Latest news with #cybercriminals
Yahoo
a day ago
- Business
- Yahoo
Amazon Prime customers warned over clever new email scam
Around the world, 200 million people rely on Amazon Prime for faster deliveries, and they are the latest target for cybercriminals. In a message sent to Prime subscribers this month, Amazon has warned that scammers are targeting Prime members with fake emails supposedly from Amazon, claiming that their Prime subscription fee is about to change. An Amazon spokesperson said, 'We are diligently working to help educate consumers to avoid impersonation scams, ensure consumers know it's us, and ensure scammers are held accountable. 'Amazon regularly educates our hundreds of millions of customers about scam prevention best practices to keep them safe from scams.' What do the Amazon scam emails say? The emails suggest that the customer's Amazon Prime subscription will soon auto-renew at a higher price, and offer a way to cancel the subscription. Some of the emails include other personal information in an effort to look more convincing, with the information obtained from other sources such as online leaks, according to cybersecurity company Malwarebytes. The emails offer a 'cancel subscription' button which takes users to a fake Amazon page that then harvests their email and password. Criminals are then able to log in to Amazon accounts or log in to other accounts that share the same email and password combination. What should users do? If you receive an email from Amazon and you use Gmail, Yahoo or other popular email providers, a smile icon next to the address (where a picture would normally show) will show it really comes from Amazon. If that icon is not present, you should be suspicious. Malwarebytes advises, 'If you receive an email like this, don't click on any links. Not sure if a message is from Amazon or not? You can check by going to the Message Centre under Your Account. Legitimate messages from Amazon will appear there. Malwarebytes advises users to report the scam every time, even if they did not fall for it, to keep other users safe. Malwarebytes says, 'Set up two-step verification for your Amazon account. This puts an extra barrier between you and the scammers if they do manage to get hold of your login details. 'Lastly, if you've fallen for this or a similar scam, change your Amazon password and anywhere else you use that password. Also, make sure to monitor your card statements for any unfamiliar charges, and contact your bank immediately if you see anything suspicious.' How can you stay safe from impersonation scams? Amazon offers in-depth tips on how to stay safe on Amazon impersonation scams, with tips here. Amazon warns to be suspicious of any emails with a sense of urgency (ie you have to do something within a certain time span). Any email which urges users to buy Amazon gift cards is also suspicious (Amazon gift cards are a 'currency' used by cybercriminals). Amazon says, 'Our obsession with customers motivates our commitment to ensuring scammers are not using our brand to take advantage of people who trust us. We encourage consumers to report suspected scams to us at so that we can protect their accounts and refer bad actors to law enforcement to help keep consumers safe.'
The Independent
2 days ago
- Business
- The Independent
UK facing ‘very significant' volume of cyber attacks, security minister warns
The UK faces a 'very significant' volume of cyber attacks every year, the security minister has warned as new laws aim to deter hackers from 'extorting' businesses amid a spate of recent incidents. Dan Jarvis said new measures send a signal to cyber criminals that ransom demands will not be tolerated. Proposals from the Home Office would ban public sector bodies and operators of critical national infrastructure from paying hackers. It would also mean private sector companies not covered by the ban would be required to notify the Government if they intended to pay a ransom. 'The UK is not alone in this regard, along with our international allies, we are subjected to a very significant number of cyber attacks every year,' Mr Jarvis told the PA news agency. 'But from a UK Government perspective we are crystal clear that these attacks are completely unacceptable. 'There's more that we need to do to guard against them and that's why we're introducing these measures.' Mr Jarvis said the measures mean cyber criminals will be 'less incentivised' to target UK institutions because of the clarity the ban on ransom payments brings. 'We think these proposals will provide a powerful deterrent, and what we're wanting to do is break the business model of the cyber criminals who think that they can get away with extorting money from UK-based institutions,' he told PA. He stressed the Government would ensure 'cyber criminals, whether they're in Russia or wherever they might be, face the full weight of the UK law'. Ransomware refers to software used by cyber criminals to access the computer systems of its victims, which can then be encrypted or data stolen until a ransom is paid. It comes after four young people were arrested for their suspected involvement in damaging cyber attacks against Marks & Spencer, the Co-op and Harrods in recent months. Microsoft also said on Tuesday night that Chinese hackers had breached its SharePoint document software servers in a bid to target major corporations and government agencies. Furthermore, under the proposals, a mandatory reporting regime would mean companies and institutions that are targeted by ransomware attacks are required to report it. Mr Jarvis said the Government was going to 'look very carefully at the precise details' of the regime but that it would provide more clarity and intelligence to government agencies. M&S chairman Archie Norman told MPs earlier this month that UK businesses should be legally required to report major cyber attacks as he claimed two recent hacks involving 'large British companies' had gone unreported. Mr Norman said the retailer believed an Asia-based ransomware operation, DragonForce, had been involved in the attack – but refused to say whether or not a ransom was paid.
The Sun
2 days ago
- The Sun
Exact signs your email is secretly HACKED as experts warn your inbox is now ‘top prize' for bank-raiding criminals
EXPERTS have revealed how to spot if your email has been hacked, as they become a "top prize" for hackers. While it is best to take a proactive approach to keep hackers away, if you do find that your email has been infiltrated, there are a number of steps you can take to secure it again. 5 5 5 5 Why do hackers target emails? Email inboxes can be valuable for hackers who are after personal information. Not only can they find out information about you through correspondence with friends and family, but they could access financial and other sensitive information. Emails from banks, online retailers and doctors could reveal a treasure trove of personal information for hackers to sell. Once they have successfully hacked into your account, they can then search for the specific information they are after. This allows them to search for information like bank account details, or to commit identity theft. If they manage to get into your emails, they could also access your online accounts using the "forgot password" feature which can in turn lock you out of your accounts. Additionally, hackers could send phishing emails to your contacts to spread malware and other scams. How do I know if my account is hacked? There are a number of signs that might reveal that your email has been hacked, and it's crucial to keep these in mind so you can act quickly. One of the easiest ways to tell if you've been hacked is if you are unable to access your account. When you try to log in, if your username and password are rejected it could be a sign that hackers have changed your password, locking you out of your own account while they wreak havoc. Ring's flying 'spy drone' that monitors your home in the AIR 'coming 2026' – it stalks burglars & even recharges itself Another way to tell if your account has been hacked is if your contacts reach out to ask about a suspicious email you've sent. If hackers have gained access to your account in order to spread malware, your contacts might receive an email containing a suspicious attachment which might prompt them to reach out to ask you about it. Once you become aware of the issue it is a good idea to let your contacts know that your account is compromised so they can avoid opening any malware-riddled attachments. Email hacking methods Phishing scams - Deceptive emails, texts, or messages which trick you into revealing your login credentials on a legitimate-looking but fake website. These steal your password directly. Data breaches - Email and password are stolen from a less secure company you set up an account with. These stolen details are then used to access other services with the same details. Weak or reused passwords - Using simple, easy-to-guess passwords, or reusing passwords can make it easy for hackers to gain access to other accounts after infiltrating one. Credential stuffing - An automated attack where bots take massive lists of stolen usernames and passwords from data breaches and "stuff" them into login forms across the internet, looking for accounts that reuse passwords. Malware Infections - Malicious software, such as keyloggers or spyware, can infect your computer and secretly record your keystrokes, capturing your email password and other sensitive information. Source: McAfee What to do if you've been hacked? Once you've realised that your account is compromised, it's crucial to act quickly to secure your account and prevent any further data leaks. Most email providers will have a recovery page if you have lost your password, or had your account stolen. Using the security questions and contact information you provided when you set up your account, you should be able to regain access using this method. Once you have regained access to your account it's integral to change your password. Using a strong, unique password can make it harder for hackers to access your account in future. If you struggle to remember your different passwords, there are a number of password managers that can ensure you keep this sensitive information safe. Enabling two-factor authentication can be another way to secure your account. This creates an additional layer of protection through a PIN, and will often alert you if someone is trying to access your account. If your email account has been hacked, it's worth checking your other online accounts for any unusual activity, particularly with your finances. To help your contacts avoid phishing scams, make sure to let them know that your account has been compromised.
The Sun
4 days ago
- The Sun
Over 10 million Android users told to turn off devices after Google exposes ‘infection' – exact list of models affected
HOUSEHOLDS have been warned against buying cheap gadgets online that may come pre-installed with dangerous malware. As many as 10 million devices have been affected, according to a recent security warning from Google. 3 TV set-top boxes, tablets and digital projectors being made in China have been found to be either susceptible to a malware known as BadBox 2.0, or have it already downloaded by the time it is shipped. BadBox targets Android devices and has been found inside 24 apps on the Google Play Store, security researchers at MalwareBytes have said. While those apps, and several BadBox servers, were removed as of March 2025, it remains one of the biggest malware threats to internet-connected TVs. The minute consumers set up the device, they open up a backdoor for criminals to access other devices in their home network. Cyber criminals gain access either by installing malicious software prior to the users purchase, or infecting the device as it downloads required applications during the set-up process. Badbox can run advertising fraud, as well as more worrying attacks, such as ransomware, where users are often asked to pay a fee to stop data being leaked. In its security warning, Google wrote: "The BadBox 2.0 botnet compromised over 10 million uncertified devices running Android's open-source software (Android Open Source Project), which lacks Google's security protections. 3 "Cyber criminals infected these devices with preinstalled malware and exploited them to conduct large-scale ad fraud and other digital crimes." The tech giant has now filed a lawsuit in the New York federal court against the crooks behind BadBox. Some of the known devices that have been infected include Android TV boxes with model numbers X88 Pro 10, T95, MXQ Pro, and QPLOVE Q9. It's unclear if these are the only affected TV boxes. Though tablets and digital projectors with unknown model numbers are still reportedly affected. If you think you have purchased a cheap Android-powered set-top box - especially one mentioned above - it's important to check if it Google Play Protect-certified. Google Play Protect is Android's built-in malware and unwanted software protection, which the tech company has updated to automatically block BadBox-infected apps. "While these actions kept our users and partners safe," according to Google. "This lawsuit enables us to further dismantle the criminal operation behind the botnet, cutting off their ability to commit more crime and fraud." The FBI has also issued an alert about the BadBox malware campaign, saying there may be more gadgets affected. "Cyber criminals gain unauthorised access to home networks through compromised IoT (internet of things) devices," the FBI wrote in an alert. "Such as TV streaming devices, digital projectors, aftermarket vehicle infotainment systems, digital picture frames and other products." WHAT TO LOOK OUT FOR There are six signs that your digital gadgets may have been infected with BadBox 2.0 malware, according to the FBI: Possible indicators of BadBox 2.0 botnet activity include: The presence of suspicious marketplaces where apps are downloaded. Requiring Google Play protect settings to be disabled. Generic TV streaming devices advertised as unlocked or capable of accessing free content. IoT devices advertised from unrecognizable brands. Android devices that are not Play Protect certified. Unexplained or suspicious Internet traffic. Image credit: Getty
CNET
16-07-2025
- CNET
Think Twice Before You Click That Link. It Could Be a Scam
If you get a random text asking you to click a link, it's probably a scam. Getty/Karl Tapales You can blame artificial intelligence or data breaches, but the fact is most of us are receiving phishing emails and texts more often than before. At the same time, scam links are getting harder to spot, which is bad news for victims who mistakenly click on a malicious URL while living their busy lives. Phishing and spoofing scams led to more than $70 million in losses in 2024, according to the FBI's Internet Crime Complaint Center. Many links include standard "https" encryption and domains similar to legitimate websites in order to trick everyday people. If you click on a scam link, you could suffer monetary losses. But you may also give up very sensitive information like your name and credit card information to scammers or even risk malware being downloaded onto your device. How to identify scam links Scam links are regularly found in phishing emails, text messages or other communications sent by cybercriminals. They're designed to fool you into downloading malware or bringing you to a fake website to steal your personal identifying information. Some examples of popular phishing scams include unpaid toll, gold bar and employment scams. Criminals typically send these links out en masse -- often aided by artificial intelligence. Enough people fall victim to phishing scams every year that con artists find it worth their while to follow the same playbook. Here's how to avoid taking the bait. Check the URL "Smartphones do their best to block scam links, so attackers use tricks to make their links clickable," said Joshua McKenty, CEO of a cybersecurity company that helps businesses protect mobile phones and call centers from AI-driven phishing scams. For example, you'll want to watch for an "@" sign in the URL, or you might have two different URLs "glued together" by a question mark, he added. Especially if the first URL is a or an link. Dave Meister, a cybersecurity spokesman for global cybersecurity company Check Point, added that you may be able to hover over the URL to reveal the actual destination. People should also look out for "typo-squatting," when the URL looks authentic, but it has "PayPa1" instead of "PayPal." That should tip you off that it's a bad link. Remember the URLs you frequently visit It would behoove everyone to pay attention to the URLs they visit often. "Major brands, especially banks and retailers, don't often change up their domain names," McKenty said. "If the link says it's likely safe. If it says, stay away." Be suspicious of short links Short links are often in texts and on social media. "Sadly, there's no safe way to check a shortened URL," McKenty said. He recommended not clicking on them. " or "shorturl" links often have standard " encryption, which make them appear trustworthy. In these cases, it's best to read the message itself and pay attention to any threatening language or pressure to act immediately to identify the scam. How are scam links sent to victims? Text scams Ironically, these don't always rely on website links. In fact, phone numbers are a frequent vehicle used in scammers' phishing attempts, according to McKenty. "People get tricked into clicking a phone number that's not actually their bank or the IRS, and then surrendering identity information on the phone," he said. If you think you got a message from a scammer, as tempting as it is to mess with them, do your best to resist. If you interact with the scammer, they may want to circle back knowing that you're reachable. Email scams Emails can also have scam links. McKenty said that while clicking on phone numbers and links in texts is happening more frequently, "the biggest dollar losses are still the classic email scams." He suggests copying any link you see into a notes app so that you can properly inspect it before clicking. QR code scams Sometimes, scams can even be embedded into a QR code. "QR codes have become the new stealth weapon, used everywhere from restaurant menus to parking meters," said Meister. "Scammers are known to slap fake codes on top of real ones in public, or embed them in phishing emails, linking to cloned websites or malware downloads," he said. Before you scan, make sure the QR code makes sense. If it's on the side of a gas pump, on a random park bench or in an unrecognized email, it's better to avoid it. Social media direct messages Chances are, you've run into these scam links. Sometimes social media accounts get compromised by cybercriminals posing as people you know. If your "uncle" sends you a direct message while sounding like a pushy timeshare salesman, telling you to check out this investment opportunity by clicking on a link, call your uncle first. What if I already clicked a link? If you clicked on a scam link, a number of things could happen. If you have software protecting your device, the firewall probably blocked it. If you don't have software protecting you from computer viruses and malware, then you might have a problem. Try these tips if you think you might've clicked on a phishing link: Get anti-virus software. If you don't already have anti-virus software that can help rid your laptop or desktop of viruses, you should get one. There are plenty of free and paid options to choose from. If you don't already have anti-virus software that can help rid your laptop or desktop of viruses, you should get one. There are plenty of free and paid options to choose from. Be aware of malware. Your phone isn't immune to malware. Scam links are often designed to trick somebody into downloading malware, which can then give the scammer access to your phone. If your phone is infected with malware, do not access any financial apps. Instead, clear your browser cache, remove any apps you don't recognize, or try a factory reset. If you're really stuck, you could also call your phone's tech support. Your phone might be slow or unresponsive and you may see increased pop-up ads if it's infected. Your phone isn't immune to malware. Scam links are often designed to trick somebody into downloading malware, which can then give the scammer access to your phone. If your phone is infected with malware, do not access any financial apps. Instead, clear your browser cache, remove any apps you don't recognize, or try a factory reset. If you're really stuck, you could also call your phone's tech support. Your phone might be slow or unresponsive and you may see increased pop-up ads if it's infected. Contact your bank or credit card issuer. If you've been visiting your bank website or app on a compromised device, to be safe, let your financial institution know. If you've been visiting your bank website or app on a compromised device, to be safe, let your financial institution know. Contact the authorities. If you clicked on a spam link and were scammed out of money, report it to the Federal Trade Commission so they can spread the word about the scam. You'll also want to call your police department and anyone else you can think of. The more people are aware of a scam, the less likely they'll fall for it.
