Security News
Home-network and family security news, explained: what happened, who's affected and what to do — published every morning, US time.
Scam alertFTC Warns of Misleading Health Insurance Ads and Calls
The FTC says some open-enrollment ads and calls impersonate insurers or sell limited benefits as full coverage. Here’s how to shop safely.
Account securityFake Firefox Crypto Wallet Extensions Stole Recovery Phrases
Three fake Firefox add-ons posed as crypto wallets and stole recovery phrases and private keys. Users should check extensions now.
Family safetyStolen School Accounts Spread Phishing Between Districts
Compromised school accounts are sending convincing phishing emails to other districts. Families should verify unusual requests before acting.
Scam alertRecovery Scams Add to Identity Theft Victims’ Losses
A new U.S. survey finds scam and identity theft victims face lasting stress—and many pay recovery services that may be scams too.
UpdatesTailscale Fixes SSH Flaws That Could Give Attackers Root Access
Tailscale has rolled out fixes for serious SSH flaws that could let an authorized attacker gain root access on connected servers.
Scam alertElection Scams Use Fake Registration and Donation Links
Fake voter-registration links, donation requests and prize polls can steal personal data or money. Verify every request through official sites.
Scam alertFTC Warns of Fake Charity Sweepstakes Prize Calls
Scammers are posing as trusted charities and claiming past donors won prizes. The FTC says any demand for payment means it is a scam.
Scam alertFake Crypto Investment Scam Took $36.9 Million From Americans
An alleged international scam used fake crypto sites and false gains to take $36.9 million from 174 Americans. Learn how to spot the pattern.
Account securityuCreator Android Spyware Targets Telegram and WeChat Accounts
Android users who installed unofficial Telegram or WeChat apps should remove them and secure their accounts against uCreator spyware.
UpdatesCritical Brotli Flaw Prompts Microsoft and Node.js Patches
A critical Brotli decoding flaw affects Microsoft tools, Node.js and Python packages. Updates are available, but some projects remain unpatched.
UpdatesBlackX Bootkit Bypasses Secure Boot on Some Patched PCs
A new UEFI bootkit can persist on patched Windows PCs if Secure Boot revocations are missing, though home users were not reported as targets.
Scam alertMicrosoft Teams Adds AI Phishing Checks for External Chats
Microsoft Teams will add AI phishing checks for external chats, giving households and small offices another warning against impersonation scams.
Scam alertPhone Scams Get Harder to Spot as AI Impersonation Grows
Scammers are using texts, calls and AI impersonation to steal money and accounts. Five phone settings and habits can reduce your risk.
PolicyFCC Blocks Two Video Devices Over Huawei-Linked Chips
The FCC blocked a wireless video transmitter and dashboard camera containing Huawei-linked surveillance chips from the US market.
Data breachCapcom Breach Exposes 11.7 Million Email Addresses
Capcom says attackers stole 11.7 million CAPCOM ID email addresses and changed 196 account passwords, raising phishing and takeover risks.
Scam alertFTC Warns of Phone Number Deactivation Impersonation Scam
Scammers posing as FTC officials threaten to deactivate phone numbers, seek personal details and demand a fake security deposit.
UpdatesOpenCode Flaw Put Windows and WSL Users at Risk
OpenCode users on Windows and WSL should update after a flaw let malicious MCP servers run commands during the sign-in process.
Scam alertChrome Adds Warnings for ClickFix and Suspicious Sites
Chrome now flags suspicious pages and ClickFix commands while adding approval prompts before insecure HTTP connections.
UpdatesWeak eMudhra Certificate Keys Blocked Across Major Platforms
Weak eMudhra certificate keys could have enabled trusted site impersonation. Major browsers and operating systems have now blocked them.
Scam alertiOS 27 Scam Detection Is Off by Default on iPhones
Apple’s new Impersonation Risk Detection can warn supported apps about active scams, but iPhone users must switch it on themselves.
Data breachTax Preparer Phishing Stole Data From 800 US Customers
A phishing case that hit U.S. tax preparers exposed at least 800 customers’ data and funded fraudulent tax refunds and loans.
Account securityFake Web3 Accelerator Spread Malware Through npm Packages
A fake Web3 accelerator used malicious npm packages to infect Windows and Mac computers and redirect some AI service traffic.
Data breachCalifornia Student Records Stolen From ETS System
California families are being notified after an intruder copied student records from an ETS file-transfer system using a compromised login.
Router securityUnpatched Broadcom Wi-Fi Flaw Threatens Some Routers
A Broadcom WPS flaw may let nearby attackers take over some routers without a password, and older devices may never receive a fix.