2-Spyware
What are you dealing with?
Pop-ups & adwareunwanted ads, push notificationsBrowser hijackerschanged homepage, redirectsRansomwarelocked or encrypted filesTrojans & backdoorshidden remote accessSpyware & keyloggersstolen passwords and dataScam emailsfake invoices, extortion, phishingFake alerts"your PC is infected" pagesRogue anti-spywarefake security tools that pretend to be realSuspicious filesis this .exe or process safe?Unsafe websitescheck a link before you open it
New membersthis monthAll
Community
Data breachesThe Record reports that Ahold Delhaize confirmed malicious actions behind a cyberattack that forced systems offline across most of its U.S. and European grocery brands. The company said it has no evidence that sensitive customer, employee or partner data was stolen, but the investigation is still ongoing. Shoppers should watch their accounts and be cautious if they use the affected online shopping services.
Ethan ColeOne setting I still see people miss: check your browser’s saved passwords and remove anything you don’t recognize. Scam pages often trick users into saving a fake login, and that can make the next sign-in easier to steal. If possible, keep two-step verification on too.
Browser securitygHacks reports that Microsoft is testing a seamless update system for Edge that would apply updates in the background without a restart prompt. The company says the goal is to close the patch gap and that Edge already has options to update when the device is idle or to alert administrators when a release includes fixes, including zero-day vulnerabilities. Windows users should keep Edge set to update and restart when prompted, or let it update while idle.
Martin BlakeOne Windows habit I still see people miss: check your Downloads folder for old installers and ZIPs you don’t need, then delete them. I get a few cases where someone runs the wrong file later because it’s been sat there for weeks with a harmless-looking name. Keep it tidy and you cut down the risk.
Exploited flawsSecurityWeek reports that attackers exploited multiple Fortinet flaws in an attack on a telecommunications organization, including a FortiManager bug patched in October 2024 and a path traversal flaw in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. CISA has added the path traversal issue to its Known Exploited Vulnerabilities list and urged immediate patching. Home and small-office users running Fortinet products should install the latest updates as soon as possible.
Megan Doyleugh, i just got an e-mail on my windows laptop saying my microsoft account password was changed, but i didn’t do it. there’s no obvious login in my recent activity, and i’m a bit panicked because it looks real. has anyone seen this before, and what should i check first?Data breachesInfosecurity Magazine reports that ConnectWise suspended several cloud services after finding unauthorized access to application identities in its ConnectWise Cloud Backup environment. The company says the access could let an attacker reach customers’ Microsoft 365 data, including mailboxes, OneDrive, SharePoint, Teams and directory information. ConnectWise advises customers to keep affected apps disabled, preserve sign-in and audit records, and review authentication, credentials, roles, consent grants, mailbox forwarding rules and other suspicious changes.
Malware newsThe Hacker News reports that a flaw in Broadcom’s Wi‑Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step. It was shown on home gateways from three Belgian internet providers, and no fix has been deployed to the affected routers. Windows users should check their router model and firmware status, and replace or isolate affected gear if no patch is available.
Scam alertsBitdefender reports that Ireland’s police force had two of its X accounts hijacked and used to post cryptocurrency messages. The posts claimed followers could claim free cryptocurrency through an airdrop, but the link could lead victims to hand over the keys to their crypto wallet. Users should be cautious with unexpected messages from trusted accounts and use multi-factor authentication and unique, strong passwords.
Claire HollowayOne Windows habit people still miss after a phishing scare: check the sign-in methods on your important accounts, not just the password. If an attacker added a recovery email, phone, or app, they can get back in even after you change the password. Remove anything you don’t recognise from a clean device.
Daniel ReevesOne Windows check people skip after a suspicious download: open Task Manager and look at the Startup tab. If something unfamiliar is set to launch with Windows, that’s worth a second look before you reboot and let it carry on like nothing happened.
Linda HarperThis morning on my Windows 10 laptop, I got an e-mail that looked like it was from my browser company saying my saved passwords were being checked and I had to sign in right away. The address looked a little odd to me. Is this something dangerous, and should I just delete it?Scam alertsKnowBe4 reports that Microsoft’s disruption of YAM Store, CoGUI and Iron Man exposed a cloud-based impersonation industry behind phishing. Criminals were buying accounts, hosting and templates that mimicked banks, retailers, healthcare providers, police and government agencies, then used fake CAPTCHA screens and live monitoring to capture credentials and payment details.
The post says ordinary users and small offices should not rely only on spotting bad grammar. It recommends phishing-resistant authentication, rapid reporting and training that keeps up with changing social engineering tactics.
Linda HarperThis evening on my Windows 10 laptop, I opened the browser and a little page came up saying my browser was out of date and I needed to install an update right away. It looked a bit odd, so I closed it. Is that the kind of thing I should worry about, or is it just one of those fake messages?