to give you more control over your body and your data. 

But in 2026, the bigger risk isn’t someone spying on your smartwatch or smartring in real time. It’s what happens if the data connected to that device gets exposed. 

Health data, login credentials, and behavioral patterns tied to wearables can become valuable signals for cybercriminals. And once that data is out, it can fuel everything from identity theft to highly targeted scams. 

Here’s what’s actually at risk, and how to protect yourself. 

What Is Wearable Health Data (and Why It Matters) 

Wearable health data refers to the personal information collected and stored by devices like fitness trackers, smartwatches, and connected medical monitors. 

This can include: 

  • Heart rate and activity levels  
  • Sleep patterns  
  • Location data  
  • Medical metrics (like glucose levels)  
  • Account credentials tied to apps and dashboards  

On its own, this data may seem harmless. But combined, it creates a highly detailed profile of your habits, routines, and health status. 

The Real Risk in 2026 Isn’t the Device. It’s the Data. 

Early conversations around wearable security focused on device hacking or surveillance. 

Today, the bigger concern is data exposure. 

If wearable platforms, apps, or connected services are breached, your data could be: 

  • Sold on the dark web  
  • Used to impersonate you  
  • Leveraged in targeted phishing or health-related scams  

And because this data is personal and specific, scams built from it can feel far more convincing than generic spam. 

How Exposed Wearable Data Can Lead to Scams 

When cybercriminals gain access to personal data, they don’t just sit on it. They use it. 

Here’s how that plays out: 

Scenario  What It Looks Like  Why It Works 
Health-related phishing  “Your insurance claim was denied” or “Update your health profile”  Feels relevant and urgent 
Account takeover attempts  Password reset emails tied to known apps  Uses real account signals 
Personalized scams  Messages referencing routines, devices, or conditions  Builds trust quickly 
Fake alerts or services  “Device security issue detected”  Mimics real product behavior 

 

This is where the risk shifts from data privacy → real-world financial and identity impact. 

6 Smart Ways to Protect Your Wearable Data 

1)Install updates immediately
Security patches fix known vulnerabilities. Delaying updates leaves gaps open.  

2) Use layered protection, not just device settings
A VPN and security software help protect data in transit and block threats before they reach you.  

3) Strengthen your login credentials
Use strong, unique passwords and enable two-factor authentication wherever possible.  

4) Limit what you share
Review app permissions and only connect devices to services you trust.  

5) Verify every message or alert
If you receive a message tied to your device or health data, double-check the source before clicking.  

6) Monitor your accounts regularly
Small signs of unusual activity can be early indicators of larger issues. 

How McAfee Helps Protect Your Data Beyond the Device 

Protecting your wearable doesn’t stop at the device itself. It extends to what happens if your data is exposed or targeted. 

Identity Monitoring 

McAfee helps track your personal information across known breach sources and alerts you if your data appears where it shouldn’t. 

This gives you early warning if wearable-related accounts or associated data are compromised. 

Scam Detector 

If your data is exposed, scammers often follow. 

McAfee’s Scam Detector helps identify suspicious messages, links, and communications before you engage, and explains why something was flagged, so you can make informed decisions quickly. 

Together, these tools help protect not just your device, but the chain reaction that can follow a data breach. 

The post Can Your Wearable Health Monitors Be Compromised? appeared first on McAfee Blog.

Social Security Scam Emails and a Healthcare Data Breach: This Week in Scams

10 April 2026 at 12:00

Emails claiming to be from Social Security are making the rounds right now. 

They look official. They sound official. And they’re designed to get you to click before you think twice. 

The Social Security Administration’s Office of Inspector General is warning about a spike in messages that claim your Social Security statement is ready to download. The goal is simple. Get you to click a link or open an attachment. 

From there, things can go sideways fast. 

Before interacting with anything like this, it’s worth pausing and running it through a tool like McAfee’s Scam Detector. This is exactly the kind of message it’s built to flag. Something that looks legitimate, but feels just slightly off. 

How The Scam Works 

The email mimics official government communication, using logos, formatting, and language that feels familiar. It might say your statement is ready, your account needs attention, or you need to review a document. 

Once you click: 

  • You may be sent to a fake website designed to capture your personal information  
  • You may download malware without realizing it  
  • Or you may be prompted to enter sensitive financial details  
  • Either way, the goal is the same: get access to your identity. 

The Red Flags In These Emails 

  • Messages claiming your social security statement is ready to download  
  • Links or attachments labeled as official documents  
  • Urgency pushing you to act quickly  
  • Sender addresses that do not end in “.Gov”  

The biggest tell: Social Security does not send emails like this asking you to download statements or provide sensitive information. 

What To Do If You Get One 

  • Do not click links or download attachments  
  • Delete the email immediately  
  • Access your account by going directly to the official SSA website  
  • Report the message to the SSA Office of Inspector General  

If you already clicked: 

  • Stop communication immediately  
  • Contact your financial institutions  
  • Monitor your accounts closely  
  • Report the incident to the FTC or the FBI’s IC3  

And that, my friends, is scam number one in this week’s This Week in Scams. 

Let’s get into what else is on our radar. 

A Healthcare Data Breach That Could Lead to Follow-Up Scams 

Healthcare data breaches don’t always make headlines the same way big tech breaches do, but they can be just as serious. 

According to reporting from Fox News, CareCloud, a company that supports electronic health records for tens of thousands of providers, recently confirmed a security incident involving unauthorized access to one of its systems.  

The access lasted several hours. And while it’s still unclear whether any data was taken, that uncertainty is exactly what makes situations like this risky. 

Because even if you’ve never heard of the company, your doctor might use it. 

Why This Matters 

Healthcare data is incredibly valuable. It can include: 

  • Names and social security numbers  
  • Insurance details  
  • Medical history  
  • Billing information  

Unlike a credit card, you can’t just cancel your medical history. 

And when that kind of data is exposed or even potentially exposed, scammers often follow up with messages that feel highly specific and personal. 

What To Watch For Next 

After incidents like this, scammers often move quickly: 

  • Emails or texts pretending to be your provider  
  • Messages about billing issues or medical records  
  • Requests to “verify” your information  
  • Links to log in or update your account  

These scams work because they’re timed perfectly and feel relevant. 

This is another moment where Scam Detector can help flag suspicious links or messages before you engage, even when they reference real healthcare providers. 

How To Protect Yourself 

  • Review medical bills and insurance statements for unfamiliar activity  
  • Enable two-factor authentication on patient portals  
  • Use strong, unique passwords  
  • Avoid clicking links in unexpected healthcare-related messages  
  • Consider identity monitoring to catch misuse early  

Where McAfee Steps In (So You Don’t Have to Guess) 

Scams today are layered. 

A fake email leads to stolen credentials. A breach leads to targeted phishing. And those follow-ups are getting harder to spot. 

McAfee+ Advanced gives you multiple layers working together so you are not left figuring it out after the damage is done: 

  • Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast
  • Personal Data Cleanup helps remove your information from data broker sites, making you harder to target in the first place
  • Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage
  • Safe Browsing helps block risky sites if you do click
  • Device Security helps detect malicious apps or downloads
  • Secure VPN keeps your data private, especially on public Wi-Fi  

Safety Tips To Carry Into Next Week 

  • Be cautious of emails that look official but create urgency  
  • Never trust unsolicited messages asking for personal or financial information  
  • Go directly to official websites instead of clicking links  
  • Stay alert after any breach or security incident makes headlines  
  • Use tools like McAfee that help you verify what’s real before you act  

Because the reality is, scams are designed to look legitimate. You shouldn’t have to figure it out on your own. We’re safer together. 

We’ll be back next week with more scams making headlines. 

The post Social Security Scam Emails and a Healthcare Data Breach: This Week in Scams appeared first on McAfee Blog.

McAfee’s Scam Detector Named Webby Awards Finalist for AI Innovation

9 April 2026 at 12:00

We’re excited to share that McAfee’s Scam Detector has been named a finalist in the 2026 Webby Awards. 

Recognized in the AI Experiences & Applications – Consumer Application category and named a Webby Honoree for Best Use of AI & Machine Learning, Scam Detector is being acknowledged for its effectiveness as an AI-driven consumer tool. 

This recognition of Scam Detector validates something key in research findings. According to McAfee’s 2026 State of the Scamiverse report, Americans now spend 114 hours a year trying to decide what’s real and what’s fake online. 

Scam Detector was built with this era of uncertainty in mind, designed to help people cut through confusion and identify scams as they appear. The Webby recognition reinforces to us that McAfee’s Scam Detector is doing exactly that. 

What Are the Webby Awards? 

The Webby Awards are presented by the International Academy of Digital Arts & Sciences and recognize excellence across the internet, including apps, software, AI, and digital experiences. 

Each year, thousands of entries are evaluated, with finalists representing the top work in their category globally. 

In addition to judged awards, the Webby Awards include a People’s Voice Award, which is decided by public vote. 

How McAfee’s Scam Detector Uses AI to Stop Scams 

Scam Detector is designed to help people identify scams where they’re most likely to happen, always ready to help you spot what’s real and what’s not when you least expect it. 

It uses AI to analyze and flag suspicious: 

  • Text messages and emails  
  • Links and websites  
  • QR codes  
  • Social media messages  
  • AI-generated and deepfake content  

Beyond detection, Scam Detector explains why something was flagged as risky. That transparency helps show how decisions are made, so people can quickly understand the risk and feel more confident trusting what’s flagged.

As scams become more personalized and harder to detect, this combination of automatic detection and clear guidance is critical to preventing financial loss and identity theft. 

Vote for McAfee’s Scam Detector 

Scam Detector is eligible for the Webby People’s Voice Award, which is decided by public vote. 

If you would like to support McAfee’s Scam Detector, you can vote here: https://vote.webbyawards.com/PublicVoting#/2026/ai/ai-experiences-applications/consumer-application 

Voting is open through Thursday, April 16 at 11:59 pm PDT. 

Winners will be announced on April 21, 2026. 

And a big thank you to the McAfee teams who brought Scam Detector to life and who continuously improve how Scam Detector identifies new threats and adapts to the evolving world of AI-driven scams. 

The post McAfee’s Scam Detector Named Webby Awards Finalist for AI Innovation appeared first on McAfee Blog.

Oklahoma Tax Breach and FBI Impersonation Scam: This Week in Scams

3 April 2026 at 11:01
Suspects wanted by the FBI

A tax system breach in Oklahoma is putting highly sensitive personal information at risk. And unfortunately, this is exactly the kind of situation scammers love to exploit. 

Hackers reportedly accessed W-2 and 1099 files through Oklahoma’s online tax portal, according to state officials, exposing the kind of information that can open the door to tax fraud, identity theft, and highly targeted phishing attempts. 

Before the follow-up scams start rolling in, this is the kind of moment where layered protection matters. McAfee+ Advanced includes identity monitoring and data cleansup that can help alert you if your personal information starts circulating where it shouldn’t, and Scam Detector can flag suspicious messages if scammers try to use this breach as a hook. 

What Happened in Oklahoma 

According to a statement by the Oklahoma Tax Commission and reported by KOCO News 5, a local ABC affiliate, suspicious activity inside the state’s Oklahoma Taxpayer Access Point system was identified in December 2025. The agency says impacted individuals have been notified directly by mail, and complimentary credit monitoring and fraud assistance are being offered. 

When W-2s, 1099s, Social Security numbers, and tax-related records are exposed, scammers can use that information to: 

  • File fraudulent tax returns  
  • Try to open new accounts  
  • Build phishing emails or texts that feel unusually real  

Either way, the goal is the same: use real information to make the next scam more believable. 

Red Flags of a Scam After a Breach Like This 

The breach itself is real. But what often follows is a second wave of scams pretending to help. 

Watch For: 

  • Emails or texts about your “tax account” that create urgency  
  • Messages asking you to verify personal information  
  • Fake alerts about refunds, filings, or suspicious activity  
  • Links telling you to log in and “secure” your account  

That’s where people can get hit twice: once by the breach, and again by the scam that follows it. 

What To Do If You’re Impacted 

First, don’t panic. Then: 

  • Take advantage of any free credit monitoring or fraud assistance being offered  
  • Monitor your bank accounts, tax records, and credit reports closely  
  • Consider placing a fraud alert or credit freeze if needed  
  • Be extra careful with any message referencing taxes, refunds, or account access 
  • Go directly to official sites instead of clicking links in emails or texts  

And that, my friends, is scam number one in this week’s This Week in Scams. 

Let’s get into what else is on our radar. 

The FBI Impersonation Scam Showing Up Across the U.S. 

Scammers pretending to be federal agents are making the rounds across the country, and this one is built to make people panic fast. 

Field offices, including Chicago and Houston, are warning the public about fraudsters posing as FBI agents in calls, texts, and emails. In some cases, the scammers claim you’re connected to an investigation. In others, they say you’re a victim of fraud and need to act immediately to protect yourself. 

Sometimes they do not stop there. They may also pretend to be bank employees working alongside the FBI, all to make the story feel more convincing and get access to your money or personal information. 

Suspects wanted by the FBI
The FBI has shared images of these suspects pretending to be agents. If you are contacted by these officials, report it to the FBI.

Why This Scam Works

This scam plays on the same pressure tactics we’ve seen over and over again: authority, urgency, and confusion. 

If someone claims to be a federal agent, many people freeze up and assume they need to cooperate immediately. That’s exactly what scammers are counting on. 

The FBI has been clear about this: federal law enforcement will not ask you for money or sensitive personal information over the phone, by text, or by email. 

The Red Flags in This Message

  • Unsolicited outreach from someone claiming to be federal law enforcement  
  • Pressure to act immediately  
  • Requests for money, gift cards, prepaid cards, or personal information  
  • Instructions to keep the conversation secret  
  • Stories involving a bank “working with” the FBI  

If it feels dramatic, high-pressure, and just a little off, trust that instinct. 

What To Do if You Get One Of These Messages

  • Do not respond  
  • Do not send money or share personal information  
  • Contact the agency directly using publicly listed contact information  
  • Save the message for your records  
  • Report it to the FBI: 1-800-CALL-FBI (225-5324), or online at tips.fbi.gov.

This is also exactly the kind of message McAfee’s Scam Detector is built to flag before you get pulled in. 

How McAfee Helps You Stay Ahead of Scams and Breaches 

McAfee+ Advanced gives you multiple layers working together so you are not left figuring it out after the damage is done: 

  • Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast
  • Personal Data Cleanup helps remove your information from data broker sites, making you harder to target in the first place
  • Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage
  • Safe Browsing helps block risky sites if you do click
  • Device Security helps detect malicious apps or downloads
  • Secure VPN keeps your data private, especially on public Wi-Fi  

This kind of layered protection is critical in cases like ghost student scams, where the first sign of fraud often comes after financial damage has already happened. 

Safety tips to carry into next week 

  • Be extra cautious after any real breach makes headlines  
  • Do not trust unsolicited messages just because they reference real institutions  
  • Never send money to someone claiming to be law enforcement  
  • Go directly to official websites instead of clicking links  
  • Use tools that flag suspicious messages in real time so you do not have to guess 

The reality is, scams are getting better at looking official. 

You should not have to be an expert to spot them. That’s why McAfee is here to help. We’re Safer Together.

We’ll be back next week with more scams making headlines. 

The post Oklahoma Tax Breach and FBI Impersonation Scam: This Week in Scams appeared first on McAfee Blog.

Why Was My Tax Refund Intercepted? The “Ghost Student” Scam Explained

2 April 2026 at 13:00

Rob J., 31, an internal auditor in California, thought he was doing everything right this tax season. He filed his return as usual, even early, and expected a state refund just short of $400. 

Instead, he got a letter saying the state had taken it. 

The notice from the California Franchise Tax Board said his refund had been intercepted to pay a debt owed to a local community college. 

There was just one problem: Rob had never attended that school. 

“How could the state be taking my tax refund to pay a debt to a community college I’ve never attended?” he told us at McAfee. “I immediately knew something was wrong.” 

“I started researching and came across the term ‘ghost student,’ and that’s when it clicked. Someone had used my identity to enroll in a college like they were me.” 

How McAfee+ Advanced Helps Protect You from Identity Theft  

Scams like this do not start with a suspicious text or email. They start with your data being exposed somewhere you cannot see. 

That is why protection has to go beyond one moment and cover the full lifecycle of identity theft. 

McAfee+ Advanced gives you multiple layers working together so you are not left figuring it out after the damage is done: 

  • Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast
  • Personal Data Cleanup helps remove your information from data broker sites, making you harder to target in the first place
  • Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage
  • Safe Browsing helps block risky sites if you do click
  • Device Security helps detect malicious apps or downloads
  • Secure VPN keeps your data private, especially on public Wi-Fi  

This kind of layered protection is critical in cases like ghost student scams, where the first sign of fraud often comes after financial damage has already happened. 

What Is a Ghost Student Scam? 

A ghost student scam is a form of identity theft where someone uses your stolen personal information, often your Social Security number, to enroll in a college or university under your name. 

The scammer is not trying to attend school. They are trying to use your identity to access financial aid, create accounts, or generate funds tied to a real person. 

In many cases, the victim has no idea anything happened until the consequences show up later, such as a tax refund being taken, a debt appearing, or a loan being opened in their name. 

That is exactly what happened to Rob. 

“I started researching and came across the term ‘ghost student,’ and that’s when it clicked,” he said. “Someone had used my identity to enroll in a college like they were me.”  

How Ghost Student Scams Happen 

These scams typically follow a predictable pattern, even if the victim does not see it happening in real time: 

Stage  What happens  Why it matters 
Data exposure  Your personal information is leaked in a data breach or collected from data broker sites  Scammers get the core details they need to impersonate you 
Identity misuse  Your information is used to apply to colleges or financial aid programs  The scam is tied to your real identity, not a fake one 
Enrollment activity  Fake students may enroll just long enough to access funds or create accounts  This helps scammers avoid early detection 
Financial impact  Debts, balances, or aid obligations are created in your name  You become financially responsible on paper 
Discovery  You find out later through a notice, refund interception, or account alert  By this point, damage has already been done 

In Rob’s case, the starting point was a data breach the year before. His Social Security number had been exposed, but he had not frozen his credit. 

Someone used that information to enroll at Pasadena City College. When the balance went unpaid, the state redirected his tax refund to cover it. 

“Despite Being the Victim, I’m Trying to Prove My Identity” 

Once Rob realized what happened, he moved quickly. He froze his credit, set up identity monitoring, filed a police report, and began working with the college to prove he was not the student. 

He says the process has been slow and frustrating. 

“I’ve spent hours on the phone trying to fix this… I’m exhausted,” he said. “Despite being the victim I am the one dealing with the consequences and trying to prove my identity to the same institution that let a fake me register.”  

When he contacted campus police, he learned something else: “this has been happening to other people too.” 

Why Ghost Student Scams Are Increasing 

Ghost student scams are part of a broader shift in how identity theft works. 

Instead of quick-hit fraud like a stolen credit card, scammers are using real identities to create more complex, longer-term opportunities for financial gain. 

In higher education, that can include: 

  • Enrolling fake students using stolen identities  
  • Accessing financial aid  
  • Holding seats in classes long enough to collect funds  

This trend has already affected thousands of suspected cases across education systems and continues to grow as scammers scale their tactics  

What to Do If Your Identity Is Used in a Ghost Student Scam 

If something like this happens, speed matters: 

  • Freeze your credit with all three bureaus  
  • Check your FAFSA and student loan records  
  • Contact the school and dispute the enrollment  
  • File a police report  
  • Set up identity monitoring and alerts  
  • Remove your personal information from data broker sites  

These steps help contain the damage, but they are reactive. The goal is to catch exposure earlier. McAfee+ Advanced can help you with freezing your credit, ongoing identity monitoring, and data removal from the dark web. 

How Rob’s Story Ends: ‘I’m Waiting for the Other Shoe to Drop’ 

Rob has confirmed there are no federal loans in his name, but the situation is not fully resolved. 

“I still feel like I’m waiting for the other shoe to drop,” he said.  

That uncertainty is part of what makes identity theft so difficult. You are often reacting to something that started months or even years earlier. Rob said he currently has an outstanding police report and is in the process of getting his refund reclaimed.  

How to Stay Ahead of Identity Theft Like This 

Ghost student scams work because they operate quietly, using real data in systems most people are not actively watching. That is where ongoing protection matters. 

McAfee+ Advanced helps close those gaps by: 

  • Alerting you early when your personal data appears on the dark web or in risky environments  
  • Reducing your exposure by removing your data from broker sites that scammers rely on  
  • Blocking scam entry points across texts, emails, links, and deepfakes  
  • Protecting your devices and connections so attackers have fewer ways in  

Because the goal is not just to respond to identity theft, it’s to catch the signals early enough that someone cannot become a “student” in your name in the first place. 

The post Why Was My Tax Refund Intercepted? The “Ghost Student” Scam Explained appeared first on McAfee Blog.

McAfee’s “Keep It Real” Campaign Named Shorty Awards Finalist

2 April 2026 at 11:00

We’re proud to share that McAfee’s “Keep It Real” campaign has been named a finalist in the 2026 Shorty Awards Social Good Campaign category. 

This category recognizes work that doesn’t just perform, it matters: campaigns that raise awareness, inspire action, and make a real-world impact. 

That’s exactly what “Keep It Real” set out to do. 

Because behind every scam statistic is a person who thought they were making the right call. And too often, what follows isn’t just financial loss. It’s embarrassment, silence, and stigma. 

We wanted to change that. 

The campaign launched alongside McAfee Scam Detector to address a growing reality: scams powered by AI are becoming harder to recognize and easier to fall for. 

“Keep It Real” paired real survivor stories with AI-driven protection to show how scams actually happen and how people can stop them in the moment. 

The goal was simple: 

  • Normalize the experience  
  • Remove shame around being scammed 
  • Help more people recognize scams faster  

Because when people feel safe talking about scams, they’re more likely to spot them and stop them. 

What Are the Shorty Awards? 

The Shorty Awards honor the best work in social media, digital campaigns, and online storytelling across brands, creators, and organizations. 

Now in their 18th year, the awards recognize campaigns that combine creativity, impact, and real-world relevance. Finalists are selected alongside leading global brands and judged on both industry evaluation and public voting. 

How McAfee’s Scam Detector Fits In 

McAfee’s Scam Detector is designed to help people identify scams across everyday digital moments. 

It uses AI to fight AI by flagging suspicious: 

  • Text messages and emails  
  • QR codes and links  
  • Social media messages  
  • AI-generated and deepfake content  

By combining automatic detection with clear guidance, Scam Detector helps people better understand what they’re seeing and decide what to trust. 

Real Stories Behind the Campaign 

A core part of “Keep It Real” was giving space to people who experienced scams to share what happened, in their own words. 

These stories helped show that scams can happen to anyone and played a key role in breaking the stigma around being targeted. 

 

This recognition reflects the work across McAfee teams who built and brought this campaign to life, including product, engineering, research, creative, and communications. 

It also reflects the individuals who chose to share their real scam stories to help others recognize scams, stay safer, and end the shame and stigma around being scammed. 

Support the Campaign 

The Shorty Awards include a public voting component. 

If you’d like to support the campaign, you can vote here:
https://shortyawards.com/18th/keep-it-real-mcafees-ai-scam-media-relations-campaign 

Voting is open through April 8, and you can vote once per day. 

Examples of real messages sent in response to our campaign.

The post McAfee’s “Keep It Real” Campaign Named Shorty Awards Finalist appeared first on McAfee Blog.

❌