Cyber Training Group International (CTGI)

Blog

  • Beware of Computer Worms

    Beware of Computer Worms

    The first computer worm to spread extensively across the internet was the Morris Worm, released on November 2, 1988.

    This computer worm was created by Robert Tappan Morris, a graduate student at Cornell University, it was originally designed as an experiment to gauge the size of the early internet. However, a design flaw caused it to replicate much faster than intended, leading to the first major cyberattack in history.

    Within 24 hours, it infected approximately 6,000 computers, which was about 10% of the internet at the time. It exploited vulnerabilities in the Unix operating system, specifically in programs like sendmail and the finger service. The worm didn’t delete data, but it reinfected machines multiple times, consuming so much processing power that it caused systems to crash or become unusable.

    SO WHAT IS A COMPUTER WORM?

    A computer worm or digital worm is a standalone malware computer program designed to replicate itself and spread across networks without requiring human interaction.

    However, unlike computer viruses, these digital worms don’t require a host file or program to latch onto. Instead, they exist as self-contained files or scripts.

    While both are types of malicious software (malware) that replicate themselves and damage computer systems, the main difference is how they spread. Computer viruses require a “host” and human interaction to spread, whereas computer worms are standalone programs that spread by themselves across networks.


    WHAT ARE THE MAIN DIFFERENCES BETWEEN A COMPUTER VIRUS AND A
    COMPUTER WORM?

    Computer Virus
    A computer virus attaches itself to a clean computer program or file (host) and hides there. It stays completely still until a user accidentally opens the infected file or runs the program. Once activated, the virus infects other files and spreads when the user shares those files with others. Computer virus takes time to spread because it relies on human movement.


    Computer Worms
    A computer worm is a standalone, independent program. It does not need a host file to exist, nor does it need you to click anything. Once a computer worm gets onto your device (often through a network connection or software loophole), it replicates itself and spread automatically. Computer worms spread rapidly through network connections such as the internet and Local Area Network.

    Internet Image
    Computer Worms can spread across the Internet and Local Area Network.


    Both computer worm and computer virus can harm your device, delete files, or steal personal information.
    To keep your devices and data safe while browsing, you don’t need to be a tech expert—you just need to stay alert. Here are the most effective habits to adopt:

    1. Check for the “Padlock”
    Always look at the address bar for HTTPS (and the padlock icon) before entering any passwords or credit card info. This means your connection is encrypted, making it much harder for hackers to “listen in” on your data.

    2. Be Skeptical of Links and Pop-ups
    Think before you click:     Hover your mouse over a link to see the actual URL destination in the bottom corner of your browser. If it looks gibberish or slightly misspelled (like g00gle.com instead of google.com), stay away.

    Avoid “Free” Traps: Sites offering free movie streams or cracked software are prime breeding grounds for the worms and viruses we discussed.

    3. Use a Password Manager
    Reusing the same password is a huge risk. Use a password manager (like Bitwarden, Google Password Manager or 1Password) to create and store unique, complex passwords for every site. This way, if one site gets hacked, your other accounts stay safe.

    4. Enable Two-Factor Authentication (2FA)
    Even if a hacker gets your password, 2FA acts as a second lock. Always choose an authenticator app or a security key over SMS (text) codes when possible, as they are more secure.

    5. Keep Your Browser Updated
    Those “Update Available” pop-ups are actually critical. They often contain security patches for newly discovered vulnerabilities that hackers are already trying to exploit.

    6. Use an Ad Blocker
    Many malicious scripts (malvertising) are delivered through shady ads. Using an extension like uBlock Origin can stop these scripts from even loading on your page.

    Experts are warning about computer “worms” created with AI that can infect devices and harm users without restraint. University of Toronto professor Nicolas Papernot joins with more. Credits: CBS NEWS

    TYPES OF COMPUTER WORMS

    1) Email Worms
    Also called mass-mailer worms, they propagate by sending copies of themselves (whether as email attachments or malicious links). Upon opening the file or clicking on the link, a worm will activate, and it will have access to contacts of the recipient to continue spreading.


    2) File-sharing Worms
    Since file-sharing worms allow infected users to hide behind the guise of real media files, they are shared in filesharing aids. Once the file is downloaded by a user, the worm turns the device into an evil server that may accumulate personal data or credentials to be used or sold.

    3) Crypto Worms
    Crypto worms are like ransomware. They spread through systems, encrypt files of users, and then request that decryption key be returned by payment, typically in cryptocurrency. These worms can lock down entire networks if not contained.

    4) Internet Worms
    This category of Computer Worms has the specific purpose of targeting widely used websites with weak Cyber Security measures. The goal of these worms is to infiltrate the website’s system, which then allows them to spread to any computer that has accessed the site and infect them as well.

    5) Instant Messaging Worms
    The worms sent by Instant Messaging Worms exploit an instant messaging program and social media by spitting off impersonation links or files sent by a trusted source. They are usually filled with clickbait, making a user unintentionally infect himself or herself and share it with others.

    6) IRC Worms
    Internet Relay Chat (IRC) Worms spread into chat rooms or forums through the vulnerability of IRC clients. They transmit virulent links or move orders to the people and propagate at high-speed using real-time chats.

    7) P2P Worms
    P2P Worms take advantage of peer-to-peer file-sharing programs by assuming the form of desirable downloadable content. After being downloaded, they multiply through shared folders and also linked users, so infection becomes widespread even without the knowledge of the user.


    Computer Worm Examples

    1) Morris (1988)
    Created by Robert Morris, this worm unintentionally overloaded 6,000 UNIX Operating Systems leading to crashes and damages up to £8 million.

    2) Mydoom (2004)
    Targeting Windows systems, Mydoom became one of the fastest-spreading worms, causing an estimated £30 billion in damages. It persists, accounting for a significant portion of malicious emails.

    3) Storm Worm (2007)
    Storm Worm was carried by emails with eye catching headlines like 230 killed as storm swept Europe which even fooled the user into clicking. After activation, it infected systems, making them a botnet to send spam and attack computers with millions of computers.

    4) ILOVEYOU (2020)
    ILOVEYOU was a love letter worm which made itself known as a love letter, also called the Love Bug. It hit more than 50 million devices within two weeks of its outbreak and resulted in clean-up and recovery costs which amount to about 12 billion pounds.

    5) Conficker
    Also referred to as Downup or Kido, Conficker exploited vulnerabilities in Microsoft Windows to spread rapidly. It infected millions of computers across more than 100 countries. It disrupted networks worldwide and demonstrated how unpatched systems can be compromised at a massive scale.

    6) Code Red
    Code Red was a widespread Computer Worm that emerged in 2001, infecting more than 300,000 systems. It targeted Microsoft IIS web servers and generated massive traffic from compromised machines, even overwhelming high-profile websites such as that of the White House.

    How do I know if I have a computer worm?

    Computer worms are a type of self-replicating malware. Because they consume resources and spread without your knowledge, they typically leave behind specific red flags.

    Signs of a Computer Worm Infection

    1. Sudden Performance Drops: Unusually high CPU usage, frequent freezing, or a sluggish system.
    2. Rapidly Disappearing Hard Drive Space: Because worms replicate repeatedly, they can eat up large chunks of your storage.
    3. Network Activity Outburst: Your internet becomes incredibly slow, or you notice unusually high network traffic even when you aren’t browsing.
    4. Unfamiliar Emails: People in your contact list receive strange or spam emails that you never sent.
    5. Missing or Strange Files: System files go missing, or you notice unknown programs/folders suddenly appearing on your hard drive.
    6. Programs Running Automatically: Web browsers or programs launching on their own without you clicking them.

    How to Confirm and Remove the Worm

    Disconnect the Network: Unplug your Ethernet cable or turn off Wi-Fi. This isolates the computer worm so it cannot infect other devices.

    1. Run an Offline Antivirus Scan:
    • Windows: Open the Windows Security app, go to Virus & threat protection > Scan options, and select Microsoft Defender Antivirus offline scan. The PC will restart and perform a deep, 15-minute scan while the malware is inactive.

    2. Check Task Manager:

    • Press Ctrl + Shift + Esc to open Task Manager.
    • Look for any unusual processes taking up massive amounts of
      memory or using unfamiliar names.
    • If you spot a suspicious process, right-click and open its file
      location to delete it.

    3. Use an On-Demand Scanner:

    • Once you have completed the built-in scan, download a reliable
      on-demand tool like Malwarebytes.
    • Free Scan to catch anything the primary antivirus might have
      missed.

  • Fake WhatsApp API Package on npm Steals Messages, Contacts, and Login Tokens

    Fake WhatsApp API Package on npm Steals Messages, Contacts, and Login Tokens

    Cybersecurity researchers have disclosed details of a new malicious package on the npm repository that works as a fully functional WhatsApp API, but also contains the ability to intercept every message and link the attacker’s device to a victim’s WhatsApp account.

    The package, named “lotusbail,” has been downloaded over 56,000 times since it was first uploaded to the registry by a user named “seiren_primrose” in May 2025. Of these, 711 downloads took place over the last week. The library is still available for download as of writing.

    Under the cover of a functional tool, the malware “steals your WhatsApp credentials, intercepts every message, harvests your contacts, installs a persistent backdoor, and encrypts everything before sending it to the threat actor’s server,” Koi Security researcher Tuval Admoni said in a report published over the weekend.

    Specifically, it’s equipped to capture authentication tokens and session keys, message history, contact lists with phone numbers, as well as media files and documents. More significantly, the library is inspired by @whiskeysockets/baileys, a legitimate WebSockets-based TypeScript library for interacting with the WhatsApp Web API.

    This is accomplished by means of a malicious WebSocket wrapper through which authentication information and messages are routed, thereby allowing it to capture credentials and chats. The stolen data is transmitted to an attacker-controlled URL in encrypted form.

    The attack doesn’t stop there, for the package also harbors covert functionality to create persistent access to the victim’s WhatsApp account by hijacking the device linking process by using a hard-coded pairing code.

    “When you use this library to authenticate, you’re not just linking your application — you’re also linking the threat actor’s device,” Admoni said. “They have complete, persistent access to your WhatsApp account, and you have no idea they’re there.”

    By linking their device to the target’s WhatsApp, it not only allows continued access to their contacts and conversations but also enables persistent access even after the package is uninstalled from the system, given the threat actor’s device remains linked to the WhatsApp account until it’s unlinked by navigating to the app’s settings.

    Koi Security’s Idan Dardikman told The Hacker News that the malicious activity is triggered when the developer uses the library to connect to WhatsApp.

    “The malware wraps the WebSocket client, so once you authenticate and start sending/receiving messages, the interception kicks in,” Dardikman said. “No special function needed beyond normal usage of the API. The backdoor pairing code also activates during the authentication flow – so the attacker’s device gets linked the moment you connect your app to WhatsApp.”

    Furthermore, “lotusbail” comes fitted with anti-debugging capabilities that cause it to enter into an infinite loop trap when debugging tools are detected, causing it to freeze execution.

    “Supply chain attacks aren’t slowing down – they’re getting better,” Koi said. “Traditional security doesn’t catch this. Static analysis sees working WhatsApp code and approves it. Reputation systems have seen 56,000 downloads, and trust it. The malware hides in the gap between ‘this code works’ and ‘this code only does what it claims.’”

    Malicious NuGet Packages Target the Crypto Ecosystem# The disclosure comes as ReversingLabs shared details of 14 malicious NuGet packages that impersonate Nethereum, a .NET integration library for the Ethereum decentralized blockchain, and other cryptocurrency-related tools to redirect transaction funds to attacker-controlled wallets when the transfer amount exceeded $100 or exfiltrate private keys and seed phrases.

    The names of the packages, published from eight different accounts, are listed below –

    • binance.csharp
    • bitcoincore
    • bybitapi.net
    • coinbase.net.api
    • googleads.api
    • nbitcoin.unified
    • nethereumnet
    • nethereumunified
    • netherеum.all
    • solananet
    • solnetall
    • solnetall.net
    • solnetplus
    • solnetunified

    The packages have leveraged several techniques to lull users into a false sense of trust in security, including inflating download counts and publishing dozens of new versions in a short amount of time to give the impression that it’s being actively maintained. The campaign dates all the way back to July 2025.

    The malicious functionality is injected such that it’s only triggered when the packages are installed by developers and specific functions are embedded into other applications. Notable among the packages is GoogleAds.API, which focuses on stealing Google Ads OAuth information instead of exfiltrating wallet data secrets.

    “These values are highly sensitive, because they allow full programmatic access to a Google Ads account and, if leaked, attackers can impersonate the victim’s advertising client, read all campaign and performance data, create or modify ads, and even spend unlimited funds on a malicious or fraudulent campaign,” ReversingLabs said.

    Credits: The Hacker News

  • Attacks are Evolving: 3 Ways to Protect Your Business in 2026

    Attacks are Evolving: 3 Ways to Protect Your Business in 2026

    Every year, cybercriminals find new ways to steal money and data from businesses. Breaching a business network, extracting sensitive data, and selling it on the dark web has become a reliable payday.

    But in 2025, the data breaches that affected small and medium-sized businesses (SMBs) challenged our perceived wisdom about exactly which types of businesses cybercriminals are targeting.

    This article will outline the learnings from key data breaches in 2025 as well as the most effective ways for SMBs to protect themselves in the coming year.

    Examining the 2025 data breaches# Prior to 2025, large businesses were popular targets for hackers because of their large pools of resources. It was assumed that smaller businesses simply weren’t as vulnerable to cyberattacks because there was less value in attacking them.

    But new security research from the Data Breach Observatory shows that’s changing: Small- and medium-sized businesses (SMBs) are now more likely to become a target. This change in tactic has been caused by large businesses investing in their cybersecurity and also refusing to pay ransoms. Cybercriminals are less likely to extract anything of value by attacking these businesses, so instead they’re turning to attacking smaller businesses.

    While the payday may be smaller when attacking SMBs, by increasing the volume of attacks, cybercriminals can make up the shortfall. Smaller businesses have fewer resources to protect their networks and thus have become more reliable targets. Four in five small businesses have suffered a recent data breach.

    By examining some of these data breaches and the companies they affected, a pattern emerges, and failings can be identified. Here are three key SMB data breaches from 2025:

    Tracelo — More than 1.4 million records stolen from this American mobile geolocating business appeared on the dark web following an attack from a hacker known as Satanic. Customer names, addresses, phone numbers, email addresses, and passwords were all made available for sale. PhoneMondo — This German telecommunications company was infiltrated by hackers and had more than 10.5+ million records stolen and posted online. Customer names, dates of birth, addresses, phone numbers, email addresses, usernames, passwords, and IBANs all made it onto the dark work. SkilloVilla — The 60-person team behind this Indian edtech platform wasn’t able to protect the extensive customer data collected by the platform, and more than 33 million records were leaked on the dark web. Customer names, addresses, phone numbers, and email addresses have all been spotted online. What can we learn?# Looking at these particular breaches and taking into account the wider data breach landscape, we can identify trends that shaped 2025:

    SMBs were the number one target for hackers in 2025, accounting for 70.5% of the data breaches identified in the Data Breach Observatory. This means that companies between 1 and 249 employees were the most vulnerable to cybersecurity breaches throughout the year. Retail, tech, and media/entertainment businesses were targeted most frequently. Names and contact information are the most common records to appear on the dark web, increasing the risk of phishing attacks targeting workers. Names and emails appeared in 9 out of 10 data breaches. With these trends in mind, it’s likely that hackers will continue targeting SMBs in the new year. If your organization falls into this category, your risk of a data breach could be higher.

    It’s not inevitable, however. By considering your business’s sensitive data, how it’s stored, and what you use to protect it, you can secure your organization.

    How to avoid data breaches in 2026# Avoiding a data breach doesn’t have to be costly or complicated, as long as your business takes the right approach and finds the right tools.

    Employ two-factor authentication# If all it takes to gain access to one of your business tools is a username and a password, your network is significantly easier to breach. Two-factor authentication (2FA) makes it harder for unauthorized individuals to gain access.

    By introducing a secondary authentication method, such as an OTP code, security key, or biometric login, authentication and authorization take less time for your system, as well as increasing the barrier to entry.

    Secure access control to your network # The principle of least privilege is a method used to decide who has access to what business tools and data. It dictates that any given team member should have access to strictly the necessary information they need to perform their role and nothing else. This approach to access control protects your organization by reducing the number of entry points into your network.

    When access has been granted to strictly necessary team members, that access needs to be secured with good password hygiene. This includes creating strong passwords, not reusing passwords for multiple accounts, and ensuring that your business is notified if any of your data appears on the dark web. Strong and enforceable password policies support good password hygiene, and you can ensure that the dark web is regularly scanned for business data with a tool or service such as a password manager.

    Store sensitive data securely# Leaked passwords and email addresses contribute to the risk that your employees will be targeted by phishing attacks or have their accounts compromised. Even a single compromised account can lead to a data breach.

    Create a single, secure repository for every business credential by adopting a secure business password manager. With a password manager, every team member can safely generate strong passwords that meet your business’s password policy, autofill them on frequently visited websites and apps, and securely share credentials when needed. This secures all of these vital entry points into your business network.

    Credits: The Hacker News

  • Budget Samsung phones shipped with unremovable spyware, say researchers

    Budget Samsung phones shipped with unremovable spyware, say researchers

    A controversy over data-gathering software secretly installed on Samsung phones has erupted again after a new accusatory post appeared on X last week.

    In the post on the social media site, cybersecurity newsletter International Cyber Digest warned about a secretive application called AppCloud that Samsung had allegedly put on its phones. The software was, it said,

    “unremovable Israeli spyware.”

    This all harks back to May, when digital rights group SMEX published an open letter to Samsung. It accused the company of installing AppCloud on its Galaxy A and M series devices, although stopped short of calling it spyware, opting for the slightly more diplomatic “bloatware”.

    The application, apparently installed on phones in West Asia and North Africa, did more than just take up storage space, though.According to SMEX, it collected sensitive information, including biometric data and IP addresses.

    SMEX’s analysis says the software, developed by Israeli company ironSource, is deeply integrated into the device’s operating system. You need root access to remove it, and doing so voids the warranty.

    Samsung has partnered with ironSource since 2022, carrying the its Aura toolkit for telecoms companies and device maker in more than 30 markets, including Europe. The pair expanded the partnership in November 2022—the same month that US company Unity Technologies (that makes the Unity game engine) completed its $4.4bn acquisition of ironSource. That expansion made ironSource

    “Samsung’s sole partner on newly released A-series and M-series mobile devices in over 50 markets across MENA – strengthening Aura’s footprint in the region.”

    SMEX’s investigation of ironSource’s products points to software called Install Core. It cites our own research of this software, which is touted as an advertising technology platform, but can install other products without the user’s permission.

    AppCloud wasn’t listed on the Unity/Ironsource website this February when SMEX wrote its in-depth analysis. It still isn’t. It also doesn’t appear on the phone’s home screen. It runs quietly in the background, meaning there’s no privacy policy to read and no consent screen to click, says SMEX.

    Screenshots shared online suggest AppCloud can access network connections, download files at will, and prevent phones from sleeping. However, this does highlight one important aspect of this software: While you might not be able to start it from your home screen or easily remove it, you can disable it in your application list. Be warned, though; it has a habit of popping up again after system updates, say users.

    Not Samsung’s first privacy controversy This isn’t Samsung’s first controversy around user privacy. Back in 2015, it was criticized for warning users that some smart TVs could listen to conversations and share them with third parties.

    Neither is it the first time that budget phone users have had to endure pre-installed software that they might not have wanted. In 2020, we reported on malware that was pre-installed on budget phones made available via the US Lifeline program.

    In fact, there have been many cases of pre-installed software on phones that are identifiable as either malware or potentially unwanted programs. In 2019, Maddie Stone, a security researcher for Google’s Project Zero, explained how this software makes its way onto phones before they reach the shelves. Sometimes, phone vendors will put malware onto their devices after being told that it’s legitimate software, she warned. This can result in botnets like Chamois, which was built on pre-installed malware purporting to be from an SDK.

    One answer to this problem is to buy a higher-end phone, but you shouldn’t have to pay more to get basic privacy. Budget users should expect the same level of privacy as anyone else.

    Credits: Malwarebytes

  • This Sneaky Scam Is Targeting iPhone Users — And It’s Alarmingly Effective

    This Sneaky Scam Is Targeting iPhone Users — And It’s Alarmingly Effective

    This scheme is quite devious. Here are the steps you should take to prevent it.

    When you lose your phone, it’s normal to welcome any leads as to where it might be. But beware of who you trust ― scammers are banking upon you answering their message.

    According to a November scam alert from the government agency Swiss National Cyber Security Centre, some people are getting alarming texts about lost iPhones.

    Here’s how it works: The scammers pretend to be a legitimate Apple representative. They send text messages or iMessages, claiming that your lost iPhone has been found abroad, sometimes weeks or months after you may have lost it.

    “To make the messages look convincing, they include accurate details of the missing device – such as its model, color and storage capacity – which the scammers can read directly from the phone itself,” the NCSC warns in its alert.

    The scammer then asks you to “click the link below” in the message to learn more about where your phone might be. People are then directed to a site that looks real.

    “The message contains a link that supposedly shows the device’s location, but it actually leads to a fake website designed to look like Apple’s official login page,” NCSC states. What the scammers really want is for you to share your Apple ID credentials so they can unlock your phone and use it.

    This scam works because it’s tempting to believe your lost phone is within reach. And that’s when you stop thinking with your head.

    “You go into panic if you’ve lost your phone…You’re not necessarily thinking cognitively,” said Amy Nofziger, the director of victim support for the AARP Fraud Watch Network. “You’re thinking, everything in my life is on that device. I need to get it back at all costs.“

    The good news is that there is one clear big telltale sign that this is a scam –– the message itself.

    “Do not give any of your personal information out to a link that came to you unsolicited,” Nofziger said. “My best advice is to not try to discern if it’s Apple or not reaching out to you. Just go directly to Apple.“

    It’s highly unlikely that Apple would send you an unsolicited text message about your lost iPhone. “Never share personal data or security information like passwords or security codes, and never agree to enter them into a webpage that someone directs you to,” Apple states to users on its website.

    What To Actually Do When You Lose Your Phone

    Losing your phone is already stressful, but getting scammed can make your misfortune even more stressful.

    Instead of trusting a random text message, take matters into your own hands and use the built-in tools your phone has. And don’t dilly-dally. There are steps you should take immediately to prevent scammers from easily hacking into your phone.

    Mark your phone as ‘lost.’

    Make it harder for a scammer to pass off your iPhone as their own by enabling Lost Mode ASAP. You can do this through the Find My app on another device or going to iCloud.com/find. This way, no one can access your personal information on your phone and you can see where your phone was last located. Once you select your device you want to be locked, payment cards are suspended, and you can create a message that will display on your phone saying that it is lost and how you want to be contacted.

    Similarly, if you lose your Android phone, you can enable Remote Lock by typing in the phone number of the device you want locked.

    Change your passwords.

    If you believe your lost phone has been compromised, change your Apple Account password immediately, so that a scammer can’t access your valuable personal information.

    And no matter what kind of device you have, it’s always a good security practice to turn on two-factor authentication, which requires a texted or emailed code to login, so that it’s harder for your phone to be used without your permission.

    Report what you see.

    If you get a suspicious message from Apple, take a screenshot of the message and email the screenshot to reportphishing@apple.com. For Android phones, you can block or mark them as spam under your phone’s “More options” tab when you receive a message.

    Losing your phone is already a stressful event. Don’t add to your stress by getting scammed. Instead, stay clear-headed and suspicious when you get a text that’s too good to be true. That’s how you beat scammers at their own game.

    Credits: Huffpost

  • How to Avoid Social Security Scams: Spot the Red Flags and Protect Yourself

    How to Avoid Social Security Scams: Spot the Red Flags and Protect Yourself

    Social Security scams are one of the most common and costly forms of fraud targeting Americans today.

    Criminals impersonate officials from the Social Security Administration (SSA), the Office of the Inspector General (OIG), or even the U.S. Department of Justice (DOJ) to try to trick you into handing over money or personal information. 

    These scams can arrive by phone, email, text, letter, or social media message. The scammers may even use real employee names, spoof government phone numbers, or send official-looking documents to gain your trust. 

    However, once you know the warning signs, you can protect yourself and help spread awareness to your friends and loved ones. 

    4 signs you’re dealing with a Social Security scam 

    Most Social Security-related scams follow a similar playbook. Watch out if you begin getting messages and they follow a pattern: 

    1. They pretend to be from a government agency you know, especially SSA or OIG. 
    2. They say there’s a problem or prize, like suspicious activity on your Social Security number or a sudden benefit increase. 
    3. They pressure you to act immediately, creating a sense of panic. 
    4. They tell you to pay in a specific, and often strange, way, like gift cards, cryptocurrency, wire transfers, or mailing cash. 

    Now, scammers are constantly evolving their playbook. But the reddest flag to look out for is the sense of urgency – the idea that something really good or really bad is about to happen, and you need to act fast. Scammers play on your emotions to try to get you to act before thinking.  

    What Social Security will never do 

    If you get a suspicious message, remember:

    • SSA will never threaten you with arrest or legal action for not paying immediately.
    • SSA will never suspend your Social Security number.
    • SSA will never ask for payment to activate a cost-of-living adjustment (COLA) or benefit increase.
    • SSA will never demand secrecy or direct message you on social media. 
    • SSA will never request payment via gift cards, prepaid debit cards, wire transfer, cryptocurrency, or cash in the mail.

    If someone does any of the above, stop replying. They’re a scammer. 

    Also Read: Online Safety Tips For Older Adults

    The Social Security scammer bag of tricks 

    Criminals keep updating their tactics and some can be scarily convincing. You might encounter: 

    • Spoofed phone numbers that look like government or local police lines. 
    • Fake social media accounts using SSA logos, photos, and jargon. 
    • Official-looking documents sent through email, text, or postal mail. 
    • AI-powered scams, including voice cloning, to make fake messages sound more convincing. 

    To verify SSA’s official social media accounts, visit: Social Media Hub | SSA  

    How to protect yourself from Social Security scams 

    If you get an unexpected message claiming to be from SSA: 

    1. Stay calm. Scammers often create urgency to cloud your judgment. 
    2. Hang up or ignore the message. Don’t click links or open attachments. Initiate communication with SSA through official channels. 
    3. Don’t send money. Never send payment in untraceable ways like gift cards, crypto, or wire transfers. 
    4. Guard your personal information. If the message mentions a problem you’ve never heard of, especially if they already know some of your personal details, be skeptical. 
    5. Spread the word. Share scam warnings with friends and family, especially seniors who are frequent targets. 

    How to report a Social Security scam

    Reporting scams helps authorities track criminals and warn others.

    • Report directly to SSA OIG 
    • If you’re unsure what type of scam it is, use the USA.gov scam reporting tool to find the right agency 
    • You can report the scam to the FBI and other federal law enforcement agencies through IC3. 

    What to do if you’ve been scammed 

    If you think you’ve given money or personal information to a scammer: 

    • Stop all contact with them immediately. 
    • Notify the three credit bureaus, Equifax, Experian, and TransUnion, to place a fraud alert on your credit report. Freeze your credit with all three bureaus. 
    • Protect your Social Security number, although you may need to request a replacement card or new SSN. 
    • If money was stolen, contact your bank and local law enforcement for further steps. 

    Keep your Social Security safe 

    If someone claims to be from Social Security, pressures you to act fast, or asks for unusual payment – stop, hang up, and report it. The SSA will never threaten you, suspend your SSN, or demand payment through gift cards or cryptocurrency. When in doubt, assume it’s a scam.

    Credits: National Cybersecurity Alliance

  • Online Safety Tips For Older Adults

    Online Safety Tips For Older Adults

    Being online today is now a daily routine for most of us, no matter your age.

    But just as you make a habit of locking your front door or fastening your seat belt, you need to adopt a few behaviors to help keep you safe online. Consider the smoke alarm in your hallway or checking if a safety seal is broken on a food container. We learned safety precautions. Just as you made a habit of locking your front door or fastening your seatbelt “back then,” new steps are needed now to stay secure in the digital age.

    Spot the scams 

    Then: Con artists tried to get you to buy counterfeit watches or play a rigged game of three-card monte.   

    Now: Scammers use emails, texts, and phone calls to pressure you into paying them, often with gift cards, wire transfers, or cryptocurrency. Treat any unexpected, urgent request with suspicion, even if it seems like it is coming from someone you know. If anyone demands an unusual payment, it’s a scam – it’s not rude to hang up immediately!  

    Verify independently 

    Then: You’d double-check a request by calling a neighbor or your bank.   

    Now: Criminals spoof caller IDs, create fake websites, and even use AI voice clones. If you’re suspicious that a scammer is targeting you, don’t respond immediately. Pause and contact a trusted source directly, such as looking up a phone number on an official website instead of the link in a scammy email.  

    Think before you click 

    Then: Junk mail went straight into the trash.   

    Now: Dangerous links in emails, texts, or ads can infect your device instantly. If you didn’t expect it, don’t click links or reply – don’t even click the “Unsubscribe” button. 

    Keep devices up to date 

    Then: You changed your locks if you lost a house key.   

    Now: Software updates keep you safe. They patch security holes and protect against hackers. Turn on automatic updates whenever possible. 

    Use strong passwords 

    Then: You used a four-digit bank PIN at the ATM.   

    Now: Criminals use powerful tools to guess short passwords. A strong password should be at least 16 characters long, unique to the account, and include a mix of letters, numbers, and symbols. Use a password manager program to keep track of all your passwords.  

    Read Also: What is Multifactor Authentication (MFA) and Why Should You Use It?

    Protect your privacy 

    Then: You kept some things to yourself.   

    Now: Oversharing on social media can give criminals the clues they need to steal your identity, such as your birthdate and address. Share with care, and review your privacy settings regularly. 

    Many modern crimes seem invisible today 

    Then: You could see a house break-in or the empty garage where your stolen car was.   

    Now: Cybercrime is often invisible. Clicking a bad link may look harmless, but hidden malware can steal data for months without you noticing. You might get scammed and not realize it until months later.  

    You have the power to stay safe online!  

    Online safety isn’t about fear. It’s about awareness. By understanding how threats have changed, you can take simple steps to protect yourself and your loved ones. 

    Credit: National Cybersecurity Alliance

  • What is Multifactor Authentication (MFA) and Why Should You Use It?

    What is Multifactor Authentication (MFA) and Why Should You Use It?

    You can protect your online accounts with more than just a password.

    Multifactor authentication (MFA) adds another layer of protection—think of it like securing your front door with both a deadbolt and a keypad lock. MFA is a simple, effective way to keep hackers out, even if they manage to get your password. 

    What is multi-factor authentication? 

    Multifactor authentication, often called MFA, is a security feature that requires you to verify your identity in multiple ways before accessing an account. You might also hear it called two-factor authentication (2FA) or two-step verification. 

    Here’s how it works: when logging in, you provide your username and password as usual, but then you add another step to prove it’s really you. This second step could be a fingerprint, a code sent to your phone, or even a notification from an app. 

    Why bother? Because passwords alone can be stolen or guessed, especially if they are short, use common words, and are reused. As a reminder: each password should be unique, at least 16 characters long, and a random string of characters. MFA makes it exponentially harder for cybercriminals to break into your accounts. Even if they know your password, they’ll hit a wall. 

    MFA increases the security of an account by 99%

    According to guidance by the Cybersecurity and Infrastructure Agency (CISA) and backed up by research from Microsoft, enabling MFA can prevent 99% of automated hacking attacks.  

    The math makes sense. If you require both a password and another factor like FaceID to increase your protection, the account’s security basically doubles! 

    It’s important to remember that these statistics refer to automated attacks. You still need to be on the lookout for social engineering hacks, like phishing, where cybercriminals try to trick you into giving them your password or MFA code. 

    How does MFA work? 

    Enabling MFA means tweaking your login process just a bit:

    1. Enter your username and password.
    2. If correct, you verify your identity in a second way.

    Depending on the account or service, this second step might involve:

    • A text or email with a one-time code.
    • A prompt in an authentication app like Google Authenticator. 
    • A biometric scan (e.g., fingerprint or facial recognition).
    • A physical security key.

    Most MFA systems are quick and seamless, adding between five and 30 seconds to your login time while almost doubling your security. 

    Types of multifactor authentication 

    MFA usually requires two factors, which is why it is sometimes called two-factor authentication. One factor is your password. The other factor can include: 

    • One-time passwords (OTP): Codes sent via text or email expire quickly. 
    • Authenticator apps: Apps like Duo or Microsoft Authenticator generate time-sensitive codes or send push notifications to approve logins. 
    • Biometrics: Scans of your fingerprint, face, or voice. 
    • Hardware tokens: Physical devices, such as USB keys, that connect to your computer to verify your identity. 
    • Security questions: Answers to personal questions, like your first pet’s name or high school. 
    • PINs: A secondary password unique to the service. 

    MFA fans will say these factors break down into three categories: 

    • Something you have: text message codes, authenticator apps, and hardware keys. 
    • Something you know: passwords, security questions, and PINs. 
    • Something you are: biometrics.  

    While any form of MFA is better than no MFA, we recommend using authenticator apps, biometrics, or hardware devices as second factors. Text message codes and security questions are more vulnerable but are still better than only a password.  

    Where should you enable MFA?

    MFA is common nowadays, and many services allow you to enable it. Start by checking the accounts you use daily. Some familiar platforms that typically allow for MFA include:

    • Banking: Secure your financial data with MFA for online banking and payment apps.
    • Email: Protect your inbox, which often holds sensitive information and links to your other accounts. 
    • Social media: Keep your accounts safe from unauthorized posts or takeovers.
    • Online shopping: Add an extra layer of security to your stored payment details.

    If a service offers MFA, turn it on—especially for accounts involving finances, sensitive information, or personal data. And honestly, most of our accounts today involve sensitive personal information you don’t want hackers to have.

    Can MFA be hacked? 

    While MFA is highly effective, it’s not invincible. Some cybercriminals use social engineering to trick users into granting access. For example, they might flood you with MFA requests, hoping you’ll approve one out of frustration or confusion. 

    If you receive an MFA request and you aren’t logging in, don’t approve it. Instead: 

    1. Contact the account’s platform immediately. 
    2. Change your password for the account. 
    3. Update any other accounts that use the same password – this is why every password should be unique to the account.  

    Despite rare instances of bypasses, MFA remains one of the strongest defenses against unauthorized access. 

    Is a passkey the same as MFA? 

    Passkeys are a newer login technology that we’re very excited about. In a sense, they are a form of MFA, but neither factor required is a password. In this way, they pave the way forward for a passwordless future. Instead of a password, generally, the factors involved are the possession of a device and biometrics, like a facial scan. If you’re prompted to set up a passkey, try it out! They are simple to set up and are incredibly secure.

    Why MFA is a must 

    Your data is valuable and MFA takes your protection to a new level. This simple tool adds a robust layer of security that can stop hackers in their tracks. 

    Don’t wait for a hack to teach you the hard way—take action today. Enable MFA on all accounts that offer it and enjoy the peace of mind that comes with knowing your digital life is well-protected. 

    Credit: The National Cybersecurity Alliance

  • New Rules Impact 500 Million Outlook Users

    New Rules Impact 500 Million Outlook Users

    Email has been both a blessing and a curse for billions of users. Unfortunately, it’s definitely been a blessing for hackers and a curse for consumers who receive their phishing attacks, malware attachments and more. Although highly-targeted “spear” phishing attacks are increasingly seen as the way to go by sophisticated threat actors, there’s no doubting the broad impact that spray-and-pray scammers, sending large volumes of email on a daily basis, have on the email ecosystem. It’s these malicious spam floods that can cause the most significant security issues, and it’s these that Microsoft is focusing on as it introduces new email security rules impacting the 500 million users of outlook.com, including hotmail.com and live.com addresses. Here’s what you need to know and do before May 5.

    New Outlook Security Rules Come Into Force On May 5

    Google has already taken action against the problem of malicious bulk senders impacting the security of users of the Gmail service by introducing new sender authentication requirements on April 1. The point of these news rules is to mitigate the risk of criminals using unauthenticated or compromised domains to deliver dangerous payloads. Now, at last, Microsoft is following suit and introducing similar rules to “reduce the likelihood of spam and spoofing campaigns reaching our user base,” according to an April 2 Microsoft announcement on the Windows Defender security blog.

    Applying to domains sending more than 5,000 emails in a single day, and to the Outlook.com consumer service that supports hotmail.com, live.com, and outlook.com consumer domain addresses, the May 5 rules will require mandatory Sender Policy Framework, DomainKeys Identified Mail and Domain-based Message Authentication, Reporting, and Conformance compliance. “Non‐compliant messages will first be routed to Junk,” Microsoft said, and eventually rejected if issues remain unresolved.If you are sending marketing materials, or maybe just run a large hobby mailing list, you need to take note.

    The full email authentication process has been explained in some detail by Microsoft, but the bullet point compliance requirements are as follows:

    • SPF: Must pass for the sending domain, and your domain’s DNS record should accurately list authorized IP addresses/hosts.
    • DKIM: Must pass to validate email integrity and authenticity.
    • DMARC: Must ensure, at least, p=none is in the configuration as well as aligning with SPF or DKIM, and preferably both.

  • Ethiopia, Uganda, Angola, Ghana, Nigeria top African countries targeted by threats

    Check Point Software Technologies released its Global Threat Index for December 2024, emphasising the growing sophistication of cybercriminals. For Africa, December was hardly a season to be jolly with eight of the continent’s countries listed among the top 20 most attacked.

    Ethiopia retained its top spot as the most attacked country with a 98.2% Normalised Risk Index out of the 106 countries featured in the Index.

    Other African countries featured in the top 20 are:

    Uganda at 8th place with a Normalised Risk Index of 68,2. 
    Angola at 9th place with a Normalised Risk Index of 66,2.
    Ghana at 11th position with a Normalised Risk Index of 62,7.
    Nigeria at 13th position with a Normalised Risk Index of 62,3, not too far from Ghana.
    Kenya’s Normalised Risk Index has increased since last month, moving from position 20 to 17 with a Normalised Risk Index of 57,6. 
    Mozambique comes in at position 18 with a Normalised Risk Index of 56,9.
    In 20th position with a higher Normalised Risk Index than last month is Cote d’Ivoire with 55,6.
    In December, the malware focus was on the rise due to FunkSec, an emerging ransomware-as-a-service, RaaS operator leveraging Artificial Intelligence, alongside persistent threats from malware families like FakeUpdates and AgentTesla. Data from ransomware shame sites reveals FunkSec as the most active group in December, responsible for 14% of all published attacks.

    Linked to Algeria, FunkSec appears driven by financial gain and hacktivist ideologies, with its AI-assisted tactics pointing to the increasing use of advanced technologies in cybercrime.

    FunkSec’s operations have thrust it to the forefront of double-extortion ransomware groups. Publishing over 85 victims in December 2024 alone, FunkSec has surpassed its competitors in volume. However, Check Point Research has flagged many of these claims as recycled or unverified, raising doubts about the group’s credibility

    Among the most prevalent malware threats, FakeUpdates reclaimed the top spot globally, affecting 5% of organisations worldwide, followed closely by AgentTesla, 3% and Androxgh0st, 3%. FakeUpdates, also known as SocGholish, remains a versatile downloader that introduces additional malicious payloads, while AgentTesla continues to target sensitive credentials.

    Maya Horowitz, VP of Research at Check Point Software, commented on the findings. “The latest trends in cybercrime underscore the importance of vigilance and innovation in cybersecurity. Organisations must leverage advanced threat prevention measures to protect themselves against the evolving landscape of sophisticated attacks.”

    Credits: Intelligent CIO