Election security isn’t just about protecting voting machines or counting ballots accurately. It’s also about making sure voters have reliable information and know how to recognize scams designed to steal their personal information.

During election season, scammers may impersonate election officials, send fake voter registration alerts, or spread misleading information about when and where to vote.

The good news? A few simple precautions can help you protect your information and make sure you’re getting accurate voting instructions.

Here’s what to know about election security, the scams to watch for, and how to vote with confidence.

Key Takeaways

• Check your voter registration through your state’s official election website, not an unexpected text or email.
• Watch for election scams that ask for personal information, payment details, or immediate action.
• Verify voting information with state or local election officials before trusting social media posts or unfamiliar websites.
• Protect your online accounts with strong passwords and two-factor authentication.
• Report suspicious activity to election officials or the appropriate authorities.

What Is Election Security, and Why Does It Matter?

Election security refers to the measures used to protect voting systems, voter information, ballots, and election results from interference, errors, and cyber threats.

Election officials use safeguards that can include physical security, cybersecurity protections, paper records, and post-election audits to help protect the voting process.

But there’s another side to election security that affects voters directly: scams and misinformation.

Criminals can take advantage of election-related confusion to trick people into sharing sensitive information or visiting fraudulent websites.

Importantly, an election-related scam doesn’t necessarily mean an election system has been hacked. Scammers can impersonate election officials without gaining access to official voting systems.

Understanding that difference helps voters focus on the risks they can control.

What Are the Most Common Election Scams?

Election scams often rely on familiar tactics: impersonation, urgency, and requests for personal information.

Here are four warning signs to recognize.

1) Fake Voter Registration Texts and Emails

You receive a text claiming your voter registration has expired or needs immediate verification.

The message includes a link to a website asking for personal information.

The risk: The link could lead to a phishing website designed to steal your information.

Phishing is when a scammer impersonates a trusted organization to trick you into revealing sensitive information, such as passwords or financial details.

What to do: Don’t use the link in an unexpected message. Instead, check your registration directly through your state’s official election website.

2) Calls Impersonating Election Officials

Someone calls claiming to represent an election office and asks for your Social Security number or credit card details to confirm your eligibility.

According to the Federal Trade Commission (FTC), scammers have used voter registration as a pretext to request sensitive personal and financial information.

What to do: Don’t provide sensitive information during an unsolicited call. Hang up and contact your election office using a verified phone number.

3) Fake Election Websites

Scammers may create websites that resemble official election resources.

These sites might claim to help you register, locate your polling place, or update your voter information.

What to do: Start with official government resources, such as USAGov, which directs voters to their state’s election information.

4) Misleading Voting Information

A social media post claims your polling location has changed, voting hours have been extended, or you can vote through an unfamiliar website.

The information may look credible, especially if it includes official-looking graphics or appears to come from a trusted source.

What to do: Verify voting instructions with your state or local election office before acting on or sharing them.

How Can You Check If You’re Registered to Vote?

The safest way to check your voter registration is through your state’s official election website.

You can find your state’s registration lookup tool through USAGov’s voter registration guide.

Check that:

• Your name and address are correct.
• Your registration status is active or otherwise eligible.
• Your assigned polling location is accurate.
• Any required updates are completed before your state’s deadline.

Registration deadlines vary by state, so check well before Election Day.

Remember: You don’t need to follow a link from an unexpected text to verify your registration. You can always start with an official election resource.

How Can You Tell If Election Information Is Real or Fake?

Election misinformation can spread through social media, text messages, emails, and even AI-generated audio or video.

Artificial intelligence can make it easier to create convincing messages that imitate real people or organizations. But the underlying scam tactic is familiar: convincing someone to trust a message without verifying its source.

Before believing or sharing election information, ask yourself:

• Who published it? Is it an official election office or a verified, reputable news organization?
• Can I confirm it? Does the information match what my state or local election office says?
• Is it creating unnecessary urgency? Be cautious of messages pressuring you to act immediately.
• Is it asking for personal information? Unexpected requests for passwords, payment information, or other sensitive details are warning signs.

The safest approach is simple: When voting information seems surprising or urgent, verify it before acting.

How to Vote Safely: 4 Election Security Tips

Protecting your vote starts with knowing where to find accurate information and how to recognize suspicious requests.

✓ 1. Verify Your Voting Information

Check your registration, polling location, voting hours, and identification requirements through official election resources.

Don’t assume your polling place is the same as it was during the last election.

✓ 2. Be Careful With Election-Related Links

Avoid clicking unexpected links claiming you need to update your registration or confirm your voting eligibility.

Instead, navigate directly to a trusted election website.

✓ 3. Protect Your Personal Information

Use strong, unique passwords for important online accounts, especially your email.

Turn on two-factor authentication wherever available. This adds another verification step that can help prevent someone from accessing your account with a stolen password.

✓ 4. Know How to Report Suspicious Activity

If you receive a suspicious election-related message, don’t respond or provide personal information.

Report suspected scams to the ReportFraud.ftc.gov.

If you experience voter intimidation, misleading voting instructions, or another potential voting rights violation, contact your state or local election office. You can also find reporting guidance through USA.gov/Voter-Fraud.

What Should You Do If You Fall for an Election Scam?

If you’ve clicked a suspicious election-related link or shared personal information, take action to protect yourself.

• If you clicked a suspicious link: Avoid entering additional information. If you downloaded a file or installed an unfamiliar application, run a security scan.
• If you shared a password: Change it immediately through the legitimate website. Update any other accounts using the same password and enable two-factor authentication.
• If you shared financial information: Contact your bank or credit card provider using its official contact information.
• If you shared your Social Security number: Visit IdentityTheft.gov for guidance on protecting your identity.
• If you received misleading voting instructions: Contact your local election office to confirm the correct information and report the suspicious message.

Taking action quickly can help limit the damage.

Election Security FAQ

Can someone steal my vote using my personal information?

Stolen personal information can be used for identity theft or attempted voter impersonation, but possessing someone’s information does not automatically allow a criminal to cast a ballot in their name. Election procedures and safeguards vary by state.

If you suspect someone has misused your voter information, contact your local election office.

Is it safe to register to vote online?

Yes, when your state offers online voter registration and you use its official registration website.

Avoid entering personal information on unfamiliar websites or through unsolicited links.

Can scammers send fake voter registration texts?

Yes. Scammers may send messages claiming your registration needs urgent attention to trick you into visiting a fraudulent website or sharing sensitive information.

Always verify registration information through your state’s official election resources.

Can AI be used to spread election misinformation?

Yes. AI tools can generate realistic-looking images, audio, videos, and written messages that may be used to mislead voters.

Don’t assume something is authentic simply because it looks or sounds convincing. Verify important voting information with election officials.

Where can I find accurate information about voting?

Start with USA.gov/voting or your state or local election office.

These resources can help you confirm registration requirements, polling locations, voting methods, and important deadlines.

Stay Informed and Vote With Confidence

Election security involves many safeguards, but protecting yourself from scams doesn’t have to be complicated.

Verify information through official sources, be cautious of unexpected requests for personal details, and take a moment to investigate suspicious messages before responding.

A little preparation can help you avoid election scams, protect your personal information, and focus on what matters: making your voice heard.

The post Election Security: How to Protect Your Vote and Avoid Scams appeared first on McAfee Blog.

Hackers stole about $6.36 billion in cryptocurrency from Binance wallets on Oct. 29, 2026, according to blockchain intelligence firm TRM Labs, the largest crypto heist on record. Binance estimates the impact at $6.3 billion and says it will cover all losses from its SAFU fund and company funds. If you hold crypto on any platform, expect scammers to use this news as bait: check your account only in the official app, and never share your seed phrase.

Key Takeaways

• TRM Labs puts the theft at about $6.36 billion, drained from Binance wallets on 10 blockchains, mostly within 20 minutes.
• Binance says user funds are safe and that it will cover all losses. Binance briefly suspended deposits and withdrawals. Deposits are back to normal, and withdrawals remain paused.
• TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean hacking group.
• Binance’s early findings point to one engineer’s compromised work laptop, plus additional points of breach still under investigation.
• The biggest risk for most people now is follow-on scams: fake support messages, fake refund sites, and fake recovery firms.

What Happened in the Binance Crypto Heist

Attackers moved billions of dollars in crypto out of Binance’s hot wallets, the internet-connected wallets an exchange uses to process withdrawals. According to TRM Labs’ Oct. 29 analysis, most of the roughly $6.36 billion left in about 20 minutes starting at 20:05 UTC (4:05 p.m. ET), across 10 blockchains. That is about four times the $1.5 billion Bybit hack of February 2025, previously the largest on record.

Binance’s own estimate puts the impact at about $6.3 billion. Binance says it and its blockchain partners have frozen about $3 billion in affected assets on-chain, while TRM Labs estimates the attacker still holds about $2.4 billion in assets that issuers can’t freeze.

Is Your Money on Binance Safe?

Binance says yes. Late on Oct. 29, Binance said user funds are safe and that it will cover all losses from its SAFU fund and company funds. SAFU, short for Secure Asset Fund for Users, is an emergency reserve Binance set up to cover losses from incidents like this one.

In an Oct. 30 video update, Binance co-CEO Richard Teng said Binance has reserved more than $6.34 billion of company funds to cover the stolen assets, $5 billion of which is already held in the exact tokens taken, according to Decrypt.

What that means for you as of October 30, 2026:

• Deposits and withdrawals: Binance briefly suspended deposits and withdrawals. Deposits are back to normal, and withdrawals remain paused while Binance completes a security revamp of its withdrawal service. In the same video, Teng said Binance aims to reopen withdrawals within about 40 hours, ahead of a Sunday, Nov. 1 deadline, once the rebuilt service passes testing, according to WinBuzzer.
• Your balance: Teng said the exchange never uses customer funds, “so they are not impacted,” according to Bitcoin.com News; the losses hit Binance’s corporate holdings. Teng advised anyone concerned to check their balance and contact Binance support. You don’t need to file a claim, pay anyone, or move funds to protect your balance.
• US: Binance.US, a separate platform that serves US residents, said it has not been affected, according to the BBC.
• Next updates: Binance says it will publish a technical post-mortem when its investigation is complete. Get updates only from Binance’s official app, website, or verified social accounts.

Who’s Behind the Hack and How It Worked

TRM Labs attributes the attack with high confidence to TraderTraitor, which it calls North Korea’s elite hacking unit. Chainalysis reached the same conclusion after watching stolen Binance funds mix with funds from an earlier exploit tied to North Korea. The FBI attributed the 2025 Bybit hack to the same group, which is part of North Korea’s Lazarus Group.

The attack reportedly started on a single device. Binance’s initial investigation suggests it may have begun with a compromised DevOps engineer’s laptop, which gave the attacker access to a service container used to submit withdrawals. Binance has found no evidence that wallet private keys leaked, but it later said it uncovered “additional points of breach” and hasn’t published a root cause.

TRM Labs reports that on Ethereum, the attacker submitted 50 pre-signed authorizations so that one would work, handing control of a Binance hot wallet to a contract only the attacker could command.

The lesson for everyone else: a compromised computer can hand attackers the keys to accounts it touches. The same logic applies at home. If malware lands on the laptop or phone you use for crypto, an attacker can capture passwords, swap wallet addresses you copy, or approve transactions in your name. Learn more in our guide to how data breaches happen and how to avoid them.

Scams That Can Follow the Binance Hack

Scammers often target crypto holders after major exchange incidents. After FTX collapsed in 2022, McAfee Labs found several phishing sites targeting FTX users, including one that asked people to submit their crypto wallet phrase to receive a refund.

“When news about such big breaches breaks, there tends to be panic and confusion for consumers. Scammers will try and take advantage and leverage this incident by making contact over Email, text/whatsapp, a phone call,” says McAfee’s Head of Threat Research Abhishek Karnik. “Avoid such interactions that come out of the blue. The key is don’t panic, don’t react to inbound messages, and don’t have a knee-jerk reaction. Consumers shouldn’t let urgency override verification. If you are curious about your account at Binance, verify it but by navigating to the trusted website and not clicking on a link you received inadvertently from a text or email. The breach may be the headline, but the secondary scam wave could reach far more consumers.”

Watch for these red flags:

 

Red Flag	Why It Matters
An email, text, or call saying your Binance account is “at risk”	In an Oct. 29 statement to TechCrunch, Binance said it would share verified updates through official channels and warned users to avoid unofficial links.
A request for your seed phrase or private key to “verify” or “refund” you	Anyone with your seed phrase can empty your wallet. This is the exact tactic McAfee Labs found on fake FTX refund sites.
Instructions to move your crypto to a “safe wallet”	The wallet belongs to the scammer. Binance has pledged to cover the losses from its own funds. Moving your crypto won’t protect it.
A compensation form, claims portal, or airdrop for “hack victims”	Binance has not announced any claims process as of October 30, 2026. Fake refund sites can steal your login, seed phrase, or wallet approvals.
An unsolicited law firm or “recovery service” offering to get your crypto back	The FBI’s IC3 warned in August 2025 that fake law firms target people who lost crypto and charge fees.
A claim to work with the FBI or another government agency	“There are no law firms which are officially authorized partners of US Government agencies,” according to the same IC3 warning.
Fees requested in crypto or gift cards, or through a WhatsApp group chat	Fees demanded in crypto or gift cards, or talks moved to a private group chat, are common signs of a recovery scam.
“Support agents” who contact you first on social media or messaging apps	Real support is reached through the exchange’s official app or website, not through accounts that message you.

For more warning signs, see our guide on how to spot a crypto scam.

How to Protect Your Crypto Right Now

The most important step is to verify every message about your account through the official app, never through a link. These steps apply whether you use Binance, another exchange, or your own wallet:

1. Check your account only in the official app or by typing the web address yourself. Scam messages copy real branding and link to look-alike sites. Bookmark the real site and use only that.
2. Never share your seed phrase or private keys. No legitimate exchange, wallet, or recovery service needs them. Treat any request for them as a scam.
3. Use an authenticator app, passkey, or hardware security key for two-factor authentication. These are harder to intercept than codes sent by text message.
4. Turn on your exchange’s extra protections. If your exchange offers a withdrawal address allowlist or an anti-phishing code in its emails, turn them on. They make unauthorized withdrawals and fake emails easier to catch.
5. Review and revoke wallet permissions you don’t recognize. Connecting a wallet to a site can grant it ongoing permission to move certain tokens. Use your wallet’s settings or a block explorer’s approval checker to remove ones you no longer use.
6. Keep the devices you use for crypto updated and clean. The Binance hack reportedly began on one laptop. Install system and browser updates promptly, avoid unknown apps and browser extensions, and consider a dedicated device for large holdings.
7. Double-check every address before you send. Some malware swaps a copied wallet address for the attacker’s. Compare the first and last several characters before confirming.
8. Don’t act on urgency. Pressure to move funds, pay a fee, or confirm details “within the hour” is a sign of a scam. You don’t need to pay anyone or move funds to protect your Binance balance.

Exchange vs. Self-Custody: What’s the Difference?

Neither option removes all risk; they trade one set of risks for another. Here’s how they compare:

	Crypto on an exchange	Self-custody wallet
Who holds the private keys	The exchange	You
Main risks	Platform hacks, paused withdrawals, exchange failure	Lost or stolen seed phrase, malware, signing a malicious transaction
If something goes wrong	Depends on the exchange’s reserves and policies	Usually no one can reverse the loss
What protects you most	Strong two-factor authentication and phishing awareness	Offline seed phrase backup and careful transaction review

Whichever you choose, the same rule applies: nobody legitimate will ask for your seed phrase. For more background, see our guide to blockchain security. This article doesn’t recommend specific wallets, exchanges, or investments.

What to Do If You’ve Already Been Targeted

If you clicked a suspicious link, shared account details, or sent crypto after this hack, act quickly to limit the damage. Scammers are skilled at timing their messages to major news, and anyone can be caught off guard.

1. Stop all contact. Don’t reply, and don’t send more money or crypto, even if the person promises a refund or says one more fee will unlock your funds.
2. Secure your accounts. Change your exchange and email passwords from a device you trust, and turn on app-based two-factor authentication. Sign out of all other sessions if your exchange allows it.
3. If you shared your seed phrase, move what’s left. Create a new wallet with a new seed phrase on a clean device, and transfer any remaining funds there. The old wallet is no longer safe.
4. Revoke wallet permissions. If you connected your wallet to a suspicious site, revoke the approvals it received.
5. Contact the platform you sent from. Report the transaction to your exchange or wallet provider through its official support channel. Exchanges can sometimes flag or freeze funds that reach another platform.
6. Check your devices. Update your operating system and remove apps or browser extensions you don’t recognize. If you installed something a scammer sent, run a full security scan.
7. Protect your identity if you shared personal details. If you gave out your Social Security number, ID photos, or bank details, go to IdentityTheft.gov and consider a free credit freeze with Equifax, Experian, and TransUnion.
8. Keep records. Save wallet addresses, transaction IDs (hashes), dates, amounts, screenshots, phone numbers, and messages. Investigators and platforms need them.

If you’re a Binance customer and haven’t interacted with a scammer, you don’t need to pay anyone or move funds. If you’re concerned, check your balance and contact Binance support through its official app. Don’t pay anyone who offers to file a claim for you.

How to Report It

Report scams and suspicious messages tied to the Binance hack to these channels:

• FBI Internet Crime Complaint Center: file at ic3.gov, and include wallet addresses and transaction IDs.
• Federal Trade Commission: report at reportfraud.ftc.gov.
• Binance: report phishing and fake accounts through Binance’s official app or website support.
• Your local FBI field office or police: contact them if you lost money or were threatened. The IC3 recommends contacting a local FBI field office about fake law firms.

The Binance hack is the largest crypto theft on record, but for most people, the next risk arrives by email, text, or direct message. Check your account only through the official app, never share your seed phrase, and treat any unsolicited offer to recover or protect your crypto as a scam.

FAQ

Can stolen crypto be recovered?

Sometimes, but only in part. Some tokens can be frozen: about $2.7 billion of the Binance theft has been frozen, mostly by stablecoin issuers, according to TRM Labs. Recovery isn’t guaranteed: TRM Labs estimates the attacker still holds about $2.4 billion beyond issuers’ reach. Be wary of anyone who contacts you offering to recover crypto for a fee, the FBI’s IC3 warns.

Can someone steal my crypto if they have my wallet address?

Not with the address alone. A wallet address lets people see your balance and send you funds. To move your crypto, a thief needs your private key or seed phrase, or needs you to approve a malicious transaction.

Can you lose crypto in a cold wallet?

Yes. A cold wallet keeps your keys offline, which reduces exposure to online hacks. You can still lose funds if someone gets your seed phrase, you lose your only backup, or you approve a malicious transaction.

The post Hackers Drain $6.3B From Binance in Record Crypto Heist: How to Protect Your Wallet appeared first on McAfee Blog.

Discord announced on October 27, 2026, that messages from public channels in its more than 63,000 Discoverable Servers will start appearing in Google and other search engines from mid-December 2026, according to Discord’s official blog. In the US and most other countries, the setting that shares your messages is on by default for adult accounts. To keep new messages off the web, turn off “Show my message content from Discoverable channels on web pages” under User Settings > Data & Privacy.

Key takeaways

• Only public channels in Discoverable Servers are affected. DMs, group DMs, and private servers are not.
• Server Web Pages with AI-generated Channel Summaries go live November 16, 2026. Individual messages follow from mid-December.
• One Discord privacy setting covers every Discoverable Server you belong to.
• Turning the setting off stops future messages from appearing. It does not remove messages already published.
• Discord hides usernames and avatars, but the details inside a message can still identify you.

What Is Changing on Discord, and When

Discord is rolling out search visibility in three stages, starting with admin controls and ending with individual messages. The change covers only Discoverable Servers: communities listed in Discord’s Server Discovery that have at least 1,000 members, are at least eight weeks old, and meet Discord’s activity and safety requirements, according to the Discord blog.

 

Date	What happens	Who controls it
October 27, 2026	Admin controls and the member privacy setting begin rolling out	Server admins and members
November 16, 2026	Every Discoverable Server gets a public Server Web Page, including AI-generated Channel Summaries	Server admins
Mid-December 2026	Individual messages from participating channels begin appearing, rolled out gradually over several weeks	Members (and admins, by channel)

Discord says messages sent before mid-December 2026 won’t be included, whatever your setting. Channels whose content may appear on the web are labeled, so you can see it before you post.

Is Discord Private? What Can Go Public and What Stays Private

Public channels in Discoverable Servers can now reach search engines, but your DMs and private servers stay out of search. Here’s how the change applies, based on the Discord announcement:

Can appear on the web	Stays off the web
Message text in participating public channels of Discoverable Servers (from mid-December 2026)	Direct messages (DMs) and group DMs
AI-generated Channel Summaries of active conversations (from November 16, 2026)	Private servers and servers not listed in Server Discovery
Server Web Pages describing each Discoverable Server	Messages sent before mid-December 2026
	Usernames and avatars, which Discord says won’t be shown
	Messages from accounts in Discord’s teen age group

How to Change Your Discord Privacy Settings to Opt Out

You can opt out of Discord’s search indexing with one toggle, and it applies to every Discoverable Server you’re in. On desktop or the web:

1. Open User Settings. Select the gear icon next to your name at the bottom left of the Discord window.
2. Go to Data & Privacy. It’s listed in the settings menu on the left.
3. Turn off “Show my message content from Discoverable channels on web pages.” This stops messages you send afterward from appearing on Server Web Pages and in search results.
4. If you don’t see the option on the mobile app, try the desktop app or a browser. Log in at discord.com/settings/data-and-privacy. Changes made there apply to your entire account across all devices.

Two things to know before you rely on the switch:

• It only works going forward. According to Discord, messages you sent while the setting was on stay up unless you delete them in Discord.
• It doesn’t cover Channel Summaries. Summaries are controlled by server admins, so a summary can still describe a conversation you took part in.

If you don’t see the setting yet, Discord says controls are rolling out gradually from October 27, 2026. Check again before mid-December, when messages start going live.

If You Run a Server: Use the Web Presence Controls

Server owners and admins decide whether their community appears on the web at all, including the AI-generated summaries members can’t switch off. If you take no action, Discord says public channels stay on and a Server Web Page goes live on November 16, 2026.

1. Open Server Settings > Web Presence.
2. Choose which channels take part, or opt every channel out.
3. Review Channel Summaries. You can change which channels feed them, curate what’s shown, or turn them off.
4. Tell your members. Post a short note explaining what will be public and how members can turn off message sharing.

Why Hidden Usernames Don’t Make You Anonymous

Discord removes usernames and avatars from public pages, but the words in a message can still point to you. Doxxing, the practice of piecing together and publishing someone’s personal details, often starts with small clues spread across many posts.

What’s in a message	How it can identify you
Your city, school, workplace, or gym	Narrows you down to a small group of people
A distinctive phrase, project, or story	Can be matched to your posts on other platforms
Photos and screenshots	Can show faces, locations, or details in the background
Links to your other accounts	Connect your Discord activity to your real name
Dates and plans (“I’m away next week”)	Reveal routines or when your home is empty

Public pages can also be copied by other sites, and search results can lag behind changes, with a removed or changed page often showing in results for a while until a search engine’s crawler revisits it. McAfee’s guide on how to protect yourself from doxxing covers Discord-specific steps, including using a username you don’t use anywhere else.

What to Do If Your Discord Messages Are Already in Search

If you’re reading this after Discord’s mid-December 2026 rollout and your setting was on, messages you’ve sent since then may already be on Server Web Pages and in search results. Turning the setting off now only stops new messages from appearing, so you’ll need to delete the ones you want gone. Messages sent before mid-December aren’t included in search results. Work through the steps that apply:

1. Turn off the Data & Privacy setting so nothing new is shared.
2. Delete messages that reveal personal details. Discord says deleting a message removes it from its public pages.
3. Search for yourself. Look up your username, display name, and any phrases you’ve used to see what’s indexed.
4. Ask Google to refresh old results. After you delete a message, use Google’s Refresh Outdated Content tool so search results stop showing the old text. For personal information that’s still online, see Google’s guide to removing web results.
5. Secure your accounts. If a message exposed an email address or linked account, change those passwords and turn on multi-factor authentication.
6. Keep records. Save screenshots, links, and dates of anything posted about you or any threats you receive.

Is Discord Safe to Use After This Update?

Discord’s search change doesn’t make the platform inherently unsafe, but you do need to stay mindful of what you post and avoid sharing personal information about yourself. Your DMs and private servers are unaffected. Treat anything in a Discoverable Server’s public channels as something anyone could find.

• Post as if your words are searchable. Keep your real name, location, school, and workplace out of public channels.
• Review your server list. Leave Discoverable Servers you no longer use.
• Limit who can DM you. Restrict DMs to friends to cut down on unwanted contact.
• Use a unique username. Don’t reuse a handle that links to your other accounts.
• Turn on two-factor authentication for your Discord account.

Lock Down the Accounts Your Discord Posts Could Lead To

Discord’s toggle only controls Discord. If a public message can be tied to your Instagram, X, or LinkedIn profile, those accounts can fill in your name, photos, location, and contacts. That’s why it’s worth checking privacy settings across all your social accounts, not only the one that changed.

Take control of who sees what. McAfee’s Social Privacy Manager recommends privacy settings based on how you prefer to social, then applies them across your accounts in just a few clicks, with no need to open each site. It covers nearly every privacy setting across Facebook, Instagram, X, LinkedIn, YouTube, TikTok and Google. You can change your settings back at any time. Update your Discord privacy settings directly, since Social Privacy Manager doesn’t cover Discord.

You can make your social media presence safer by setting each profile to private or friends-only, hiding your friends or followers list, removing your location and workplace from public profile fields, and turning off search engine indexing where the platform offers it.

Tips for Parents Whose Teens Use Discord

Teen accounts are excluded entirely. Discord says users in its teen age group can’t enable message sharing until they’re adults. That protection depends on the age on the account, so check that your teen’s birthdate is accurate.

• Talk about what “public” means. Server Web Pages and Channel Summaries may describe conversations in large communities, even when individual messages aren’t shown.
• Know which servers your teen is in. Large public communities are the ones affected.
• Revisit the setting at 18. Discord hasn’t said whether sharing turns on automatically when a teen account becomes an adult account, and the adult default in the US is on.

How to Report Doxxing or Harassment on Discord

If someone uses your public messages to find, threaten, or extort you, report it to the platform and to authorities:

• Discord: right-click (desktop) or press and hold (mobile) a message, then select Report Message, as described in Discord’s guide to reporting content.
• Local police: if you’ve been threatened or your safety is at risk.
• FBI Internet Crime Complaint Center: report extortion or online fraud at ic3.gov.
• FTC: if your identity is misused, report it at IdentityTheft.gov.

The single most useful step is the setting itself. Before mid-December, open User Settings > Data & Privacy, turn off “Show my message content from Discoverable channels on web pages,” and delete any public messages that reveal more about you than you’d want a stranger to find.

FAQ

Will my Discord DMs show up in Google?

No. Discord says DMs, group DMs, and private servers are always private and aren’t part of this change.

Are Discord messages public now?

Messages in public channels are already visible to anyone in the server. From mid-December 2026, messages from participating channels in Discoverable Servers can also appear on the open web and in search, but only for members whose sharing setting is on.

Will my old Discord messages appear in search?

No. Discord says messages sent before mid-December 2026 won’t be included, regardless of your setting.

If I opt out later, are my messages removed?

No. Turning the setting off stops future messages only. Messages already published stay up unless you delete them in Discord, and search results may take time to update.

The post Public Discord Servers Become Searchable: How to Keep Your Messages Off Google appeared first on McAfee Blog.

Quest Diagnostics, one of the largest lab testing companies in the US, disclosed in an October 22, 2026, SEC filing that an unauthorized party accessed certain patient records in its Quanum Lab Services Manager (LSM) system. The company’s Quanum security notice says Quest believes protected health information and personal information were involved. The number of affected patients and the specific data taken have not been disclosed, and the investigation is ongoing.

How the Quest Diagnostics Breach Happened and What Was Exposed

The unauthorized access was discovered on October 21, 2026, according to Quest’s SEC filing. Doctors’ offices, health systems, and other Quest clients use Quanum LSM to place lab test orders and to receive and look up results. Patient data inside that system was accessed, the company says, but its other systems were not affected.

According to the notice, the company believes both protected health information (PHI) and personally identifiable information (PII) were involved. Quest has not listed which specific data fields were exposed, and it has not disclosed how many patients were affected. The potential reach is wide: Quest says it serves about half of the physicians and hospitals in the US and touches the lives of one in three American adults each year.

To contain the breach, Quest paused access to Quanum LSM and, as a precaution, to its Essential Insights and LabHQ systems. Its notice says access to all three had been restored as of October 26. The SEC filing adds that Quest notified federal law enforcement and brought in outside cybersecurity experts. As of October 23, no hacking group had publicly claimed the attack. Quest is posting updates on its security notice at questdiagnostics.com/links/quanum-notice.

This is not Quest’s first breach involving patient data. In 2019, about 11.9 million Quest patients were affected by a breach at AMCA, a third-party billing collections vendor. Medical records exposed in older breaches can still be misused today. Health data retains its value to criminals over time, because unlike a credit card number, it cannot be canceled or reissued.

Red Flags: Scams That Follow the Quest Breach

The most immediate risk for most patients is follow-up scams that use the breach as a hook. Quest’s own notice warns people to watch for “breach-notification, credit-monitoring or settlement scams.”

Red Flag	Why It Matters
An email, text, or call about the Quest breach asking you to confirm your Social Security number, insurance ID, or date of birth	Quest has said it will notify affected patients by letter. A message asking you to re-enter personal data is a common way to collect more of it.
A credit or identity monitoring offer that asks for payment or sends you to an unfamiliar link	Quest says its notification letters will describe available resources, including credit and identity monitoring. Verify any offer through Quest’s official website or phone number.
A “class action settlement” message asking for a fee or your bank details	Quest’s notice specifically flags settlement scams. Treat any request to pay to join a settlement as fraud.
A “your lab results are ready” message with a login link you didn’t expect	Scammers borrow the look of real health notices. Log in only through an app or website you already use.
A bill or Explanation of Benefits (EOB) for lab tests or services you didn’t get	Charges for care you never received can mean someone is using your medical identity.
A debt collector contacting you about medical debt you don’t owe	Collection notices for unfamiliar medical debt can mean someone received care or opened accounts in your name.

 

How to Protect Yourself After the Quest Diagnostics Breach

If you’ve had lab work processed by Quest, take these steps now, even if you don’t yet know whether your records were involved.

1. Get updates from Quest directly. Use the official notice at questdiagnostics.com/links/quanum-notice or call Quest at 1-866-MYQUEST. If someone contacts you first about the breach via call, text, or email, don’t use any phone number or click any link they provide. Contact Quest through these official channels instead.
2. Watch your mail for a notification letter. Quest says it will send letters to affected patients once its investigation identifies them. If a letter includes a monitoring enrollment code, confirm it by contacting Quest through its official channels before you enroll.
3. Review your medical bills and EOBs. Look for tests, visits, or prescriptions you don’t recognize. This is one of the earliest places medical identity theft shows up.
4. Check your credit reports. You can get free reports from Equifax, Experian, and TransUnion at AnnualCreditReport.com. Look for accounts or medical collections you don’t recognize.
5. Consider a credit freeze. A freeze is free and blocks new credit accounts from being opened in your name. You can lift it temporarily when you need to apply for credit.
6. Secure your health accounts. Use a unique password for any patient portal or health app, and turn on multi-factor authentication where it’s available. A password manager makes it easier to keep up with unique passwords.
7. Be skeptical of unexpected breach messages. Quest has said it will notify affected patients by letter. If an email, text, or call asks you to act quickly, click a link, or share personal or payment details, don’t respond. Contact Quest directly using the number on its official website.

What to Do If Your Information Was Exposed or You’ve Already Been Targeted

Your next steps depend on what has happened so far:

• If you received a Quest notification letter: Follow its instructions, note any enrollment deadline, and keep the letter with your records.
• If you shared information with a scammer: Stop contact. Call your bank, card issuer, or payment app right away to try to stop or reverse any payments.
• If you gave away a password: Change it on that account and any account that uses the same password, and turn on multi-factor authentication.
• If you see signs of medical identity theft: The FTC recommends asking each doctor, lab, pharmacy, and insurer involved for copies of your records and reporting any errors in writing. If a provider doesn’t send your records within 30 days of a written request, you can file a complaint with the HHS Office for Civil Rights.
• If fraudulent claims appear: Call your health insurer’s fraud line, using the number on your insurance card.
• If your identity data was exposed or misused: Place a credit freeze or fraud alert with Equifax, Experian, and TransUnion, and create a recovery plan at IdentityTheft.gov.
• Keep records: Save the breach letter, suspicious messages, phone numbers, bills, EOBs, and notes from every call.

How to Report It

Report breach-related fraud and identity theft to the right channel:

• Medical or other identity theft: IdentityTheft.gov
• Scam messages or calls using the Quest breach: FTC at ReportFraud.ftc.gov
• Online fraud that cost you money: FBI Internet Crime Complaint Center at ic3.gov
• Concerns about how your health information was handled: HHS Office for Civil Rights at hhs.gov/ocr/complaints
• Money lost or threats made: Your local police department

Quest is still determining whose records were accessed, so the most useful step today is to treat every unexpected message about this breach as suspect. Get information only from Quest’s official notice or phone number, and check your bills, EOBs, and credit reports for activity you don’t recognize.

FAQ

Was my information exposed in the Quest Diagnostics breach?

Quest has not disclosed how many patients were affected. It says it will send notification letters to affected patients once its investigation identifies them.

What is Quanum Lab Services Manager?

Quanum LSM is a Quest system that healthcare providers use to place lab test orders and to receive and look up results. Quest describes it as a system its clients use, so patients’ records can be in it when their provider orders tests through it.

Will Quest offer free credit monitoring?

Quest’s notice says its letters will describe available resources, including credit and identity monitoring. Enrollment details have not been published, so verify any offer through Quest’s official channels.

Is this related to the 2019 Quest data breach?

No. The 2019 breach happened at AMCA, a third-party billing collections vendor. The 2026 incident involves Quest’s own Quanum LSM system.

The post Quest Diagnostics Data Breach Exposes Patient Records: How to Stay Safe appeared first on McAfee Blog.

Capcom, the Japanese publisher behind Street Fighter, Resident Evil, and Monster Hunter, confirmed on October 22, 2026, that an unauthorized third party accessed records tied to more than 11.7 million CAPCOM ID accounts worldwide. According to the company’s official notice, the exposed data includes email addresses and account details such as creation dates, login counts, and the IP address used at last login. Capcom says credit card information was not affected, and it is warning players about fraudulent messages that impersonate the company.

How the CAPCOM ID Breach Happened and What Was Exposed

Unauthorized access to CAPCOM ID, a free player account for games such as Street Fighter 6, was detected on October 19, 2026, and blocked on the same day. The company reported the incident to police and Japan’s Personal Information Protection Commission on October 21.

Most of the 11.7 million records held only an email address and basic account activity: creation date, last login, login count, and last-login IP address. Forty-three records also included a date of birth, gender, country or region, and nickname. The attacker also changed passwords on 196 accounts, which Capcom has since reset, and used 19 of them to view e-Capcom store profiles in Japan with names, addresses, phone numbers, birth dates, and purchase histories, according to an October 23 update.

Capcom says credit card information was not affected and it has not confirmed that customer-set passwords were compromised. Its investigation is complete, and it will notify affected customers.

Why Phishing Is the Bigger Risk

Capcom warns that the exposed data could be used in emails, texts, or calls impersonating the company. A message that quotes your real email address, account creation date, or last login can look convincing because those details are accurate. Scammers use that credibility to steer players to fake login pages or to request passwords, one-time codes, or payment details, which they can use to take over accounts or commit fraud.

Gamers are a regular target. Every major game launch brings a noticeable increase in gaming-themed scams, including phishing pages posing as gaming platforms, according to McAfee’s August 2026 report on gaming scams. McAfee Labs also recently reported on WeedHack, malware disguised as free Minecraft clients and mods, that has infected more than 116,000 gamers.

Warning Signs of CAPCOM ID Phishing

Watch for messages that use the breach as a hook. Common red flags include:

Red Flag	Why It Matters
An unexpected email or text about your CAPCOM ID, a password reset, or account suspension	The breach gives scammers a believable reason to contact you.
Your real account details used as “proof”	Creation dates, login counts, and IP addresses were exposed, so knowing them does not prove a message is from Capcom.
A link or attachment urging you to “verify” or “secure” your account, especially from a look-alike domain	Capcom advises customers not to open links or attachments in suspicious messages.
A request for your password, a one-time code, or payment card details	Attackers use these to take over accounts or commit fraud.
Offers of free in-game currency, DLC, or compensation for the breach	Freebies tied to a breach are a common lure to fake login pages.
An unsolicited call claiming to be Capcom support	Calls are harder to verify, and some phone numbers were exposed.

How to Protect Your CAPCOM ID and Gaming Accounts

Treat any breach-related message as suspicious until you verify it yourself, then lock down the accounts attackers would target first:

1. Verify through Capcom directly. Don’t use links in messages. Type the CAPCOM ID site address into your browser, and use only the support contacts Capcom lists in its notice, such as the Capcom customer support site. If you can’t confirm a request there, don’t act on it.
2. Change your CAPCOM ID password and any reused passwords. Capcom has not confirmed that customer-set passwords were exposed, but a new, unique password limits the damage if account details are misused. A password manager makes maintaining many unique passwords practical.
3. Secure your email and turn on multi-factor authentication. Your email controls password resets, so protect it first. Then add multi-factor authentication to your PlayStation, Xbox, Nintendo, and Steam accounts so a stolen password alone isn’t enough to sign in.

What to Do If You’ve Already Been Targeted

If you clicked a link, entered your login, or shared information with someone posing as Capcom, act now to limit the damage:

• Stop responding to the sender and don’t send any money, codes, or card details.
• Reset your passwords now, starting with your email, then your CAPCOM ID and any account that shares that password. Check your email’s recovery phone number and forwarding rules for changes.
• Call your bank or card issuer right away if you entered payment details, and ask about stopping or reversing charges.
• Review your accounts for unfamiliar purchases, linked devices, or changed settings on your game platforms.
• Consider a credit freeze with Equifax, Experian, and TransUnion if you shared your name, address, date of birth, or other identity details.
• Visit identitytheft.gov for a personalized recovery plan if your personal information was misused.
• Keep records of suspicious messages, sender addresses, phone numbers, links, and any receipts.

How to Report CAPCOM ID Phishing

Reporting helps platforms and investigators shut down phishing campaigns. In the U.S.:

• FTC: Report phishing and fraud at ftc.gov.
• FBI Internet Crime Complaint Center: File a complaint at ic3.gov if you lost money or account access.
• Capcom: Report suspicious messages and account changes through the Capcom customer support site.
• Your email provider: Use the “report phishing” or “report spam” option so similar messages get filtered.
• Local police: File a report if you lost money or were threatened.

The CAPCOM ID breach exposed contact and account details, not credit card data, so the main threat now is phishing that looks like it comes from Capcom. Don’t click links in unexpected Capcom messages. Only sign in through the official site or your game, and use a unique password with multi-factor authentication on your email and gaming accounts.

FAQ

Was my credit card information exposed in the Capcom breach?

Capcom says credit card information was not included in the affected data. That applies to both the CAPCOM ID records and the 19 e-Capcom store accounts accessed in Japan.

Were CAPCOM ID passwords stolen?

Capcom says it has not confirmed that passwords customers set themselves were compromised. However, the attacker changed the passwords of 196 accounts, which Capcom has since reset. That said, it is still a good idea to update your password, use multi-factor authorization, and avoid using the same password for multiple accounts.

How do I know if my CAPCOM ID was affected?

Capcom says it will notify affected customers. Because 11.7 million records were involved, assume your email may be on the list if you have a CAPCOM ID, and watch for phishing.

Can I still play Street Fighter 6 and other Capcom games?

Yes. Capcom says access to games and CAPCOM ID–linked services was not affected, and registered email addresses can still be used.

The post CAPCOM ID Data Breach Hits 11.7M Accounts: What Players Should Do appeared first on McAfee Blog.

Hackers stole about 8.3 million confidential tip records submitted to school safety and crime tip lines across the US and Canada, according to Nevada education officials citing media estimates. The exposed data may include names, addresses, dates of birth, and Social Security numbers. The tips were stored on P3 Global Intel, an anonymous reporting platform owned by safety software company Navigate360, which acknowledged the breach on Oct. 23, 2026, as reported by Reuters.

How the Navigate360 Breach Happened

An attacker accessed Navigate360’s P3 Global Intel system between November 2025 and March 2026 and copied confidential tips. P3 runs the anonymous reporting apps and websites behind many school safety and crime tip lines. According to an April 2026 letter from U.S. Sens. Maggie Hassan and Jim Banks, Navigate360’s products are used by more than 35,000 schools and 5,000 public safety agencies.

Here is what’s known so far:

• March 2026: A hacktivist group claimed it stole 93GB of data, including millions of tips.
• 22, 2026: The Nevada Department of Education said about 10% of SafeVoice Nevada tips containing personally identifiable information were compromised between November 2025 and March 2026, in what it called a “criminal multistate cybersecurity incident.”
• 22, 2026: Toronto Crime Stoppers said it had frozen its operations after CBC reported that more than 1.5 million Canadian Crime Stoppers tips, some dating back 25 years, were exposed. The stolen data had been made available to journalists and researchers by the transparency group Distributed Denial of Secrets in March, according to The Record.
• 23, 2026: Navigate360 publicly acknowledged the breach and said sensitive personal data may have been exposed.

Tip records are different from most breached data. A single tip can include the tipster’s details, a student’s name, a description of another person, and sensitive details such as medical information. Nevada says it cannot notify everyone directly because SafeVoice tips are anonymous, so many affected people may never receive a letter.

Exposed personal data often fuels follow-up scams. Americans already receive an average of 14 scam messages a day across text, email, and social media, according to McAfee’s State of the Scamiverse report (January 2026). Breach news gives scammers a fresh, believable pretext to add to that volume.

Red Flags After the Navigate360 Breach

Watch for messages that use this breach as a hook:

• A text or email about “your tip” or “your SafeVoice report” with a link: Scammers copy breach news to steer people to fake claim or login pages.
• A caller who says they’re from Navigate360, a school, or police and asks for your SSN or bank details: Legitimate breach notifications don’t ask for payment, and you should never give your full SSN to an unsolicited caller.
• A demand for payment to “remove” your tip or keep it private: No legitimate organization charges to protect leaked data. This is extortion or a scam.
• Someone who knows details from a tip you submitted: This may mean your tip was exposed. Treat it as a possible safety issue, not just a scam.
• New credit accounts, inquiries, or tax notices you don’t recognize: These are signs your SSN may be in use.
• Mail or calls about credit in your child’s name: Children rarely have credit, so this activity is a warning sign.

How to Protect Yourself After the Navigate360 Breach

If you or your child ever submitted a tip through SafeVoice, a Crime Stoppers program, or another P3-powered tip line, take these steps now:

1. Use only the official notice line. Navigate360’s call center is 833-966-1754, open 6 a.m. to 6 p.m. Pacific Time, Monday through Friday, according to the Nevada Department of Education. If a message gives a different number or link, don’t use it.
2. Freeze your credit. A freeze with Equifax, Experian, and TransUnion blocks new accounts in your name. It’s free and does not affect your current accounts.
3. Freeze your child’s credit, too. Parents and legal guardians can freeze credit files for children under 16 at no cost. You’ll typically need your child’s birth certificate and Social Security card, your ID, and proof of address. Our guide on how to protect your child from identity theft walks through the freeze and other steps.
4. Check your credit reports. Get free reports at AnnualCreditReport.com and look for accounts or inquiries you don’t recognize.
5. Treat unexpected breach messages as suspect. Don’t click links or call numbers in unsolicited texts or emails. Go directly to the official source instead.
6. Turn on multi-factor authentication. Add it to email, banking, and school accounts so a stolen password alone can’t unlock them.

What to Do If Your Information Was Exposed or Misused

Act quickly if you see signs your data is being used:

• Report identity theft: Go to identitytheft.gov to get a recovery plan and an FTC Identity Theft Report.
• Contact your bank or card issuer: Call right away if you see charges or accounts you didn’t open.
• Stop contact and don’t send money: Don’t pay anyone who threatens to release your tip or demands payment.
• Change passwords: Update any account that shares a password you used with a tip app or school portal.
• Call the Navigate360 line: Dial 833-966-1754 to ask about the breach and available help.
• Keep records: Save letters, messages, phone numbers, and any accounts or charges you dispute.
• Contact police: File a report if anyone threatens or harasses you over a tip.

How to Report Navigate360 Breach Scams and Identity Theft

If you encounter suspicious activity, potential scam communications, or identity theft related to the breach, it is essential to report it promptly to the appropriate authorities. Reporting assists law enforcement in tracking fraudulent schemes and protects others from falling victim. Use these official channels:

• Identity theft: identitytheft.gov
• Scam messages or calls: FTC at reportfraud.ftc.gov
• Online fraud or extortion: FBI Internet Crime Complaint Center at ic3.gov
• Threats to your safety: Your local police department

While learning about a potential breach can be unsettling, taking a few proactive steps can go a long way in securing your personal information. If you or your child have ever used SafeVoice, Crime Stoppers, or another P3-powered tip service, freezing your credit files is an effective measure to help keep your family protected. As always, stay vigilant and verify any unexpected messages referencing your tip through official channels.

FAQ

Is SafeVoice Nevada still safe to use?

Navigate360 told Nevada that SafeVoice “remains fully operational and available 24/7.” The state has also opened a request for information to evaluate other vendors, according to the Nevada Department of Education.

What information was exposed in the Navigate360 breach?

Navigate360 said names, addresses, dates of birth, Social Security numbers, and other sensitive information may have been exposed. What was exposed varies by tip.

Which states were affected by the Navigate360 breach?

As of Oct. 27, 2026, Nevada is the only US state that has publicly quantified its impact. Canadian Crime Stoppers programs were also affected. Navigate360 has not published a full list.

The post Navigate360 Breach Exposes Millions of Anonymous Tips: How to Protect Your Family appeared first on McAfee Blog.

Two serious security holes were found in PHP, the behind-the-scenes software that powers a large share of the websites you visit every day. Fixes went out on Oct. 21, 2026. Until each website installs them, attackers could use the holes to take over the computers that run those sites and grab the passwords and data stored there.

For most people, there is nothing to install on your phone or computer. Website owners and hosting providers are responsible for installing the fix. You can still take steps to protect your accounts in case a site you use is compromised.

The PHP security team announced the two flaws, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), in an Oct. 21 security advisory and rated both 9.2 out of 10 for severity. The UK’s National Cyber Security Centre warned that “organisations using any version of PHP are affected.” PHP runs about 69.7% of websites whose server-side programming language is known, according to W3Techs data cited by Infosecurity Magazine.

What Is PHP?

PHP is a programming language that runs behind the scenes on many websites. When you log in to an account, add something to a shopping cart, or post a comment, PHP is often the software doing that work on the website’s computer, called a server. It runs on servers, not on your phone or laptop. Many popular website builders, including WordPress, Drupal, and Joomla, are built on PHP.

How the PHP2Shell Vulnerability Works

Both flaws stem from errors that occur while PHP is processing a request from a website visitor. When PHP fails partway through, it can leave data from that request behind in the server’s memory. Attackers can trigger these errors deliberately and exploit the leftover data to gain access to the server.

Both flaws involve how PHP cleans up after handling a request. According to PHP’s Oct. 21 advisory:

• CVE-2026-109618: When PHP runs out of memory at the wrong moment, it can stop while data is only partly set up, then treat that incomplete data as valid.
• CVE-2026-109619: After an error, PHP can keep a reference to memory it has already released, and a later request handled by the same server process can reuse it.

To exploit the flaws, an attacker sends specially built requests to a website and does not need a password. That can expose passwords, digital keys, and other secrets stored in the server’s memory, or let the attacker run their own commands on the server. Wiz Research showed the attack working against WordPress, Drupal, and Joomla sites.

Information about the flaws leaked online on Oct. 20, a day before the fixes came out, according to the PHP Foundation. Cloudflare said it saw attack traffic aimed at its customers after the leak. For a short window, PHP2Shell was effectively a zero-day threat, meaning attackers knew about it before a fix existed.

Artificial intelligence helped find the flaws. OpenAI said the research firm Calif used one of its AI models to find one of them, and Wiz independently found both with help from AI tools.

How the PHP Exploit Could Affect You

The main risk to you is indirect: a website you use gets hacked before it installs the fix. Think of it like a store whose back door was left unlocked. You didn’t do anything wrong, but your information inside the store could still be taken.

If an attacker breaks into a site’s server, they could:

• Steal account information, such as usernames, email addresses, and passwords stored on that site.
• Grab the site’s own keys and passwords, which attackers can use to reach other systems that hold customer data.
• Change what the site shows you, because whoever controls the server controls the pages it sends.

You may also notice some sites going offline for a while. Some Dutch government and education sites went down, and the HR software company BambooHR took its service offline as a precaution. A site going offline doesn’t by itself mean your data was stolen.

Attackers moved quickly. Amazon Threat Intelligence reported that one of its decoy servers caught an attack attempt on Oct. 17, four days before the flaws were made public, and said PHP2Shell “is now seeing broad exploitation attempts in the wild.” One web hosting platform blocked more than 60,000 suspicious requests probing the flaws by the evening of Oct. 21, according to The Hacker News. As of Oct. 23, no successful break-ins had been publicly confirmed, according to SecurityWeek.

Warning Signs to Watch For

You can’t see whether a website runs PHP or has been patched. What you can watch for are signs that a site you use was affected, or that scammers are using the news to trick you. McAfee’s guide to recognizing a phishing email covers more of the tricks to look for.

Red Flag	Why It Matters
A message telling you to download a “PHP update” or “PHP2Shell patch” for your phone or computer	PHP runs on website servers, not personal devices. A message like this is a scam.
An email from a company saying your data may have been exposed	The site may have been breached. Act on it, but log in by typing the site’s address yourself instead of clicking the link.
Password reset emails or login alerts you didn’t request	Someone may be trying to use stolen login details.
A familiar site suddenly asks for unusual information or tries to download a file	The site may have been tampered with. Leave it and check the company’s official channels.
Charges you don’t recognize on a card you used with an online store	Payment details may have been stolen.

How to Protect Yourself

You can’t patch other people’s websites, but you can limit the risk to yourself if one of them is breached. These steps help with PHP2Shell and with data breaches in general.

1. Use a different password for every account. If one site leaks your password, attackers can’t use it to get into your other accounts. A password manager can create and remember them for you.
2. Turn on multi-factor authentication. It adds a second step, like a code sent to your phone, so a stolen password alone isn’t enough to get in.
3. Set up alerts with your bank and card issuer. Text or email alerts for new charges let you spot fraud the day it happens, instead of weeks later on a statement.

If you run a personal blog or small business website: Ask your hosting company to confirm that PHP is updated to version 8.5.12, 8.4.27, 8.3.36, 8.2.35, or newer. Updating WordPress or your plugins is not enough on its own, according to Cloudflare, because the fix has to be made to PHP itself. If your site runs an older PHP version, ask your host to move it to a supported one.

What to Do If Your Information Was Exposed

If a company tells you your data may have been exposed, act quickly. Being caught up in a breach is not your fault, and these steps can limit the damage.

• Change your password for that site, and on any other account where you used the same one.
• Turn on multi-factor authentication for that account and for your email.
• Call your bank or card issuer if payment details may have been exposed, and ask about freezing or replacing the card.
• Consider a free credit freeze with Equifax, Experian, and TransUnion. It stops anyone from opening new credit in your name.
• Go to IdentityTheft.gov if your Social Security number or other identity details were exposed. It creates a step-by-step recovery plan.
• Keep records of the breach notice, any suspicious messages, and any charges you dispute.

How to Report It

If you lost money or think someone is using your information, report it:

• FTC: ReportFraud.ftc.gov for scams and fraud
• FBI Internet Crime Complaint Center: ic3.gov for online crime, including hacked websites
• Identity theft: IdentityTheft.gov
• Your bank or card issuer: for any unauthorized charges
• Local police: if you lost money or were threatened

PHP2Shell is a problem that website owners have to fix, but it can still impact your accounts if a site you use is breached. The most important thing you can do is use a unique password and multi-factor authentication for every account, so one breach doesn’t expose the rest.

FAQ

What is PHP2Shell?

PHP2Shell is the nickname for two serious security flaws in PHP, software that runs behind the scenes on many websites. Fixes were released on Oct. 21, 2026.

Do I need to update my phone or computer?

No. PHP runs on website servers, not personal devices, so the fix is up to website owners. Any message telling you to install a “PHP update” on your device is a scam.

Is my information at risk?

It could be, if a site you use was hacked before it installed the fix. Watch for breach notices from companies you do business with, and use unique passwords and multi-factor authentication.

How do I know if a website I use was affected?

You can’t tell by looking at a site. Companies that find a breach may notify you by email or post an update on their official website. Check the company’s site directly rather than trusting a link in an email.

Has the PHP exploit been used in real attacks?

Yes. Security firms including Amazon and watchTowr have reported widespread attack attempts, and Amazon saw one as early as Oct. 17, before the fix was public. No confirmed break-ins had been publicly reported as of Oct. 23.

The post PHP2Shell Leak Sparks Emergency Fix for Software Behind Most Websites: How to Stay Safe appeared first on McAfee Blog.

Digital certificates function like digital passports, confirming to your browser that a website is genuine so it can set up an encrypted connection for the information you send. On October 20, 2026, Ars Technica reported that eight intermediate digital certificates were compromised due to weak private signing keys. This vulnerability created a window where bad actors could forge credentials, impersonate legitimate websites, and intercept sensitive web traffic across the internet.

The TLS Certificate Vulnerability: What Happened and the Risks to Your Data

When you visit a secure website, like your bank, email provider, or healthcare portal, your web browser inspects the site’s digital certificate, often called an SSL certificate, to confirm you are connecting to the real service rather than an imposter. These certificates rely on cryptographic keys generated by authorized Certificate Authorities. When those keys are generated properly, each one is an enormous random number, far too large for anyone to guess. The danger comes when that randomness breaks down.

On October 17, 2026, a security researcher checking the Common CA Database discovered that eight subordinate certificates issued by Indian authority eMudhra relied on private keys between 3 and 8 bits in size. The researcher reported the flaw to Apple, Google, Microsoft, Mozilla, and eMudhra, and Mozilla made the incident public on October 20 on its Dev Security Policy forum. Keys of this type normally carry about 384 bits of randomness, but one of these compromised keys was generated as the number “4.”

With keys that weak, unauthorized actors could easily discover them and generate counterfeit security certificates for virtually any website. If an attacker positioned themselves between you and the internet, such as on a public Wi-Fi network, they could launch a man-in-the-middle attack. During this attack, your browser would mistakenly trust the fraudulent connection, exposing entered passwords, messages, and personal information.

There is no public evidence that anyone used these keys to forge certificates, and eMudhra says none of the affected certificates were used to issue certificates to websites. However, the weak keys existed from April 2025 until the flaw was reported in October 2026, so no one can say for certain that they went unnoticed for those 17 months.

Warning Signs of an Insecure Connection

A certificate forged with one of these keys would look legitimate to any device that hasn’t received the block, so there may be no visible warning at all. That’s why updates are your main defense. Still, these signs can point to an intercepted or unsafe connection:

• Sudden browser security warnings: On an updated device, a site using one of the blocked certificates triggers alerts like “Your connection is not private.”
• Repeated login requests: Prompts demanding credentials on websites where your browser normally keeps you signed in.
• Unexpected account security alerts: Emails or texts about sign-ins, password changes, or new devices you don’t recognize.
• Address bar discrepancies: URLs that switch from HTTPS to HTTP, or subtle typos in web addresses.
• Suspicious Wi-Fi networks: Networks with names nearly identical to a legitimate one, or that ask for personal details before you can connect.

How to Protect Yourself From Insecure Connections and Man-in-the-Middle Attacks

Google, Mozilla, Apple, and Microsoft have all blocked the compromised certificates. Chrome and Firefox blocked them on October 17, the day the flaw was reported. Android devices received a block on October 19, and Apple and Microsoft devices followed on October 19 and 20. Most browsers are now protected, but apps and older devices that don’t get regular updates may still trust the bad certificates. Keeping everything up to date closes that gap:

• Keep your web browser up to date. Browsers receive lists of blocked certificates automatically, but installing any pending update and restarting your browser makes sure you have the latest protections.
• Install all pending operating system updates. Operating systems maintain internal certificate trust stores. Updating your phone, tablet, and computer helps non-browser apps, including mobile banking and email clients, reject compromised certificates. Older devices that no longer receive updates are the most exposed.
• Avoid public Wi-Fi for sensitive activities. Man-in-the-middle attacks require access to your shared network path. When accessing sensitive accounts, mobile cellular data or a private home network you control is generally safer.
• Heed certificate warnings. If your browser blocks a page due to an invalid certificate, close the tab immediately rather than clicking past the warning screen.

What to Do If You’ve Already Been Targeted

If you have reason to believe you entered sensitive information over an untrusted or intercepted connection, act quickly to secure your data and accounts:

• Disconnect and update passwords: Disconnect from the suspicious network immediately. Using a separate, secure connection, change passwords for any accounts accessed during that session and enable multi-factor authentication (MFA).
• Notify your financial institutions: Monitor your bank and credit card accounts for unauthorized transactions, and notify your card issuer if financial details were entered.
• Set up a credit freeze: Contact the three primary credit bureaus (Equifax, Experian, and TransUnion) to freeze your credit files if personal identifying details were exposed.
• Document and begin identity recovery: If sensitive personal data was compromised, create a personalized recovery plan through IdentityTheft.gov.

How to Report Suspicious Online Incidents

You can report suspicious cyber activity to official consumer protection agencies. File an incident report with the FBI Internet Crime Complaint Center (IC3) or submit a fraud complaint to the Federal Trade Commission (FTC).

Broad infrastructure vulnerabilities demonstrate why digital security requires cooperation across every layer of the internet. While global security teams and certificate authorities identify and revoke flawed credentials at the root level, taking simple personal actions, such as applying system updates and maintaining healthy browsing habits, goes a long way toward keeping your personal devices secure.

The post Flawed Certificates Left Web Traffic Open to Interception: How to Stay Safe appeared first on McAfee Blog.

An international law enforcement operation has dismantled a cybercrime ring responsible for sending more than one billion scam messages to mobile phones and inboxes worldwide. On October 14, 2026, Microsoft collaborated with global police agencies, healthcare defense groups, and cybersecurity partners to seize the servers, web domains, and digital toolkits fueling the fraudulent campaigns. The coordinated operation severed a critical pipeline that criminals relied on to steal passwords, financial credentials, and personal information across the globe.

Authorized by an emergency seizure warrant from the U.S. District Court for the Southern District of Florida, the coordinated disruption dismantled “YAM Store” (tracked as Storm-3119), an underground marketplace selling stolen corporate cloud environments. The operation also took down three affiliated turnkey phishing kits—the Iron Man System (tracked as Storm-2990), CoGUI, and Haozi—which contained over 2,335 malicious templates. In total, investigators deactivated more than 20,000 illicit cloud accounts, blocked 100,000 deceptive web domains, and disrupted attack infrastructure that had targeted over 75,000 organizations across more than 150 countries.

How the Phishing Syndicate Operated

According to technical analysis from Microsoft Threat Intelligence, the syndicate operated as a full-service underground business, providing buyers with everything required to execute large-scale phishing attacks. The criminal supply chain operated across five primary phases:

1. Account Acquisition: Operators acquired abandoned internet domains from legitimate businesses, re-registered them to pass security checks, and fraudulently established genuine Microsoft 365 and Google Workspace accounts.
2. Turnkey Toolkits: The syndicate bundled these verified enterprise accounts with automated phishing platforms like the Iron Man System, which provided prebuilt templates mimicking trusted banks, package carriers, and government agencies.
3. Mass Distribution: Buyers sent waves of text messages and emails from authentic cloud environments, allowing their lures to bypass standard spam filters.
4. Credential Harvesting: When recipients clicked lure links, malicious proxy servers captured entered login passwords, authentication codes, and payment details in real time.
5. Asset Laundering: Stolen funds and marketplace subscription fees were moved through cryptocurrency exchanges, where researchers at TRM Labs helped track and freeze illicit digital assets.

Why Recognizing These Phishing Lures Still Matters

The seizure of YAM Store dealt a major blow to a global cybercrime network, immediately taking hundreds of thousands of active fraud domains offline. However, the commercial model behind these attacks remains intact across the broader threat landscape. As automated kits lower the technical barrier to entry, rogue actors can easily purchase replacement infrastructure to launch new campaigns. Recognizing the difference between how these scammers act and how a legitimate organization behaves can help you spot future variations of these phishing schemes. 

Attack Vector	Common Pretext	Scammer Red Flag	Legitimate Entity Behavior
SMS (Smishing)	Unpaid parking tickets, traffic violations, or municipal road tolls.	Demands immediate payment via an included shortened link to avoid license suspension.	Municipal agencies send citations via postal mail and direct payments to an official government portal.
SMS or Email	Package delivery exceptions (e.g., postal services, FedEx, or UPS).	Claims a package cannot be delivered until an administrative fee (typically $1.50–$5.00) is paid online.	Parcel carriers provide tracking numbers verifiable directly on their official mobile app or primary website.
Email	Corporate account or cloud storage password expiration warnings.	Demands you verify login credentials within 24 hours through an external sign-in form.	Legitimate enterprise platforms manage credential resets within secure internal system settings, not via external forms.
Payment Screen	Fake banking verification or credit card confirmation forms.	Requests two-factor authentication codes, debit PINs, or full billing details on an unfamiliar domain.	Financial institutions never prompt for PINs or temporary codes on third-party payment redirect pages.

How to Protect Yourself from Emerging Phishing Schemes

Because accessible phishing kits make it easy for scammers to replace dismantled networks, staying safe requires consistent verification habits and practical safeguards:

• Navigate independently to official service portals. Never click links inside unexpected text messages or emails regarding parking fines, road tolls, or shipping fees. Open your browser and navigate directly to the verified agency or company website.
• Check the full website address in your browser. Scammers frequently register web addresses that look nearly identical to authentic brands by changing a single letter. Confirm that the URL in your browser bar matches the organization’s official domain before typing any information.
• Switch to an authenticator app for account logins. Instead of receiving login verification codes through SMS text messages, consider using an authenticator app on your phone. Phishing pages can capture texted six-digit codes in real time, but app-based verification makes it much harder for scammers to intercept your account access.
• Verify delivery notifications using your original tracking number. If you receive a message claiming a package is delayed, locate your original purchase confirmation and enter the tracking number directly into the delivery carrier’s official website.
• Treat tiny fee requests as major red flags. Scammers deliberately ask for small sums, such as a $2.50 processing fee, to lower your guard while capturing your full credit card number, expiration date, and security code.

What to Do If You Have Already Been Targeted

If you interacted with a suspicious link, submitted account credentials, or paid a fraudulent fee, take these immediate recovery steps:

1. Sever contact immediately. Do not click further links, reply to the message, or send additional payments.
2. Contact your financial institutions. Call your bank or card issuer immediately to report unauthorized transactions, cancel compromised cards, and dispute fraudulent charges.
3. Update passwords across shared accounts. Reset credentials on any account that shared the exposed password, and select the option to sign out of all active devices in your account settings.
4. Place a credit freeze with the major bureaus. Block scammers from opening fraudulent lines of credit in your name by freezing your credit files with Equifax, Experian, and TransUnion.
5. Submit an official identity theft report. If personal identifiers such as your Social Security number or driver’s license details were submitted, file a recovery plan through the federal identity theft reporting portal.
6. Preserve evidence. Save screenshots of the scam message, sender phone number or email, website URLs, and payment records before deleting anything.

How to Report Phishing Scams

Reporting cybercrime infrastructure helps industry defenders and law enforcement track repeat patterns and build cross-border cases:

• Federal Trade Commission: Submit consumer fraud and deceptive business reports through the Federal Trade Commission complaint assistant.
• FBI Internet Crime Complaint Center: File reports involving significant monetary theft, wire fraud, or corporate account compromise with the FBI Internet Crime Complaint Center.
• Federal Communications Commission: Report spam text messages, smishing campaigns, and spoofed phone numbers through the Federal Communications Commission consumer center.
• Local Law Enforcement: File a police report with your local department if you experienced direct financial loss, as financial institutions frequently require a police report number during fraud investigations.
• Mobile Carriers: Forward deceptive text messages directly to the cellular carrier spam reporting shortcode at 7726 (SPAM).

Major takedowns disrupt criminal supply chains and hold malicious operators accountable, but the tools behind these schemes continue to evolve. Verifying unexpected payment requests directly with official organizations, monitoring your financial statements regularly, and securing your accounts with strong authentication remain dependable defenses against online fraud.

The post Global Takedown Hits Network Behind 1 Billion Scam Messages appeared first on McAfee Blog.

Financial scammers are increasingly targeting older Americans, using deceptive online platforms, high-pressure phone pitches, and complex impersonation schemes to drain hard-earned savings. While older consumers are more likely to report suspicious solicitations, those who get caught in these elaborate operations face catastrophic financial consequences. As digital payment systems and online networks evolve, organized criminal rings are extracting record amounts of capital from people preparing for or living in retirement.

On October 19, 2026, the Federal Trade Commission (FTC) submitted its annual report to Congress, Protecting Older Consumers 2025–2026, detailing the rapid escalation of this trend. The report revealed that fraud losses reported by adults aged 60 and older reached approximately $3 billion in 2025, a fivefold increase from the $600 million reported in 2020. Since most victims do not report fraud to government agencies, the FTC estimates actual losses for older adults in 2025 ranged between $13.3 billion and $119.5 billion.

How Fraud Schemes Target Older Adults

The sharp rise in elder fraud is largely propelled by a surge in massive, individual six-figure losses. Combined losses from older adults who lost $100,000 or more increased nearly sevenfold between 2020 and 2025. While these severe losses represented only 6% of loss reports filed by older adults in 2025, they accounted for 70% of the entire $3 billion total.

Analysis of consumer reports reveals that these catastrophic losses were concentrated in these specific scam categories:

Investment Scams Promoted on Social Media

Investment fraud was the costliest category for older consumers in 2025, with $1.06 billion in reported losses, a 42% jump. Scammers use social media to pitch fake crypto, stock, or automated trading platforms, directing targets to fraudulent sites displaying falsified account balances. When victims request withdrawals, operators demand bogus “taxes” or “administrative fees” before freezing accounts.

Government and Business Impersonation Schemes

Government and business impersonators drew $870 million in losses ($448M government, $422M business). Government imposters claim bank accounts are tied to crime, while business imposters pose as bank or tech support fraud departments. Both fabricate urgent crises, coercing victims to transfer money to “protective custodial accounts” or government “lockboxes.”

Romance Scams That Exploit Trust

Romance scams caused $384 million in reported losses among older adults in 2025 (up 17%). Fraudsters build trust over weeks or months via social media or dating apps before fabricating urgent emergencies—like medical bills or foreign travel issues—to request repeated money transfers.

Prize, Sweepstakes, and Lottery Schemes

Prize and lottery scams cost older adults $143 million in 2025. Scammers contact targets via phone, mail, or online, claiming major prize wins from known brands but requiring upfront processing fees or taxes to release funds.

Tech Support Deception

Older consumers were over four times (324%) more likely than younger adults to report losing money to tech support scams. Alarming browser pop-ups prompt calls to fake technicians who gain remote access to computers and charge high fees for unneeded services.

Irreversible Payment Methods That Fuel the Losses

While credit cards were the payment method most frequently used by older adults (accounting for 28% of loss reports), payment channels that cannot be easily recalled accounted for the largest aggregate dollar amounts. Bank transfers and payments accounted for over $1.03 billion in reported losses, while cryptocurrency transfers totaled $603 million. In impersonation and sweepstakes scams, criminals also routinely demand payment through retail gift cards, direct bank wires, physical cash sent via couriers, or cash deposits into automated Bitcoin kiosks.

The table below details the top six fraud categories ranked by total reported dollars lost by older adults (ages 60 and older) in 2025, alongside the year-over-year percentage change compared to calendar year 2024.

Fraud Category	2025 Reported Losses (Age 60+)	Change from 2024	2025 Loss Reports	Common Tactic
Investment Scams	$1.059 billion	+42%	10,578	Counterfeit crypto dashboards and fake trading platforms.
Government Imposters	$448 million	+20%	12,183	Threats of arrest or asset seizure to force money transfers.
Business Imposters	$422 million	+12%	24,820	Fake bank fraud alerts directing funds to “safe” accounts.
Romance Scams	$384 million	+17%	6,832	Fabricated emergencies or joint investment pitches from online partners.
Prizes, Sweepstakes & Lotteries	$143 million	-1%	5,280	Upfront fee demands to release fake winnings.
Tech Support Scams	$126 million	-21%	5,334	Browser pop-ups prompting calls to bogus technicians.

Warning Signs of Elder Scams

Federal agencies participating in the nationwide Never Ever campaign, led by the FTC, the Department of Justice (DOJ), and the Department of Health and Human Services (HHS), have identified clear warning signs that expose fraudulent communications.

• Demands to transfer money to “protect” it: Legitimate banks and government agencies never tell you to move your funds into a separate account, a crypto kiosk, or a temporary vault to keep it safe from fraud.
• Insistence on specific, unusual payment methods: Demands to pay using retail gift cards, cryptocurrency, money-transfer apps, bank wires, or envelopes of cash collected by a courier are red flags that you may be dealing with a scam.
• Demands for complete secrecy: Fraudsters often order you to stay on the line, instruct you not to speak with family members, and supply fake cover stories to recite to bank tellers during cash withdrawals.

How to Protect Yourself and Older Relatives

You do not need to be a technical expert to guard against these schemes. Following five straightforward habits can help protect household savings from scams:

1. Hang up and call a number you know is real. If you get a call or text claiming your bank account, credit card, or Social Security number is in danger, hang up immediately. Do not press any buttons or call back the number that contacted you. Pick up your physical debit card, credit card, or an official paper statement, and call the customer service phone number printed on the back.
2. Talk to a family member or friend before you pay. Scammers rely on panic to make you act before you have time to think. Make it a personal rule to discuss any unexpected financial request, sudden investment tip, or prize notification with a trusted relative, neighbor, or bank employee before you authorize any transfer.
3. Refuse all requests to buy gift cards or use Bitcoin machines. If anyone on the phone tells you to go to a retail store to buy gift cards, or asks you to deposit cash into a Bitcoin ATM to clear a bill or protect your savings, stop. Legitimate businesses and government offices do not accept payment through these methods.
4. Restart your computer if an alarming warning screen appears. If your screen suddenly freezes with loud alarms or an urgent warning saying you are hacked, never call the phone number shown. Press and hold your computer’s power button until everything turns completely off, wait 30 seconds, and turn it back on. When you reopen your internet browser, click “Cancel” or the “X” if it asks to restore your previous pages.
5. Let unfamiliar phone calls go to voicemail. Scammers can alter the name and phone number that appear on your phone screen to look like a local courthouse, police department, or bank. Let calls from numbers you do not recognize go to voicemail. If a matter is truly legitimate, the organization will leave a message and send official mail.

What to Do If You Have Already Been Targeted

When money has been sent or sensitive personal details have been disclosed, acting promptly improves the chances of limiting damage and recovering funds:

• Cut off all communication: Discontinue every phone call, text exchange, and email thread with the scammer. Never send additional money to “release” previously transferred funds or pay supposed “withdrawal fees.”
• Contact your financial institutions immediately: Call your bank, credit union, or credit card company. Request an immediate recall on any recent wire transfers, flag fraudulent debit or credit charges, and ask the bank to secure your accounts.
• Request the Financial Fraud Kill Chain for wire transfers: If you sent a significant bank wire within the last 72 hours, submit a report immediately to the FBI Internet Crime Complaint Center. The FBI’s Recovery Asset Team works directly with domestic and international financial networks to freeze fraudulent wire transfers before they settle. In 2025, this process helped freeze $679 million in stolen funds.
• Contact the National Elder Fraud Hotline: Call the DOJ’s free hotline at 1-833-372-8311. Staffed by the Office for Victims of Crime, case managers provide direct support, help you organize reporting documentation, and connect you with local and federal resources.
• Place a security freeze on your credit reports: Restrict identity thieves from opening new lines of credit by freezing your credit files directly with the three national credit bureaus: Equifax, Experian, and TransUnion.
• Report identity exposure: If you provided your Social Security number, banking details, or driver’s license number, go to IdentityTheft.gov to receive a customized recovery plan.
• Preserve all records: Save written notes, phone numbers, text messages, emails, bank transfer confirmations, and cryptocurrency wallet transaction receipts to share with investigators.

How to Report Elder Fraud

Reporting scam attempts provides law enforcement agencies with the evidence required to identify criminal syndicates, freeze illicit assets, and bring enforcement actions. In fiscal year 2026, FTC enforcement actions resulted in more than $513 million returned to consumers of all ages.

Submit incident details through these official reporting portals:

• Federal Trade Commission: Submit reports through the FTC Fraud Reporting Portal, which feeds directly into the secure Consumer Sentinel Network used by thousands of law enforcement agencies nationwide.
• FBI Internet Crime Complaint Center: Report internet fraud, cryptocurrency theft, and wire transfers to the FBI Internet Crime Complaint Center.
• Federal Communications Commission: Report phone number spoofing and unlawful automated calls to the FCC Consumer Complaint Center.
• Local Police or Sheriff’s Department: File a formal police report with your local law enforcement agency. Banks frequently require a copy of an official police report to process fraud disputes.
• Specific Government Agencies: Report calls from Social Security imposters directly to the Social Security Administration Office of the Inspector General, and report tax-related scams to the Treasury Inspector General for Tax Administration.

Federal enforcement actions continue to target the infrastructure that enables these operations. In fiscal year 2026, the FTC secured a settlement requiring payment processor Nuvei to turn over $4.85 million for processing transactions for an overseas tech-support scheme that impersonated major US brands. The FTC also took action against operations like American Tax Service, requiring defendants to surrender nearly $10 million in cash and assets for running deceptive tax-debt telemarketing targeting older adults. Staying informed, hanging up on unsolicited calls, and checking in with loved ones remain the most dependable defenses against these escalating threats.

The post Elder Fraud Losses Surge to $3B: FTC Report and Prevention Tips appeared first on McAfee Blog.

The California Department of Education (CDE) announced on October 16, 2026, that unauthorized actors accessed an Educational Testing Service (ETS) server, compromising the educational and demographic records of millions of California public school students. The breach occurred between May 22, 2026, and September 18, 2026, exposing student names, dates of birth, home addresses, disability records, and state assessment scores across three academic years.

While state officials confirmed that Social Security numbers and financial account details were not accessed, exposed personal files elevate the risk of secondary phishing attacks, fraudulent account creation, and child identity theft.

Why did I get mail from Educational Testing Service?

If you received a letter from Educational Testing Service (ETS) about a data breach, it’s likely because you or your child may have been affected by a cybersecurity incident involving California public school student records.

ETS administers standardized tests for California schools, including the CAASPP and ELPAC assessments. Even if you’ve never interacted directly with ETS, the organization may have processed your child’s information through their school.

Following the 2026 ETS data breach, affected families are being notified about potentially exposed personal information, including student names, birth dates, addresses, and academic records.

Is the Educational Testing Service letter legitimate? If you’ve received a data breach notification, don’t ignore it, but verify its authenticity before sharing personal information or following instructions. Visit the official California Department of Education website to confirm details about the breach and available identity protection services.

How the ETS Data Breach Happened

Unauthorized actors used compromised login credentials to gain illicit access to a Secure File Transfer Protocol (SFTP) server operated by ETS. Educational Testing Service administers statewide standardized testing assessments for California public schools, including the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC).

ETS identified the unauthorized file access on September 25, 2026, and notified school districts on October 2, 2026, before coordinating a public disclosure with the state. An internal investigation confirmed that intruders copied student files intermittently across a four-month window.

What Student Data Was Exposed in the Breach

The scope of exposed data varies by student, but involves records dating back through the 2023–2024 academic year:

Data Category	Exposed in ETS Breach?	Details
Basic Identifiers	Yes	Full student name, date of birth, home address, and school attended
Academic Identifiers	Yes	Statewide Student Identifier (SSID) and standardized test scores
Demographic & Special Records	Yes	Demographic profiles, disability records, and program eligibility files
Social Security Numbers	No	Confirmed not stored on the compromised SFTP server
Financial & Payment Data	No	No credit cards, banking data, or parent billing files were involved
Parent/Guardian Personal Data	No	Contact information and parent personal records were excluded

Because Social Security numbers were not taken, scammers cannot automatically establish traditional lines of credit overnight. However, bad actors frequently bundle basic demographic data with records from other breaches to assemble synthetic profiles or craft convincing spear-phishing schemes aimed at families.

Warning Signs of Child Identity Theft After the Breach

Data breach exposures involving children often manifest months after the initial intrusion. Watch for these indicators that an affected student’s personal information may be circulating among scammers:

• Unsolicited calls, texts, or emails claiming to be from ETS or school officials: Legitimate state agencies will not call or text asking for your child’s Social Security number or payment to receive breach protections.
• Credit offers and pre-approved cards addressed to a minor: Children rarely have credit files, so pre-approved cards, loan offers, or rewards enrollments indicate an active file exists.
• Government and agency notices in your child’s name: Warning letters from the IRS about unpaid taxes, notifications regarding state benefits, or jury duty summonses for a minor signal identity misuse.
• Calls from collection agencies: Debt collectors demanding payment for opened utility accounts, cell phone contracts, or medical services in a student’s name point to fraudulent accounts.
• School enrollment or testing discrepancies: Notifications from educational institutions regarding unauthorized transfers, unknown state test submissions, or modified student records.

How to Protect Yourself and Your Child

Take the following concrete defensive steps to protect your child’s personal data from being weaponized:

1. Activate the state-provided identity protection coverage. ETS is offering two years of complimentary identity monitoring through Experian IdentityWorks. Parents can enroll eligible minor children at Experian IdentityWorks for Minors using the activation code provided in the official CDE breach notification.
2. Place a credit freeze on your child’s credit file. Federal law allows parents and legal guardians to freeze a credit file for children under 16 at no cost to prevent unauthorized accounts from being opened. Contact each of the three credit bureaus (Equifax, Experian, and TransUnion) directly to request a minor freeze.
3. Apply a verification test to all breach-related outreach. Scammers exploit news of large breaches to pose as test administrators, district staff, or identity support agents. If someone contacts you seeking account verification, hang up and reach out through the official California Department of Education incident portal.
4. Monitor your household’s digital accounts. Update passwords across school portal logins, parent-teacher applications, and family email accounts, pairing each with multi-factor authentication (MFA) using an authenticator app.
5. Check for existing credit files for older dependents. Students who are 18 or older can review their own credit reports for free every week at AnnualCreditReport.com to ensure no accounts have been opened under their names.

What to Do If Your Child’s Information Was Misused

If an unauthorized party uses your child’s personal details to open accounts, secure credit, or claim benefits, take immediate action to limit liability:

• Halt contact and refuse demands for payment: Never send funds or negotiate with debt collectors attempting to collect on fraudulent debts opened in a child’s name.
• Contact the fraud departments of involved companies: Reach out to the bank, merchant, or utility provider that issued the fraudulent account, notify them of child identity fraud, and demand written confirmation that the account is closed and cleared.
• File an identity theft report with the FTC: Submit an official declaration at IdentityTheft.gov. This creates an official Identity Theft Report required by banks and credit bureaus to remove fraudulent records.
• Demand immediate credit file purges: Send copies of your FTC Identity Theft Report and proof of minor custody to Equifax, Experian, and TransUnion, requesting the immediate deletion of all fraudulent tradelines and inquiries.
• File a police report: Contact your local police department if financial fraud, impersonation, or extortion occurred, and retain the incident report number for your financial documentation.
• Maintain complete paper trails: Log all correspondence, including dates, representative names, case numbers, and copies of collection letters.

How to Report the Threat and Stay Protected

Reporting incidents promptly assists regulatory authorities and cybersecurity investigators in tracking down threat actors and stopping systemic abuse. Use these verified channels:

• Federal Trade Commission (FTC): Report identity theft and recover an identity through IdentityTheft.gov, or submit general fraud reports to the FTC Fraud Reporting Portal.
• FBI Internet Crime Complaint Center (IC3): File cybercrime and data breach reports via the IC3 Portal.
• California Department of Justice: Access identity theft resources and state breach updates via the Privacy Enforcement and Protection Unit.
• Federal Communications Commission (FCC): Report suspicious caller ID spoofing or phishing robocalls on the FCC Complaints Center.
• California Department of Education Support Line: Families with questions regarding the ETS breach notification can contact the CDE assistance line at 833-931-8488.

Safeguarding student records requires active vigilance. By placing credit freezes, enrolling in complimentary monitoring, and questioning unexpected communications, families can minimize the risks associated with school vendor data security incidents.

The post Educational Testing Service (ETS) California Student Data Breach: What Parents Should Do appeared first on McAfee Blog.

Gen Z grew up online. But that isn’t giving them an advantage against the next generation of AI-powered scams, and the data shows it. 

More than one in three Gen Z adults reported losing money to an online scam in the past year. They’re also encountering several types of online fakes at higher rates than Americans overall, including fake social media profiles, fake recruiters, AI-generated images and deepfake-style videos.

The data points to a new reality for a generation that has spent much of its life online: Digital familiarity alone may not be enough when AI is making fake content easier to create and harder to recognize.

Here’s what we found, plus our Head of Threat Research Abhishek Karnik’s key safety takeaways for Gen Z:

 5 Online Fakes Fooling Gen Z More Often

1. Fake social media profiles: 51% of Gen Z vs. 41% of Americans overall

More than half of Gen Z adults encountered a fake social media profile in the past year, according to McAfee’s research.

In these instances, someone might impersonate a creator, brand, potential romantic partner or even a person you already know. Once contact is established, the conversation can move toward a suspicious link, request for money, investment opportunity or attempt to collect personal information.

Abhishek’s key takeaway: “Treat unexpected messages regarding requests for money or help, with some level of skepticism, even if it’s from familiar-looking accounts. Account takeovers (where a known contact’s account was compromised) and copycat accounts (impersonated accounts where someone created a similar looking profile) are often tactics used to target victims. Call your friend on a trusted number and confirm if they really need help.”

2. AI-generated images presented as real: 51% vs. 44%

AI image tools can produce realistic-looking people, products, places and events that never existed.

For scammers, that creates another way to manufacture credibility. A fake profile can have convincing photos. A fraudulent product listing can appear to show a real item. An investment or giveaway scam can be dressed up with imagery that looks legitimate at first glance.

Abhishek’s key takeaway: “Look for oddities in the images itself. AI is not always perfect and does make errors. But also look beyond the image. Check the account posting it, the surrounding context and whether reputable sources confirm the claim before acting on it.”

3. Deepfake-style videos: 40% vs. 34%

Two in five Gen Z adults said they encountered deepfake-style videos in the past year.

A deepfake is manipulated or AI-generated media designed to make it appear that a real person said or did something they didn’t. Improvements in AI mean visual oddities alone are becoming a less reliable way to identify one.

Abhishek’s key takeaway: “Not all deepfakes are bad. Some are made for entertainment. However, pause to analyze and consider what the video is asking you to do or believe.

A surprising celebrity investment pitch, urgent request for money or unbelievable announcement deserves independent verification, even when the person on screen looks and sounds convincing.”

4. Fake recruiters and job opportunities: 34% vs. 27%

For Gen Z adults entering or moving through the workforce, job hunting increasingly means interacting with people they have never met through email, social media, job platforms and messaging apps.

Scammers can exploit that normal behavior by posing as recruiters or employers. A convincing company name, professional-looking profile and friendly interview process can make a fraudulent opportunity harder to distinguish from the real thing.

Abhishek’s key takeaway: “Be cautious when a recruiter quickly asks for sensitive personal information, asks you to pay upfront costs or moves the hiring process onto an unusual platform like WhatsApp. Verify the role through the employer’s official website and independently confirm that the recruiter works there.”

5. Fake celebrity endorsements: 27% vs. 21%

AI has also made it easier to put familiar faces and voices behind claims they never made.

Fake celebrity endorsements can appear in investment scams, product promotions and giveaways. What makes them powerful is the borrowed trust. Seeing someone familiar can make an unfamiliar offer feel more credible.

Before buying, investing or sharing information, verify the endorsement through the celebrity’s official channels and independently research the company or offer.

3 Scams Hitting Gen Z’s Wallet Harder

Exposure tells us what people are seeing. Financial loss tells another part of the story.

McAfee’s research found Gen Z adults were more likely than Americans overall to report losing money to three particular types of scams:

• Package delivery scams: 25% of Gen Z vs. 18% overall
• Fake customer support scams: 24% vs. 18%
• AI-generated impersonation scams: 20% vs. 15%

Each takes advantage of an ordinary digital interaction.

Abhishek’s key takeaway: “Scams can work by fitting naturally into what someone is already doing online, making verification increasingly important before clicking a link, sending money or sharing sensitive information.”

3 Ways Job Scams Are Shaking Gen Z’s Confidence

The job market provides one of the clearest examples of how scam concerns can affect people even when they never lose money.

McAfee found:

• 65% of Gen Z adults say scam concerns have made them hesitate or avoid applying for a job online, compared with 54% of Americans overall.
• 57% have suspected a recruiter or job opportunity was fake, compared with 43% overall.
• 39% encountered a fake recruiter or job scam in the past year, compared with 31% overall.

For young adults building careers, that uncertainty can carry a real cost. A legitimate recruiter and a scammer may contact someone through the same platforms and use many of the same professional conventions.

Abhishek’s key takeaway: “Verification can help. Search for the position on the company’s official careers page, check the recruiter independently and contact the company through information you find yourself when something feels questionable.”

The Broader Scam Reality Across the U.S.

Gen Z’s experience sits inside a much bigger shift in how Americans navigate life online.

McAfee’s newest research, which combines a nationally representative survey of 5,000 U.S. adults with McAfee Labs analysis of text-based scam activity, found that 88% of Americans encountered at least one type of scam in the past year. Nearly one-third, 31%, reported losing money to one.

The effects extend beyond financial losses.

Nearly three-quarters of Americans, 74%, say they feel the need to double-check most things online before trusting them. Sixty-two percent say figuring out what is real takes more mental energy than it did a year ago. And 82% say concerns about scams have changed something they do online.

That can mean avoiding an unfamiliar retailer, ignoring a legitimate message or deciding against clicking a real link.

AI adds another layer to that uncertainty because convincing content can now be produced faster and at greater scale. As synthetic content becomes part of everyday digital life, spotting scams cannot depend entirely on whether something simply “looks fake.”

For Gen Z, the findings suggest that challenge is already especially visible. They are encountering some forms of manipulated and fraudulent content more frequently while also navigating important parts of early adult life, from finding work to shopping and managing money, online.

The post The Top 5 Scams Hitting Gen Z Harder Than the Rest of America appeared first on McAfee Blog.

A security breach at the Pentagon’s Defense Manpower Data Center (DMDC) exposed unencrypted personal and military records for approximately 3.05 million individuals between October 2025 and July 2026. First reported by Military Times on September 24, 2026, the intrusion compromised sensitive files, including Social Security numbers, belonging to active-duty personnel, veterans, and deceased service members.

With official notification letters dated September 18, 2026, now arriving in physical mailboxes, affected individuals can determine their exposure and enroll in 12 months of free credit monitoring and identity restoration services provided by the Department of Defense through IDX. Understanding the full scope of the incident, confirming whether your records were involved, and establishing immediate account and credit safeguards are essential steps to shielding military benefits and personal finances from targeted exploitation.

How the DMDC Data Breach Happened and What Data Was Compromised

The breach occurred when unauthorized actors exploited a software vulnerability in a DMDC file-sharing system, maintaining access to a server holding unencrypted personnel data for nine months. According to official notification letters mailed by the DMDC on September 18, 2026, unauthorized users accessed personal and military service files between October 2025 and July 2026.

The Pentagon did not issue a public press release prior to dispatching physical mailings. Community members first raised public awareness by sharing letter excerpts on Reddit’s r/Veterans. Pentagon officials confirmed to CNN that the breach compromised records for 2.76 million living individuals and 294,000 deceased service members.

The exposed server contained unencrypted personally identifiable information (PII) belonging to service members, veterans, and military dependents. Compromised records include full names, Social Security numbers, dates of birth, contact information, and administrative military service details.

How to Know If Your Information Was Exposed in the Pentagon Breach

The primary notification method for this incident is a physical letter sent via the United States Postal Service. The DMDC began mailing official breach notification letters dated September 18, 2026, directly to affected personnel, veterans, and surviving family members.

The Pentagon has not released an online lookup database to verify individual exposure. The incident affects individuals whose personnel, manpower, or benefits records were stored on the compromised server during the nine-month exposure window, spanning active-duty military, reserve personnel, National Guard, defense civilians, contractors, veterans, and eligible dependents.

If you have moved recently, your notification letter may be delayed or returned to sender. Log in to milConnect to confirm that your mailing address and contact details are current within the Defense Enrollment Eligibility Reporting System (DEERS). If your records were maintained in DMDC systems between October 2025 and July 2026, take proactive security steps even before a physical letter arrives.

Red Flags That Cybercriminals Are Using Your Military Data

When personal and military records leak, cybercriminals routinely use the data to stage targeted impersonation schemes and financial fraud. Watch for these warning signs:

• Government impersonation attempts: Unsolicited calls, emails, or text messages claiming to be from the Department of Defense (DOD), Department of Veterans Affairs (VA), or TRICARE requesting verification of personal identifiers.
• Benefit redirection notices: Unexpected alerts regarding direct deposit changes, login credential updates, or profile modifications across military portals that you did not initiate.
• Phony breach assistance solicitations: Unofficial communications offering expedited claims, settlements, or data removal services in exchange for an upfront fee or account numbers.
• Unexplained credit or loan activity: Inquiries on your credit report, new credit card accounts, or collection notices for debt you do not recognize.
• Unexpected tax or benefit filings: Notifications from the IRS or state tax authorities stating that a tax return or benefit claim has already been filed in your name.

How Military Personnel Can Protect Themselves

Military personnel and service members should take immediate steps to restrict access to their credit profiles and personal accounts:

1. Enroll in free credit monitoring through the official IDX portal.
   The Defense Department is offering 12 months of free credit monitoring and identity restoration services to affected individuals through IDX. If you received a breach notification letter, use the unique enrollment code included in the mailing to register on the official IDX DMDC response portal or call the support line directly at 1-855-744-4556.
2. Place a credit freeze with all three credit bureaus.
   Contact Equifax, Experian, and TransUnion to freeze your credit files. A credit freeze blocks prospective lenders from accessing your credit report, stopping identity thieves from opening loans or lines of credit with your Social Security number.
3. Enable multi-factor authentication on defense portals.
   Log in to MilConnect, VA.gov, and MyPay to update passwords and enforce multi-factor authentication (MFA). Use an authenticator app or hardware security key rather than SMS verification where available.
4. Verify official contacts independently.
   The DOD, DMDC, and VA do not initiate contact via phone, text, or email to demand immediate payment or confirmation of your Social Security number. Verify any inquiry by navigating directly to official .gov domains.
5. Inspect TRICARE and medical billing statements.
   Review Explanations of Benefits (EOBs) and medical statements closely. Confirm that all listed provider appointments, diagnostic tests, and prescription orders match care you actually received.

What Military Personnel Should Do If Their Data Was Compromised

If you received an official DMDC notification letter dated September 18, 2026, or notice unauthorized activity on your accounts, execute the following recovery steps:

• File an identity theft report with the FTC. Submit an official report through the Federal Trade Commission identity theft portal to establish your legal rights and dispute fraudulent accounts with creditors and banks.
• Obtain an IRS Identity Protection PIN (IP PIN). Prevent fraudulent tax filings using your exposed Social Security number by applying for a six-digit IP PIN through the Internal Revenue Service identity protection page.
• Place an extended fraud alert on your credit file. If you choose not to freeze your credit entirely, request an extended fraud alert, which requires lenders to verify your identity before approving credit in your name.
• Notify your financial institutions. Contact the fraud divisions of your bank and credit card issuers to review account statements, replace compromised account numbers, and set up real-time transaction alerts.
• Retain all breach correspondence. Keep physical copies of your DMDC notification letter, agency complaints, police reports, and dispute logs for ongoing tracking.

How Military Personnel Can Report Fraud and Suspicious Activity

Report security incidents, fraudulent accounts, and impersonation attempts directly through official federal reporting channels:

• Department of Defense Inspector General: Report military personnel data misuse or military identity impersonation via the Department of Defense Hotline.
• FBI Internet Crime Complaint Center (IC3): File an online cybercrime complaint regarding credential misuse or unauthorized financial compromise through the FBI Internet Crime Complaint Center.
• Local Law Enforcement: File a formal police report with your municipal department if an unauthorized party obtains loans, opens accounts, or conducts financial transactions in your name.

Because Social Security numbers and military service records cannot be readily changed, exposure from the DMDC breach presents a persistent risk for active personnel and veterans. Taking proactive security measures now, such as enrolling in the IDX identity monitoring program, locking down credit files, securing military accounts with multi-factor authentication, and reporting suspicious contact immediately, is critical to preventing long-term identity exploitation.

The post Pentagon Data Breach Impacts 3.05 Million: How Military Personnel Can Protect Themselves appeared first on McAfee Blog.

On October 6, 2026, the ASOS push notification hack sent unauthorized messages to millions of customer devices after cybercriminals accessed a connected third-party platform. ASOS, a British online fashion and cosmetic retailer serving active shoppers worldwide, confirmed that an attacker compromised employee credentials to access external systems. As reported by BBC News, the intrusion exposed customer contact records and personal search histories, although company representatives confirmed that banking and payment information was not accessed.

How the Attack and Social Engineering Breach Worked

The unauthorized messages originated from an extortion ring calling itself the Xuanyewen hacker group. The intruders hijacked the ASOS mobile shopping app interface to broadcast rogue alerts directly to users, claiming they had extracted full customer databases.

The breach did not stem from a software flaw within the ASOS mobile application. Instead, the intruders relied on social engineering, impersonating a trusted contact to deceive an employee into providing valid system credentials.

Those credentials allowed the attackers to sign in to Simon AI, a third-party marketing and personalization platform built on Snowflake Cortex AI that ASOS uses to power customer communications. Once logged in, the threat actors initiated app-wide push alerts and exfiltrated audience data containing customer personal data.

Clarifying the Snowflake Breach Claims

During the intrusion, the hackers claimed they had carried out a direct Snowflake breach to compromise ASOS’s central databases. Official statements from both platforms quickly refuted that claim.

In a corporate statement released through Snowflake’s official statement via Alliance News, a Snowflake spokesperson stated: “We can confirm this issue did not in any way result from a vulnerability, weakness, flaw, or misconfiguration with the Snowflake service… and was not caused by Snowflake.”

Independent reporting and corporate disclosures confirm that the compromise occurred exclusively at the third-party marketing integration layer. Attackers frequently target peripheral marketing tools using stolen credentials because these platforms handle live customer segments without requiring direct access to locked-down corporate networks.

Warning Signs That Your Personal Data Was Compromised

The data accessed during the incident included more than basic contact lists. As documented by BBC’s reporting, data samples provided directly by the threat actors revealed specific customer search histories, including search terms such as “reclaimed vintage.”

In the official ASOS customer breach notification, the retailer stated they did not believe that payment card numbers, banking details, and account passwords were accessed, as those are stored on separate, isolated transactional systems. However, exposed contact information and shopping preferences still present risks for targeted follow-up fraud. Watch for these warning signs that your personal data was exposed:

• Unsolicited push messages: App notifications prompting you to verify your identity, visit external chat platforms, or click unverified links.
• Tailored phishing emails: Messages referencing specific clothing brands, recent browsing queries, or recent order details designed to trick you into revealing passwords.
• Unrequested authentication codes: Password reset messages or multi-factor prompts that you did not initiate.
• Direct contact from extortionists: Unsolicited communications via email or messaging apps claiming to hold your retail browsing data.

How to Protect Your Personal Data

Taking direct defensive steps helps minimize the risk of identity theft or secondary phishing. Use these best practices to protect your personal data:

• Avoid clicking unexpected push notification links: If you receive an unexpected alert about an account security issue, dismiss the message and sign in through an official web browser instead.
• Update your account password: Create a strong, unique password for your ASOS account that is at least 12–16 characters long and not shared across any other platforms.
• Enable multi-factor authentication (MFA): Set up MFA across your primary email and retail accounts, opting for an authenticator app over SMS codes whenever available.
• Verify retailer messages independently: If you receive an email regarding an order change or account issue, visit the store’s website directly rather than using embedded links.

What to Do If Your Personal Data Was Compromised

If your personal details were exposed or you interacted with the rogue push alert, take these containment measures:

• Cease all contact with extortionists: Do not communicate with extortionists or send payments to individuals offering to delete stolen records.
• Change shared account credentials: If you used your ASOS password on other websites, update those services with unique login combinations immediately.
• Place a credit freeze: Contact the three major credit reporting agencies—Equifax, Experian, and TransUnion—to freeze your credit files against unauthorized new accounts.
• Monitor financial statements: Check linked credit card and bank statements for unauthorized charges or low-value test transactions.
• Create an identity recovery plan: If sensitive contact or identity records were exposed, file a report at the federal government’s IdentityTheft.gov recovery portal to document the incident and receive a recovery plan.
• Preserve digital evidence: Keep screenshots, message headers, and timestamps of any suspicious texts, emails, or calls you receive.

How to Report Identity Threats and Extortion

Reporting incidents to official oversight agencies helps authorities identify threat infrastructure and take down fraudulent operations:

• Submit digital extortion and hacking incidents to the FBI Internet Crime Complaint Center.
• File complaints regarding misleading commercial notifications or identity misuse with the Federal Trade Commission fraud reporting portal.
• Report unwanted marketing alerts, unauthorized text messages, or spoofed communications to the Federal Communications Commission complaint center.
• Contact law enforcement directly by filing a report with your local police department if you encounter direct extortion or financial theft.
• Flag compromised account records through the verified ASOS Customer Care portal.

The ASOS App push notifications incident highlights how cybercriminals bypass central infrastructure by using social engineering to compromise connected third-party tools. Practicing strong credential hygiene, staying alert to targeted phishing messages, and reporting suspicious contact to regulators are your most effective steps for keeping your personal information secure.

The post ASOS Push Notification Hack: Inside the Breach and How to Stay Safe appeared first on McAfee Blog.

A new cyberattack is weaponizing everyday search results to trick users into running malicious code on their devices. The campaign, dubbed “Adception,” was uncovered by Push Security. By buying paid search ads on Google and routing traffic through trusted web services, attackers are placing deceptive links directly in front of people searching for popular software. Then, they use a social engineering framework known as “ClickFix” to trick people into running malicious scripts on their devices.

How the Adception Campaign Works

Search ads appear at the very top of search engine results, making them easy to click and easy to trust. Malvertising (short for malicious advertising) occurs when cybercriminals buy or hijack legitimate ad placements to spread malware or direct users to fraudulent websites. In this campaign, attackers purchase legitimate ad slots but route clicking visitors through a hidden chain of web redirects before loading a fraudulent website. This detour conceals the final destination from automated ad-review crawlers, allowing malicious ads to bypass platform security filters and reach active searchers.

According to Push Security’s research, the threat actors specifically targeted Mac users searching for Anthropic’s Claude AI assistant. To evade automated detection, the attack chain bounces traffic through legitimate Bing click-tracking redirects and a compromised website. Once a visitor lands on the fake software portal, the attackers deploy an evasion technique known as “ClickFix,” using deceptive troubleshooting prompts to trick macOS users into executing base64-encoded malware directly inside the Z shell (zsh).

The campaign executes across five distinct stages:

1. Sponsored Search Ad Placement: Attackers purchase top-ranked Google search ads that bid on keywords for Anthropic’s Claude desktop app.
2. Cross-Engine Redirection (Google to Bing): Clicking the Google ad routes the visitor through legitimate Bing click-tracking infrastructure. The attackers use this cross-engine detour because automated Google ad-review crawlers do not expect ad traffic to route through a competitor’s tracking domain, effectively blinding them to the ultimate destination.
3. Compromised Intermediary Site: The traffic forwards to a compromised WordPress site owned by a South American retailer, which runs two layers of cloaking to weed out automated scanners and non-Mac operating systems.
4. Deceptive Landing Page: Qualifying visitors land on a counterfeit webpage that closely mimics Anthropic’s official website and branding.
5. ClickFix Terminal Execution: The landing page displays a fake installation error and activates the “AcSig” ClickFix toolkit, which hijacks the user’s clipboard and instructs them to paste code into the macOS Terminal to “fix” the download.

Warning Signs of Deceptive Search Ads

• Unfamiliar or shifting URLs: The address displayed on the ad card does not match the real software vendor, or your browser rapidly redirects through multiple unrelated domains before loading.
• Terminal or command-line prompts: When you arrive at a website through a search ad, it instructs you to open your computer’s terminal, shell, or command prompt to complete a download or resolve an installation error.
• Clipboard hijack instructions: The webpage asks you to copy code or automatically copies script text containing terms like base64, eval, curl, or zsh into your system clipboard.
• Fake system repair messages: On-screen pop-ups claim your browser or operating system requires an immediate manual patch to proceed with a standard download.

How to Protect Yourself from Deceptive Search Ads

• Navigate directly to official vendor sites. Type known web addresses directly into your browser’s address bar rather than searching for download portals.
• Verify the destination URL before clicking. Inspect the displayed web address on search results to ensure it matches the actual company domain.
• Use automated web protection tools: Install a secure browsing extension to automatically protect against malware and phishing sites.
• Never paste unverified code into command-line tools. Legitimate commercial software does not require pasting terminal commands to resolve browser download issues.
• Use official application stores. Download desktop applications directly through official developer portals, the Mac App Store, or the Microsoft Store.

What to Do If You Interacted with a Malicious Ad

If you clicked a deceptive ad and pasted code into your Mac’s Terminal, assume your device has been compromised. Take these immediate steps to limit the damage:

1. Disconnect from the internet immediately. Turn off your Wi-Fi from the menu bar at the top of your screen and unplug any network cables. This cuts off communication between your computer and the attacker’s server.
2. Shut down the Terminal and turn off your Mac. Quit the Terminal app completely. Shut down your computer to stop any background scripts from continuing to run.
3. Change your passwords from a different device. Using your phone or a separate, clean computer, immediately update passwords for your primary email, online banking, and password manager. When prompted, choose the option to “Log out of all devices.”
4. Turn on two-factor authentication (2FA). For any critical accounts that don’t already have it, enable two-factor authentication using an authenticator app rather than SMS text messages.
5. Run a full antivirus scan. Restart your Mac, keep Wi-Fi turned off, and run an offline security scan using reputable antivirus software to detect and quarantine any installed files.
6. Avoid sensitive logins and seek professional help if uncertain. Do not sign into online banking, email, or password accounts on the affected computer. If your security scan cannot confirm the threat is gone or you feel unsure, take the device to an Apple Store or certified technician to safely wipe and reinstall the operating system.

How to Report Deceptive Ads

• Report rogue ads to Google: Submit an abuse report via the Google Ads Complaints Form to flag fraudulent ad links and advertiser accounts.
• Report redirect abuse to Microsoft: Submit details on hijacked redirect links directly through the Microsoft Security Response Center.
• File an official fraud report: Report deceptive advertising to the Federal Trade Commission.
• Contact cybercrime authorities: File formal reports regarding malware delivery or financial loss with the FBI’s Internet Crime Complaint Center.
• Notify the impersonated vendor: Alert the affected brand’s support team to inform them of active trademark abuse and domain spoofing.

Deceptive search ads succeed by exploiting everyday browsing habits and the assumption that top-ranked search results are safe. Taking a moment to verify destination URLs and reporting suspicious sponsored listings helps platforms dismantle malicious infrastructure and keeps the broader online community safer. 

The post New Adception Campaign Weaponizes Search Ads: How to Stay Safe From Malvertising appeared first on McAfee Blog.

Security researchers at Jamf Threat Labs issued a September 2026 threat report warning Mac users about a newly discovered malware program called “CloudSyncD.” Disguised as a Zoom installer on unverified download sites, this malicious software tricks users into entering their administrator password, allowing attackers to secretly take remote control of the computer. The campaign targets individuals looking to install or update the popular video conferencing software.

How the CloudSyncD Malware Works

For a detailed technical breakdown of how the malware operates, you can read the full Jamf Threat Labs report. In simple terms, when someone downloads and opens the fake Zoom installer, the malware enacts a process to take control of the Mac:

• Fake System Prompt: The installer opens a pop-up window asking for your computer password, designed to look like an official macOS prompt.
• Hidden Credentials: Once typed, the malware saves your password in a disguised file, hiding the text with invisible characters to bypass standard checks.
• Silent Setup: Using administrative privileges, the malware quietly installs a hidden background program on your system.
• Remote Access: The background program connects your Mac to an attacker’s server, granting hackers full remote access to run commands, steal files, or install additional software.

Malicious Installer Warning Signs and Red Flags

Recognizing a suspicious installer before opening it prevents system compromise:

• Unofficial Download Sources: The file originates from a sponsored search link, file-sharing site, or third-party portal rather than the software’s official web page or the official Mac App Store.
• Immediate Password Requests: A system password prompt appears right when opening a disk image before any setup wizard begins.
• System Security Warnings: macOS Gatekeeper or XProtect displays an alert stating the software is untrusted or lacks a recognized developer signature.
• Unfamiliar Background Processes: Unknown applications or scripts execute with administrative privileges in macOS Activity Monitor.

How to Protect Your Mac From CloudSyncD and Other Malware

Adopting safe download practices reduces the risk of installing malicious macOS software:

• Download exclusively from official sources: Always obtain applications directly from the developer’s official website or the Mac App Store.
• Verify unexpected password prompts: Cancel any password request that appears unexpectedly when opening a newly downloaded file.
• Keep macOS security features active: Ensure built-in protections like macOS Gatekeeper and XProtect remain turned on to flag unverified software.
• Check app signatures before opening: Inspect installer details and developer certificate signatures before approving setup.

What to Do If You’ve Already Used a Fake Zoom Installer

If you downloaded a fraudulent Zoom installer or entered credentials into a suspicious prompt, execute these recovery steps immediately:

• Disconnect from the Internet: Turn off Wi-Fi and unplug Ethernet cables right away to break active communication between your Mac and remote servers.
• Change Account Passwords: Using a separate, secure device, update your Mac administrator password and any account credentials accessed from that computer.
• Turn On Multi-Factor Authentication: Enable multi-factor authentication (MFA) across your financial, email, and personal accounts.
• Isolate and Remove Malicious Artifacts: Run a full system scan or work with a technical professional to locate and delete unauthorized background files.
• Place a Credit Freeze: If personal or financial data was stored on the computer, place a credit freeze with Equifax, Experian, and TransUnion.

Report Fraudulent Installers and Secure Your Mac

Reporting malicious downloads helps threat intelligence researchers and federal agencies track active campaigns. Submit reports regarding fraudulent software installers to the FBI Internet Crime Complaint Center or the Federal Trade Commission. Notifying the official security team of the impersonated service provider also assists in taking down fake download domains.

Because CloudSyncD installs persistent background files, completely removing every component is essential to restoring system security. Simply deleting the downloaded installer disk image does not eliminate the threat. Ensure all hidden binaries and configuration files are thoroughly purged from your system to revoke remote access and protect your data.

The post CloudSyncD macOS Malware Hidden in Fake Zoom Installer: How to Avoid Malicious Installers appeared first on McAfee Blog.

On October 2, 2026, attackers hijacked Microsoft’s official X account (which reaches over 13 million followers) to execute a cryptocurrency pump-and-dump scheme, as reported by The Verge. The unauthorized access allowed attackers to replace Microsoft’s profile image with its retro mascot Clippy and promote a fraudulent token called $Clippy before the posts were removed. An official statement on Microsoft’s X account confirmed the account was secured, the unauthorized posts were deleted, and an internal investigation into the breach is ongoing.

How the $Clippy Crypto Scam Worked

When cybercriminals gain control of a verified corporate account, they leverage its built-in credibility to trick followers into fake financial investments.

Unauthorized actors gained access to @Microsoft on October 1, 2026. The attackers changed the account’s profile picture to image assets of Clippy, Microsoft’s legacy virtual assistant, and retweeted promotional posts from an impersonator handle, @clippymsftcto.

The malicious posts directed users to external sites promoting a fraudulent $Clippy cryptocurrency token. To confuse followers and delay remediation, the attackers also published a fake apology tweet from @Microsoft claiming control had been restored while continuing to promote the scam. Account access was eventually restored, and X suspended the associated impersonator accounts.

Warning Signs That an Account Has Been Compromised for a Crypto Pump-and-Dump

• Uncharacteristic financial endorsements: Verified corporate accounts suddenly promoting unannounced meme coins, cryptocurrency presales, or Web3 projects.
• Sudden profile changes: Abrupt alterations to official branding, logos, bios, or handles accompanying high-yield investment offers.
• High-pressure purchasing tactics: Posts creating artificial urgency by urging followers to buy unlisted tokens or connect wallets before a deadline.
• External wallet connection links: Unfamiliar links directing users to third-party decentralized finance platforms or signature-draining websites.
• Contradictory apology posts: False status updates or fake “all-clear” statements published during an active breach that still include external links or contract addresses.

How to Protect Yourself from Social Media Crypto Scams

Protecting your assets from social media crypto schemes requires careful verification and strict wallet safety practices.

• Cross-reference announcements on official newsrooms: Confirm product or financial launches on a company’s main website before trusting social media posts.
• Avoid clicking direct links for token sales: Never interact with link shorteners or unfamiliar domains asking you to connect a digital wallet.
• Audit token contracts independently: Use reputable blockchain analytics tools to check liquidity, developer wallet allocations, and contract safety before buying new tokens.
• Remember that verified badges do not guarantee immunity: Blue checkmarks confirm identity verification, but they do not prevent credential theft, session hijacking, or account takeovers.

What to Do If You Have Already Been Targeted

• Disconnect wallet permissions immediately: Use security tools to cancel active smart contract allowances granted to suspicious sites.
• Transfer remaining assets: Move funds to a newly generated, secure wallet if you suspect your private keys or seed phrases were compromised.
• Contact your financial institutions: Notify your bank, credit card company, or crypto exchange immediately if fiat currency or linked accounts were involved.
• Change passwords and enable multi-factor authentication (MFA): Update credentials across all sensitive accounts using an authenticator app rather than SMS.
• Document transaction evidence: Save wallet addresses, transaction hashes, screenshots of fraudulent posts, and web links for formal reports.
• Report identity exposure: If you shared personal identity or banking details on a phishing site, submit a report to the FTC and get a recovery plan.

How to Report Social Media Crypto Scams

If you encounter or fall victim to a social media crypto scam, report cyber fraud directly to the FBI Internet Crime Complaint Center and deceptive financial schemes to the Federal Trade Commission. You can also flag hijacked profiles or scam links using on-platform reporting tools directly on X, or contact local law enforcement if you suffered significant financial losses.

High-profile corporate account hijacks demonstrate how quickly bad actors can exploit trusted brands to promote fraudulent schemes. Verifying financial news across primary corporate websites, auditing token contracts, and recognizing red flags remain critical steps to keeping your digital assets secure.

The post Microsoft X Account Hacked in Crypto Scam: How to Spot Hijacked Accounts Promoting Scams appeared first on McAfee Blog.

Authored By: Fernando Ruiz

McAfee’s Mobile Research Team identified more than 1,900 unique applications associated with the campaign across over 500,000 devices in more than 190 countries. Based on publication patterns, we estimate that the operators were releasing approximately 20 to 25 new applications per day, each leveraging different themes, brands, and impersonation targets. The highest concentrations of affected devices were observed in India, Russia, and the United States.

Most of these apps were published on the official android platform impersonating well-known products such as CapCut, Roblox, Zelle, PayPal, Netflix, Xbox Game Pass, Siri, iMessage, etc. under different developer accounts, they shared a common codebase, repeated the same deceptive behaviors, and contacted the same remote server, which told each app where to send its users. That destination was an advertising funnel and in our testing the ads it served led to third-party subscription-fraud pages billing as much as $49.99 per month

McAfee identified the malicious apps, conducted technical analysis, and reported its findings to Google through responsible disclosure channels. Following McAfee’s report, Google removed all of the identified apps from Google Play. McAfee is a member of the App Defense Alliance, which supports collaboration across the mobile ecosystem to improve user protection. McAfee Mobile Security detects these apps as a Medium-Risk Threat. For more information, and to get fully protected, visit McAfee Mobile Security.

The Global Impact

This fake app campaign reached consumers around the world, with McAfee researchers identifying more than 1,900 unique apps across over 500,000 devices in more than 190 countries.

McAfee’s detection data shows how the campaign appeared across key markets. In the United Kingdom, McAfee recorded 11,862 detections, in Germany (5,016 detections), France (4,288), Australia (1,434), and Japan (944).

Market	Devices protected	Global rank	Share of global	Fake apps seen	Top 3 lures
United Kingdom	10,582	#8 of 207	1.98%	970	Streaming/TV/sports (17%), video editors (13%), games (11%)
Germany	4,465	#16	0.84%	444	Health apps (22%), games (16%), AI tools (13%)
France	3,882	#19	0.72%	450	Streaming/TV/sports (20%), AI tools (17%), adult content (10%)
Australia	1,293	#42	0.24%	306	Video editors (16%), AI tools (16%), adult content (15%)
Japan	843	#55	0.16%	229	Health apps (29%), streaming/TV (18%), AI tools (11%)

These figures represent fake app encounters identified by McAfee, not total infections. It reflects where McAfee detected these apps rather than the overall infection rate in each country.

Different Regions, Different Fake App Lures

While the campaign used the same underlying tactics worldwide, the types of apps detected varied by region. Globally, fake video and photo editors accounted for 19% of detections, followed by streaming, TV, and sports apps (13%).

A closer look at individual markets reveals some notable differences:

• United Kingdom: Streaming, TV, and sports apps led at 17% of detections, followed by video and photo editors at 13%.
• Germany: Fake health apps accounted for 22% of detections, followed by games and game modifications at 16%.
• France: Streaming, TV, and sports apps were the most common at 20%, followed by AI tool clones at 17%.
• Australia: Video and photo editors and AI tool clones were nearly tied, each accounting for approximately 16% of detections.
• Japan: Fake health apps stood out at 29% of detections, followed by streaming, TV, and sports apps at 18%.

These findings highlight how the same fake app campaign can appear in very different forms depending on what consumers are looking for. Whether it’s a health app, an AI assistant, a streaming service, or a popular game, familiar names and recognizable branding can make a fraudulent app appear trustworthy.

The risk isn’t limited to one country or one type of app. It’s the same underlying deception: an app that promises a familiar service but delivers something entirely different.

The Financial Impersonators

We identified fake apps impersonating Zelle, PayPal, Apple Pay, Mir Pay, Binance and several banks. One fake PayPal app had been downloaded 10,000+ times.

Zelle has no standalone consumer app: it lives inside your bank’s app so anyone searching Google Play for “Zelle” is already confused. And Apple Pay has no Android app at all, so users searching for it cannot find a legitimate result. Both are searches with no correct answer, which makes them ideal traffic to intercept.

Figure 1: Firsts result on Google Play of ‘Zelle’ search are Fake Applications

Combine that with an in-app browser whose address bar is hidden and whose destination the operator controls remotely, and the risk profile of a fake banking app is simply not the same as a fake video editor even when both currently do nothing worse than show ads.

From the user’s perspective the current risk is straightforward: they search Google Play for “Zelle”, the first results include fake apps, and installing it delivers not a banking guide but a stream of full-screen ads. Tapping one leads to a page requesting their credit card details for a “free” trial that then bills them monthly.

What Users Actually Got: Gambling Inventory, on an “Everyone” Rating

In multiple cases we observed a gambling-style quiz funnel: “Win Mega Jackpot,” “50,000 COINS DAILY,” “PLAY FOOTBALL QUIZ,” “Play Now.”

Now consider who was looking at those store pages: Among the apps still available for measurement at the time of our analysis, the ones impersonating children’s and teenagers’ brands had been downloaded more than 86,000 times:

Downloads	App title	Package Name
50,000+	Roblox	com.sitaram.robloxgame1
10,000+	Roblox	com.sitaram.robloxgame3
10,000+	Netflix Game Controller	netflixgamecontroller.uzair1
10,000+	Netflix Game Controller: Play	netflixgamecontroller.uzair2
5,000+	Xbox Game Pass: Play Games	xboxgame.abdul2
1,000+	Fall Guys for Mobile	com.react.fallguysgame1

Across the full campaign we identified 37 apps impersonating games and services aimed at young players: Roblox, Minecraft, Fall Guys, Brawl Stars, Clash of Clans, Deltarune, Xbox Game Pass even GTA VI.

Figure 2: Fake Xbox App with over 5,000 installations

Every one of these listings carried an “Everyone” content rating.

So, the chain runs: a child searches Google Play for Roblox, installs an app called Roblox with the Roblox logo, rated suitable for everyone — and is funneled into gambling-style prize inventory that the operator can redirect at will. No exploit, no permission prompt, no warning.

The Searches With No Correct Answer

One application captured this strategy particularly well: Published as “AppStore: App Downloader,” the application used a legacy Appstore icon and presented itself as an Android version of Apple’s official software marketplace.

Figure 3: Fake AppStore on Google Play with over 1K Downloads

A legitimate Apple App Store cannot exist on Android because Apple operates the App Store exclusively for its own platforms, and the iOS applications it distributes are not compatible with Android’s operating system or application format. Any Android app claiming to be Apple’s App Store is therefore impersonating the service rather than providing the official marketplace.

“AppStore: App Downloader” was not an alternative marketplace but an advertising funnel disguised with Apple’s branding, rated for all users, and distributed through Google Play.

There is no App Store, Siri, iMessage, FaceTime nor Apple Pay app for Android. Zelle has no standalone consumer app, it lives inside your bank app. Every one of those is a search people perform on Google Play every day, and every one of them is a search with no legitimate result.

Figure 4: Multiple fake apps that does not officially exist on Android

The user’s own intent is the vulnerability: they want the thing, they cannot have the thing, and something appears that looks exactly like the thing. No security control mediates that moment. It is not a technical failure at all: it is a person trusting a logo, which is precisely what logos are for.

How Are the Ads Displayed?

Each app is a shell. It wears the branding of something people search for — CapCut, Roblox, Zelle, PayPal, Netflix, Huawei Health, Xbox Game Pass, Siri, iMessage — and behind that branding it contains no real product. What it contains is a redirector.

On launch, the app contacts a server controlled by the operator:

`hxxps://rewadevelopments[.]online/data/.json`

The server replies with a small configuration block. One field in that block, `qureka_url`, holds a web address. The app takes that address and opens it in an in-app browser window, a Chrome Custom Tab, configured with the URL bar hidden.

In every case we observed, the address served was a gambling-style quiz site promising daily coin rewards. Users did not get a CapCut tutorial or a Zelle guide. They got an endless funnel of ad and quiz pages, monetized by the operator.

The mechanism matters more than today’s payload. Because the destination is fetched from the server at every launch, the operator can change where these apps send users at any moment, for any single app, without shipping an update and without passing store review again. An app wearing a bank’s logo, opening a browser window with the address bar hidden, pointed wherever the operator chooses, is a capability that can be used for phishing and credential exfiltration.

Figure 5: Ads severed from the website loaded in full screen that funnel to subscription fraud.

The full-screen ads users encounter are not served by the app. Its own ad slots are configured with Google’s public test IDs, which generate no revenue — so the app earns nothing from advertising itself. The ads come from the website the app opens: the destination supplied in the remote JSON configuration. That page’s ad inventory is filled with deceptive offers which, when tapped, lead to credit-card forms tied to subscription-fraud billing.

What Makes These Apps Interesting Is What They Do Not Do

There is no exploit, privilege escalation, rooting attempt, dynamic code loading, obfuscation, encrypted payload, or dropper chain. The applications request no dangerous Android permissions. From the perspective of conventional static analysis, their code presents few of the indicators typically associated with Android malware.

This campaign avoids many of those controls because its primary deception occurs outside the application code. Rather than exploiting a software vulnerability, the operators exploit the user’s trust in an official app store and in recognizable brands.

The post-installation behavior can remain technically simple, as it does here with advertising redirection, because persuading the user to install the application is the most critical stage of the operation.

The affected users did not need to follow a malicious link or sideload an APK from an unofficial forum. They searched an official application store for a product they recognized, and the search results presented an application with the expected name, logo, and visual identity.

How to protect yourself

• Install financial apps only from your bank’s own website or a verified link. If you are searching for an app store for a payment brand, you are in the exact position this campaign targets.
• Be suspicious of “guide,” “tutorial,” “helper” and “tips” apps for products you already use.
• Legitimate services do not need a third party to explain them.
• Check the developer’s name, not just the app name and icon. A real brand’s app is published by that brand.
• If a product doesn’t exist on your platform, no app can provide it. There is no Apple Pay, Siri, or iMessage for Android.
• Ignore install counts as a trust signal. Several of these apps had tens of thousands of downloads.
• Run mobile security software. McAfee Mobile Security detects this family.

Conclusion

Mobile security has genuinely improved. Permissions are narrower, sandboxing is stronger, exploit mitigations are routine, store review catches more than it used to, and AI now finds obfuscated payloads at a scale no human team could match. Every one of those defenses works but none of them was tested here.

Attackers move to one part of the system that cannot be patched: the judgment of the person holding the phone. And they apply pressure exactly where that judgment is weakest — a familiar logo, an official store, a name that matches what you searched for.

These apps are adware or a medium risk threat rather than malware because the fraudulent content is not theirs. The app opens a web page chosen by its operator; that page’s advertising slots are filled by open programmatic ad exchanges, which sell to whichever advertiser bids. The subscription-fraud pages belong to those advertisers.

As threat actors continue to exploit trust rather than software vulnerabilities, McAfee remains committed to protecting users, raising awareness, and collaborating across the industry to ensure that seemingly harmless applications do not evolve into large-scale fraud operations.

 IOC

Prevalent Apps

App title	Package	Play downloads	SHA-256 (primary build)
Roblox	com.sitaram.robloxgame1	50,000+	4f7b36963518e701276c77c1cad88d16fe64e8025c5223141c9af0eeb954ea63
Roblox	com.sitaram.robloxgame3	10,000+	c56d49a2f323ca0333778964fd58a7399aa60c8136a6a178adc1f222747b353f
Netflix Game Controller	netflixgamecontroller.uzair1	10,000+	2bdbd5c78a9d08b69983b965ae466210329b09eb26e5b491acdae9b822c729ab
Netflix Game Controller: Play	netflixgamecontroller.uzair2	10,000+	8cf714e0dab975c12cb5ac16837d7d2748a7f1672a3210a0e8e247dc405f8c68
Xbox Game Pass: Play Games	xboxgame.abdul2	5,000+	37539a20f07bd29e9285e7266ab29015c5467241bea43eee48f77769c42bbc7e
Fall Guys for Mobile	com.react.fallguysgame1	1,000+	d9ae6d844bf9269bee7d1f67f2f3d9e1d932974733068639c7204c2c92c391b1
Capkut – Video Editor	com.flintos.capcut2	50,000+	ba7a00fd597c04b7aa2efb59da853b1fcf34ba3bb63e7fbef2b9d9ef1a497641
Capcut Video Editor 2026	com.capcut.capvideoeditorapp58	10,000+	9b9e08b176d12c5e388b33c3e1fcdf2ba52b94cc6b310b56e3596eb783c26569
Siri Voice Assistant Android	com.shahdi.siri2	10,000+	b015de54db5073758909e5f3eaa90e73d7ff6f923195569d22395808b99a5557
Siri for Android	com.shahdi.siri1	5,000+	9a0881a67a7c35592216e0896e184d1ed960ef5c2280a6dafcfcbc0dcb29c099
Siri for Android	com.keli.siriapp1	1,000+	30a9f7461a0c11061b9349004f3dcd39ec763ec8bf1520ce655653fca67e183e
iMessage for Android	com.keli.imessage3	100+	ac46add9b7bb09779ab0a51924601e649431153c40d95c2ecc995e614ff2b89d
iMessage Android App	com.shahdi.imessage2	100+	83a95ceb22e24d5486f997d3ab7a8fa336cbf52c6489bfd20b285ccb16237f8e
Apple Health for Android	com.godwin.applehealth2	1+	5d2c823acf6e719553688626a113e79842d186de7d3203c011b032eb2f87adca
Huawei Health	huwaei.health1	10,000+	695eca22217b60b6218fbef51bcf660e569f7ce36c1d73a4646494d5489ae352
Casino Plus PH	casinoplus.pindo3	10,000+	3a50fa0ee7be36cbb1052254fbfdc0602abd7f52d69d7dc32d5c9ea6148ed16c
Aviator Game	com.aviator.aviatorgamejamantech2	1,000+	18af2b9a1e9db5f85c789252dbb0048a244e0a181f88b31c0969e6789b9657b8
GTA VI	com.react.gta6game1	N/A	78a098470a7926dc0bd36c625032fd421587aea88200fdbb877dbc655110c5f5

 

Financial Impersonators

App title	Package	Play downloads	SHA-256 (primary build)
PayPal – Fast Payments	com.paypal.wallawalled11	10,000+	601639168ac739e08fd267e86ba7eae440116e5b295fe01c00098bc2d9845405
Zelle® Easy Secure Payments	com.premkumar.zelleapp5	100,000+	8a943f50417c53fd9d8f522fdb69d76c96ca386c2416a43d20f9181350282bd1
Zelle® Faster Payments	com.premkumar.zelleapp2	50,000+	84fac9f350cd9d627392125cd3b06bac62321a2a36954605bd4680383ee86ae2
Zelle® – Faster Payments	com.zelleapp.devnexus2	10,000+	99122b355ba17d6fa55625414f9a48f8755f4a438374ce85c73c751e9f4fe6b6
Zelle® – Online Payments	com.mhd.zelleapp2	N/A	0022360894f15199c5f2fda5b5d8be3d26045d12ad50d80d02a23741601345af
Apple Pay	com.godwin.applepay3	N/A	aa6883d64438a4374a5f44b5180d8ff12ca3d0c9423946df092420291007fdaf

The post Android/RewaFake: Uncovering a Large-Scale Fake Apps Adware Campaign on Google Play appeared first on McAfee Blog.

Every time a big Amazon sales event takes place, shoppers flock to the deals. And scammers know it.

This year, Amazon has added a new Prime Day event Oct 6-7 called Amazon’s Prime Big Deal Days event. And in preparation, we’re breaking down the ways scammers use AI-driven manipulation to create fake Amazon websites, send delivery scam texts, impersonate customer support agents, and make scams look more convincing than ever. 

Recent McAfee research suggests shoppers may be especially vulnerable in 2026. Forty percent of consumers say they would trust a lower-priced deal without verifying it first, while 29% admit they would skip researching a seller if the price looked good enough.

That combination of urgency, discounts, and increasingly sophisticated scams creates the perfect environment for fraud. 

“Anyone who has ever fallen for a scam thought they would recognize one first,” McAfee’s Head of Threat Research Abhishek Karnik reminds shoppers.  

“That confidence is part of what scammers count on,” he says. “Tools like McAfee exist precisely for those moments, flagging suspicious links, messages, and offers in real time, before a split-second decision becomes a costly one.”  

Here are the most common Amazon Prime Day scams to watch for in 2026 and the warning signs that can help you avoid them. 

Scam Type	How It Works	Red Flags
Fake shopping websites	Fraudulent websites mimic real retailers and disappear after collecting payments	Prices far below competitors, little company information, newly created websites
Fake social media ads	Ads promote products that never arrive or are counterfeit	Too-good-to-be-true discounts, limited reviews, unfamiliar brands
Delivery notification scams	Fake package alerts claim there is an issue with your shipment	Unexpected texts, suspicious links, requests for payment
Retailer impersonation scams	Messages claim there is a problem with your account or order	Urgent language, login requests, unfamiliar sender addresses
QR code scams	QR codes redirect shoppers to fraudulent websites	Codes placed on flyers, posters, packages, or public locations
Brushing scams	Unsolicited packages arrive at your home	Items you never ordered, requests to scan codes or leave reviews
Fake recall scams	Messages claim a recent purchase has been recalled	Requests for payment, account credentials, or personal information

Here are examples of Amazon-related scam texts our team came across near Prime day last year, McAfee’s Scam Detector helped detect and stop these messages:

 

 

Figure 1. Examples of Amazon tariff and job scams

 

Figure 2. An example of a fake Amazon sign-in page.

 

 

Figure 3. Examples of Amazon phishing scams

 

Why Prime Day Scams Work 

Major shopping events create the exact conditions scammers rely on: urgency, distraction, and the promise of savings. 

McAfee research found: 

• 82% of consumers prioritize finding the cheapest deal when shopping online  
• 55% spend more time hunting for discounts  
• 40% would trust a lower-priced deal without verifying it  
• 29% would skip researching a seller if the deal looked especially good  
• 23% feel pressure to act quickly before a deal disappears  

“What the data reflects is that economic pressure has effectively done some of the scammer’s work for them,” says Abhishek Karnik, Head of Threat Research at McAfee. “When consumers are already primed to move quickly and prioritize price over authenticity, it takes far less effort to push them toward a bad click or a fraudulent purchase.”  

How to Protect Yourself This Prime Day 

The good news? These scams are preventable if you know what to watch for and take the right precautions. Here’s your defense playbook: 

Verify Before You Trust 

• Amazon will never call you about suspicious account activity or unauthorized purchases 
• Always log into your Amazon account directly through amazon.com to check for real issues 
• Use Amazon’s Message Center – all legitimate communications from Amazon appear there 
• Never give personal information, passwords, or payment details over the phone 

Watch for Red Flags 

• Urgent language demanding immediate action (“Your account will be closed in 24 hours!”) 
• Requests for payment via gift cards, wire transfers, or cash 
• Claims that you need to “verify” or “legalize” your money 
• Transfers to “government agencies” during the same call 
• Pressure to keep the call secret or not hang up 

How to Protect Your Shopping Experience 

• Enable two-factor authentication on your Amazon account 
• Only shop on secure websites (look for “https://” and the padlock icon) 
• Monitor your bank and credit card statements regularly 
• Never click links in suspicious emails – go directly to the retailer’s website instead. 
• Use reputable online protection like McAfee to keep you safer from online shopping scams 
• Trust your gut – if it feels too urgent or too good to be true, it probably is 

Together, these protections are designed to address the broader range of online risks people face every day. 

Check out the McAfee our latest offer this Amazon Prime Big Deal Days Event here.

The post How to Shop Safely During Amazon’s October Prime Big Deal Days Shopping Event appeared first on McAfee Blog.

Updated: Nov 5, 2026

Frontline Education, which makes K–12 school administration software, is notifying more than 1.3 million school employees and students that their personal information was stolen in an August 2026 breach. That count comes from filings in five states, SecurityWeek reported on Nov. 3, 2026, and the full total is likely higher.

The exposed data varies by person but can include Social Security numbers, dates of birth, driver’s license and passport numbers, Medicaid IDs, and Student IDs, according to Frontline’s Oct. 26 notice. Frontline serves more than 10,000 K–12 organizations nationwide.

Did You Get a Frontline Education Breach Letter or Email?

Frontline began sending individual notices on or about Oct. 26, 2026, by email or by U.S. mail. The mailed letter’s return address reads “Frontline Education c/o Cyberscout, PO Box 1286, Dearborn, MI 48120-9998,” according to the sample letter Frontline filed with the California attorney general. Cyberscout, a TransUnion company, is handling mailings and monitoring on Frontline’s behalf. District administrators received earlier emails from frontline@notifications.cyberscout.com starting Oct. 1.

• What’s offered: Adults get 24 months of free TransUnion credit monitoring. Enroll at mytrueidentity.com with the activation code in your letter. Minors are offered free cyber monitoring.
• Deadline: Enroll by the date in your letter (Jan. 31, 2027, on the sample notice). Your code won’t work after the date in your letter.
• How to confirm it’s real: Don’t call numbers or click links in an unexpected message. Call the TransUnion call center listed in Frontline’s notice, 1-800-759-7279 (8 a.m. to 8 p.m. ET, Monday through Friday), or check with your district’s HR department or main office.
• Spanish: A Spanish version of the letter template is at frontline-transunion.com/Spanish.

What Happened in the Frontline Education Data Breach

On Aug. 14, 2026, Frontline’s security team found that a vulnerability in third-party software it uses had allowed unauthorized access to part of its environment. The last unauthorized activity was Aug. 15. Frontline says it fixed the vulnerability, investigated with an independent cybersecurity firm, and contacted law enforcement. It has not named the software or the attackers, and it says it is not aware of any misuse of the data.

The breach affected two Frontline products: Frontline Central, which districts use for employee records, and School Health Management, which school nurses use to document student health care. That is why both staff and students are getting notices. The exposed information varies by person and can include:

• Names, home addresses, and email addresses
• Social Security numbers and dates of birth
• Driver’s license numbers, passport numbers, and other government ID numbers
• Medicaid IDs
• Student IDs

Who has been notified so far:

What was exposed depends on which Frontline products a district used. Some districts report only employee data, and others report student data.

• Five states: Filings in Massachusetts, New Hampshire, South Carolina, Texas, and Vermont total 1,298,917 people, SecurityWeek reported. Frontline also filed notices in California, Indiana, and Iowa, so the full count is likely higher.
• South Carolina: The state’s breach notice registry lists 493,535 affected residents, eSecurityPlanet reported.
• Killeen ISD (Texas): About 45,000 current and former employees and others. The district said no student information was involved.
• Greenwood School District 50 (South Carolina): About 16,678 current and former students. Exposed data may include Medicaid ID numbers and contact details. [VERIFY]

Warning Signs That Your Personal Information was Compromised in a Data Breach

Because compromised Social Security numbers and contact details enable identity theft and targeted phishing, school employees and parents should watch for these specific warning indicators:

• Unsolicited verification requests: Emails or calls claiming to represent Frontline Education, Cyberscout, or district HR asking you to confirm personal details, login credentials, or your monitoring activation code.
• Targeted phishing (spear phishing): Messages addressing you by name and referencing your specific school district, job title, or administrative role.
• Unfamiliar credit inquiries: Alerts from credit monitoring services showing credit checks or new account applications that you did not initiate.
• Tax filing irregularities: Communications from the IRS or state tax authorities indicating that a tax return has already been filed using your Social Security number.
• Health coverage you didn’t use: Medicaid or health plan statements, or benefit notices, for care or services you didn’t receive.
• Activity in a child’s name: Credit offers, IRS notices, or collection calls addressed to a student.

How School Staff and Parents Can Protect Themselves

If you work or worked for a school district that uses Frontline, or your child attends or attended one, take these steps:

• Enroll in the free monitoring by the date in your letter. Adults can enroll at mytrueidentity.com with the activation code in their letter. Minors are offered free monitoring.
• Freeze your child’s credit. Parents and guardians can request a free credit freeze for children under 16 at Equifax, Experian, and TransUnion. Each bureau creates a file for the child and freezes it, which blocks new accounts in the child’s name.
• Review health coverage statements. If your letter lists a Medicaid ID, check Medicaid or health plan statements for visits, prescriptions, or services you didn’t receive.
• Freeze your credit, or place a fraud alert. A freeze has to be placed separately at Equifax, Experian, and TransUnion. A fraud alert needs only one bureau, which notifies the other two. A credit freeze prevents lenders from accessing your credit report, stopping bad actors from opening unauthorized accounts in your name.
• Verify the notice before you act. Confirm with your district’s HR department or main office that your district was affected, or call the TransUnion call center listed in Frontline’s notice. Don’t call numbers or click links in an unexpected message.
• Enable multi-factor authentication (MFA). Turn on MFA across all personal email accounts, financial portals, and school district access systems to prevent unauthorized sign-ins.
• Monitor credit reports at the source. Request free annual credit reports through the official annual credit report website to review active accounts and financial inquiries.

What to Do If You Have Already Been Targeted

If your or your child’s Social Security number or personal financial details have already been misused, complete the following recovery steps immediately:

• Stop contact with suspicious senders. Do not reply to unverified emails, texts, or phone calls requesting additional personal information.
• Notify your financial institutions. Contact your bank, credit card issuers, and payment providers to alert them of potential identity theft and place fraud holds on compromised accounts.
• Report identity theft to the federal government. File an official identity theft report at the FTC identity theft portal to receive a recovery plan and official documentation for disputing fraudulent accounts.
• Freeze your credit. If you have not yet frozen your credit, do so immediately with Equifax, Experian, and TransUnion.
• Change affected account credentials. Update passwords for primary email accounts and school portal logins. Use complex, unique passwords for every service.
• File a report with local law enforcement. If you incur financial losses or discover fraudulent accounts opened in your name, submit a police report and request a copy for your dispute records.
• Maintain detailed documentation. Retain copies of notification letters, email headers, police reports, and fraudulent transaction statements.

How to Report the Threat and Next Steps

To report suspicious activity or document fraudulent use of your information resulting from this incident, use official reporting channels:

• FBI Internet Crime Complaint Center: File cybercrime reports at the FBI Internet Crime Complaint Center.
• Federal Communications Commission: Submit complaints regarding phone scams or caller ID spoofing at the FCC complaint center.
• Federal Trade Commission: Report identity theft at FCC.gov and other fraud at ReportFraud.ftc.gov.

As of November 2026, Frontline’s notices are still going out, and new district and state counts are still being posted. If you got a letter or email, enroll in the free monitoring by the date in your letter, and freeze your credit, and your child’s, with Equifax, Experian, and TransUnion. Treat any call, text, or email about this breach that asks for your Social Security number or activation code as a scam until you confirm it through your district or the call center number in Frontline’s notice. Automated monitoring tools can alert you if your exposed information appears online.

The post Frontline Education Data Breach Hits 1.3M: What to Do If You Got a Letter appeared first on McAfee Blog.