In a confirmation that we've gone full Black Mirror, air fryer and other IoT manufacturers are being told to stop playing with our data.

In a confirmation that we’ve gone full Black Mirror, the UK’s privacy czar has wagged a finger at air fryer manufacturers and told them to stop playing with our data.

New draft guidance from the Information Commissioner’s Office (ICO) targets not just air fryer vendors but manufacturers of any smart home products, ranging from smart lighting systems through to internet-connected refrigerators and connected toys.

Collectively known as IoT (Internet of Things) devices, these connected objects have a nasty habit of collecting our data without us really understanding what they’re doing. It’s a problem with many of them, although late last year Which? magazine added air fryers to the list of offenders.

The guidance highlights data that IoT vendors might collect. This includes registration data such as an owner’s name, address, and email. It also means information gathered directly from the product that reveals how the user interacts with it. A device might simply tell its manufacturer when you used the product and how long for, but sensors embedded in it might monitor anything from temperature to motion.

The ICO is interested in enforcing privacy laws such as the UK’s version of the General Data Protection Regulation (UK GDPR). That allows products to process user information if it’s purely for domestic use, like asking a smart speaker to play Lady Gaga’s all-time greatest hits, say.

But if the IoT vendor uses audio recordings of the person’s interactions with the speaker to improve its own service or even to make inferences about that person from their musical choices, then that isn’t domestic use. That’s processing for the company’s own purposes, and it falls on the wrong side of the law.

**Consent is key**

The guidance tells vendors to ask for consent when processing this kind of data. That means ensuring that users can easily tell what they’re consenting to, and be able to make a clear choice not to do so.

Users should be able to find out how the manufacturer is using their information after they sign up for the service, says the ICO. They must also be able to withdraw consent at any time. In practice, that helps people who might click a consent button early on but then think twice about it later and decide to change their permissions.

When vendors do collect information about users they must tell them what they’re collecting, and why they’re using it. They should tell people what decisions they’re making with it, and how it affects their service. People should also be informed about how long the vendor will keep that data.

The company should also process user data fairly. That means only doing what people expect them to do with it, and not in ways that harm the user.

This is all good advice, and in keeping with existing privacy laws, but it means vendors will have a fine line to walk. Some of the requirements are nuanced. For example, the guidance asks companies to consider ways of making their privacy information easy to follow. That means giving them all the information they need without overloading them. It might require careful user interface design, along with collaboration between designers and privacy or compliance professionals.

Where appropriate, design choices like navigation panels, collapsible lists, large text, and diagrams will go a long way towards satisfying these requirements, the ICO says.

**There’s an existing UK law for IoT security**

There’s also a section outlining security for IoT devices and the data they collect. This points to an existing UK law called the Product and Telecommunications Infrastructure Regulations 2024 (PSTI Regulations), which came into effect last year. This calls for specific protections such as the use of unique passwords for devices, encryption of user data, and regular security updates.

The security aspect of IoT is perhaps one of the most important of all. Even companies with the best of intentions can make mistakes and leak customer data gathered by everything from connected chastity devices through to kids’ toys.

This guidance applies not just to smart connected objects but to the apps that vendors often provide with them. Those apps, which give you data about what your smart object is doing and allow you to control it, are great ways for vendors to harvest information about you.

**You’re your own best protection**

The document is still in draft form and open to consultation. Because it’s UK guidance it likely won’t protect people not in the UK. As always, the first line of defense is you.

So, when buying a smart home device, consider whether an app for it is necessary. Your smart fryer might have no way of phoning home without an app, but you might be able to just check whether your food is done without needing your phone to tell you.

In some cases, you might want to consider whether you really need a product to be connected at all. Connected devices are a great way for companies to nickel and dime you unexpectedly through subscription programs, or brick your product remotely when they decide it isn’t profitable for them any more.

Sometimes, all you want to do is cook up some hot fries without things getting too complicated, you know?

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

 Smart air fryers ordered to stop invading our digital privacy 

Reddit has announced more AI-powered tools to help advertisers. But do users care for it?

Reddit has introduced two Artificial Intelligence (AI) tools which will use Reddit comments, posts, and conversations to help sellers make the most of the community.

Reddit is a social media platform and online forum where users can share and discuss content across a wide range of topics. The platform’s structure divides it into communities known as “subreddits,” each focused on a specific subject or interest (from cars to movies to sports to knitting).

There are also promoted posts, which look like regular Reddit posts but are marked as sponsored. They can include text, images, videos, or carousels and often appear in users’ feeds or within specific subreddits. Due to its size, Reddit has evolved into a major digital platform for both advertising and AI-powered data analysis.

Reddit introduced its “Reddit Community Intelligence” at the Cannes Lions International Festival of Creativity 2025. It described this new addition as the collective knowledge of billions of conversations to help businesses and organizations make “smarter marketing decisions.”

Last year, Reddit launched AI-powered advertising such as an ads inspiration library, AI copywriter, and image auto-cropper to help small businesses create more effective, platform-specific ads.

The new tools, dubbed “Reddit Insights” and “Conversation Summary Add-ons” use AI to analyze conversations, summarize sentiment, and surface relevant user-generated content for advertisers.

Last year, the FTC advised Reddit that it would conduct a non-public inquiry focused on Reddit’s sale, licensing, or sharing of user-generated content with third parties to train AI models. This was before Reddit announced a partnership with OpenAI to bring Reddit content to ChatGPT.

When the FTC launched a Request for Information (RFI) to better understand how technology platforms deny or degrade users’ access to services based on the content of their speech or affiliations, and how this conduct may have violated the law, without specifically mentioning Reddit, the company saw a 9% drop in stock price.

The new tools will undoubtedly fuel the ongoing debates about the ethics of AI-driven analysis on Reddit, especially regarding user consent and the potential for privacy breaches.

In April, users of the r/ChangeMyView subreddit expressed outrage at the revelation that researchers at the University of Zurich were secretly using the site for an AI-powered experiment in persuasion, prompting the moderation team to explain that the experiment was conducted without authorization.

Given the open nature of Reddit it’s important to keep in mind that anything you post can be found by anyone and everything, including AI. So, it’s important to hold yourself to the same standards you may use when posting on social media.

On June 28, 2025 a new Privacy Policy will go into effect. It stands to reason that you should be aware of the current policy and keep up with any changes.

A few general rules to help improve your privacy on the platform:

*   Anonymity: there is no reason to use your real name or any identifying information in your username or profile. Don’t share personal details like your location, workplace, or other identifiers in posts or comments unless they are relevant to the post.
*   Don’t link to other social media profiles in your profile or posts. Also don’t link your account to your Google or Apple account.
*   If you’re active in several Reddit communities, consider creating separate accounts for different interests or sensitive topics.
*   In your Reddit account settings, under Privacy you can turn off “Show up in search results” to prevent your posts and comments from being indexed by search engines or easily browsed by others.
*   You can also disable “Personalize ads on Reddit based on information and activity from our partners.”
*   Protect your account using a unique, complex password and enable two-factor authentication (2FA) for your Reddit account.
*   Regularly check your account activity for unauthorized access and report anything suspicious.

**We don’t just report on threats – we help protect your social media**

Cybersecurity risks should never spread beyond a headline. Protect your social media accounts by using Malwarebytes Identity Theft Protection.

 Reddit&#8217;s new AI-powered tools scan your posts to serve you better ads 

This week on the Lock and Code podcast, we revisit a 2024 interview with Dr. Jean Twenge about smartphones and the teen mental health crisis.

_This week on the Lock and Code podcast…_

Complex problems often assume complex solutions, but recent observations about increased levels of anxiety and depression, increased reports of loneliness, and lower rates of in-person friendships for teens and children in America today have led some school districts across the country to take direct and simple action: Take away the access to smartphones in schools.

Not everyone is convinced.

When social psychologist and author Jonathan Haidt proposed five solutions to what he called an “epidemic of mental illness” for young adults in America, many balked at the simplicity.

Writing for the outlet Platformer, reporter Zoe Schiffer spoke with multiple behavioral psychologists who alleged that Haidt’s book cherry-picks survey data, ignores mental health crises amongst adults, and over-simplifies a complex problem with a blunt solution. And in speaking on the podcast Power User, educator Brandon Cardet-Hernandez argued that phone bans in schools would harm the students that need phones the most for things like translation services and coordinating rides back home from parents with varying schedules.

But Haidt isn’t alone in thinking that smartphones have done serious harm to teenagers and kids today, and many schools across America are taking up the mantle to at least remove their access in their own hallways. In February, Los Angeles Unified School District did just that, and a board member for the school district told the Lock and Code podcast that he believes the change has been for the better.

But for those still in doubt, there’s a good reason now to look back.

Today, on the Lock and Code podcast with host David Ruiz, we revisit a 2024 interview with Dr. Jean Twenge about her research into the differences in America between today’s teens and the many generations that came before. A psychologist and published author, Twenge believes she has found enough data tying increased smartphone use and social media engagement with higher strains on mental health. In today’s re-broadcast episode, Twenge explains where she believes there is a mental health crisis amongst today’s teens, where it is unique to their generation, and whether it can all be traced to smartphones and social media.

According to Dr. Twenge, the answer to all those questions is, pretty much, “Yes.” But, she said, there’s still some hope to be found.

> “This is where the argument around smartphones and social media being behind the adolescent mental health crisis actually has, kind of paradoxically, some optimism to it. Because if that’s the cause, that means we can do something about it.”

Tune in today to listen to the full conversation.

**Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.**

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.

 The data on denying social media for kids (re-air) (Lock and Code S06E12) 

A list of topics we covered in the week of June 9 to June 15 of 2025

June 13, 2025 - Users of the Meta AI seem to be sharing their sensitive conversations with the entire world without being aware of it

June 11, 2025 - In a senate hearing, 23andMe was questioned about the impending take-over of the company and its trove of genetic data

June 10, 2025 - A mobile scam finds most people at least once a week, new Malwarebytes research reveals. The financial and emotional consequences are dire.

June 10, 2025 - Google has fixed a vulnerability in its account recovery flow which could have allowed attackers to find linked phone numbers.

June 9, 2025 - Find out where and how victims can report online scams to prevent more victims and possibly recover funds.

 A week in security (June 9 &#8211; June 15) 

Users of the Meta AI seem to be sharing their sensitive conversations with the entire world without being aware of it

Conversations that people are having with the Meta AI app are being exposed publicly, often without the users realizing it, revealing a variety of medical, legal, and private matters. The standalone app and the company’s integrations with artificial intelligence (AI) across its platforms—Facebook, Instagram, and WhatsApp—are now facing significant scrutiny for such privacy lapses.

The past two years have seen an explosion in generative AI tools, such as ChatGPT, Anthropic’s Claude, Google Gemini, and more. But with new players entering the market almost daily, not all of them deserve the same level of trust.

With 1 billion active monthly users, Meta AI is one of the contenders aiming for ChatGPT’s crown. To monetize this success, Meta’s CEO Zuckerberg said “there will be opportunities to either insert paid recommendations” or offer “a subscription service so that people can pay to use more compute.”

Similar to ChatGPT, Meta AI can generate text, answer questions, and help users plan, brainstorm, and strategize on various issues. But when using the Meta AI app, after submitting a question, users can also press a “share” button, which directs them to a screen showing a preview of the post, which users can then publish. But some users appear blissfully unaware that they are sharing these text conversations, audio clips, and images **publicly** with the world.

Other users can access “shared” conversations by using the apps Discover feed.

With only one glance at that feed, I found this example of a conversation the user might not have wanted to be publicly visible. A teacher shared an email thread regarding their upcoming arbitration of a job termination that felt unjust. The Meta AI app responded:

> “Hello {name}, it’s great to hear from you again. I can sense the emotional weight of revisiting this experience, and **I appreciate your trust in sharing it with me**. It sounds like a really tough situation, and I’m here to listen and support you as you process it. No rush, take your time to gather your thoughts, and we can continue the conversation whenever you’re ready. How’s the preparation for the arbitration going so far?”

The emphasis is by me. If the AI realizes how much trust it takes to share that story with anyone, even if it’s only a bot, then how must it feel when the user finds out the whole world can find and read it. I didn’t even have to log in to find this conversation.

TechCrunch reported about people asking for help with tax evasion and other personal matters, calling Meta AI a “privacy disaster.” Many sources found threads about medical topics, and other conversations about delicate and private issues.

What people may not realize is that if they use the integrated versions on social media, they are logged in and their conversation can be tied to their social media profile.

Your best option would be not to use Meta AI at all. If you do, make sure you are not logged in and double check that fact if you are logged in on any of the Meta platforms on the same device. And never, ever use the Share button unless you mean to.

Meta spokesperson Daniel Roberts wrote in an emailed statement to WIRED that users’ chats with Meta AI are private unless users go through a multistep process to share them on the Discover feed.

When asked about these mishaps, the Meta AI chatbot said:

> “Some users might unintentionally share sensitive info due to misunderstandings about platform defaults or changes in settings over time.”

However, Meta has not provided detailed, easily accessible in-app guidance at the moment of sharing, which contributes to user confusion. I decided to ask Meta AI.

**Question**: What do I need to do so you don’t share our conversation with the rest of the world? And is it true that the information I share with you might be used for advertising? Or, at least for “sponsored” recommendations?

**Answer**: Your conversations with me are used to improve the model and might be reviewed by our team to ensure quality. We may also use your conversations to train our models to be more helpful and accurate. However, we take steps to protect your privacy.

If you have concerns about how your data is used, you can visit Meta’s Privacy Center to learn more about how Meta handles data: https://www.facebook.com/privacy/center/.

Did that actually answer my question? No.

So, here are the steps you may want to take if you decide to engage with Meta AI for all the different platforms where you may encounter it.

**Meta AI App**

*   To ensure your prompts and conversations are only visible to you:
    *   Tap your profile icon in the Meta AI app.
    *   Go to **Data & Privacy** under **App settings**.
    *   Select **Manage your information**.
    *   Set **Make all your prompts visible to only you**.
*   Avoid using the **Share** button unless you are certain you want your conversation to appear publicly on the Discover feed.

**WhatsApp, Facebook, and Instagram**

Note: Conversations with Meta AI on WhatsApp are not protected by end-to-end encryption and may be used for AI training

To limit Meta’s use of your data for AI training:

*   Go to **Settings & Privacy > Privacy Center**.
*   Scroll to **Privacy Topics** and select **AI at Meta**.
*   Under **Submit an objection request** click Your messages with **AIs on WhatsApp** (or any of the other platforms you’re looking for) and fill out the form to request that Meta not use your data for AI training.  
    

**Deleting AI conversation data**

Meta has introduced commands to delete information shared in any chat with an AI:

*   For example, type /reset-ai in a conversation on Messenger, Instagram, or WhatsApp to delete your AI messages.

**We don’t just report on threats – we help protect your social media**

Cybersecurity risks should never spread beyond a headline. Protect your social media accounts by using Malwarebytes Identity Theft Protection.

 Your Meta AI chats might be public, and it’s not a bug 

Flight data of US customers is being sold by several airlines through a joint data broker sending contracts to ICE and CBP.

A data broker owned by some of America’s biggest airlines has been selling access to customer flight data to the US Department of Homeland Security (DHS).

The data, compiled by data broker Airlines Reporting Corporation (ARC), includes names, flight itineraries, and financial details. It also covers flights booked via US travel agencies.

ARC makes this data available to Customs and Border Protection (CBP), along with Immigration and Customs Enforcement (ICE), both of which were previously known as the US Customs Service until 2003, and both of which are offices under DHS.

ARC is owned and operated by eight major US airlines and is unique in being the only financial intermediary between the airline industry and US travel agencies, according to the data broker’s contract with ICE. ARC also provides payment settlement services for travel agencies and airlines, which has created a huge database of travel information that the data broker then makes available under its Travel Intelligence Program (TIP).

ARC’s most recently revealed contract, uncovered by tech news outlet by 404 Media, is with US Customs and Border Protection. A statement of work with that agency revealed that the TIP pilot program “generated meaningful results to current \[redacted\] cases and will continue to do so once fully accessible to \[redacted\] analysts across \[redacted\] Offices.”

The CBP contract mandates silence from DHS on where it got the data. The statement of work, which began in June 2024 and could optionally run until June 2029, states that the CBP will “not publicly identify vendor, or its employees, individually or collectively, as the source of the Reports unless the Customer is compelled to do so by a valid court order or subpoena and gives ARC immediate notice of same.”

ARC’s contract with ICE, meanwhile, provides a view into the data obligations from travel agencies. As the contract stated:

“Daily, travel agencies must submit ticket sales and funds for over 240 airlines worldwide to ARC. This process enables ARC’s TIP, an essential intelligence tool integrated into HSI INTEL’s investigative mission.”

HSI INTEL stands for the Homeland Security Investigations Office of Intelligence. It investigates criminal networks, and also any “individual or organization that threatens national security or seeks to exploit the customs and immigration laws of the United States,” per the DHS website.

Those with access to the TIP database can search across 39 months of flight booking data. Flight itineraries and passenger name records, along with travel dates, flight dates, and even credit card numbers are available from the database.

Other agencies that have purchased access to the database include The Secret Service, the Securities and Exchange Commission, the Drug Enforcement Administration, and the US Marshals Service, according to 404 Media.

Delta, Southwest, United, Lufthansa, Air France, American Airlines, Air Canada, Alaska Airlines, and JetBlue all have seats on the ARC board. The company also partners with hundreds of airlines and travel agencies around the world.

 US airline industry quietly selling flight data to DHS 

In a senate hearing, 23andMe was questioned about the impending take-over of the company and its trove of genetic data

In a Senate hearing adequately titled “23 and You: The Privacy and National Security Implications of the 23andMe Bankruptcy,” 23andMe executives addressed concerns about the privacy implications of the company’s sale and the handling of associated genetic data.

For those who missed the latest developments, in May 2025, we reported that 23andMe had agreed to sell itself to the pharmaceutical organization Regeneron for $256 million. In that agreed sale, Regeneron was also going to acquire the genetic data of 23andMe’s customers. But in early June, 23andMe’s former CEO Anne Wojcicki put forth a last-minute bid of $305 million, throwing Regeneron’s purchase into question, and placing 23andMe itself back on auction.

The bid was made through the TTAM Research Institute, a nonprofit medical research organization recently set up by Wojcicki.

We explained earlier how consumers could (and why they maybe should) delete their genetic data from 23andMe. Apparently, people listened. Interim CEO Joe Selsavage said at the hearing that since the company’s March bankruptcy filing, 1.9 million of the company’s 15 million customers have chosen to delete their data.

Committee chairman James Comer said in opening remarks:

> “It is imperative that 23andMe … ensure there is absolutely no legal or illegal way for foreign adversaries or anyone else to access or manipulate and abuse Americans’ genetic data to advance their nefarious agendas.”

The urgency of the matter, undoubtedly enhanced by the way 23andMe has handled data sales and breaches in the past, lies in the impending sale of the company.

The committee criticized the company for failing to model the potential transfer of customers’ genetic data in the upcoming sale with an “opt-in” framework, and ruled that 23andMe made it too cumbersome for consumers to delete the data—23andMe’s biggest asset in the sale.

US Representative Suhas Subramanyam of Virginia said:

> “If there simply was a ‘delete my data’ page or button somewhere more prominent then I think it would be easier for a lot of people to feel that control.”

During the hearing, interim CEO Selsavage and former CEO Wojcicki repeatedly declined to commit to establishing a customer opt-in mechanism, specifically one that would _require_ consumers’ approval before their data could be sold and transferred to a new owner, despite multiple requests from committee members.

Beyond the threat of genetic data falling into foreign hands, many raised concerns that the sale could enable targeted advertising aimed at individuals with mental health conditions, drive up insurance premiums, or restrict access to credit.

23andMe assured the committee that regardless of who wins the auction, the company will not be sold to any entity unless it agrees to uphold the existing privacy policy.

23andMe’s privacy statement tells users that any new owner must adhere to its existing data protection guidelines, which include not providing user data to insurers, employers, public databases, or law enforcement without a court order, search warrant, or subpoena.

**What can consumers do to protect their data?**

Customers should actively manage their data on 23andMe by reviewing policies, deleting data if desired, and staying vigilant about how their sensitive genetic information is used.

People that have submitted samples to 23andMe have three different options, each providing a different level of privacy.

**1\. Delete your genetic data from 23andMe**

For 23andMe customers who want to delete their data from 23andMe:

*   Log into your account and navigate to **Settings**.
*   Under **Settings**, scroll to the section titled **23andMe data**. Select **View**.
*   You will be asked to enter your date of birth for extra security. 
*   In the next section, you’ll be asked which, if there is any, personal data you’d like to download from the company (make sure you’re using a personal, not public, computer). Once you’re finished, scroll to the bottom and select **Permanently delete data**.
*   You should then receive an email from 23andMe detailing its account deletion policy and requesting that you confirm your request. Once you confirm you’d like your data to be deleted, the deletion will begin automatically, and you’ll immediately lose access to your account. 

**2\. Destroy your 23andMe test sample**

If you previously opted to have your saliva sample and DNA stored by 23andMe, but want to change that preference, you can do so from your account settings page, under “Preferences.”

**3\. Revoke permission for your genetic data to be used for research**

If you previously consented to 23andMe and third-party researchers using your genetic data and sample for research, you may withdraw consent from the account settings page, under **Research and Product Consents**.

**Check if you were caught in the 23AndMe data breach**

Additionally, you may want to **check if your data was exposed in the** **2023 data breach**. We recommend that you run a scan using our free Digital Footprint Portal to see if your data was exposed in the breach, and then to take additional steps to protect yourself (we’ll walk you through those).

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

 23andMe raked by Congress on privacy, sale of genetic data 

GirlsDoPorn owner pleaded guilty to sex trafficking through his coercive pornographic websites. He now faces life in prison.

Michael James Pratt, the owner of pornographic websites GirlsDoPorn and GirlsDoToys, has pleaded guilty to sex trafficking in a US court.

Pratt ran the websites, which lured and coerced young women into filming pornographic videos, from 2013 to 2019. Pratt and his accomplices lured women from across the US and Canada to San Diego, where the filming would take place in hotel rooms or short-term rental units.

The group would advertise via online sites including Craigslist. In some cases the advertisements would promote clothed modelling jobs. It would later transpire that the work involved performing in sex videos.

When women showed doubt about appearing in such videos, Pratt and his team would convince them that the videos they made would only be distributed to a small base of private collectors outside the US, and that no one who knew the women would ever see them. Pratt would also pay other young women known as ‘reference girls’ to seal the deal by helping to persuade the victims, on the expectation that another young woman’s testimony would be more convincing.

**Victims were coerced**

Once the victims arrived at the airport, they would be taken to the shoot, where Pratt and his accomplices would rush them into signing contracts without giving them copies.

The perpetrators would tell the women that the shooting sessions would be short, but in fact they would take hours. Pratt and his group would bully victims into having sex on camera, according to the FBI. Sometimes they would refuse to let them leave until they completed the shoots, pressing the women to perform acts that they had previously declined. Pratt and his associates would threaten to cancel flights home or publish what had already been filmed if victims did not comply.

The operation, which ran from 2013 to 2019, targeted hundreds of people. It would post the videos on its own sites, which were available in the US for a subscription fee. The operators would also post free versions of the videos on giant adult content site Pornhub to drum up business. These were often viewed millions of times. It generated over $17 million in revenue for Pratt, who originally conceived the operation. When contacted by one victim and asked to remove a video from the site, Pratt did not reply.

**A fugitive from justice**

Pratt played various parts in the operation, including recruiting victims, transporting them to the shooting sessions, and filming. He had already been charged in a US court in 2019 but fled to Spain, making it onto the FBI’s most wanted list. The FBI extradited him in 2022 and he pleaded not guilty in March 2024 to 19 felony counts, including sex trafficking (of both adults and minors), production of child pornography, and conspiracy to commit money laundering.

The pornography operation had already ordered to pay $18 million to victims in 2021 after 22 women sued it for damages. The FBI has also prosecuted other people involved in the sites. Matthew Wolfe, who moved from New Zealand to begin working for Pratt in 2011 and who run multiple parts of the business, received a 14-year sentence in March 2024. Cameraman Theodore Gyi was sentenced to four years in 2022. Adult film performer Ruben Andre Garcia received 20 years on June 2021. Office manager Valerie Moser will be sentenced on September 12.

Pratt will be sentenced on September 8 this year on two counts. He faces a minimum sentence of fifteen years for sex trafficking, and a maximum penalty of life in prison. Another count of sex trafficking conspiracy also carries a maximum life sentence.

 GirlsDoPorn owner faces life in jail after pleading guilty to sex trafficking 

A mobile scam finds most people at least once a week, new Malwarebytes research reveals. The financial and emotional consequences are dire.

It’s become so troublesome owning a phone.

Malicious texts pose as package delivery notifications, phishing emails impersonate trusted brands, and unknown calls hide extortion attempts, virtual kidnapping schemes, or AI threats. Confusingly, even legitimate businesses now lean on outreach tactics that have long been favored by online scammers—asking people to scan QR codes, download mobile apps, and trade direct messages with, essentially, strangers.

All this junk is adding up, and it’s hurting everyday people.

According to new research conducted by Malwarebytes, 44% of people encounter a mobile scam every single day, while 78% encounter scams at least weekly. The victims of those scams—be they people who accidentally clicked on a link, filled out their information on a malicious webpage, or simply believed the person on the other side of a social media account—also suffered serious harms to their finances, emotions, and reputations. As Malwarebytes learned, 25% of scam victims were harassed or blackmailed, 19% had private info exposed, and 15% permanently lost their money.

As shared by one scam victim writing about their experience:

> “I felt like I was in a horror movie. I never thought it would happen to me like this.”

These are the latest findings from original research conducted by Malwarebytes to understand the reach, frequency, and impact that mobile scams have across multiple countries. By surveying 1,300 people over the age of 18 in the US, UK, Austria, Germany, and Switzerland, Malwarebytes can reveal a mobile reality full of tension: high concern, low action, and increasingly blurred lines between what’s safe and what’s not.

The complete findings can be found in the latest report, “Tap, swipe, scam: How everyday mobile habits carry real risk.” You can read the full report below.

Here are some of the key findings:

*   77% of people worry about mobile scams and threats. The biggest fears are around financial loss and fraud (73%), account and device lockout (70%), and identity theft (68%).
*   66% worry about the future of AI and how realistic scams are going to become.
*   Just 15% of people strongly agreed: “I am confident in my ability to tell when something on my mobile phone is a scam.”
*   74% of people have encountered a social engineering scam in their lives, such as phishing attempts, fake FedEx notifications, or romance scams, and 36% have fallen victim.
*   37% of people have encountered an extortion scam and 17% have fallen victim, including 7% who were harmed specifically by a sextortion scam.  
*   10% of people have a “safe word” in their family to “protect against things like kidnapping and extortion scams.”
*   52% of scam victims suffered financially: 18% had to freeze their credit, 15% lost money permanently, and 8% had accounts opened fraudulently in their name.
*   Only 20% of people use traditional security measures like antivirus, a VPN, and identity theft protection.
*   25% of people do not worry about scams at all because “it’s not something I can control.”

This is the mobile world that the public is forced to live in, and the mobile world that future generations may soon inherit. While broad, bold action is required to meaningfully catch and stop scammers, everyday people can lean on many cybersecurity best practices to stay safe and secure online. From using unique passwords, to implementing multifactor authentication (MFA), there is plenty at hand to make life more difficult for scammers.

Importantly, there’s also help from Malwarebytes.

With the launch of our free, AI-powered digital safety companion **Scam Guard**, users can review any concerning text, email, phone number, link, image, or online message and receive on the spot guidance to avert and report scams. Try it today and remove the fear from being online.

Scam Guard is available for both free and paid users of Malwarebytes Mobile Security (iOS and Android), without having to install an additional app.  

Try it out for yourself: Download Malwarebytes Mobile Security for iOS or Android.

 44% of people encounter a mobile scam every single day, Malwarebytes finds 

Google has fixed a vulnerability in its account recovery flow which could have allowed attackers to find linked phone numbers.

Google has fixed vulnerabilities that made it possible to retrieve the phone numbers of almost any Google user. The flaw was found in the flow that allows users to recover their Google account using a phone number.

A cybersecurity researcher called Brutecat was able to figure out the phone number linked to any Google account, information that is usually not public and is considered sensitive.

Brutecat found that the page where users can recover their Google account if they have forgotten their login details lacked BotGuard protection. BotGuard is a cloud-based cybersecurity solution designed to protect websites and web applications from malicious bots, automated attacks, crawlers, and scrapers.

However, BotGuard does not work on websites that do not use Javascript. This is because many of its advanced detection techniques rely on executing Javascript in the visitor’s browser to gather client-side data. If a website does not serve Javascript, or if a user or bot disables Javascript, BotGuard cannot collect the necessary information for fingerprinting or behavioral analysis.

Brutecat also had to use rotating IP addresses and a trick to bypass the occasional CAPTCHAs but was able to manage 40k requests per second. At that rate, if the attacker knew the country code of the phone number, it would take about 20 minutes in the US to find out the recovery phone number. In the UK that would come down to 4 minutes because they have shorter phone numbers.

For those doing the math and finding this is impossible, it’s important to know that Google displays the last two numbers of the phone number as a hint and Brutecat used Google’s own library ‘libphonenumber’ to generate valid number formats.

But the researcher also needed the full display name of a targeted account. The researcher discovered a method to leak Google account display names by exploiting a feature in Looker Studio (formerly Google Data Studio). The researcher made a report/document in Google’s Looker Studio tool. Then changed the document’s owner to the victim’s Google account (using the victim’s email address). After transferring ownership, the victim’s full name automatically appeared on the Looker Studio home page’s “Recent documents” list even if the victim never opened the document, interacted with it, or knew about it. The key to this was finding that Looker Studio’s interface still displayed names for document transfers without requiring any action from the victim, unlike other Google services that now require prior interaction.

Google spokesperson Kimberly Samra told TechCrunch:

> “This issue has been fixed. We’ve always stressed the importance of working with the security research community through our vulnerability rewards program and we want to thank the researcher for flagging this issue. Researcher submissions like this are one of the many ways we’re able to quickly find and fix issues for the safety of our users.”

Google also says it’s not aware of any confirmed reports about exploits of these vulnerabilities.

Nonetheless, a weakness allowing an attacker to trace phone numbers to Google accounts like this creates a massive risk for phishing and SIM-swapping attacks—especially since the majority of users will have their primary phone number as their account recovery number.

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

Source

Malwarebytes