2-Spyware
What are you dealing with?
Pop-ups & adwareunwanted ads, push notificationsBrowser hijackerschanged homepage, redirectsRansomwarelocked or encrypted filesTrojans & backdoorshidden remote accessSpyware & keyloggersstolen passwords and dataScam emailsfake invoices, extortion, phishingFake alerts"your PC is infected" pagesRogue anti-spywarefake security tools that pretend to be realSuspicious filesis this .exe or process safe?Unsafe websitescheck a link before you open it
New membersthis monthAll
Community
Scam alertsKnowBe4 says attackers are abusing trusted services like DocuSign, SharePoint, Adobe Sign, Dropbox and Google Drive to send phishing emails that look legitimate. In its analysis of 544,000 threat emails between June and August 2026, LOTS techniques accounted for 53,000 emails, with DocuSign and QuickBooks making up nearly two-thirds of that volume.
The post says these emails can bypass security gateways because they come from real platforms. Windows users and small offices should be careful with document-share and payment messages, even when the sender looks trustworthy.
Data breachesThe Record reports that the FBI arrested another suspected ShinyHunters member after the group breached its jobs site. The hackers stole sensitive data on nearly every FBI employee, including medical records, home addresses, phone numbers, and work locations, and also exposed records about local police officers on task forces. People affected by similar breaches should change passwords, turn on two-step verification, and watch accounts for unusual activity.
Exploited flawsThe Register reports that researchers found two characters that can trick Chromium browsers into showing lookalike URLs as genuine web addresses. The issue affects Chromium-based browsers such as Chrome and Edge, and the fake domains can bypass browser safety checks. Windows users should update their browser when a fix is available and be careful with links that look like familiar sites but use unusual characters.
Scam alertsHackread.com reports that the DOJ has charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy to commit wire fraud. Prosecutors say he claimed the company could recover encrypted files without paying a ransom, but instead paid attackers for decryption keys and charged victims much higher fees. The FBI and CISA advise against paying ransoms, since payment does not guarantee files will be recovered or stolen data will not be leaked.
Malware newsThe Hacker News reports that attackers have compromised open-source maintainer accounts to push a malicious GitHub Actions workflow into more than 340 repositories, with more than 500 GitHub accounts affected since October 7. The workflow is designed to steal secrets, including cloud, SaaS and AI credentials. Developers should check for the named workflows, revoke compromised GitHub credentials, rotate secrets, and delete the malicious workflow from all branches.
Hannah PriceThis morning on my Windows 11 laptop I got a browser warning saying my session had expired and I needed to confirm my email right away. The page looked tidy, but the address felt off, so I closed it and checked the site by typing it myself. Have others seen these fake session-expiry warnings lately?
Browser securityChrome Releases reports that the Stable channel is being updated to ChromeOS version 16805.33.0, with browser version 154.0.8037.151 for most ChromeOS devices. The update includes multiple Chrome browser security fixes, including several high and critical issues in V8, Passwords, PDFium, and other components. Windows users should update Chrome when prompted and avoid delaying security updates.
Data breachesThe Record reports that medical device maker iRhythm said data on at least 360,000 people was breached in a June cyberattack. The stolen information includes names, addresses, phone numbers, patient account numbers, device serial numbers, insurance numbers, dates of service and dates of birth. iRhythm says the attack did not affect its devices or operations, but affected people should watch their accounts and be alert for misuse of their personal information.
Malware newsSecurityWeek reports that Bitdefender found Midnight Mimosa, a campaign that ships malware preinstalled in the firmware of low-cost Android devices built on MediaTek platforms. The malware can silently install and remove apps, grant permissions, and load code remotely, and some related apps were also found on Google Play. Windows users should be cautious with cheap devices and avoid installing apps from untrusted sources.
Exploited flawsSecurityWeek reports that Citrix is urging immediate patching of a critical NetScaler vulnerability that could lead to remote code execution or denial of service. The flaw affects NetScaler ADC and NetScaler Gateway appliances in specific SAML configurations, as well as Secure Private Access Hybrid deployments. Citrix says it is not aware of unmitigated exploits, but users should update to the fixed versions as soon as possible.
Daniel ReevesOne Windows setting worth checking after a scare: Windows Security > Virus & threat protection > Protection history. If something was blocked or removed, it often tells you whether the problem was a real threat or just a noisy browser tantrum. Saves a lot of guesswork, which is nice for a change.
Ray DunbarGot a weird e-mail on my Windows 10 PC this morning. Said my Microsoft account was locked and I had 24 hours to verify or lose access. The sender looks off, and the link smells bad. I didn’t click it. Is this a common scam, or should I check anything in Windows or my account?Browser securityChrome OS has received a Long Term Support Channel update to version 150.0.7871.256. Google says it includes selected security fixes, including issues in Browser, Omnibox, Extensions, WebRTC, GPU, PDF, and other components. Devices in the LTC channel will be updated to this version, so users should install it when it arrives.