Today, in most countries around the world, virtually every reasonably large city is packed with video cameras. On the one hand, the idea, of course, is to “keep us safe”: to monitor security in the streets, improve road safety and enforce traffic rules, and so on. But there’s the other side of the coin — ubiquitous video surveillance creates both privacy risks and opportunities for unauthorized surveillance We’ve repeatedly posted on our blog about how to protect yourself from surveillance involving IP cameras.

There’s another problem, too: relying too heavily on video surveillance systems can also be dangerous. If your cameras aren’t adequately cyber-secure, attackers may be able to disable them remotely to be able to then enter physical areas supposedly protected by video surveillance without being detected. This issue is especially relevant to home and privately managed surveillance systems — large companies generally do a better job of securing their devices (although there are exceptions there as well).

Disabling or replacing a camera feed is an almost obligatory plot device in heist movies. But unfortunately, this isn’t just a screenwriter’s invention: our recent research uncovered a vulnerability that makes it possible to remotely disable IP cameras made by Intelbras — a popular camera manufacturer. Read on to learn what the problem is, and how to protect your surveillance systems; a detailed technical analysis of the vulnerability is available on our expert blog, Securelist.

When an update does more harm than good

A surveillance camera is essentially a fully-fledged mini-computer, and its firmware needs to be updated regularly. In this case, however, the vulnerability was hidden in the firmware update procedure itself.

Intelbras provides firmware update files on its official website. The firmware can be updated manually from an SD card, or over the local network via the web interface or mobile app. However, during a firmware update, the camera neither required (past tense; a patch has since been issued – see below) authentication nor validated the firmware file before starting the update. As a result, anyone connected to the same Wi-Fi network as the camera could send it an update request. When an update is initiated, the camera reboots, taking it offline for about a minute before it becomes available again. But if the requests are sent repeatedly in a loop, the camera can be kept offline indefinitely.

We investigated this vulnerability on an Intelbras iM3 C (iM3B-C) camera running firmware version v240927 — the latest available at the time of our research. The iM3 C is a smart Full-HD Wi-Fi camera designed for both home surveillance and as a baby monitor. According to Intelbras, the firmware for the iM3 C is also compatible with the iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FC models.

This vulnerability has a medium severity rating. However, because of the large number of potentially affected users, the impact of successful exploitation could be significant. Intelbras Mibo Smart — Intelbras’s app for setting up and managing these camera models — has been downloaded more than four million times, with most of its users based in Brazil and elsewhere in Latin America.

We notified Intelbras about the vulnerability, and the company promptly fixed it in a new firmware release — R.260804 (installation instructions for the update are available here).

How to secure your cameras and other smart devices

First and foremost, all Intelbras owners should update their camera firmware as soon as possible — and continue to do so regularly. More generally, it’s a good idea to secure your smart-home infrastructure in advance to reduce the risk posed by other potential vulnerabilities.

• One of the simplest yet most important steps is to change the default settings on both your smart devices and your home network. Be sure to replace the factory-default passwords on all smart devices and on your router — default username/password combinations such as admin/admin or root/admin provide no meaningful protection.
• Protect your home Wi-Fi with a strong password; otherwise, attackers could easily gain access to your local network.
• Disable WPS on your router. WPS is designed to simplify network setup and authentication: you can connect by pressing dedicated buttons on the router and respective device, or by entering an eight-digit PIN. The problem is that this PIN can be brute-forced relatively easily, allowing an attacker to recover the key to your Wi-Fi network fairly quickly.
• Use a strong, unique password for every account that can be used to manage your smart devices through official apps or websites. Where possible, enable two-factor authentication (2FA); the most secure option is generally to use one-time codes generated by authenticator apps. For generating and storing passwords, as well as creating one-time codes, it’s most convenient to use a password manager.
• Put your IP cameras and other smart devices on a separate Wi-Fi network — isolating them from phones, laptops, tablets, NAS devices, and so on. Most modern routers can create at least two Wi-Fi networks (a primary and a guest network). Use the guest network for smart-home devices, but make sure it’s protected with a strong password. If your router supports multiple Wi-Fi networks, consider putting the cameras on a dedicated network of their own. That way, even if the cameras are compromised, attackers won’t be able to reach your other devices.
• Use Smart Home Monitor, available in Kaspersky Plus and Kaspersky Premium. This feature shows all devices connected to your home network, lets you check their security status, and alerts you if an unknown device joins your home Wi-Fi.

More camera-security and smart-device tips and stories:

• Five rules to stop IP cameras from spying on you
• Webcam hacking, Korean-style: 120,000 IP cameras compromised
• Camera surveillance: myth or reality
• Network camera security: bad, worse, and terrible
• How to secure your smart home

Contrary to a common misconception, people haven’t stopped enjoying books in the digital age. The truth is that for a while now, reading on paper hasn’t been the only way to enjoy the written word.

At first glance, what cybersecurity risks could there possibly be? But then, since there are more than a billion e-book readers in the world, cybercriminals are bound to try to cash in. We spoke with Andrey Sidenko, Head of Child Online Safety at Kaspersky, to learn how criminals exploit interest in e-books, and what to look out for so you don’t become a victim yourself.

Malware instead of a book

Most often, scammers target computer and smartphone users who try to download an e-book from a pirate site. For example, our experts recently discovered a miner spreading this way: it was tapping the processing power of infected computers to generate various cryptocurrency tokens. Several of these sites let visitors read e-book excerpts for free. In reality, the attackers were stealing passwords and using a malicious script to swap links: users got an archive with malware named the same as the book they wanted. What’s more, links to these sites sat at the top of search results, so the risk of taking the bait was very high.

A year ago, we also wrote about fake e-books in Turkish or Arabic. These files were actually malicious executables disguised as ordinary PDFs. Once launched, they installed infostealers on the victim’s device: malware that sent chat-app session tokens, browser files, saved passwords, and crypto wallet data to the cybercriminals.

Traps in search results

Sites that engage in search spam pose a danger of their own. Picture this: you search for “The Lord of the Rings free download” — and land on a page that repeats your search phrase word for word and supposedly offers that very book for download. But instead of the book you were hoping for, you may be redirected to yet another sketchy site and treated to a malicious file.

By the way, this scam can work even if you search for a made-up author and a made-up book. Such sites can automatically generate plausible download pages for just about any query.

Book phishing

There are also phishing scams aimed squarely at book lovers. For example, one group of scammers sent out fake emails to users pretending to be from the popular book community Goodreads, offering various bogus (paid) services, which, alas, some recipients fell for: becoming a moderator, taking part in book events, or buying a paid promotion.

Here’s another example: ads supposedly from Orell Füssli, a well-known Swiss bookstore chain, circulated on social media. The ads offered books at hefty discounts. To place an order, users had to follow a link and enter their bank card details. Our regular readers will have no doubt guessed that the link led to a fake site, which in this case simply set up a paid subscription billed to the victim’s card.

Finally, scammers often create phishing sites that pose as pirate libraries. These libraries no longer cater only to fiction readers: readers go there for textbooks, academic papers, studies, rare editions, and other material that’s hard to find publicly. Because such libraries get blocked regularly and have to keep changing domains, it can be hard for users to tell the real site from a fake one.

Attackers take advantage of precisely this by promoting their own sites as official mirrors. These fake sites are often fully functional: you can search for and download books just like on the real thing, and the design is almost indistinguishable from the original. In 2024, for example, data on almost 10 million users of a phishing site mimicking Z-Library, a platform providing free downloads of access-restricted books and publications, was leaked online.

The leak included names, email addresses, countries of residence, password hashes, purchase details, and even crypto wallet addresses. With data this detailed, it’s easy to plan a follow-up attack: say, posing as a police officer to accuse the person of visiting an illegal site and demand money to drop the criminal case.

Can an e-reader get infected?

For attackers, e-readers aren’t the juiciest target: it’s hard to predict what device someone uses, or whether that person even has internet access. Besides, most e-readers are basic models — essentially a flash drive with a screen.

But there are more advanced devices — with internet access, browsers, and the ability to download third-party apps and use cloud storage. These are more likely targets, but let’s be honest: most of the time, it’s cybersecurity researchers who hack them — not criminals. For example, in 2025, researchers discovered a vulnerability in the Kindle that could let an attacker hijack the linked Amazon account.

Data leaks and other less obvious risks

Some e-readers let you highlight quotes, take notes on books you like, and share either with other users. Attackers can use this data for doxing, especially if a person wants to keep quiet about reading a particular book — something like, say, Fifty Shades of Grey, or anything personal that isn’t meant for the public.

In 2020, a Guardian journalist requested a copy of her personal data from Amazon, and received more than 20 000 records regarding how she’d used her e-reader. These included which books she read and when, how long she spent reading them, which passages she highlighted or copied, and which words she looked up in the dictionary.

So it’s worth treating your reading history as personal data too. If a book service leaks data, or your account gets hacked, a bad actor could learn not just your email address but far more personal details.

So how do you read e-books safely?

One of the simplest tips is to use official bookstores — and not just for copyright reasons. Since these platforms value their reputation, their content is vetted — meaning the files are more trustworthy.

Another essential tip is to update all your devices regularly — even the most basic e-reader: if it runs an operating system and any software — keep those updated. Timely updates close vulnerabilities that attackers could exploit, which lowers the risk of being hacked. The same goes for apps for reading and cataloging e-books: this year, researchers found serious vulnerabilities in both Calibre and Koodo Reader.

Note that installing unofficial firmware on your devices — for example, closed-ecosystem e-readers like Kindle — may not be the best idea. Risks include bricking the device and losing your warranty. The device may die or lock up during flashing or later on — when an automatic over-the-air update installs official firmware. The manufacturer may also block your account if it detects the modified firmware when the device goes online. And, naturally, the firmware itself may carry malware, such as stealers that siphon off your personal data and passwords. The fact that there’s no way to install an antivirus on your e-reader only exaggerates the potential problem.

It’s also a good idea to back up your digital library from time to time. Buying a book doesn’t guarantee you’ll keep access to it in your account forever. A title may become unavailable because of changes to licensing terms, platform policies, or other restrictions. What’s more, some formats can only be bought and read inside the e-reader’s closed ecosystem. So we recommend keeping a backup copy on your computer or another device, where you can get to it quickly offline. That way, you’ll keep access to your content even if something goes wrong with either the book service or your device.

Every time you download an e-book, be sure to check the file extension. A regular e-book filename should certainly not end in .exe or .bat. You can read more about the most common extensions of malicious files here.

With scammers, alas, getting better and better at disguising malware, perhaps the best all-around advice is this: don’t visit dubious websites, and don’t download unknown files. This is where Kaspersky Premium comes in: one of its main features is protection against phishing and malware. The application warns you if you try to visit an untrustworthy site, or download a potentially dangerous file. This keeps your data and money safe, and you can download and read your favorite books with peace of mind.

Love the written word? Check out our other posts about books:

• Into the rabbit hole: AI slop is flooding Amazon
• Books on cybersecurity: 5+ recommendations from our experts
• Information security in Dune

AI systems are much harder to protect than traditional IT — whether from operator mistakes, malicious interference, or just plain unstable behavior. There are two main reasons for this. First, AI outputs are probabilistic, so the same prompt can give different answers each time you run it. Second, today’s LLMs can’t reliably tell commands apart from data. Despite the demonstrated security issues of AI systems that we’ve covered many times, it’s impossible to ignore the potential economic payoff of adopting them. That’s why many companies are moving beyond simple AI assistants to AI agents. These agents carry out tasks on their own and have direct access to the same tools as humans — from reading databases to changing settings in production processes. Our experts, in their new study, examine how to clearly define and minimize the resulting risks to keep potential problems to a minimum. The approach borrows and adapts the principles of Cyber Immunity and Security by Design.

The basic principles of Security by Design

All the principles of this discipline are universally applicable to the design of any computer system — AI agents included. What differs is how deeply each principle needs to be adapted and reworked for AI scenarios.

1. Security is a separate and important factor right from the design stage. Security goals and assumptions are set on day one and followed throughout every stage of development. For AI agents, these assumptions should include three key points: (i) the language model is treated as untrusted, (ii) external data of any kind is considered potentially malicious, and (iii) irreversible actions can’t be performed autonomously without mandatory human approval.
2. The system is designed on the assumption that it will be attacked.
3. The trusted computing base and attack surface are kept to a minimum. Agents get only the tools they actually need, limited permissions, and the smallest amount of context possible. Security policy enforcement is handled entirely by deterministic components: the policy monitor, the agent harness, and isolation mechanisms (sandboxes).
4. The principle of least privilege applies. Each agent has its own set of credentials and access privileges (identity), limited to the bare minimum it needs to do its job. If an agent temporarily needs elevated privileges, it gets them only after external approval, and they last exactly as long as the task that requires them.
5. Components are isolated. In agent-based systems, this is one of the most complex and multi-layered architecture problems. The agent harness should run in an isolated environment (sandbox or virtual machine), and agents should be kept as isolated from each other as possible. Data processing in trusted and untrusted contexts is also kept separate. For example, one agent reads a pull request and writes a draft of the code, while another reviews that work without ever seeing the potentially malicious text of the request.
6. Default deny is the rule. Security policies follow the rule: anything not explicitly allowed is forbidden. This includes tool calls, interactions between agents, and network traffic.
7. Defense in depth is in place. Different measures should work at the same time and reinforce each other. Probabilistic defenses — like AI guardrails (a “firewall” for language models) or alignment (the model’s own sense of what’s acceptable and what isn’t) — can’t offer any formal security guarantees. Nevertheless, they make the system more secure overall and serve as a valuable source of telemetry.
8. The supply chain is protected. Some agents can install skills, libraries, and other software components on their own, so these abilities need strict rules. Either block them completely, or limit them to a closed, pre-approved list of specific versions of specific components. Systems built on cloud LLMs face an extra risk: model updates. One day, the same API request might be answered by a different language model with different security properties.

Pitfalls of AI security

The general principles of Security by Design are well known and look simple on paper. But applying them to AI systems is tricky because agents are incredibly flexible. For example, a security team might believe that an agent on a developer’s computer runs in a sandbox and can’t change anything outside it. But an attacker, or even the agent itself, can come up with dozens of ways around this seemingly solid protection: from running commands through a local MCP server that the sandbox doesn’t restrict, to reconfiguring another AI agent installed on the system. To make things even harder, the range of attack vectors is huge: from arbitrary fields in the agent’s configuration to innocent-looking text strings in a skill file.

One serious problem that designers often underestimate is user fatigue. A busy agent can throw up dozens of requests every minute, asking the user to confirm potentially dangerous actions. Within an hour, the person is clicking Approve on autopilot without reading what they’re approving. That’s why it’s important to carefully tune both how often these requests appear and how they’re worded. Nobody will read a request description that’s too long. And one that’s too short can hide the key details the user needs in order to make the right call.

Vulnerabilities in agents and related tools are a pressing problem — and it’s made worse by how quickly these categories of software evolve and receive updates. Industry-standard platforms and apps — such as LangGraph, MS Semantic Kernel, and Claude Code — have had critical vulnerabilities patched more than once. Architects should always consider swapping a large, do-it-all framework for a compact, stripped-down system that has only the features a specific agent actually needs.

On top of that, carefully implementing standard, long-established security measures in the available tools greatly reduces the damage if an agent is attacked or behaves unexpectedly. One example is a strict allowlist of domains that the web fetch tool can open when asked by the agent. But designers rarely account for the hidden problems and overhead associated with maintaining the list. As a result, it slowly goes out of date and leaves loopholes for attackers. The most striking example is the EchoLeak attack. Microsoft 365 Copilot had a properly implemented and fairly effective allowlist for accessing external sites, but attackers circumvented it through a feature in a secondary tool and the MS Teams domain.

Practical tips for architects and security teams

AI system architects and heads of engineering and security teams should build in agent security from the design stage. They should rely primarily on verifiable, deterministic mechanisms: isolating components, controlling interactions, and keeping the trusted computing base to a minimum.

Key architectural decisions include defining acceptable autonomy for the agents, limiting access to confidential data and dangerous combinations of capabilities, and using sandboxes, separate roles for different models, and access control gateways. Restrictions added as an afterthought reduce risks, but they’re no substitute for secure architecture.

At the organizational and operational levels, companies need to keep an inventory of their agents, coordinate the efforts of security and deployment teams, protect container environments, manage the supply chain (AIBOM), and integrate multi-layered defense.

Observability requires special attention. For AI systems, this should include logging the LLM’s requests, responses, and reasoning, as well as detailed telemetry from the hosts and cloud environments where the agent harness runs.

The hardest part of designing agents is balancing security, performance, and usefulness. To learn how to strike that balance with threat modeling and clearly defined security goals, read the full version of the study.

We’ve looked at information-security cases and technologies through the lens of famous movies, popular book series, and even fairy tales more than once before. Next up it’s the turn of Christopher Nolan’s adaptation of The Odyssey (based on the ancient Greek epic poem), which, incidentally, inspired the works of Tolkien, various movies and series in the Star Wars franchise, and much more.

Homer’s Odyssey doesn’t just describe classic plots and archetypes. It also covers key technologies and principles of digital hygiene — albeit in veiled form. The hero’s journey was a risky business — and so, for that matter, is watching The Odyssey itself, but we’ll get to that at the end of this post. For now, let’s see how to safely sail the vast internet Hellenic seas in search of Ithaca.

Administrator Penelope and 108 attackers

Nolan has reshaped the poem’s structure quite a bit, but the film still opens on the island of Ithaca. There, Penelope and Telemachus, the wife and son of Odysseus, king of Ithaca, wait for him to return from the Trojan War. Meanwhile, a mob of 108 suitors is running riot in Odysseus’ house. They’re all courting Penelope and dreaming of the throne, and the whole kingdom is on the brink of collapse.

In essence, this is an attack on digital infrastructure by a group of malicious actors. Penelope, an advanced user with admin rights, does everything she can to block attempts to hack the root account take Odysseus’ place. Her trick: she’s promised to choose a husband only after she finishes weaving a burial shroud for Odysseus’ father, Laertes. By day, she weaves in front of everyone. By night, she unravels everything she’s done: clearly a daily factory reset.

Nolan gives Penelope even more authority than Homer did. This helps highlight the coming-of-age story of Telemachus, who starts out as a beginner user. His storyline is about searching for his father and recognizing him: the ancient Greek version of multi-factor authentication. Following the tradition set by James Joyce, Nolan focuses on the tragedy of Telemachus, who can’t remember Odysseus, since his father last connected to the server left Ithaca so long ago.

Root account Odysseus, Trojan Horse, and Ram VPN

Meanwhile, Odysseus is on the island of the nymph Calypso. She feeds him lotus flowers that make him gradually lose his memory — clearly the classic playbook of ransomware. But in seven years, Calypso never manages to fully encrypt wipe his memory. Odysseus longs for home, and the hapless ransomware operator ends up helping him partly recover the encrypted data remember his story. Odysseus remembers how, after ten years of war outside the walls of Troy, he came up with a cunning scheme that became the basis for all Trojan horses ever since…

The Greeks left a malicious file huge wooden horse on the shore and sailed away. A spy who stayed behind convinced the Trojans that it was a very useful thing an offering to Athena, and they dragged the horse into the city. At night, once the people of Troy had gone into sleep mode, the malicious modules soldiers led by Odysseus hidden inside the horse added themselves to Defender’s exclusions opened the gates. The Greeks returned and captured Troy, then stole data and cryptocurrency burned and looted the city. Only after that did they finally head home.

But the road to Ithaca was long and dangerous. After landing on an unfamiliar island, Odysseus got overconfident. Instead of leaving the suspicious site stocking up and sailing away, he went off to explore the infrastructure, and ended up trapped with his men in the cave of a giant Cyclops, known online as Polyphemus. The Greeks managed to blind the Cyclops, though not without losses, and Odysseus figured out how to get out of the cave: by hiding under the bellies of the rams. The blinded Cyclops felt the rams’ wool but never noticed the Greeks — a textbook example of how a VPN works.

But once he’s out of the cave, Odysseus gets cocky and fires an arrow at Polyphemus. That gives away his real IP address location, and his crew has to flee in a hurry from the furious Cyclops. In the end, the ships are knocked off course and get lost at sea.

Interestingly, unlike in the film, Homer’s poem has a group of OLYMP experts constantly steering the course of events. For example, Odysseus’ ships lost their way because of the interference of Poseidon, OLYMP’s chief expert in maritime technology. As we know from the poem, Odysseus first logged in to Polyphemus’ place as “Nub_Oddy”, but later, in a fit of arrogance, changed his username to “Odysseus_Son_of_Laertes_King_of_Ithaca”. With Odysseus deanonymized, the Cyclops used the Pray messaging app to send Poseidon a voice request to launch targeted attacks on Odysseus’ crew. In Nolan’s version, though, Poseidon doesn’t appear as a character. Instead, he becomes a metaphor for an APT a destructive force of nature.

Expert Circe, APT group Sirena, Scylla, and Charybdis malware

Odysseus’ ships drift across the vast Web seas, and every so often they land on unsafe sites shores. First comes the bay of Lamos, where the giant Laestrygonians launch a DDoS attack, hurling requests rocks at the Greeks and wiping out nearly all of Odysseus’ infrastructure crew. Only he and a small group survive.

Next, the heroes land on the island of a lone cybersecurity professional known as Circe, who puts them through harsh cybersecurity training. She lures Odysseus’ warriors to dinner with a social engineering scheme known as pig butchering and turns them into… yes, you guessed it, pigs. But the protagonist doesn’t fall for her tricks, so Circe agrees to help him and gives his crew their human form back. She also advises Odysseus to run an analysis in an isolated environment descend into Hades’ underworld and find the blind Tiresias, whom the OLYMP experts promoted to threat intelligence analyst gifted with foresight.

Tiresias tells Odysseus that he is the only one with enough cybersecurity knowledge strength to reach Ithaca. But Odysseus is determined to save his crew. He learns that they’ll have to face a very dangerous APT group, the Sirens. They use advanced social engineering (singing) to lure sailors to their doom. So Odysseus orders his men to put in solid protection against voice spam: wax earplugs. The film never lets us hear what the Sirens actually sing. They may well be posing as bank employees, law enforcement, or government officials, but the anti-spam trick keeps the crew safe.

Then far more destructive malware hits the ship: Scylla and Charybdis. From Tiresias’ beginner course in infosec, Odysseus knows that Scylla has six heads, and can hit no more than six users at a time. But dodging her attack means running straight into Charybdis, who will deal critical damage drag the whole ship into a whirlpool. This is the first historical mention of an ethical thought experiment that would later become known as the “trolley problem” — and Odysseus picks Scylla.

Having passed these threats, the remaining crew members land on the island of Thrinacia. That cluster allows initial login with a standard access level for regular users, on one condition: don’t touch the island’s critical resource, the sacred bulls of Helios — chief expert in solar technology. But the warriors ignore Odysseus’ instructions, break the rule, and use that resource to mine food. This triggers a defense system built by OLYMP’s leader, nicknamed Zeus, which permanently blocks strikes down the ship and Odysseus’ crew. Odysseus himself barely survives and reaches Calypso’s island.

Return of root

Once his memory is back, Odysseus builds a raft and charts a course, thanks to Calypso. Athena, the wisest of the OLYMP experts, helps him reach the shores of Ithaca against all odds. He then slips into the city disguised as a beggar.

There, Odysseus passes several steps of multi-factor authentication:

• His old dog Argus sees his master, wags his tail, and dies.
• Telemachus sees this and realizes the poor wanderer is his father.
• His elderly nurse Eurycleia recognizes the man she raised by a unique code the scar on his leg.

But that isn’t enough to restore his root access. So with Telemachus’ help, Odysseus has to enter the palace using the account of one of his former companions, where he meets the administrator, Penelope. Nolan added an important twist here. At this moment, Odysseus regrets creating the first Trojan, which destroyed the infrastructure of an entire city. He also realizes that the malicious suitors’ constant attempts to guess the root password put Ithaca’s infrastructure at risk of the same decline.

Penelope begins to guess who is standing in front of her from his digital footprint indirect signs. She then sets a condition for the would-be root account owners her suitors: she’ll marry the one who can shoot an arrow through the rings of 12 axes with Odysseus’ bow. The bow is essentially a passkey with biometrics, which nobody knew how to fake back in those ancient times. So the bad actors fail one after another. Only Odysseus draws the bowstring and sends an arrow through every axe’s ring. Thanks to the successful biometric authentication, everyone accepts him as the true root king of Ithaca.

The rest is simple: the malware villains are neutralized, the kingdom is saved, and peace and information security return to Ithaca.

Why watching The Odyssey can be dangerous

In the window between the movie stopping being shown in cinemas and its release on digital media, our experts discovered a new multi-stage malicious campaign that had been running since mid-August. Malicious actors are spreading a previously unknown piece of malware called MovieReaper through compromised torrent trackers. They disguise it as downloads of popular movies — first and foremost The Odyssey, one of the biggest premieres of the summer. Scammers use this irresistible bait to make people more likely to download their file. The malware itself is as treacherous as the Sirens. It can hide from detection, give attackers remote access to the victim’s device, and deploy extra modules to stay in the system even after it’s removed. Read the full technical breakdown of MovieReaper on our expert blog, Securelist. Victims of this attack have been found all over the world. This is one more reminder of how important it is to be careful online — especially when downloading files.

Practical lessons from The Odyssey

So what can we learn from the story of the cunning king of Ithaca?

• A good offense isn’t the best defense. Instead of developing software to attack other users, focus on your own information security.
• Keep an eye on your personal data. It can fall into the hands of bad actors, which can lead to targeted attacks.
• Set up multi-factor authentication. It lowers the risk of being hacked, and helps you regain access to your accounts safely.
• Set up reliable protection (and don’t ignore it), because you should beware Greeks bearing gifts!

We love watching movies and breaking them down from a cybersecurity perspective. Read our other top reviews and analyses:

• Cybersecurity in 007’s world
• Matrix vulnerabilities
• The Matrix Resurrections security assessment
• Obi-Wan Kenobi in terms of information security
• Cybersecurity in season 2 of The Mandalorian
• and others…

 

For more than two decades now, setting up a home router has meant going through the same old routine: pick a Wi-Fi band, name your network, choose a security type, and set a password. After you type in your network name, you often see an option next to it to hide the network name — sometimes labeled hide SSID, or simply hidden or closed network. If you choose this option, the network you create won’t show up automatically in the list of available Wi-Fi networks on any smartphone, computer, or smart-home device — you need to type in the correct network name by hand. Only then will the device be able to find that network and connect to it. At first glance, hiding your wireless network’s name might seem like a smart precaution: keeping neighbors or passersby from hacking into your Wi-Fi since they simply can’t see it. But in fact things work differently: all your devices will give away the hidden network — and not just at home either.

How devices connect to Wi-Fi

Every Wi-Fi access point broadcasts a short data packet roughly 10 times a second so your smartphone or computer can show you a list of nearby networks’ names, like JohnWiFi, TommyNet, CafeDeArts_Guest, or other, creative variants. This packet contains (i) the network’s name (Service Set Identifier, or SSID), (ii) a unique identifier for the access point (Basic Service Set Identifier, or BSSID), and (iii) details about the radio channel the network uses. This info helps devices (i) pick the best network to connect to, and (ii) automatically join networks they already know; accordingly, none of the data in that packet is encrypted. Hidden networks also broadcast these advertising packets; they just leave the SSID field blank. This method of finding networks is called passive because a Wi-Fi client, like, say, your smartphone, just needs to listen to the airwaves to spot nearby access points.

On top of that, the client can scan for Wi-Fi networks on its own, which is known as active discovery. Your smartphone or computer is constantly broadcasting the names of Wi-Fi networks it knows and would like to connect to. If one of those networks happens to be nearby, the access point answers back, and the connection is made.

Active discovery can sometimes help save your smartphone’s battery, and it’s indispensable when you’re working with hidden networks. Discovering a hidden network and connecting to it becomes a two-step process. First, the smartphone “hears” that there’s a Wi-Fi access point nearby with a hidden network name. It then tries to reach that network by broadcasting the names (SSIDs) it already knows — either hidden networks it’s connected to before, or the name the user typed in when first connecting to a hidden network. If the name matches, the router responds, and the connection goes through.

A hidden network name (SSID) doesn’t actually hide your Wi-Fi network

The regular list of available Wi-Fi networks on your smartphone or computer won’t show networks that don’t broadcast a public SSID. But any specialized Wi-Fi scanning software can spot them easily — it just won’t show their names. And hidden networks are still easy to identify and tell apart thanks to each router’s unique BSSID.

So hiding a Wi-Fi network’s name doesn’t make it truly invisible, and it won’t protect you from cybercriminals. It’s worth noting that any large-scale analysis, such as mapping the geographic locations of Wi-Fi networks, relies on BSSIDs, not SSIDs. Besides the huge databases kept by Apple and Google, there are public access-point-mapping projects too, like WiGLE.

If someone wants to break into a network at a specific location, specialized software lets them find out its SSID just by waiting for one of the legitimate clients to connect and listening in on the active discovery session. From there, they can connect to that Wi-Fi network — provided it uses a weak enough security protocol.

Your devices leak hidden Wi-Fi network names and personal data

The main drawback of a hidden SSID is that smartphones and computers have to broadcast it before they can connect to the wireless network. And they do this everywhere — not just near the specific access point in question. As soon as any network with a hidden name shows up within signal range, the client attempts to connect, and during that attempt it broadcasts the names of every hidden network it knows. And this broadcast isn’t encrypted, which means anyone nearby can pick up the data being transmitted.

In 2021, researchers at the University of Hamburg ran an experiment collecting radio signal data on a busy street. In just three one-hour listening sessions, they gathered 252 000 Wi-Fi connection requests from passersby’s smartphones. Of those, 23% contained the SSID of a network the smartphone would have preferred to connect to.

And that’s where a factor few people think about comes into play: the network’s name itself. Twelve percent of the SSIDs found were long numeric strings that looked a lot like passwords. So, once someone knows the SSID and BSSID, they can look up the BSSID in a service like WiGLE and find the access point’s real-world address. Once there, an attacker can try to use such a string as both the SSID and the password to connect — with a good chance of success. The researchers’ sample also included 106 SSIDs containing a first and/or last name, 92 SSIDs that pointed to a home address, and three that revealed an email address.

Given all this, it’s no surprise that Apple and Asus recommend against using the hidden SSID feature.

Other drawbacks of hiding your Wi-Fi network

Beyond the data leak issues, hidden SSID technology — a holdover from early Wi-Fi versions — also hurts the performance of modern versions of the radio protocol. In the 6GHz band, searching for a hidden Wi-Fi network across 59 possible channels becomes noisy and power-hungry: the client has to run through every option and send a lot of requests. As a result, performance drops for all nearby Wi-Fi networks in the 6GHz band, and the client itself burns through battery power sending out all those requests.

Asus also points out that Windows devices may tend to connect to visible networks first — even if a network with a hidden SSID is available and marked as preferred.

When a hidden SSID actually makes sense

There aren’t many scenarios where hiding your network name is genuinely useful. For example, if a router is meant for a small group of people but is installed in a very crowded location, a hidden SSID can cut down on the number of connection attempts and ease the load on the router. But keep in mind that this boosts performance, not security — and only slightly at that.

Another similar case is a technical Wi-Fi network for a limited number of fixed devices — like a network of security cameras or smart home gadgets. These devices always stay in the same place, so whenever they try to connect to their assigned Wi-Fi, they find it right away, and no data leaks out — unless an attacker is actually listening in on the radio signal near the router. At the same time, outsiders are less likely to try connecting to such a network.

How to make your Wi-Fi more secure

To protect your Wi-Fi network from wireless hackers, don’t hide the SSID: instead, use the modern WPA3 security protocol along with a long password. Attackers can intercept data over the air and then try to crack the password with brute force, so a strong Wi-Fi password should be at least 20 characters long. The easiest way to generate and store such long, hard-to-crack passwords is with a password manager that syncs across your devices; that way they’re always at hand — no matter which gadget you’re using.

If some of your older devices don’t support WPA3, it’s fine to use WPA2 with protected management frames (PMF) turned on, which guard against many types of attacks on Wi-Fi networks.

You should also make sure Wi-Fi Protected Setup (WPS) is turned off, since it essentially replaces your password with an easy-to-guess PIN code.

To quickly spot unknown devices connected to your Wi-Fi network, use Smart Home Monitor in Kaspersky Premium.

As for the network name, instead of hiding it, pick one that doesn’t reveal your name, address, or any other personal details. It’s also worth avoiding default network names like ISPName-XXXX or dlink, but for a different reason: generic names like these can confuse you and your guests alike. If you don’t want your access point to show up on Wi-Fi geolocation maps from Apple, Google, and other providers, you can add the suffix _nomap to the end of your network name, but there’s no guarantee it will actually work.

Apart from protecting your Wi-Fi, make sure your router is configured securely overall. First and foremost, that means giving it a long, unique admin password, and keeping it updated with the manufacturer’s latest firmware. And if you have a bit more time, you could even boost your Wi-Fi performance.

How Wi-Fi networks get hacked, and how to protect them:

• How to find a person and recognize their pose using Wi-Fi
• Is your printer informing on you to the police?
• Wi-Fi hacking using PMKID interception
• How to secure your smart home
• Securing home security

In 2026, the owner of an ordinary home router, smart TV, or TV box is a prime target for cybercriminals. These devices are readily recruited into botnets and residential proxy networks, which we’ve covered before.

Criminals “sublease” the infected device by letting outsiders pay to visit any website from the victim’s IP address, so it looks like the device’s owner is doing it. The service is in demand across all kinds of shady schemes: from ad fraud and spam campaigns to password bruteforcing and account hacking. In our previous post, we described how home routers get recruited into these proxy networks; today we take a look at an even more vulnerable, and equally ubiquitous category of devices: smart TVs and TV boxes.

These appeal to criminals for two reasons. First, unlike computers and smartphones, TVs are almost always plugged into the power and have a fast internet connection. A dark screen doesn’t mean the device is switched off. On top of that, the limited user interface and monitoring tools mean suspicious background processes can easily slip unnoticed past users.

The threat is evolving and growing more aggressive. A recent study found that once proxyware turns up on a set-top box, the risks to its owner go well beyond having their traffic siphoned off.

Anatomy of the infection

The researchers focused on a popular TV box by SuperBox, which we already covered earlier in the post Is your TV box renting out your network?

SuperBox’s marketing leans heavily on the promise of providing thousands of TV channels, with no subscription or monthly fees. But out of the box, the device can’t actually do anything of the sort. To get access to pirated content, you need to install the brand’s proprietary app store.

When you launch it and install additional apps, the thousands of TV channels do appear. Meanwhile behind the scenes, with no warnings or permission prompts, the device floods external sites with unauthorized requests, and network traffic spikes sharply.

The researchers uncovered several alarming facts. First, the victim gets enrolled into as many as five botnets at once. The SuperBox runs clients for several proxyware networks simultaneously, which even try to compete with one another by blocking rival software from being installed.

But the real shock was the attacks on the internal network. The TV box’s proxyware places no limits on what its paying clients can actually do on the network. They can reach not only external sites but also devices inside your home network.

Normally, your home router and ISP settings protect you from outside attacks. But proxyware bypasses these barriers because it operates from inside the network. During an experiment, the researchers confirmed that an attacker on the internet can easily leverage the infected set-top box to open the admin panel of a home router, such as a Linksys, which is supposed to be accessible only to its owner when connected to the home Wi-Fi network. This means hackers can try to steal data from other devices in the same household, or even encrypt home network storage (NAS).

At the same time, flaws in SuperBox’s factory firmware let hackers remotely install and run any application with superuser privileges, and the threat is anything but hypothetical. Over three weeks of monitoring, the test set-top box was hit by more than 1300 attacks through the home proxy network. Attackers installed three different types of malware, including a module for launching DDoS attacks.

The malware uses several methods to gain a foothold in the system, and it survives reboots and power failures alike.

How to tell if your set-top box is working for hackers

If you have a cheap TV set-top box or Android TV from a little-known brand, it’s worth checking it for anomalies.

The most reliable method is to review the network traffic. Use the statistics in your router’s control panel, but note that some budget models may lack this feature. This feature is called Traffic Analyzer on Asus routers, Traffic Usage on TP-Link, and Traffic Monitor on Keenetic. Find your TV or set-top box in the device list and check the ratio of downloaded to uploaded data. They should consume a lot of traffic to download video while sending very little. If your box is quietly pushing gigabytes of data out or staying chatty on the network even while idle, that’s a telltale sign it’s infected.

If traffic statistics aren’t available, look for indirect signs:

• The network and memory activity LEDs won’t stop blinking even though no one’s using the device.
• The set-top box’s casing is constantly warm or hot.
• The interface lags behind the remote, and the box freezes at random moments that have nothing to do with heavy video playback.
• Your other devices (computers or phones) are seeing a real drop in internet speed.
• When trying to visit familiar sites over your home Wi-Fi, you’re constantly hit with a CAPTCHA — a sign your network may be compromised and flagged as a spam source.
• Your ISP’s tech support calls you asking about suspicious network loads.

What to do with an infected device

The best solution is to disconnect the device from the internet and dispose of it. If you have to keep using it, follow these steps to minimize the risks:

1. Do a factory (hard) reset. Restore the set-top box to its original state.
2. Take it offline before setting up again. The first time you turn it on after a reset, skip the Wi-Fi setup step and don’t plug in the Ethernet cable.
3. Block app installation. Go to Android settings and disable installation of apps from unknown sources. Be sure to turn off any debugging features if enabled: USB debugging, Wireless debugging, and ADB. Menu item names may differ depending on your Android version and device manufacturer.
4. Isolate it on the network. Set up a guest Wi-Fi network on your router and connect the TV box to it. Enable Client Isolation in your router’s settings, if it has it. This will stop the box from seeing other devices on your home network, which protects your computers and network storage.
5. Check for updates. Once the box is connected to the guest network, check for official firmware updates: manufacturers sometimes patch known vulnerabilities, though with lesser-known brands, you shouldn’t count on it.

Your most reliable safeguards

Buying cheap devices with pirate streaming features and installing software from shady sources is a surefire way to compromise your home network. Your IP address will become a source of malicious activity, which at best gets you blocked by your ISP and at worst puts you on law enforcement’s radar. What’s more, hackers can use the box as a launchpad to attack your home computers and NAS, which can lead to personal data theft or a ransomware attack.

The best protection is to buy devices from trusted brands and pay for legal content. And to rule out someone hijacking control of your network, make sure your router’s admin panel and other home devices are protected with unique, strong passwords. To avoid having to remember them all, use a reliable password manager such as Kaspersky Password Manager. Additionally, the Smart Home Monitor feature included in Kaspersky Premium lets you keep all your devices fully under control.

There may be more things you don’t know about your smart home devices:

• Is your TV box renting out your network?
• Are your TV, smartphone, and smart speakers eavesdropping on you?
• Five rules to stop IP cameras from spying on you
• The hidden risks of cheap Android devices
• Is your router secretly working for foreign intelligence?

Security researchers have found a way to hack a Boeing 737 with a device no bigger than a coin. The 737 is one of the most widely used airliners in the world, so chances are you’ve flown on one yourself at least once.

The attack requires installing a small device in a port that’s accessible through a hatch on the outside of the plane. According to the researchers, this port is regularly within reach not just of maintenance crews, but of other airport and airline staff too. And installing the device takes less than 60 seconds. So let’s talk about what this mysterious little device actually is, what it can do, and whether it’s still safe to fly on a Boeing 737.

Why hacking a plane is harder than hacking a car

Most of us have gotten used to the idea that our computers and phones can be hacked. It’s probably the most common topic on this blog. But we’ve also covered attacks on less common targets: cars, robot lawnmowers, automated card shufflers, bikes, and even mattresses. In today’s world, all of these (and many other) devices contain tiny (or not-so-tiny) computers.

Airplanes are no exception. A modern airliner is packed with computers — some of which handle critical functions: from calculating takeoff parameters to controlling the flight itself. But there’s one key difference: airliner manufacturers, unlike the makers of most smart home gadgets, take security very seriously, which makes it far harder to reach these systems from the outside.

Maybe that’s precisely why the idea of hacking a real plane has been tempting the most inquisitive security researchers for years. A team at the University of California San Diego and Oberlin College — the researchers who finally pulled it off — spent more than a decade wrestling with the problem. As mentioned above, the main challenge in hacking a plane is that its critical systems aren’t connected to the external internet. Because of that, studying plane-related attack vectors wasn’t seen as especially promising within the cybersecurity research community: reaching isolated systems remotely is extremely difficult, and the odds of an attacker gaining physical access were considered very low.

Two other successful projects changed that assumption for UC San Diego researchers Kirill Levchenko and Aaron Schulman: a hack of the Chevrolet Impala, and research into payment card skimmers. The car hack led their team to buy secondhand Boeing 737 computer components and build their own test rig. The skimmer research gave them the idea for a small physical device that could plug directly into the plane’s internal systems.

After studying the Boeing 737’s circuit diagrams, the researchers found a port accessible from outside the plane — protected only by an unlocked hatch. That port connects to a data channel called the ARINC 429 bus, which links the plane’s flight management computer (FMC) to its multifunction control and display unit (MCDU).

 A “bus driver” at the controls

On their test rig, the researchers checked what would happen if they connected to the ARINC 429 bus through this port and sent electrical signals more powerful than the ones the Boeing’s components normally exchange with one another. It turned out that doing so let them override legitimate commands with their own. From there, all that was left was building a device small enough to fit into the port they’d found.

Step by step, the team built a device compact enough to slot into the unprotected port. The finished version set them back less than US$100, and appears to have been built largely from off-the-shelf parts: a small microcontroller, electronics for communicating with the bus, and a Wi-Fi module. That last part could potentially help the device connect to the plane’s public in-flight Wi-Fi network, giving the attacker access over the internet, and eventually letting them control the device remotely. And the whole thing takes less than a minute to install into the port.

The researchers dubbed their attack “Bus Driver”, apparently a play on words: “bus” refers to both a passenger vehicle and the data channel that lets a system’s components talk to each other. The attack lets someone step into that channel and swap out the commands being sent — effectively controlling the bus.

What the improvised Boeing 737 hacking device can actually do

An unprotected port, a coin-sized device, access to the bus: that’s all and well and good, but what did the researchers actually manage to pull off? What kind of damage can this tiny implant do? As it turns out, quite a lot — potentially even fatal. By gaining the ability to tamper with the data flowing between the flight management computer and the control and display unit, the researchers found they could interfere with several critical aspects of how the plane operates.

First, the implant can alter the data used to calculate takeoff and landing parameters. For example, it can change the plane’s recorded zero-fuel weight, which throws off the calculation of the speeds needed for a safe takeoff.

The device can also manipulate the assumed temperature value pilots use to determine how much engine thrust is needed at takeoff. Feed the system the wrong numbers, and under certain conditions the plane could end up with insufficient thrust to take off safely — potentially even going off the end of the runway. Faulty calculations during landing carry similarly serious risks.

The implant can also change the route the autopilot is following. On a long flight, a deviation of just a few degrees — subtle enough to go unnoticed — could be enough to send the plane badly off course so it runs out of fuel somewhere over open ocean.

Beyond that, an attacker could use the device to steer the plane into the airspace of a country that isn’t part of its approved flight path. That kind of deviation can also have deadly consequences: the history of civil aviation has seen more than one case of a passenger plane being mistakenly shot down by the military after straying into restricted airspace.

Of course, the odds of a deviation like this slipping past both pilots and air traffic control are very low, but disasters tend to happen exactly when several human errors line up.

Finally, the device doesn’t just let someone change flight parameters, it lets them hide those changes from the pilots. For instance, an attacker could load a new route into the flight computer while simultaneously altering what’s shown on the MCDU display, so the pilots keep seeing the original route.

That said, the researchers note that in most cases an attentive crew would catch the discrepancy. The correct data still shows up on other cockpit displays, and switching to manual control lets pilots disengage the autopilot and take back control of the plane.

So, should we all switch to trains?

To wrap up, I’ll try to put the longtime aerophobes (and anyone this article has just turned into one) at ease. The researchers themselves say that despite everything they’ve learned, they still fly on Boeing 737s. And to avoid causing any real-world trouble, they deliberately left out exactly which port they used in their experiments.

The researchers also reached out to Boeing back in 2020 to share their findings. Boeing took the information seriously and worked on addressing the issue.

Specifically, the researchers suggested Boeing either remove the vulnerable port or seal it with epoxy resin to physically rule out the possibility of someone plugging in an unauthorized device. There are more involved options too, like redesigning the internal bus’s electrical protections so a rogue device can’t override the real signals, and adding systems that can detect this kind of attack in the first place.

Longer term, the researchers recommend that Boeing, along with other aircraft manufacturers, adopt cryptographic authentication for the messages passed between avionics components.

Whether Boeing acted on this specific advice or came up with its own fixes isn’t publicly known. When Wired reporters asked the company about it, the response was fairly vague:

“Our technical experts are confident that the layers of protection in place on the airplane, including within the system design and the operating environment, provide sufficient mitigation to significantly limit the feasibility and risk of real-world attacks.”

So no, there’s apparently no need to swear off Boeing 737 flights just yet. That said, I happen to have a lot of respect for trains, so I won’t try to talk you out of traveling by rail or using other ways of getting around either. I’ve actually written about train hacking on this blog before, though in that case the goal was constructive, not destructive.

Cars, lawnmowers, card shufflers, bikes, smart mattresses — it’s not even an exhaustive list of the devices that hackers have successfully tampered with. What else was hacked? Find out in our other posts:

• Botnets on wheels: the mass hacking of dashcams
• Car hacking via Bluetooth
• Five hacks that were (mostly) just for laughs
• Vulnerabilities in a toy robot permitting snooping. Seriously
• Ecovacs robot vacuums get hacked

Artificial intelligence has gone from a technological novelty to a tool so ordinary that kids in elementary school are already using it. Trying to ban children from using AI at this point makes about as much sense as it once did to ban search engines or Wikipedia.

Today we’re breaking down how chatbots actually work, and how to teach your kid to use AI as a study aid rather than a substitute for thinking for themselves

Explain to your child (and yourself) how AI works

Before explaining anything about artificial intelligence to your child, it helps to understand how it actually works and where its limits are.

Most of the popular chatbots that kids (as well as adults) use are what’s known as large language models, or LLMs. To build such a model, researchers train it to spot patterns across huge amounts of text. The model breaks text down into small units called tokens (each token can be a sequence of words, a punctuation mark, a single word or character, or a whole sentence), then predicts which token is most likely to come next.

The same thing happens when a chatbot converses with a person. A language model doesn’t actually reason on its own. It’s calculating which words and phrases are most likely to follow one another in order to produce a response that fits your query. That means chatbots will sometimes give incomplete or flat-out wrong answers, no matter how often they’re updated or retrained. A vivid example: just two years ago, popular chatbots confidently assured users that the word “strawberry” has two letters “r” instead of three. Mistakes like these are commonly known as hallucinations.

Many chatbots can also search the internet for information. In that case, the AI pulls in data from an outside source, but it still uses its own internal algorithms to put the answer together. And search results themselves can include outdated posts, advertising content, tabloids, and other questionable sources.

How to help your child use AI wisely

Talk to them about how AI can get things wrong

We’ve already seen that artificial intelligence isn’t immune to errors. Unfortunately, hallucinations aren’t the only issue. Even when a chatbot is working from accurate information, it can still present it in a misleading way by leaving something out, putting the emphasis in the wrong place, or drawing a questionable conclusion. Sometimes the result depends on factors a user would never think to consider when asking a question.

One surprising factor is simply what language you’re using. Most of the data that major models are trained on is in English, so these systems tend to perform better in English. The same AI model might answer a question correctly in English but get it wrong when asked the exact same thing in, say, Serbian. This gap shows up most in fields such as science, medicine, technology, and law, where there’s simply far more high-quality English-language material for the model to draw on.

Another quirk of chatbots is that they get worse as you feed them more information. Studies show that the more text and data a model has to work with, the harder it is for it to keep track of details, connect information from different parts of a conversation, and answer questions that require real depth of understanding. Therefore, uploading an entire book to a chatbot and asking detailed questions about it is a surefire way to trigger hallucinations.

It’s also worth questioning not just what the AI tells you, but the way you ask your questions in the first place. Chatbots often try to please the user, and will shape their answer to match the user’s apparent point of view. For example, the same chatbot might give opposite answers to “Why is the Earth overpopulated?” and “Why isn’t the Earth overpopulated?”, each time building its response around the assumption baked into the question. One recent study found that even the most advanced language models failed to challenge false premises in 26–42% of cases.

Let AI help with learning, not do the learning

Many a former student knows that copying others’ work is an art unto itself — one that takes exceptional skill and at least some engagement with the material (sometimes even a fair amount). These days, unfortunately, even that skill is at risk of disappearing: the temptation to copy an answer that took only a few seconds to generate is simply too strong. But chatbots are far from straight-A students themselves.

In one study, researchers had three popular chatbots sit a chemistry exam, and compared their scores to those of real students from 2009–2023. The students came out ahead. Chatbots will sometimes land on the correct answer, but arrive at it via a chain of flawed reasoning, so their answers could just as easily be wrong.

So it’s worth explaining to your child that having AI write essays from scratch, or solve equations without then double-checking them, is a dead end. On top of that, in a real job they’ll be judged on actual skills and knowledge, and chatbots won’t help them fake the expertise. What AI can genuinely help with, without getting in the way of learning, is explaining difficult topics and working through mistakes. Here are some examples:

If a topic is hard to make sense of

• “Explain this topic in simple terms: {insert topic}”
• “Explain this topic using a real-life example: {insert topic}“
• “Here’s the part I don’t understand: {insert text}. Walk me through it step by step”
• “Explain this topic in simple terms first, then in more technical terms: {insert topic}“
• “Here’s a question: {insert question}. Don’t give me the answer. Ask me guiding questions so I can work it out myself”

Math and other exact sciences

• “Give me a hint for the first step, but don’t solve the whole problem: {insert problem}“
• “Look at my solution and tell me where I made a mistake, but don’t fix it for me: {insert problem and solution}“
• “Come up with a similar problem for me to try: {insert problem}“
• “Here’s my answer: {answer}. Ask me questions so I can check whether I solved it correctly”
• “Explain why this formula applies here: {insert problem}“

Essays and written assignments

• “Ask me five questions on this topic so I can come up with my own thesis and arguments: {insert topic}“
• “Here’s a draft of my essay. Try to find gaps in my logic or places that need more detail: {insert draft text}“
• “Look at my essay outline and tell me what’s missing: {insert essay outline}”
• “Point out places in my writing where the idea isn’t clear, but don’t rewrite it for me: {insert text}“
• “Pretend you’re an experienced teacher and try challenging my argument: {insert text}“

Language learning

• “Have a conversation with me in {insert language} at an A2 level. After I respond, correct my mistakes”
• “Give me five sentences to translate using this grammar structure: {insert grammar structure}“
• “Explain this grammar rule and give me some examples: {insert grammar rule}“
• “I’ll write a sentence, and you tell me if it has a mistake. Give me a hint first, and only show me the correct version after my second attempt. {insert sentence}“
• “Write a short dialogue in {insert language} where I have to answer as one of the characters”

Knowledge testing

• “Quiz me with 20 questions on this topic: {insert topic}. Ask one question at a time, and don’t show the answer right away”
• “After each answer, only explain what I got wrong”
• “Start with five easy questions, then ask five hard ones”
• “Make the questions harder each time I answer correctly”
• “Based on my mistakes, tell me which topics I should review”

Fact-check AI responses together

Make sure your child understands that they shouldn’t blindly trust what a chatbot tells them — even when it cites other sources. And asking the same chatbot to double-check its own work isn’t a great idea either; there’s a real chance it will make the same mistakes twice, or even pile up the errors.

Take any chatbot answer and go through it together, breaking it down into individual statements and asking questions about each one. Where did that date or number come from? Is the AI citing a specific person, publication, or study? Is the quote actually something that person said? If the chatbot includes a link, open it and check how accurately the AI actually represented it.

While you’re at it, take a look at the quality of the source itself. If something is written in an overly emotional tone or makes bold claims without backing them up, that’s a good sign to look for information somewhere else.

Protect your child and their accounts

Anything your child shares with a chatbot ends up on that company’s servers, and it’s used to further train the model by default. Over the past few years we’ve seen that even the biggest companies aren’t immune to bugs and data leaks. To lower the risk of your child’s information leaking and to keep their account secure, follow a few simple rules:

• Make sure your child understands that AI isn’t a private diary. Tell them not to share their name, home address, school, or any other sensitive information with a chatbot.
• Adjust the chatbot’s privacy settings. At the very least, turn off memory and any “improve the model” or training features. It’s also worth reading our detailed guides on setting up privacy and security in ChatGPT and DeepSeek.
• Update the password. Most chatbots require an account, so to keep your child’s from being hacked, set a strong password that isn’t reused anywhere else. Whether your child’s password follows the classic “mother’s maiden name plus birth year” formula or uses popular meme words like “skibidi”, we have some bad news: passwords like these get cracked really fast. Instead of coming up with and memorizing passwords, it’s better to let an encrypted password manager generate and store them.
• Turn on two-factor authentication. This adds an extra hurdle for anyone trying to break into your child’s account. Rather than using a phone number as the second factor, it’s better to use login codes generated and automatically refreshed in a password manager.
• Use anti-phishing protection. Beyond fake websites that impersonate legitimate AI services, there’s another risk: chatbots sometimes hand users links to phishing sites (fake pages designed to steal personal information). Kaspersky Premium blocks access to suspicious sites and keeps scammers from stealing your family’s data and money.
• Know what your child is doing online. Along with a password manager and protection from malware and phishing, Kaspersky Premium includes Kaspersky Safe Kids, which lets you set up parental controls, restrict unwanted content, and keep track of how much time your child spends online.

What else to read about keeping kids safe online and at school:

• Keeping kids safe online: a practical guide for parents
• How to help your kid become a blogger without ever worrying about their safety
• How hackers target Gen Z
• Choosing wisely: a guide to your kids’ first gadget
• Back-to-school threats: gadgets
• Back-to-school threats: virtual classrooms and videoconferencing
• Back-to-school threats: social networking
• Back to School Security Tips

Neighborhood chats regularly light up with posts about lost bank cards being found. People mean well and want to help a neighbor out, so they post a photo of the card with the number and other details fully visible. Others mention in the chat that they’ve left the card with, say, a security guard, cashier, or manager at whatever store or business it was found, or which happens to be the closest. Today we’re going to explain why none of that is a good idea, and what you should really do if you find someone else’s bank card.

What NOT to do if you find a lost card, and why

Let’s start with why you shouldn’t post a photo of the card with its details visible in a group chat, keep the card, or hand it to a stranger. The first reason is the most obvious, but worth spelling out anyway: card details are private information that shouldn’t be shared with people who have no business seeing them. A photo posted in a group chat can end up in the hands of criminals, who may try to use those details to make fraudulent purchases online. The worst-case scenario is a photo showing both sides of the card that also exposes the three-digit security code (known as the CVC, CVV, or CVP) on the back.

Now to a less obvious point: why you shouldn’t post about finding a card, even with a photo of it with the number blurred out, and then hold on to it, planning to return it once the owner turns up. Since there’s no guarantee you were the first person to have the card in your hands, doing this puts you at risk of coming under suspicion if money disappears from that account. Even if you had absolutely nothing to do with any theft, the mere fact that the card was in your possession for a while could still land you in an uncomfortable conversation with its owner or the police.

The same logic applies to handing the card over to a third party. A security guard, cashier, or manager is just as much a stranger as anyone else, and none of them have any special authority to take charge of a found bank card. Handing it to them gives them the opportunity to use someone else’s money themselves, and if that happens, you could end up as a person of interest.

An “out of sight — out of mind” approach, that is, leaving the card where you found it, or moving it somewhere more visible, is safer for you personally, but it’s still not really the right call. If you do that, someone else will find it, and there’s no guarantee that they’ll be a decent person. They might try to drain money from the rightful owner’s account. So this isn’t a good option either.

What you SHOULD do with a found bank card

Now let’s talk about what you should do instead. The right approach might surprise you: call the bank that issued the card, report that you’ve found it, and then… destroy the card. It’s entirely possible the owner hasn’t even noticed it’s missing yet: with contactless payments now so widespread, a physical card can sit untouched in a wallet for quite a while. The bank will block the card, notify the owner that it’s gone, and issue a new one.

That last step — destroying the card — may come as a surprise and even attract some push-back among readers, but we stand by it: a found card really should be destroyed. That way, no one can possibly use it, and you won’t have to hold onto someone else’s property or risk coming under suspicion if money goes missing from the account. The simplest and most reliable way to destroy a card is to carefully cut it into small pieces with kitchen scissors and throw it in the trash or recycle it.

Here’s something worth keeping in mind: these days, a physical card isn’t actually worth all that much to its rightful owner. For one thing, banks reissue cards quickly and easily. With most banks, you won’t even need to visit a branch since the new card gets delivered straight to your door.

For another, getting a new card issued usually doesn’t leave the owner unable to pay for things in the meantime: in many cases, they can just switch to a virtual card or another payment method. So a destroyed card is a much smaller headache for its owner than the risk of its ending up in the wrong hands and being used to drain their account.

And if the card’s disgruntled owner does somehow track you down with questions, just show them this article so they can appreciate the trouble they avoided, thanks to you.

When you shouldn’t destroy a found card

Beyond bank cards, there are also multi-purpose cards, such as ones issued to schoolchildren and students that combine a few functions, like a school or university access pass and a public transit pass. Kids, especially younger ones, lose these kinds of cards fairly often. Restoring full functionality on cards like these can take much longer than reissuing a bank card, and the amounts stored on them are usually small, so if you find one, your best move is to take it to the school or university named on the card and hand it to security or reception / front office.

In short: what to do if you find someone else’s card

To sum it up, if a lost bank card ends up in your hands:

1. Look for the bank’s phone number on the card. It’s usually printed there; if not, you can easily find it on the bank’s official website. Then give them a call. Let them know you’ve found someone else’s card.
2. After the call, destroy the card: cut it into small pieces with scissors and throw it away.

And one more reminder of what not to do: don’t post photos of the card or its details in chats or on social media, don’t hold on to the card hoping to track down the owner, and don’t hand it over to strangers.

We’d also recommend following our blog to stay on top of the latest online threats. And feel free to share this article in that neighborhood chat so your neighbors know exactly what to do if they ever find someone else’s bank card.

As for protecting your own money, it’s worth using a robust, multi-layered security solution that safeguards your money, cards, wallets, and payments. Read more in Five Kaspersky technologies to protect your finances.

What other hidden risks do bank cards carry? Find out in our other posts:

• How to avoid becoming a money mule
• How cybercriminals steal funds from bank cards — and how to protect yourself from such theft
• Web skimmers: why are they particularly sneaky and dangerous?
• NFC carders hide behind Apple Pay and Google Wallet

Mac users have historically trusted their operating system to keep them safe. That peace of mind mostly comes from Apple’s strict control over its ecosystem, and the fact that macOS has historically faced fewer mass attacks than Windows. However, that doesn’t mean Macs are invulnerable: threats do exist, and new ones emerge all the time. Over just the past few weeks, security researchers have published reports on at least two new campaigns that target Apple devices.

The malware used in one of the campaigns has been dubbed CrashStealer, while the other is known as ClickLock. Both rely on different tricks to force users into entering their Mac password, which attackers then use to steal account credentials, crypto assets, documents, and much more. In today’s post, we take a close look at how CrashStealer operates — and how to avoid falling victim to it.

A videoconferencing app with CrashStealer inside

It was back in May 2026 that researchers spotted the first signs this malware was being developed, and by early July, they caught it operating in the wild. The malware earned its name because of its core mechanism: it disguises itself as the macOS built-in crash reporting tool (CrashReporter) while functioning as an infostealer designed to hijack sensitive data.

Researchers managed to trace one of the websites users visited to download the malware. The site poses as a legitimate platform for distributing the video conferencing tool Werkbit.

However, you can’t just visit the site and download the software. Before downloading, visitors are asked to enter a special meeting PIN. This setup likely allows the attackers to limit the distribution scope by targeting only specific, pre-selected victims. Exactly how the cybercriminals choose their targets and deliver the PIN remains unknown.

The “lucky” users with a code end up installing the initial malicious payload — named Werkbit Setup. Interestingly, it carries a valid Apple developer certificate and has successfully passed Apple’s notarization process — meaning it cleared the automated prescan for malicious code. As a result, the attackers manage to bypass the operating system’s built-in Gatekeeper defense. This allows the payload to launch without triggering the usual untrusted software warnings.

Once launched, Werkbit Setup first reaches out to GitHub. Researchers believe using this popular platform helps attackers blend in by making these initial network requests look far less suspicious to security tools. After retrieving instructions from a GitHub repository, the program connects directly to the attackers’ server to fetch CrashStealer itself.

The loader then saves the malware to a temporary macOS folder, launches it, and wipes most of the intermediate setup files. As a result, a fully functional infostealer is up and running within seconds of Werkbit Setup starting. By the way, the user never gets any videoconferencing app.

How CrashStealer works

Unlike the Werkbit Setup loader, the CrashStealer malware itself isn’t signed with an Apple developer certificate. To keep users from suspecting anything, the malware disguises itself as the built-in macOS crash reporting tool, CrashReporter, by using the exact same name, app identifier, and a similar icon.

Once launched, CrashStealer completes a sequence of steps to gain access to sensitive data, establish persistence in the system, and cover its tracks:

1. Remove metadata — including the attribute that flags the app as an internet download.
2. Display a fake system prompt asking for the user’s macOS password.
3. Use the previously captured credentials to gain access to Keychain, the built-in macOS password manager.
4. Check the computer for installed security tools and malware analysis software.
5. Collect saved browser passwords, cookies, Keychain contents, and data from other password managers and crypto wallets.
6. Encrypt the data it stole and prepare it for forwarding to the attackers’ server.
7. Create a copy of itself and establish persistence to launch automatically every time macOS boots.
8. Delete temporary files and other installation traces to make detection much harder.

Step two deserves a closer look. The password prompt that the user sees looks extremely convincing. What’s more, the malware immediately verifies whether the credentials are correct: if you make a typo and enter an invalid password, CrashStealer will pop the window right back up to ask you again.

What data is CrashStealer after?

CrashStealer’s hit list is massive. First and foremost, its operators target Keychain: the built-in macOS password manager where the system stores account credentials, cryptographic keys, certificates, tokens, and more.

Users of third-party password managers aren’t safe either: the malware steals data from 14 of these services, including 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, and RoboForm.

In addition, the malware collects all credentials and cookies stored in Chromium-based browsers — Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium, and NAVER Whale — as well as Firefox. The attackers clearly have a strong interest in crypto assets: CrashStealer specifically targets data from 80 different crypto wallet extensions, including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, Exodus, Keplr, and Solflare.

Finally, the malware scans the Documents and Downloads folders to pick files that might be of interest to the cybercriminals. CrashStealer encrypts all the stolen data with the AES-256-GCM algorithm, ZIP’s it up, and sends it to the attackers’ server.

How to protect your device

The spike in attacks on macOS is a clear wake-up call: Apple users need to get proactive about their security. We recommend:

• Researching apps online before installing them
• Sticking to utilities from official app stores whenever possible
• Using a reliable security solution that blocks malicious websites and stops malware activity on your device
• Keeping all your credentials and banking details in a secure password manager. One option is Kaspersky Password Manager— which, notably, wasn’t listed among the apps targeted by CrashStealer

Kaspersky security solutions detect the malware described in this post and assigns to it the verdicts HEUR:Trojan-Downloader.OSX.Agent.gen and HEUR:Trojan-PSW.OSX.Agent.gen.

Starting last year, Android users have been seeing the “number is now verified” system notification more frequently. And in some cases people even find mysterious outgoing text messages in their history that they never sent.

These messages often cause confusion and even anxiety: has a virus infected the phone? Are tech giants spying on our phone numbers? Let’s break down how this feature works, and what potential risks it poses to your privacy.

Why all these phone number verifications?

The notification pops up whenever Google’s phone number verification feature is triggered on your device.

Its main job is to make sure that the SIM card tied to a specific phone number is physically inside the phone. Once verified, that phone number automatically links to all active Google accounts on the device.

There are several key services that rely on the verification. Most importantly, it drives Rich Communication Services (RCS) — the modern standard for “rich” messaging right inside your standard text messaging app. It feels like a popular chat app, but without the need to install anything extra. Unlike iMessage, which is locked to Apple’s ecosystem, RCS works across compatible smartphones on various platforms since it’s an industry standard set by carriers rather than tech giants. Since recently, both Apple and Android users have been able to exchange RCS messages. For this feature to work in the Google Messages app, Google needs ongoing confirmation that your SIM card is active. If you pull out your SIM card, RCS chats will keep working for about eight days before turning off automatically.

According to Google, phone number verification serves several other purposes as well:

• Account security and recovery. A verified phone number enables quick sign-ins to your Google account, two-factor authentication, and easy password recovery.
• Emergency services and device location. This includes Find My Device, remote phone lock, and sharing your location with emergency responders — including via satellite messaging on the Pixel 9 and certain other modern smartphones.
• Better sharing on Google. This feature helps other people find you faster on Google Meet or Duo, use Quick Share to send you files, and see that the phone number is linked to your profile.

Google also recently confirmed that this data is used to counter scams. Verification helps block calls or text messages from spoofed numbers if both the real owner of the number and the recipient are using Android devices with verified phone numbers.

How does Google verify phone numbers?

Phone number verification technology has been around on Android for quite some time — Google was sending test SMS messages as far back as in 2019. However, it became widely visible to most users following a Google system update in September 2025. The process was baked deeper into the operating system, with number verification now running by default during initial phone setup, and re-running periodically in the background.

There are two main technical methods for the verification process. Which one your device uses depends on your mobile carrier and your version of Android.

The older method relies on hidden text messages. In the background, your smartphone sends a specialized technical text message to Google’s servers. The operating system intercepts this message before you ever see it, which is why it rarely appears in your standard text messaging app. However, due to software glitches or Android customization quirks, these texts occasionally surface in sent messages, startling users. They typically look like this: “(string of letters and numbers) Google is re-verifying the phone# of this device.” Google explicitly notes in its help documentation that standard messaging rates from your carrier may apply.

In recent years, direct carrier verification (via carrier APIs) has become the primary verification method. This approach is more modern and secure than previous ones. The smartphone sends an encrypted token containing device and SIM card identifiers to the mobile carrier, and the carrier responds with the confirmed phone number. The whole process takes just a couple of seconds and runs completely unnoticed by the user. Both global telecom giants and smaller providers have connected to this verification network. Notably, third-party apps can also tap into the results of this check through Firebase Phone Number Verification, getting confirmation from your mobile carrier about which phone number is active on the device.

“Other device data” and privacy concerns

In its official documentation, Google notes that device identifiers and SIM card data may be collected during verification. In practice, this refers to unique identifiers for the SIM card and its subscriber profile (ICCID and IMSI), as well as technical device identifiers needed to run mobile networks. Google also explicitly states that it does not sell your personal information, including your phone number, to anyone.

Naturally, sending additional unique identifiers to Google — especially given the scale of its advertising business — always raises concern among privacy-conscious users. Here’s what you should keep in mind:

Metadata collection. To run RCS, Google exchanges data with your mobile carrier. Even when the content of RCS messages is encrypted, metadata — such as who is messaging whom and when — can still be stored on your carrier’s servers, and in some cases, on Google’s servers. As cybersecurity experts at the Electronic Frontier Foundation point out, if privacy is your top priority, you’re better off sticking to dedicated encrypted messaging apps.

Linked accounts. If you have both a personal and a work Google account (or a personal and a family account) set up on the same phone, the verified number will automatically link to both profiles. The operating system does not offer built-in tools to separate numbers for different accounts on a single device.

Phone number leaks. Apps on your device can already access various user identifiers, including your phone number. However, this verification system makes it easier to link multiple phone numbers to a user who has multiple Google accounts. And while Google states that it never sells phone numbers, you cannot say the same with confidence about obscure third-party Android developers.

On by default. The feature is enabled out of the box, and most users have no idea their device is silently querying their carrier in the background. While you can opt out in your Google settings once you notice it, there’s no guarantee that any data already collected will actually be deleted.

Turning off verification — why and how

For most users, verification is genuinely helpful. It simplifies account recovery, makes finding a lost phone easier, powers modern text messaging features, and assists emergency services when every second counts.

However, if you want to minimize the amount of metadata sent to Google, mobile carriers, and other data brokers, you can manually disable the feature. Here’s how:

1. Open your Android smartphone’s settings.
2. Tap Google, select the account at the top, and switch to the All services tab.
3. Under Privacy and security, tap Phone number verification.
4. Turn off automatic phone number verification.

If you also want to disable Better sharing on Google, go to Settings → Google → Manage your Google Account → Personal info → Contact info → Phone, select your number, and turn off the setting.

If you have multiple Google accounts on your phone, you’ll need to repeat these steps for each one. Unfortunately, verification sometimes turns itself back on automatically, and there’s no reliable way to prevent this on standard consumer phones with stock software.

Keep in mind that disabling verification means losing access to RCS chats in Google Messages — forcing you to fall back on basic SMS, or switch to alternative secure messaging apps. You also won’t be able to use that number for quick account recovery should you forget your password.

To thoughtfully customize your privacy settings across all your devices — regardless of the operating system, browser, or app — check out our free online tool, Privacy Checker.

Curious about other privacy risks you might not even know exist? Check out our other deep dives, here:

• Post-breakup digital hygiene: what to check and shut down
• What happens in the bedroom stays in the bedroom
• Is telehealth actually safe?
• Predator vs. iPhone: the art of invisible surveillance
• Brain drain: vulnerabilities in mental health apps

A breakup is a major upheaval — the kind that turns life upside down. The familiar order of things, where two people shared the same interests, moments, and often even the same physical space, collapses in an instant, leaving each of you in a world of your own.

Besides that, couples are connected not just in real life, but digitally too. Shared subscriptions, saved addresses and passwords, access to joint cloud storage — all of that used to be woven into your day-to-day life. Moving on emotionally can take a long time, sure, but there are steps you can take right now that will tighten up your security — even if they won’t help you get over your ex.

Here’s what you need to check after a breakup, which services to disconnect, and why you should do it even if the split was amicable.

Digital hygiene: your insurance policy

Cutting off your ex’s access to your online accounts isn’t paranoia — it’s looking out for your own security. A breakup doesn’t automatically sever your digital ties: any access you granted each other during the relationship stays active until someone manually shuts it down. Most of the time, nobody’s plotting to actually exploit it, yet it can still lead to anything from awkward moments to a genuine risk of being tracked.

Take Aleta Dignard-Fung, of Las Vegas, who told NPR that after breaking up with her boyfriend, it didn’t immediately occur to her that he still knew her Spotify password. One day, in the shower with music playing, she noticed her playlist suddenly switch. Her ex had logged in from another device and started playing his own chosen tracks. “It was just kind of like the Spotify wars, and we’d just spend like 10 minutes trying to override each other’s songs,” she admitted. But the fallout isn’t always this lighthearted.

Relationship coach Susan Winter shared a case from her own practice in that same interview. One of her clients simply couldn’t let go of his ex-girlfriend after their breakup. The two had shared an OpenTable account — the restaurant reservation service — and she’d never revoked his access. He started tracking her bookings: where she was going, what time, how many people. That’s how he kept tabs on whether someone new had entered her life.

These two stories, while showing very different behavior from the exes involved, both trace back to the same root cause: accounts that were never properly locked down. In the former case, it led to an awkward moment. In the latter, it led to anxiety and a real sense of being watched. To make sure neither scenario happens to you, it’s worth running through a quick checklist.

Terminate your partner’s sessions

In the settings for your social media, messaging apps, email, and other key services, pull up the list of active sessions and log out everything except your current devices.

Change your passwords

Update the passwords to any key accounts your partner might have known — say, if you used a meaningful date as your password. If you reused the same password across multiple services, change it everywhere. While you’re at it, review your security questions and your backup email or phone number for account recovery — neither should still be tied to your ex. To skip the hassle of memorizing new credentials while still leveling up your security, we recommend using a password manager — it’ll generate a unique, strong password for every account, and save and sync it across all your devices; the only thing you need to remember is a single main password.

Check two-factor authentication and trusted devices

Make sure verification codes only go to your own device. Remove your partner’s devices from your trusted list — you can do this in your Apple and Google account settings.

Split up your shared Apple/Google accounts

If you shared an Apple or Google account, sign out of that. Turn off Family Sharing, iCloud, and backups. Check your shared photo albums too — anything that lands there automatically is visible to your ex as well.

Review your subscriptions

If you shared subscriptions — streaming services, family plans, that kind of thing — cancel them or set up new ones and link your own card.

Check your bank cards

If your ex’s card is linked to a marketplace, delivery app, or rideshare service account you own, remove it from your saved payment methods. If your card is linked to their account and you no longer have access to it, the safest move is to just get your card reissued.

Revoke smart home access

Cut off your ex’s access to cameras, video doorbells, GPS trackers, and smart speakers. If the devices were on a shared account, change the password or move them over to your own personal account.

Review your privacy settings

Check the privacy settings across your accounts on various services and social media using our free online tool, Privacy Checker. It walks you through a privacy configuration tailored to your operating system, platform, and even your browser.

If you notice signs of stalking

Reach out to advocacy or legal aid organizations — they can help you map out the best course of action. It’s also worth leaning on family and close friends who can support you through a tough situation. On Android devices, you can use our security suite with the Who’s Spying on Me feature. It’s designed to help you detect tracking and stalking so you can take the right steps to protect yourself. The feature includes:

• Stalkerware Detection. Flags apps designed to secretly monitor your life and collect data you’d never want shared with anyone else.
• Device Scanner. Finds planted trackers that let someone follow your movements and always know where you are.
• Permissions Control. Shows which apps have access to permissions that could make it easier for someone to spy on you or compromise your privacy.

What can actually help — and what might make things worse — during this difficult time? Check out our other posts:

• Love, AI & robots
• What happens in the bedroom stays in the bedroom
• How chatting with a bot can lead to tragedy
• AI and the new reality of sextortion
• Digital detox: How to take a safe break from screens
• Subscription security: how to protect your account, your wallet… and your sanity

When targeting an organization to steal information, maintaining a low profile is critical for attackers. They typically aim for long-term persistence, which requires avoiding security alerts while preserving access in case they’re detected and the organization initiates incident response or routine password resets. Malware such as infostealers or ostensibly legitimate remote monitoring and management (RMM) tools fail the first requirement: their use triggers EDR and generates suspicious events in SIEM consoles. Relying on stolen credentials conflicts with the second requirement: the moment the security team suspects a compromise, passwords can be changed immediately — terminating access. If attackers attempt to steal browser cookies instead of passwords, they face a different challenge: many online services now correlate device characteristics with the expected session cookie and block access if the cookie is used on an unrecognized device. Furthermore, cookie theft protection mechanisms implemented in Chromium-based browsers (such as Chrome, Edge, and Opera) this year have made this approach significantly more difficult.

To address this persistence challenge, the ToddyCat APT — whose main game is spying — developed a novel technique. Kaspersky experts discovered this method during an incident investigation and named it Shadow Token via Remote Debug (STRD). This technique allows the attackers to establish reliable, persistent access to a victim’s mailbox and other resources in Google Workspace. With minor adjustments, the same approach could potentially be adapted to target other services that grant third-party application access via OAuth 2.0 authentication.

How an STRD attack works

First, the attackers must compromise the victim’s system with malware. In past campaigns, ToddyCat gained initial access to organizations by exploiting known vulnerabilities in server software and distributing malicious loaders via messaging apps. The specific employee targeted by the attackers might not notice the intrusion at all. This can occur, for example, if the adversary first obtains privileged administrative credentials and uses them to deploy the malware onto targeted machines remotely. Crucially, the deployment and execution of this malware mustn’t trigger immediate security alerts.

Once active, the malware executes an STRD attack, connecting the attackers’ remote service to the victim’s mailbox using the OAuth 2.0 protocol. This process requires no user interaction and shows no visible activity on the screen. To the cloud environment (Google Workspace, in the case at hand), the activity appears as if the user has legitimately authorized a third-party app for email access or data backup.

After that, the malware can terminate its operations and even delete itself from the system. The adversary retains direct access to the mailbox using the acquired OAuth token — and they need no connection to the victim’s endpoint or to the corporate network for that. Depending on the organization’s Google Workspace configuration, this access can persist for an extended period and survive subsequent password resets.

The core concept of Shadow Token via Remote Debug

At the heart of this attack is a connection to Google Workspace services via OAuth 2.0. This is a legitimate workflow used whenever a third-party application requests access to calendar data, emails, or Google Drive files. For example, to display calendar meetings in Zoom and automatically generate conference links, a user must authorize Zoom to access Google services. Similarly, configuring a third-party email client or calendar app requires granting permission. During this authorization process, the service requesting access opens a new browser window. In this window, Google Workspace first prompts the user to select the appropriate account. Once the account is chosen, the subsequent screen displays the specific permissions requested by the third-party app, allowing the user to either approve or deny access. For this scenario to proceed seamlessly, the user must already be authenticated to Google services in their browser — which is typically the case in organizations using Google Workspace. If the user isn’t authenticated, additional steps for entering credentials and completing multi-factor authentication are introduced into the sequence.

The ToddyCat hackers developed a malicious tool called Umbrij to facilitate a two-step covert authorization process when the user is already authenticated in Google. First, the malware identifies the browsers installed on the system, and locates the specific folder storing the user’s active profile for each. The attackers target Chrome and Edge, as these are the browsers most likely serving as the primary ones within the organization.

Next, Umbrij copies the entire user profile folder to a different directory on the machine. It then launches an instance of the browser, specifying the path to the duplicated profile via the command line. Because this duplicate profile contains the user’s session cookies, websites with saved credentials won’t prompt for re-authentication. Furthermore, since this occurs on the exact same computer where the primary browser is running, online services detect no anomalies. The browsing history for this newly launched instance is isolated within the new folder, keeping it hidden from the user’s main account activity.

Crucially, the browser is launched in a dedicated debugging mode typically reserved for web development. The browser window and user interface don’t appear on the screen at all (headless mode). Instead, the browser can be controlled through a debugging port using the DevTools protocol, allowing the malware to issue commands and read the state of the screen. To orchestrate these actions, Umbrij leverages Puppeteer, a legitimate automation library.

After verifying that the debugging browser instance has launched successfully, Umbrij opens a legitimate Google Workspace OAuth screen within it. The request sent to Google is engineered to bypass additional security checks while requesting maximum access privileges. For the application ID — the identity supposedly requesting these extensive permissions — the malware impersonates one of two legitimate tools: Google Workspace Migration for Microsoft Outlook (GWMMO), or Google Workspace Sync for Microsoft Outlook (GWSMO).

When Google opens the window within the headless browser, Umbrij uses debugging tools to programmatically click on the corporate account name and the confirmation buttons. As a result, Google generates an authorization code for the app. Umbrij extracts and saves this code, subsequently forwarding it to the attackers’ command-and-control server. Finally, operating entirely within their own infrastructure rather than on the victim’s computer, the attackers exchange this authorization code for an OAuth access token. This single token is all they need to maintain long-term unrestricted access to the mailbox.

How to protect against OAuth token theft

If a Google Workspace account is compromised, incident response measures must include the following steps after collecting the necessary logs and other forensic data for investigation:

• Resetting the affected user’s password
• Terminating all active web sessions for the user
• Revoking OAuth tokens and third-party app permissions
• Reviewing and removing access granted through legacy App Passwords

In addition, security and IT teams must systematically audit issued OAuth permissions, revoke unjustifiable access rights, and restrict capabilities that allow excessive or unauthorized permission grants. We covered this topic in detail in our article on blocking unwanted AI assistants.

How to prevent exploitation of Shadow Token via Remote Debug

While Kaspersky users are protected against the Umbrij tool, security teams should proactively implement policies that prevent standard users from launching browsers in debugging mode. This functionality is intended exclusively for website and web app developers. This restriction can be enforced through the DeveloperToolsAvailability group policy (available for both Chrome and Edge).

Additionally, configure monitoring within your SIEM/XDR to track the launch of browser instances with an active debugging port. This event serves as a strong indicator of this specific attack technique.

Unchecked AI in the workplace quickly becomes a massive loophole for data leaks and security breaches. All too often, employees drop sensitive company data into public chatbots, or install rogue AI assistants on their own — in the process handing over way too much access. In a previous post, we broke down the different types of risky AI systems, and later shared some tips on how to turn off the built-in AI features on major tech platforms. Today let’s take a look at practical ways to block or restrict the unauthorized “helpers” employees might be using — from ChatGPT and Grammarly, to meeting bots like Fireflies and Read AI.

How to detect and restrict ChatGPT

ChatGPT is the biggest culprit when it comes to unauthorized AI use worldwide. A quick word of warning, though: an outright ban only sends users hunting for sketchy third-party sites or messaging app chatbots that hook into the same service. That’s why it’s always a good idea to offer an approved alternative before pulling the plug.

Detecting it: keep an eye on the NGFW or web filter for traffic heading to chat.openai.com, chatgpt.com, oaistatic.com, oaiusercontent.com, or cdn.oaistatic.com. It’s also smart to use EDR/EPP tools to scan browser histories, installed apps, and browser extensions across corporate devices.

Locking it down: use the firewall or web filter to block the entire AI Services category, and set up DNS to reroute traffic away from those OpenAI domains. Browser policies can also be used to ban ChatGPT-powered extensions. Better yet, block all extensions not on a pre-approved allowlist. Finally, use application controls and EPP solutions to stop users from installing the official desktop app (ChatGPT.exe or com.openai.chat).

How to detect and restrict Claude and Claude Code

Detecting it: use the NGFW or web filter to track traffic going to claude.ai, anthropic.com, *.anthropic.com, and api.anthropic.com. EDR/EPP or application control tools can also be used to scan employee computers for the desktop app (claude.exe).

Locking it down: drop a blanket block on the AI Services category through the NGFW or web filter, and tweak DNS settings to reroute traffic away from the aforementioned Anthropic domains. Next, use browser policies to shut down Claude-powered extensions. Finally, use application controls and the EPP platform to prevent users from installing the desktop app.

How to detect and restrict Perplexity AI

Detecting it: keep tabs on the NGFW or web filter to flag any traffic heading to *.perplexity.ai or pplx.ai.

Locking it down: just like the others, add the AI Services category to the NGFW or web filter blocklist, and use DNS routing to redirect traffic away from those domains.

Configure the browser to block third-party extensions from being installed. If Firefox is used in the organization, be aware that recent versions come with Perplexity built in. Luckily, these AI features can be turned-off company-wide using enterprise policies — specifically, by setting SidebarChatbot = blocked. The full list of tweaks can be found in the Firefox documentation.

How to detect and restrict DeepSeek

Detecting it: keep an eye on the NGFW or web filter for traffic hitting deepseek.com, chat.deepseek.com, api.deepseek.com, or platform.deepseek.com. For better precision, analyze the SNI (server name identification) in TLS connection requests. For mobile devices, look out for the official app (com.deepseek.chat).

Locking it down: blocklist the AI Services category on the NGFW or web filter, and reroute traffic to DeepSeek’s domains via DNS settings. Use browser policies to block third-party extensions, and lean on MDM/EMM tools to restrict the mobile app.

How to detect and restrict Mistral, xAI Grok, and Character.ai

The playbook for these tools is exactly the same as DeepSeek, so here’s the quick list of domains to watch for and block: chat.mistral.ai, mistral.ai, console.mistral.ai, grok.com, x.ai, api.x.ai, character.ai, beta.character.ai, and c.ai.

A quick word of warning on Grok: because Grok is baked into X, blocking this specific AI access point means blocking the entire social media platform.

How to detect and restrict Slack AI

Detecting it: in the Slack workspace admin dashboard, look under Analytics → Slack AI usage. If an enterprise plan is used, the detailed Slack logs can be searched for any events starting with the ai_ prefix.

Blocking it with policies: in the organization’s Slack settings, click through the Workspace settings → Roles & permissions → Feature access, and change the permission to “no one”. Slack has a step-by-step guide in their help center.

Locking it down: shutting this down at the network level is tricky; it can be pulled off with a finely tuned CASB solution in place. Also, don’t forget the importance of blocking rogue integrations and keeping external AI services from tapping into Slack data in the first place. We covered how to lock this down using OAuth controls in a previous post.

How to detect and restrict Zoom AI Companion

Detecting it: if a corporate Zoom subscription is in use, just head to Admin Center → Reports → AI Companion usage. Detecting Zoom’s AI when employees join external meetings or use free accounts is a lot tougher, but email filters can be set up to flag incoming AI-generated meeting notes by scanning for subject lines or text containing “Meeting summary” or “Meeting assets”.

Blocking it with policies: for the company’s own Zoom subscription, go to the Admin Portal → Account Management → Account Settings → Meeting → AI Companion and toggle it OFF for everyone.

Locking it down: unfortunately, AI Companion is baked into Zoom’s DNA, so the only real option is blocking Zoom altogether.

How to detect and restrict Grammarly

What looks like an innocent spellchecker is actually one of the biggest culprits for workplace data leaks.

Detecting it: check the NGFW or web filter logs for traffic hitting grammarly.com, *.grammarly.com, and gnar.grammarly.com. EDR and MDM/EMM tools can also be used to hunt down the standalone desktop apps (Grammarly Desktop.exe and the macOS version), as well as the Grammarly browser extension.

Locking it down: use firewalls to block those domains at the network level, and EPP to stop employees from installing the desktop app, browser extensions, or the Grammarly add-ins for Microsoft Word and Excel.

How to detect and restrict meeting assistants: Fireflies, Read.ai, Tactiq, Fathom, and Granola

This massive category of third-party SaaS tools records and analyzes meetings — creating a massive risk for data leaks. The trickiest part? Outside clients or vendors can bring these bots into a meeting just as easily as employees can.

Detecting them: run an audit on calendar invites, and look for bot participants using email domains like @fireflies.ai, @read.ai, @tactiq.io, @fathom.video, or @granola.ai. Zoom, Teams, or Google Meet logs can also be used to review external participants who joined past calls.

Locking them down: since it’s impossible to control what outsiders do, blocking these bots comes down to tightening meeting rules. The best moves are: blocking users from granting OAuth permissions for bots to join calls, restricting employees from inviting unapproved external participants, or locking down meeting recording access for external users. That last option is usually the least painful way to keep bots out without disrupting business.

How to detect and restrict AI code editors: Cursor, Windsurf, and the like

Detecting them: use EDR/EPP tools to scan for executables like cursor.exe or windsurf.exe. It’s also worth monitoring network traffic heading to cursor.com and windsurf.com, as well as traffic hitting various AI model API providers. Keep in mind that there’s a pretty extensive list of API hosts to monitor here, since these editors aren’t tied to just one specific AI vendor.

Blocking them with policies: these apps can be prevented from being installed by setting up filters based on the developer’s digital signature certificate. Alternatively, a strict application allowlist can be employed where only pre-approved software is allowed to run.

Locking them down: rely on the EPP/EDR platform to actively detect and block these applications from running.

How to detect and restrict local AI tools: Ollama, LM Studio, and GPT4All

On one hand, this category carries fewer data leak risks because the AI models run completely locally on the user’s machine. On the other hand, it opens up a whole new can of worms: these apps themselves aren’t always highly secure, and can become targets for cyberattacks. Plus, it still means that employees can misuse models or process data in unauthorized ways.

Detecting them: EDR/EPP tools are the best line of defense here. They should be used to flag known local AI files and processes like ollama.exe, ollama serve, lmstudio.exe, LM Studio.app, jan.exe, or gpt4all.exe. From a network perspective, it’s worth scanning for open ports on local devices — typically port 1234 for Ollama and LM Studio, or port 8080 for WebUIs (using an additional fingerprint check of the server response). Another massive red flag is the presence of large files (often several gigabytes) containing language model weights. Look out for extensions like .gguf, .bin, or sometimes .safetensors.

Locking them down: use EPP/EDR platforms or windows AppLocker to block these applications by name, or switch to an application allowlist.

How to detect and restrict autonomous agents: OpenClaw, NemoClaw, and NanoClaw

This is easily one of the most dangerous categories of AI tools out there. These agents mix high-level independence with access to untrusted data, making them a massive security headache.

Detecting them: use EPP/EDR tools to sniff out active processes like openclaw, nanoclaw, nemoclaw, or clawdbot. Also keep an eye out for devices running Node.js that suddenly start launching Bash or Python scripts. Another dead giveaway is the appearance of system folders like ~/openclaw, ~/nanoclaw, ~/.claw*, or ~/clawhub. At the network level, monitor connections to the AI model APIs we mentioned earlier, as well as traffic hitting servers like openclaw.ai, nanoclaw.dev, or clawhub.*.

Locking them down: the safest bet is to use strict application allowlisting (only allowing approved software to run), or to specifically ban the known agent apps listed above. On top of that, consider blocking non-developers from installing Node.js and Docker, neither of which they need on their computers anyway.

Lately, software developers have been baking AI features straight into everyday work tools, operating systems, and browsers. In some cases, they’re genuinely handy. However, their presence introduces specific risks, which means plenty of companies are hesitant to give employees access to these tools. In a previous post, we categorized these unwanted AI systems, looked at how to spot them at the network and endpoint levels, and covered the ultimate universal kill switch: managing OAuth access across major corporate platforms. In this deep dive, we’re getting tactical: breaking down how to disable or restrict the AI built into popular platforms.

A quick heads-up: major software vendors occasionally change the names of their AI settings and tweak how they function. If any of the options mentioned below are missing or aren’t working as expected, a quick web search for the setting’s name will usually point you to its new location or branding.

How to turn off Microsoft 365 Copilot

Detection: you can check actual Copilot usage in the logs by going to Microsoft 365 admin →  Copilot usage report.

Disabling via policies: in the Microsoft 365Admin Center, go to Settings →  Integrated Apps, find Copilot in the Available Apps list, and select Block. More granular configuration policies are available under Customization →  Policy Management. The Policies page here contains over two thousand entries, so you’ll want to filter them by the keyword “Copilot” (detailed guide). Given that Copilot is a paid add-on for Office, another way to block it — and save money by doing so — is to simply avoid assigning users SKUs that include Copilot.

We recommend separately blocking Copilot Chat, which is available in Teams, Edge, Outlook, and several other services. Yes, it’s not Copilot itself. And yes, it has to be blocked separately by following this guide.

Additional layer of protection: you can block the domains copilot.cloud.microsoft and m365.cloud.microsoft/chat at the web filter or NGFW level. However, Microsoft explicitly advises against this, warning that it could break other Microsoft 365 features.

How to turn off Windows Copilot

Beyond the Office version of Copilot, you also need to manage its consumer-facing cousin.

Detection: look through your NGFW or other network logs for traffic hitting copilot.microsoft.com, bing.com/chat, or edgeservices.bing.com.
Disabling via policies: in Windows Group Policy, navigate to Computer Config →  Admin Templates →  Windows Components →  Windows Copilot. In Microsoft 365 Group Policy, go to Admin center →  Block consumer Copilot for organizational accounts.

Additional layer of protection: block the Copilot.exe executable from running entirely.

How to turn off the Copilot sidebar in Edge

Detection: look through your NGFW or other network logs for traffic hitting copilot.microsoft.com, bing.com/chat, or edgeservices.bing.com.

Blocking: configure the following MS Edge Group Policies: HubsSidebarEnabled = false, EdgeShoppingAssistantEnabled = false, CopilotPageContext = Disabled (false), CopilotNewTabPageEnabled = false, Microsoft365CopilotChatIconEnabled = false, GenAILocalFoundationalModelSettings = 1 (note that disabling this unexpectedly requires a 1 instead of a 0).

Second layer of protection: block the domains copilot.cloud.microsoft and m365.cloud.microsoft/chat at the web filter or NGFW level. However, Microsoft explicitly advises against this, warning that it could break other features.

How to turn off the Gemini Assistant in Google Workspace

Detection: check the Workspace Admin Console (admin.google.com), Gemini usage report section.

Blocking via policies: in the Admin Console, navigate to Apps →  Additional Google services → > Gemini app, and set it to OFF. Then, go to Manage Workspace smart feature settings →  Smart features in Google Workspace, and set it to OFF.

Second layer of protection: block network traffic to the domains gemini.google.com, bard.google.com, and aistudio.google.com.

How to turn off Gemini in Google Chrome

Detection: check your Chrome Enterprise reports (Chrome management →  Reports), or look through network traffic logs for connections to the previously mentioned domains.

Blocking via policies: in your Chrome Enterprise policies, configure the following settings: GenAILocalFoundationalModelSettings = 0, HelpMeWriteSettings = 2 (disabled), TabOrganizerSettings = 2, CreateThemesSettings = 2, DevToolsGenAiSettings = 2.

Additional layer of protection: block network traffic to the domains gemini.google.com, bard.google.com, and aistudio.google.com. Additionally, block unauthorized Chrome/Chromium installations (those outside your policy management) with the help of host-based application control tools like EPP/EDR or AppLocker.

How to turn off Apple Intelligence

Detection: on your NGFW and web filters, traffic hitting apple-relay.apple.com and *.apple-cloudkit.com is a clear indicator that Apple Intelligence is active.

Blocking via policies: any managed Apple device allows you to disable individual AI features, though there isn’t a master switch you can flip to shut down “all AI”. In your MDM profile, you need to set the following keys to false (disabled): allowWritingTools, allowMailSummary, allowGenmoji, allowImagePlayground, allowImageWand, allowPersonalizedHandwritingResults, allowExternalIntelligenceIntegrations, allowExternalIntelligenceIntegrationsSignIn, allowNotesTranscription, and allowNotesTranscriptionSummary. Here is a brief configuration example:

<dict>
<key>PayloadType</key>
<string>com.apple.applicationaccess</string>
<key>allowWritingTools</key>
<false/>
<key>allowMailSummary</key>
<false/>
</dict>

Despite Apple’s shift toward declarative device management, these AI features still need to be managed through traditional MDM payload settings.

Second layer of protection: block network traffic to the hosts mentioned above — though the obvious downside for mobile devices is that this won’t work once they leave the corporate network.

One of the biggest football (soccer) events of this summer is the World Cup 2026. The tournament is co-hosted by three countries: the U.S., Canada, and Mexico. Unfortunately, events of this scale attract not just fans, but also scammers from all over the globe. We’ve already covered how cybercriminals are prepping for the World Cup online, and today we’re talking about digital security for fans on the ground in Mexico.

The country will host 13 matches and welcome millions of tourists. They’ll be staying in hotels, heading to games, checking out restaurants, navigating airports, and visiting popular tourist spots — and everywhere they go, the temptation to connect to public Wi-Fi will be high.

We’ve surveyed more than 84 500 (!) public Wi-Fi access points in Mexico City, Guadalajara, and Monterrey — and we have a lot to share about their security. Spoiler alert: many networks are still using outdated security standards, so you really shouldn’t go on vacation without reliable protection and an eSIM.

What and how we tested

Walking across Mexico looking for public Wi-Fi access points would have been a bit tough, though that’s exactly what we did for a similar Wi-Fi security survey in Paris. You can check out the results of that in our post, How safe is Wi-Fi in Paris?

This time the mission was far more demanding: mapping the wireless landscape of three major metropolises. That’s why we went wardriving — scanning for and logging wireless networks from a moving vehicle while equipped with a smartphone or laptop. It’s similar to searching for Wi-Fi on your phone, where the device constantly listens for nearby networks. Except instead of connecting to them, we just collect data about them.

All information was used strictly for passive observation and infrastructure analysis. Beyond receiving publicly broadcast service information, the experts of Kaspersky’s Global Research and Analysis Team (GReAT) didn’t attempt to authenticate, intercept traffic, exploit systems, or otherwise interact with the wireless networks they discovered. Mobile access points deployed in cars and on mobile devices were excluded from the sample.

Our main target was Mexico City — the capital and one of the most densely populated cities in Latin America. We took a drive through popular tourist spots: Mexico City Stadium, Mexico City International Airport, Zócalo, Paseo de la Reforma, Colonia Roma, La Condesa, Polanco, Coyoacán.

In Guadalajara and Monterrey, we drove similar routes: stadiums, main avenues, airports, and popular neighborhoods. Below you can see a heatmap of the areas we covered, ranging from red for areas with the highest density of public access points, through yellow and green, to blue for the lowest concentration.

We used passive radio reconnaissance to log 84 500 signals and 69 500 unique network identifiers across these three cities. The majority of the signals were caught in Mexico City (61.4%), followed by Guadalajara (23.6%) and Monterrey (14.8%).

What we analyzed:

• Wireless network identifiers (SSIDs): the names that show up in your list of available Wi-Fi networks
• Information that can be gleaned from these identifiers
• Default router configurations and how ISPs deploy their networks
• Frequencies used and signal characteristics
• Channel load and radio frequency spectrum usage
• Wireless network security configurations:
  • Open and insecure networks
  • Networks with WPS enabled
  • Secure networks (WPA2/WPA3) with WPS activated

You can find the full version of the study on the Securelist blog.

Telltale public Wi-Fi access point names

Network names (SSIDs) can tell you a lot by unintentionally revealing information about hardware manufacturers, ISPs, deployment methods, and whether an access point belongs to a business or a private user.

About 34% of the public Wi-Fi networks we logged didn’t bother changing their names at all, either sticking with the factory SSIDs from the router manufacturers or using standard naming conventions from their ISPs. For attackers, this can be a pretty solid hint, since this kind of network name lets them know which provider owns a given access point, what hardware is being used, and how it’s likely configured by default.

Another troubling nuance is the large number of Wi-Fi networks (over 30%) that use the access point’s MAC address (BSSID) as the visible network name. The first few bytes of a BSSID contain an Organizationally Unique Identifier (OUI), which gives away the router’s manufacturer. This is a useful lead for bad actors: they can find out who made the hardware and test for vulnerabilities specific to that brand’s models.

Is Mexican Wi-Fi well-protected?

An access point secured with WPA2/WPA3 can be considered more or less safe. All other authentication mechanisms yield much weaker results. We grouped the public Wi-Fi networks into four categories:

• Secure (WPA2/WPA3)
• Unsecured (open/WEP)
• Weak (WPA)
• Undetermined

The results are roughly the same across all three cities: about 82% of all analyzed access points are protected by secure standards. The outdated and insecure WPA protocol was practically nonexistent. However, more than 10% of the access points turned out to be completely unsecured. Connecting to these networks carries the risk of traffic interception and hidden surveillance.

But security isn’t evaluated by WPA protocols alone. We also checked for the presence of WPS, the infamous feature for quickly connecting to a network without entering a password, which is highly vulnerable to attacks. It turned out that WPS is enabled on nearly half (47%) of the access points in Mexico City, 43% in Guadalajara, and 41% in Monterrey. On average, 45% of the access points are potentially vulnerable to WPS-related attacks — sacrificing security for the sake of convenience.

What’s more, this feature frequently remained active even on seemingly secure WPA2/WPA3 networks — about half of them utilized WPS. This shows that having WPA2/WPA3 is still not enough to consider a Wi-Fi access point safe, as additional features like WPS can still leave the door open to attacks.

What else every tourist needs to know

Digital risks on a trip aren’t limited to public Wi-Fi alone, especially now that many are shifting away from public Wi-Fi to an eSIM. There are still plenty of threats in crowded places: public USB chargers, QR codes with swapped links, NFC and Bluetooth attacks, and, of course, social engineering tactics. Let’s break it all down.

Charging stations. Public USB chargers can also be dangerous: bad actors could potentially gain access to the data on your device or try to install malware. We covered these attacks in detail in our post, Data theft during smartphone charging.

Dangerous QR codes. Criminals can plant phishing QR codes in popular tourist spots. The pretexts can vary wildly; for instance, ads for team-specific fan “events”, or links supposedly offering discounts or restaurant menus. In reality, any QR code posted on the street can be considered insecure by default, and you shouldn’t scan them with your smartphone unless you have a QR code threat analyzer installed.

Fake broadcasts, tickets, and betting pools. Earlier, we described cases where bad actors were distributing malware via fake IPTV apps to capitalize on the WC26 hype. Remember, even if you plan to watch the tournament from home, you still need to stay alert and not trust the first sites that pop up advertising free broadcasts, offering betting pools, or promising unbelievably generous payouts.

NFC and Bluetooth attacks. Leaving Bluetooth enabled in crowded places can also cause problems: someone might try to discover your device, track you, or initiate an unwanted pairing request. NFC services with contactless payments create additional risks too — especially when paying in sketchy spots.

How to protect yourself and your devices

Despite the prevalence of secure WPA2/WPA3 public Wi-Fi access points in Mexico City, Guadalajara, and Monterrey, our study shows that public Wi-Fi networks remain vulnerable. It’s also important to remember that attackers can create fake networks — so-called evil twins — disguised as legitimate public Wi-Fi in airports, hotels, cafés, and tourist spots.

For the average user, it’s practically impossible to tell how safe a specific access point is when trying to connect. That’s why the safest option is to use cellular data to access the internet — completely eliminating the need for Wi-Fi. Besides, there’s no need to research the nuances of local laws, rates, and other cellular details for every country you plan to visit; you can just buy a global eSIM online in two clicks. We explained how to make the entire process hassle-free in our post, Internet on the go with Kaspersky eSIM Store.

If you still plan on connecting to public Wi-Fi, always use a VPN to secure your device and data when connecting to unfamiliar — especially unsecured — Wi-Fi networks. This creates an encrypted tunnel between your device and the VPN server, making it impossible to intercept your data along the way. Haven’t picked a VPN yet? Try Kaspersky VPN Secure Connection, which is included with both Kaspersky Premium and Kaspersky Plus subscriptions.

Now, if you still plan to attend the World Cup without any cybersecurity solution, at least follow these basic rules of digital hygiene:

• Don’t use public USB chargers
• Don’t send sensitive information over connections that aren’t secure
• Don’t log in to banking, email, or social media accounts over unsecured Wi-Fi
• Turn off Bluetooth and NFC while walking around in crowded places
• Don’t trust QR codes posted on the street
• Connect to public Wi-Fi only when absolutely necessary

What else to read to make sure cheering for your favorite team isn’t only exciting, but also safe:

• Don’t let fake IPTV apps ruin your World Cup
• Soccer Cyberthreats
• How to watch soccer safely
• Travel safely and comfortably
• Airbnb security: tips for safe travel

Threat actors are already gearing up for this year’s biggest football (soccer) event, the World Cup 2026. With millions of fans looking for ways to stream matches online, many will turn to IPTV apps to watch live TV broadcasts over the internet. It’s no surprise, then, that cybersecurity researchers have discovered multiple campaigns over the past few months where malware was disguised as fake Android IPTV apps.

In this post, we discuss what IPTV apps are, how criminals use fake versions to spread malware, what this malware is capable of, and, most importantly, how to avoid becoming a victim.

What are IPTV apps?

IPTV stands for Internet Protocol Television. This technology delivers TV content over the internet instead of through cable, over-the-air antennas, or satellites. Naturally, the simplest and most common examples of IPTV are the official platforms of TV networks, which can include both websites and dedicated apps.

However, alongside official options, pirate IPTV services also exist. They usually lure users with free or dirt-cheap access to content that can otherwise be hard to find without expensive subscriptions — most notably broadcasts of various sporting events; football matches in particular.

As is typically the case with pirated content, these apps are blocked from official app stores, forcing users to download them from third-party sites. Consequently, the risk of using these services isn’t tied to IPTV technology itself, but rather to the fake apps and modified APK files distributed under the guise of well-known platforms — both official and pirated.

Massiv banking Trojan disguised as IPTV apps

For instance, in February researchers found the Massiv banking Trojan distributed under the guise of fake IPTV apps. Even then, experts noted that this wasn’t the only malware leveraging this tactic — several others were also spotted in the wild. The primary targets of these IPTV-mimicking malicious fakes have mostly been users in Portugal, Spain, France, and Türkiye.

In most cases, the discovered fake IPTV apps lacked the advertised functionality, so users didn’t get access to any content after installing the apps. Instead, the fake app would open the website of a legitimate IPTV service in a built-in browser to mimic normal functioning and avoid raising user suspicion.

Of course, the most interesting activity happened out of the user’s sight. These are some of the features the malware did have:

• Displaying fake windows on top of legitimate ones: fake forms for entering bank details or signing in to official services, as shown in the screenshot below.
• Activating a keylogger: recording and transmitting screen keyboard taps to the attackers.
• Hijacking control of the compromised device.

Perseus steals valuable information from users’ notes

In March, researchers reported on a new campaign where several fake IPTV apps were used to distribute an even more advanced and feature-rich malware strain: Perseus.

Research into Perseus shows that the malware is based on the source code of an Android banking Trojan called Cerberus, which leaked nearly six years ago. Perseus comes in two different versions: Turkish and English. The English-language version is more advanced and shows clear signs of AI-driven refinement.

Perseus abuses Accessibility Services, a set of Android features originally designed to make life easier for users with severe visual impairments. Fraudsters learned long ago how to leverage this tool to steal data from Android devices — a topic we’ve covered in detail across several of our posts.

By abusing Accessibility Services, Perseus gains remote control over the victim’s device. Here’s what it can do:

• Continuously capture and exfiltrate screenshots.
• Send a structured map of the device’s UI for remote manipulation.
• Mimic taps, swipes, text input, long presses, and other UI interactions.
• Turn on the screen, launch apps, and block them from running.
• Trigger a pitch-black screen overlay to hide its activities.
• Log keystrokes.

On top of that, the English-language version of Perseus boasts another notable feature. The malware can hunt for sensitive information like passwords, recovery phrases, and financial data across an entire range of note-taking apps: Google Keep, Xiaomi Notes, Samsung Notes, ColorNote, Evernote, Microsoft OneNote, and Simple Notes.

All of these capabilities help criminals drain football fans’ money not just from various banking services, but from cryptocurrency apps as well.

How not to let cybercrooks ruin your World Cup

The World Cup is just around the corner, and millions of fans worldwide will definitely want to tune in to this year’s premier football event. Past experience shows that cybercriminals frequently cash in on major spectacles like this. So, how can you watch the  matches safely?

• Don’t download apps from unofficial stores.
• Even when downloading an app from an official store — since malware occasionally slips through the cracks there, too— read the reviews carefully. Users who have been burned by fakes and malware often leave comments to warn others.
• Install a robust security app to keep all your devices safe from malware.
• Avoid storing passwords or other sensitive information in note-taking apps. To ensure your data and finances stay secure, use a reliable password manager. By the way, Kaspersky Password Manager includes an encrypted note-taking feature, allowing you to store your valuable information safely.

You can’t even watch TV safely anymore these days! Check out other threats facing TV lovers:

• Is your TV box renting out your network?
• The perfect storm of Android threats
• Are your TV, smartphone, and smart speakers eavesdropping on you?
• The hidden risks of cheap Android devices