Latest news with #cybercriminals
Fox News
3 days ago
- Business
- Fox News
Spot fake online stores, avoid Facebook subscription scams
Given the number of phishing scams we have all faced over the past decade, most of us have developed a basic skill to spot and avoid obvious phishing emails or SMS messages. Cybercriminals are aware of this, and they have evolved their tactics by shifting to more complex and convincing schemes designed to bypass skepticism and lure victims. Their goal remains the same: to trick you into handing over sensitive information, especially credit card data. One of the latest examples is the rise in subscription scam campaigns. Scammers are creating incredibly convincing websites selling everything from shoes and clothes to electronics, tricking people into signing up for monthly subscriptions and willingly providing their credit card information. Facebook is being used as the primary platform to promote these new and sophisticated scams. Bitdefender researchers have uncovered a massive and highly coordinated subscription scam campaign involving more than 200 active websites designed to look like real online stores. These sites, often promoted through Facebook ads, sell everything from clothes and electronics to beauty products, but the real goal is to trick users into signing up for recurring payments, often without realizing it. One of the most common lures is the "mystery box" scam, where you are promised a surprise package at a bargain price. These offers are made to look fun and harmless, but behind the scenes you are giving away personal and credit card information while unknowingly agreeing to hidden subscription terms, often written in tiny fine print. The scam doesn't stop there. Once you're convinced and reach the checkout page, scammers often layer in a second scam, like loyalty cards or VIP memberships that further lock you into payments. It's all designed to confuse you, overwhelm you with supposed perks and make the scam feel like a good deal. Researchers found that many of these websites share a single Cyprus address, possibly tied to offshore entities linked to the Paradise Papers. Despite being spread across different categories and brand names, the sites often use the same layouts, AI agents and payment structures, all pointing to a centralized fraud network. Scammers frequently rotate the brands they impersonate and have started moving beyond mystery boxes, now peddling low-quality products, counterfeit goods, fake investment schemes, dubious supplements and more. To avoid automatic detection, they employ several tactics. These include running multiple versions of an ad, with only one of which is actually malicious while the others display harmless product images, uploading ad images from platforms like Google Drive so they can be swapped out later and cropping visuals to alter recognizable patterns. What started with simple "mystery box" scams has grown into a sprawling, coordinated campaign. These scams now feature fake surveys, tiered "VIP" memberships and deceptive credit systems that make the purchase process intentionally confusing. Users are promised deep discounts or access to exclusive deals, but in reality they're just being locked into recurring payments. Many of the scam websites trace back to the same physical address in Cyprus, pointing to what appears to be a centralized operation. Researchers also found links to entities mentioned in the Paradise Papers, suggesting these fraudsters are hiding behind offshore infrastructure. And it's not just mystery boxes anymore. The same scam format is being used to sell low-quality goods, fake supplements and even bogus investment opportunities. With high-quality site design, aggressive advertising and increasingly sophisticated tactics, subscription scams are becoming the new face of online fraud. Even as scammers become more sophisticated, there are practical steps you can take right now to protect your personal and financial information from subscription fraud and other online threats. Here are ten proactive measures to help keep your data safe: 1) Always read the fine print: One of the simplest yet most effective ways to protect yourself from subscription scams is to slow down and read the fine print, especially on checkout pages. Scammers often hide recurring payment terms in small or lightly colored text that's easy to miss. What seems like a one-time purchase could actually sign you up for a biweekly or monthly charge. Taking just a moment to scan for hidden terms before hitting "Pay" can help you avoid weeks of silent billing. 2) Avoid mystery box or VIP-style deals: These offers often prey on curiosity and the promise of surprise or luxury for a low fee. In reality, the "mystery" is the trap: you might receive nothing or a low-quality item while being unknowingly enrolled in a recurring subscription. Scammers use the illusion of exclusivity or urgency to pressure quick decisions. 3) Don't trust ads blindly on social media: Facebook, Instagram and other platforms are a hotbed for these scams, with criminals running paid ads that mimic well-known brands or influencers. These ads often link to professional-looking but fake storefronts. If you're interested in a deal you see online, don't click through immediately. Instead, look up the brand or offer in a separate tab and check if it exists outside social media. 4) Investigate before you buy: Before purchasing from any unfamiliar site, take a few quick steps to verify its legitimacy. Search the brand's name alongside words like "scam" or "reviews" to see what others have experienced. Look up the company's physical address and check if it actually exists using tools like Google Maps. Make sure the website uses HTTPS, review the site's contact information and cross-check reviews on trusted third-party sites like the Better Business Bureau or Consumer Reports. 5) Use strong antivirus software: Adding a strong antivirus program to your devices can provide an extra layer of defense against fraudulent websites and phishing attempts. Strong antivirus software warns you about suspicious links, blocks malicious ads and scans downloads for malware. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices. 6) Invest in personal data removal services: Scammers often rely on leaked or publicly available personal information to target victims with convincing subscription scams. Investing in a personal data removal service can help minimize your digital footprint by removing your information from data broker databases and reducing the chances of being targeted in future campaigns. Regularly monitoring and cleaning up your online presence makes it harder for fraudsters to exploit your data for financial gain. Check out my top picks for data removal services here. Get a free scan to find out if your personal information is already out on the web. 7) Be cautious with payment methods: Use secure payment options like credit cards, which often offer better fraud protection than wire transfers, gift cards or cryptocurrency. 8) Limit personal information shared on social media: Scammers often gather details from public profiles to craft convincing scams. Review your privacy settings and only share necessary information. 9) Use strong, unique passwords and enable multifactor authentication: Create strong, unique passwords for each of your online accounts, especially those tied to your finances or shopping. Enable multifactor authentication wherever possible, as this adds an extra layer of security and makes it harder for scammers to access your accounts, even if your password is compromised. Also, consider using a password manager to generate and store complex passwords. Get more details about my best expert-reviewed password managers of 2025 here. 10) Keep your devices and software updated: Regularly update your operating system, browsers and apps. Security updates often patch vulnerabilities that scammers exploit to gain access to your information or install malicious software. While the rise of subscription scams and deceptive ads is concerning, it's especially troubling that platforms like Facebook continue to allow these fraudulent ads to run unchecked. Facebook has repeatedly failed to adequately vet or prevent these malicious campaigns from reaching vulnerable individuals. The platform's ad approval system should be more proactive in spotting and blocking ads promoting scams, particularly those that impersonate well-known brands or content creators. How do you feel about Facebook's role in allowing scam ads to circulate? Let us know by writing us at For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Follow Kurt on his social channels: Answers to the most-asked CyberGuy questions: New from Kurt: Copyright 2025 All rights reserved.
The Sun
29-05-2025
- Business
- The Sun
Terrifying Google note warns billions of phone users of 5 bank-raiding texts sent by crooks ‘without fear of punishment'
GOOGLE has warned phone users of five bank-raiding texts sent by crooks. Cybercriminals are using a diverse set of tactics to prey on customers. 1 It comes amid a recent Federal Trade Commission data which found that Google's reported fraud losses jumped 25% to $12.5 billion (£10.5 billion) in 2024. "Scammers are more effective and act without fear of punishment when people are uninformed about fraud and scam tactics," Google warned. Customer support scams Scammers trick customers by impersonating representatives from prominent companies. They prey on anxieties around safety and IT issues to access sensitive information. It's important to double check the number which has called you is legitimate before proceeding with the call. Malvertizing Some scammers use fake online ads to spread malware. Google researchers say that scammers are increasingly targeting more sophisticated users, including people with valuable online assets, like crypto wallets, and social media influencers. To swat away the offers, make sure you're being extra careful when anyone offers free versions of licenced software. Fake travel websites As more and more Brits book their sun-soaked getaways, criminals are licking their lips. Scammers present themselves as genuine travel agencies or hotels before offering holidaymakers package deals on summer getaways. Debit card warning after $500 vanishes from woman's bank account within minutes - why credit is safer at checkout Just make sure you're arranging your itinerary with reputable hotels and airlines. Package-tracking scams Cybercriminals are also masquerading as legitimate courier outfits and online retailers. The shameless crooks trick buyers into paying eye-watering add-on fees to speed up the delivery time. If you're expecting a package, go straight to the delivery company's site to check the status. Toll road scams With many toll roads operating a cash free system, opportunists are filling motorists' inboxes with phoney texts demanding they pay for unpaid tolls. If you think the fee demand is genuine, get in touch with the company itself before you hand over the cash. And remember not to click on links from unknown phone numbers or emails. TIME TO TRY PASSKEYS? Here's what security expert Chris Hauk, Consumer Privacy Advocate at Pixel Privacy, told The Sun... 'Passwords are both hard to remember and in most cases, easy to guess. "I would venture to say that most users (especially older users) will reuse passwords, simply because of all of the websites and apps that require sign-ins. "While password managers do help, they are at best, a stopgap measure and do not offer full-ranging security for your login information. "Passkeys offer the advantage of eliminating the need to enter an email address and password to log in. "This is especially handy when users are logging in on an iPhone or Android device. "Passkeys have multiple advantages over passwords. Passkeys cannot be shared or guessed. "Passkeys are unique to the website or app they are created for, so they cannot be used to login elsewhere like a reused password can. "Plus, passkeys cannot be stolen in a data breach, as the passkeys are not stored on the company's servers. "But are instead are a private key stored only on your device, where biometric authentication (like face ID or Touch ID) is required to use the passkey.' Image credit: Getty
South China Morning Post
27-05-2025
- Politics
- South China Morning Post
Malaysia's home minister ridiculed after his WhatsApp account hacked
Malaysia's home minister has been hit by a wave of public ridicule after his WhatsApp account was hacked, raising questions over the country's digital protections when its top security official has been targeted by cyber criminals. Mobile phishing scams are rampant in Malaysia, with citizens frequently harassed by calls from fraudsters posing as police, banks or courts to extort money under the guise of criminal probes. The account of Saifuddin Nasution Ismail, head of the Home Ministry – which oversees policing, immigration, border and prisons as well as citizenship registration and censorship of films and books – had been compromised by 'irresponsible groups', his ministry confirmed. It urged the public not to entertain any messages or calls from anyone purporting to be the minister. Saifuddin Nasution Ismail's ministry oversees policing, immigration, border and prisons as well as citizenship registration and censorship. Photo: Facebook/Saifuddin Nasution Ismail 'We remind the public not to be fooled by anyone claiming to be Saifuddin Nasution, especially in matters involving finances or meeting arrangements,' the ministry said.
Forbes
24-05-2025
- Forbes
Delete Any Texts On Your Phone That Include These 3 Letters
Delete these texts immediately. getty Sometimes keeping safe from cybercriminals really is this easy. Sometimes there's such a blatant telltale sign you don't need to think twice. Yes, AI is making cyber threats more frightening, more realistic, harder to detect. But if you ever see these three letters in a text, you should ignore the rest. It's dangerous. It's an attack. Hit delete. Whether it's an unpaid road toll, an undelivered package or a problem with one of your accounts, malicious text messages almost always include a lure and a link. The text at the top is the convincer, including the organization being mimicked, and the link is the call to action: Pay your bill, update your account, retrieve your package. To fuel such attacks, cybercriminals register hundreds of thousands of new domains, crafting names to match an attack with relevant keywords and brand names. Such domains are usually live for less than a day, sometimes as little as ten minutes. But that's all it takes when you can send millions of malicious texts every month. Each of those domains sits under a top level domain (TLD), an equivalent to .COM or .NET. There are now countless TLDs, operated by different players in the market. But just as much of the malicious texting market is driven by Chinese gangs, the most dangerous TLDs are issued by Chinese registrars. The .TOP domain at work. APWG Say hello to the .TOP domain, the most dangerous of them all. If you're in the United States or Europe and you receive any text with a link under that TLD with those three letters, delete it right away. It doesn't matter what the rest of the link or text says. '.TOP was first introduced in 2014 aimed at businesses looking to highlight premium or 'top' services,' Spamhaus explains, but by 2017 'this TLD had become China's most registered domain name even overtaking .com and .cn domains. However, its low-cost registrations and minimal oversight have made it a hotspot for abuse.' The numbers are stark. According to Interisle, while 'four of the top 10 TLDs – .TOP, .XYZ, .CC, and .VIP – had more than 10% of their domains under management reported for use in cybercrime activities. Worst among these was .TOP, where 30% of that TLD's domains were reported for cybercrime use. By comparison, the 3.2 million cybercrime domains reported in .COM represented only 2% of that TLD's domains.' That 30% is just the reported number — and it's getting worse. Up more than 300% year-on-year. So, what about the other 70% you might ask. Could they be legitimate domains? The Anti-phishing Working Group (APWG) warns 'phishers set up these phishing sites using cheap domain names they register in lesser-known top-level domains such as .TOP, .CYOU, and .XIN. This is one way to spot these scam messages. The .TOP domain registry is operated in China, and has a notable history of being used by phishers.' It is beyond unlikely for a legitimate western organization to use a .TOP domain. As Spamhaus says, the registrar behind the TOP domain changed its name in 2024, 'exactly five months after ICANN issued a [still unresolved] compliance notice on March 27th, 2024, citing the registrar's 'failure to take reasonable and prompt steps to investigate and respond appropriately to reports of abuse' — the very same issue raised with .TOP. Coincidence? Given .TOP's track record, it seems unlikely.' .TOP consistently and ironically tops the charts when it comes to abuse. 'Right now, .TOP isn't just skirting the rules, it's blatantly disregarding them,' Spamhaus warned this month. 'Despite ICANN issuing a formal notice to .TOP citing a breach of contract for failing to address DNS abuse, the situation has not improved. Over the last six months, abuse of .TOP hasn't just persisted, it's gotten 50% worse!' If you see that .TOP domain in any text— just hit delete.
Forbes
23-05-2025
- Forbes
Change Your Password Now If It's On This List
It would be all too easy to assume that your password is safe enough if you don't share it between sites and services, if you are aware of and take action to prevent phishing attacks, or if you ensure that sophisticated infostealer malware doesn't come anywhere near your devices. But what if you were wrong? What if your password is so weak it could be cracked in less time than it takes me to type the next word? Yes, it is that quick, folks. What if automatic password hacking machines laugh in the face of your security efforts? If your password is on this newly published list, change it now or suffer the inevitable hacking consequences. You have been warned. You really don't want to be on any password list, and most of them are compiled by cybercriminals using infostealer malware logs. But even with the global disruption of crime-industry leaders such as the Lumma Stealer network, your biggest enemy often isn't the shady hacker after your credentials, it's you yourself. Let me explain through the optics of a May 22 Huntress Security report that revealed the 20 most commonly used and therefore weakest passwords you could deploy. Look, I get it, ease of use is key, if you'll pardon the pun, and that's why people stick to familiar passwords that they have used for years. Passwords that they share across accounts. Passwords that are easy to type as well as recall. And that, right there, is your biggest mistake. If you do it, other people will do as well, and that's why if your password is on this list you must change it now. No ifs or buts, no procrastinating, no I'll do it later. Change that password right now. Here's the list in full: I will admit, even as a cybersecurity veteran and hacker of old, I was surprised to see both dragon and monkey on the list. Considering there aren't that many proper words included, numerical strings remain the go-to for lazy password creators; they wouldn't have been my first choices. And that's from someone who has something of an obsession with monkeys. Every day is a school day, although you should know better than to use dictionary words, and very short dictionary words at that. So, you know what to do: change that password now. Better still, switch to using passkeys instead, as they are way more secure and even easier to use. I would also recommend using a password manager to both create and use your passwords, as this will enable you to make strong, random and unique choices.
