Practical security tips to protect your accounts, devices and business from phishing, scams and malware.
Extortion group Luna Moth is returning to law firms it hit before, likely those that refused to pay. This time it poses as IT support and talks employees into copying their Microsoft access token themselves, with no malware involved.
Island uncovered TypoPrompting, a campaign using 186 misspelled domains that impersonate 27 AI brands, including ChatGPT, Claude, Gemini, Copilot, Grok and DeepSeek, to push ClickFix lures, browser hijackers and search-hijacking extensions.
Apiiro found 2,539 exposed credentials across nearly 2,000 public GitHub repositories and traced part of them to Claude Code, which saves secret-bearing commands in a settings file that gets committed with the code.
Campaigns like FaceStealer don't exploit a bug; they talk you into downloading a "fix" during a video call. These practical steps shut this kind of attack down.
