IT News

Romance scams continue to plague users, but their costs have risen to staggering heights, according to a Malwarebytes survey carried out last month via our weekly newsletter.

More than 66 percent of 850 respondents have been targeted by a romance scam, and those that were ensnared paid a hefty price, with 10 percent of victims losing $10,000 and up. A shocking 3 percent parted with $100,000 or more. The vast majority of those who lost money were unable to recover it, highlighting the need for increased awareness of evolving romance scam tactics and aggressive new methods of manipulation.

Romance scams, also known as confidence or dating scams, typically involve people being targeted online, with the scammers building their victim’s trust over several months. Victims are led to believe they’re in a committed relationship before being tricked into sending money, valuables, and personal information, or to launder money on the perpetrator’s behalf. In addition, some scammers convince their targets into investing in fraudulent cryptocurrency schemes, a method known as pig butchering.

While these scams are nothing new, their popularity has risen since the pandemic and ensuing loneliness epidemic, driven by an increasing reliance on the internet to connect. However, with the return to in-person gatherings, our survey results show romance scams have hardly petered out. Rather, they’re as pervasive as ever, with 52 percent of respondents targeted in the last year alone. And they’ve advanced, as cybercriminals now tap into global scamming networks for scripts, training, and technology to squeeze more money from victims.

As David Ruiz, Senior Privacy Advocate at Malwarebytes, puts it:

“Romance and dating scams are run by sophisticated cybercriminals who know what they’re doing. They conduct research, and follow a playbook. The more we can remove the stigma surrounding victims and provide education and resources, the faster we can minimize the devastating effects of these scams.”

According to the Federal Trade Commission (FTC), over 64,000 people reported romance scams in 2023, with losses totaling $1.1 billion. The Federal Bureau of Investigation (FBI) received 17,823 complaints last year, costing victims nearly $653 million. However, that data doesn’t capture the recent trend of pig butchering, as romance scammers increasingly incorporate crypto investment fraud for higher payouts. Financial losses from investment fraud totaled $4.6 billion in 2023, the costliest internet crime for consumers.

For a full breakdown of survey results, including demographics, scammer tactics, and financial and emotional impacts, read below.

Demographics of romance scams

The majority of survey respondents were subject to romance scam advances within the last year, with 37 percent saying it happened within the last six months, and an additional 15 percent saying it happened between six months and one year ago.

The majority of targets are over the age of 55 (74 percent) and male (56 percent), a pattern consistent with previous trends. As with most scams, older users are targeted because they typically have more assets but are perhaps less familiar with online security. The Department of Homeland Security says cybercriminals zero in on recently widowed or divorced seniors for their vulnerability and access to cash.

However, 26 percent of victims are between 18 and 54 years old. In fact, the FTC asserts that the most common victims of romance scam sextortion are 18–29 years old.

How romance scammers make contact

Perhaps not surprisingly, the vast majority of phony romantic overtures took place on social media and online dating apps, with 38 and 31 percent of survey respondents targeted on those platforms, respectively. In fact, the proliferation of scams is one reason noted for the decline in social media and dating app use over the last two years. A recent Barclays survey found one third of Brits avoid online dating and dating apps due to romance scam fears.

Romance scams that start on social media end up costing the most. The FTC found from January 2021 to June 2023, more money was lost to scams originating on social media than by any other contact method. Consumers lost $2.7 billion in social media fraud, with crypto investment and romance scams resulting in the steepest costs, accounting for 67 percent of total losses. In the first six months of 2023, half of those who lost money to romance scams said it began on Facebook, Instagram, or Snapchat.

Romance scammers prefer using social media and dating apps to reach their targets because they can easily create fake profiles and tailor their personas to content victims share and like. Criminals can even use advertising tools to methodically select targets based on personal details such as age, interests, or past purchases. More recent trends involve romance scammers using AI to draft convincing emails, create fake photos in the likeness of their target’s recently-departed spouse, or develop deepfake videos of celebrities endorsing their investment scheme.

In addition, despite having strong anti-scam controls, nearly 16 percent of surveyed romance scam targets were initially contacted by email. Just over 10 percent were reached via text, a popular contact method for pig butchering.

How long does the scam last?

If survey results are an indication, the majority of those targeted by romance scams have become savvy to their ways—though Malwarebytes newsletter subscribers may be particularly well-informed. 55 percent knew it was a scam right away and never responded. Almost 19 percent figured out the scam within one week, meaning nearly three-quarters of respondents demonstrated excellent cybersecurity awareness.

Unfortunately, that leaves 26 percent engaging with romance scammers for more than two weeks, with 12 percent spending several months talking to pretend paramours, and 5 percent in a faux relationship for one year or more. In general, the longer a respondent was “together” with their scammer, the more money they lost. The exceptions were those who recognized the scam immediately, but spent weeks or months leading them on to waste their time. While this might seem like poetic justice, many romance scammers themselves are victims of human trafficking, forced to work up to 15 hours a day extracting enough money from victims to meet impossibly high quotas.

Money lost

User awareness wins the day again, preventing nearly three quarters of those targeted by a romance scam from losing money. However, the majority of those who did part with cash lost a lot of it—10 percent lost $10,000 or more, and 3 percent reported losses in the six figures. An additional 7 percent of survey respondents were scammed out of $1,000–$9,999, and 5 percent lost between $200 and $999. Just 3 percent of victims were scammed out of less than $200.

This means a full 22.5 percent of those targeted by a romance scam end up losing $1,000 and up—enough to make a significant impact on finances, especially for those with lower incomes. In 2023, romance scam victims—not counting those who reported crypto investment fraud—lost a median of $2,000 per person, the highest reported losses for any form of imposter scam, according to the FTC. Romance scams were also the third costliest fraud type reported to the FTC by older Americans (age 60 and over).

The FBI 2023 Internet Crimes Report noted financial losses to investment scams rose from $3.3 billion in 2022 to $4.6 billion in 2023—a 38 percent increase over the 183 percent gained the previous year. Combined, romance and investment scams were the costliest and second-most common internet crimes reported to the FBI last year as well, a fact reflected in Malwarebytes’ survey results and participant testimonials.

Tellingly, 94 percent of those who lost money were unable to recover it. Those who wish to recover cryptocurrency should be aware of additional scams by fraudulent businesses promising to trace and return funds. No private sector company can recover crypto—only legal or internal processes can compel cryptocurrency exchanges to release money back to victims.

Reporting the scam

Stigma is still a problem in dealing with the aftermath of a romance scam. Victims report heightened feelings of betrayal and shame on top of their financial burden. Yet 40 percent of surveyed romance scam victims didn’t tell another soul about what happened. An additional 30 percent only opened up to their closest confidantes. And while research suggests individuals impacted by the stress and trauma of romance scams benefit from counseling or support groups, just 4 percent sought out therapy after their experience.

However, there does appear to be a larger portion of romance scam targets willing to speak out than in the past. One quarter of our survey respondents said they told many others about their ordeal, with 11 percent submitting reports to law enforcement and/or nonprofit organizations. Data obtained by the BBC shows there were 7,660 cases processed in England and Wales by a self-reporting tool last year, up from 4,842 in 2019.

How to spot and avoid a romance scam

Romance scams aren’t going away, so here’s how to spot signs that someone isn’t who they say they are.

• Their profile and picture seem too good to be true
• They profess love and affection very quickly
• They share a lot about themselves in the first meeting
• They claim to be overseas and cannot stay in one place for long
• They try to lure you from whatever platform you are on to talk to you via email or video chat
• They claim to need money for something

Here’s what you can do to keep yourself safe:

• Don’t give scammers the information they need. Scammers rely on what you volunteer about yourself online to tweak their script and lure you in. Use tools such as the Malwarebytes Personal Data Remover to minimize the amount of data accessible through search engine results, spam lists, and people search sites.
• Perform an image search of the photo and the name of the person you’re in touch with. Scammers often steal someone else’s image to use as bait, and stolen identities are rife.
• Go slow. Scammers tend to rush, building rapport with their victims as quickly as possible before moving in for the money-themed kill.
• Never give money to anyone you’ve met online
• Get a second opinion from someone you trust
• If in doubt, back away and report the account.

If you’ve been impacted by a romance scam, pig butchering, or crypto investment fraud, you can report the crime to the Internet Crimes Complaint Center (IC3), which is run by the FBI, or the FTC on its reporting and resources page.

To talk with other romance scam victims in safe online forums, go to the reddit thread r/Romancescam, or apply to the private Facebook Support Group for Romance Scam Victims.

There’s an awful lot about you online that some awful groups want to exploit.  

The right combination of personal data points could help an identity thief fool a bank into opening a new, fraudulent line of credit in your name. Your alma mater, salary, and email address could help an online scammer craft the perfect phishing lure to trick you into donating to a bogus school fund. Your new address could be vulnerable to obsessive stalkers, your phone number could attract countless robocalls, and even your recent divorce status could make you a target for romance scammers.  

There’s now a way to fight back, with Malwarebytes Personal Data Remover. 

For years, the public have had few defenses to evolving online scams, as sensitive, personal details are all too easy to find online. Some of this data gets exposed through the major, corporate data breaches that now punctuate our lives, but some of this data isn’t “exposed” at all.  

Instead, it’s traded through a bustling network of “data brokers” that work tirelessly to collect and sell people’s names, addresses, phone numbers, bankruptcy records, salaries, marital statuses, and more. This can generate easy money though hyper-precise online advertising, or it can be done to power “people search” sites that leave nearly nothing to a scammer’s imagination.  

People deserve better.  

Today, Malwarebytes is simplifying your security and privacy with the release of our new Personal Data Remover.  

For people in the United States, Malwarebytes Personal Data Remover provides:   

• Immediate, deep scans across roughly 175 databases to find your personal data. 
• Personalized, in-depth reports on what data is being sold and who is selling it.  
• Automatic data removal requests for subscribers, which can save 300+¹ hours of manual work in wiping sensitive details off the internet, along with free DIY guides to tackle each site individually.  
• Recurring scans and data removal requests that will make it harder for invasive websites to rebuild their digital portraits of you.²  

Malwarebytes Personal Data Remover represents our latest advancement in extending cybersecurity beyond antivirus.  

The truth is that modern threats to your privacy and your security have changed dramatically in a few short years, as cybercriminals are no longer focused only on infecting and controlling your device with viruses and malware. Rather, online scammers and thieves can glean relevant, personal details about your life to make it easier to steal your identity, take your money, or frighten you with empty ransom demands.  

This is why, almost a year ago, we launched Identity Theft Protection to help people prevent and recover from online identity theft, followed by the release of our free Digital Footprint Portal that provides free, in-depth reports about what data of yours is currently exposed online.  

With Malwarebytes Personal Data Remover, we hope to provide security and privacy beyond your device and into your entire experience online.  

Try Malwarebytes Personal Data Remover today.  Take back control of your data.

_{1. Based on historical user data on the average time it takes to search, remove, and monitor re-exposure.} 

_{2. Available for paid subscribers in the United States only.}  

A background check left a huge database unprotected online containing 2.2TB of people’s data, according to research by Cybernews.

The database was left passwordless and easily accessible to anyone on the internet by background check firm MC2 Data. MC2 Data gathers publicly available data to provide decision makers with information whether someone can rent a house, work at their firm, or be granted a loan.

The data is usually gathered from online sources like criminal records, employment history, family data, and contact details.

Just like the huge National Public Data breach, this is another example of companies that most of us have never heard having extensive databases with an enormous amount of personal data. In this case, the researchers found 106,316,633 records containing private information about US citizens.

Cybernews estimates that at least 100 million individuals are affected, meaning approximately one in three US citizens can expect to find their data in the data set.

The websites that MC2 Data operates include:

• PrivateRecords
• PrivateReports
• PeopleSearcher
• ThePeopleSearchers
• PeopleSearchUSA

And the leaked data included:

• Names
• Emails
• IP addresses
• User agents
• Encrypted passwords
• Partial payment information
• Home addresses
• Dates of birth
• Phone numbers
• Property records
• Legal records
• Property records
• Family, relatives, neighbors data
• Employment history

To make things even worse, the data of 2,319,873 users who subscribed to MC2 Data services were leaked as well.

It is incomprehensible that services like these are allowed to exist without any kind of control or sense of responsibility. Regardless of all the regulations and laws these companies need to abide by, we find time and again that their security measures are below par.

As the researchers put it:

“While background-check services keep trying to prevent such cases, they haven’t been able to stop such use of their services completely. Such a leak is a goldmine for cybercriminals as it eases access and reduces risk for them, allowing them to misuse these detailed reports more effectively.”

Protecting yourself after a data breach

There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.

• Check the vendor’s advice. Every breach is different, so check with the vendor to find out what’s happened, and follow any specific advice they offer.
• Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
• Enable two-factor authentication (2FA). If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
• Watch out for fake vendors. The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims, and verify the identity of anyone who contacts you using a different communication channel.
• Take your time. Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
• Consider not storing your card details. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
• Set up identity monitoring. Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

Check your digital footprint

If you want to find out what personal data of yours has been exposed online, you can use our free Digital Footprint scan. Fill in the email address you’re curious about (it’s best to submit the one you most frequently use) and we’ll send you a free report.

We don’t just report on threats – we help safeguard your entire digital identity

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

Breaking up is hard to do. The internet has made it harder.

With couples today regularly sharing access to one another’s email accounts, streaming services, social media platforms, online photo albums, and more, the risk of a bad breakup isn’t just heartache. Equipped with unfettered access into sensitive, shared online accounts, a vindictive ex could track someone who is actively using services like DoorDash, Uber, or Airbnb, spy on someone through a Ring doorbell, raise the temperature on a Nest thermostat, or shout obscenities through a baby monitor.

As every relationship is different, there’s no one-size-fits-all solution to safely disentangling your digital life from your ex, but there are a few rules that can make the process easier.

And, because this can be a lot of work, here are a few things that can help you along the way:

• A password manager that will help you create and store unique passwords for each online account.
• The use of multifactor/two-factor authentication on every sensitive account that allows it.
• A friend who can go through these exercises side-by-side with you.

Further down is a more comprehensive checklist of many considerations you can take in separating your digital life from your ex, but, here’s a quick, handy guide:

It’s important to remember that this work won’t be completed in a day. That’s entirely okay. Instead of trying to accomplish everything in one weekend, prioritize the most sensitive work—cutting off access to email accounts, online banking, shared photo albums, social media, and any services or apps that can reveal your location.

As Malwarebytes recently discovered in research conducted this year, 56% of people in committed relationships in the United States agreed that they “would like to see more guidance on how to handle shared logins, accounts, and apps in a relationship or during a breakup,” and 45% agreed that they “would have a hard time knowing where to begin if I no longer wanted to share location-based apps or services with my partner or in the event of a breakup.”

We hope this digital breakup checklist, which is not comprehensive, can provide some of that guidance.

Here is the Modern Love Digital Breakup Checklist.

1. Review shared devices

• Log out of personal accounts on shared devices, including laptops, tablets, e-readers, smartphones, smart TVs, and Internet of Things devices. This includes:
  • Email, social media, and online banking accounts on shared tablets, computers, and smartphones.
  • Email, social media, and online banking accounts on the shared devices of children/the entire family.
  • Entertainment accounts (Hulu, Netflix, Disney+, Spotify, etc.) on smart TVs and streaming devices such as Roku, Google Chromecast, Apple TV, etc.
• Remove your ex’s accounts from any device you share that you will maintain ownership of after the breakup. Here’s are guides on how to remove someone from:
  • Windows device
  • Mac device
  • Android devices

2. Review shared accounts

• For shared accounts where you and your ex had one set of login credentials, log out of those shared accounts on your own device.
• If you want to continue using those services, create a new personal account with a unique password.

3. Review personal accounts

• Before resetting passwords, check the recovery settings on your personal account to ensure that any attempts to reset your password will be sent to your personal email account and not to an email account owned by your ex.
• Before resetting passwords, consider using a password manager to help create, store, and remember unique passwords for each account.
• Reset and create unique passwords for sensitive accounts, including:
  • Email accounts
  • Online banking and financial accounts (Chase, Wells Fargo, Venmo, PayPal, Zelle, Cash App, etc.)
  • Online shopping accounts (Amazon, Etsy, Shein, Temu, etc.)
  • Social media accounts (TikTok, Instagram, Facebook, etc.)
  • Shared cloud accounts for photos (Google Photos, iCloud)
  • Shared cloud accounts for file storage (Dropbox, Box, etc.)
  • Streaming entertainment accounts (Netflix, Disney+, Hulu, Spotify, Apple Music, etc.)
  • Parental monitoring apps (Life360, Bark, Qustodio)
  • Online forums and chat services (Reddit, Discord, etc.)
• Reset and create unique passwords for accounts that can expose your location to users who are logged into the same account, including:
  • Food and grocery delivery apps (Uber Eats, DoorDash, Postmates, etc.)
  • Ride-sharing apps (Uber, Lyft, etc.)Vacation rental apps (Airbnb, Vrbo, etc.)
  • Health and fitness tracking apps (FitBit, Strava, etc.)
  • Connected apps for modern cars with anti-theft location tracking
• Enable multifactor authentication on sensitive accounts and accounts that can expose your location, when provided as an option.

4. Review/remove your signed-in devices

• Check your security settings in your online accounts to review what devices are currently logged into the same account. If you see a device that does not belong to you, force that device to be logged out.
  • If you take this step after successfully resetting your password, those devices will be required to use the new password (which only you should know).
  • These settings can often be found in “security” or “privacy and security” tabs in most apps.

5. Review the location settings of your device

• Your device provides a way to comprehensively turn off all location services that apps rely on to function. With this feature turned off, location-based apps (such as Uber, Uber Eats, Airbnb, Yelp, Maps, etc.) will still function, but you will need to input your address and location manually each time you use the service.
  • You can review location sharing settings on iPhone here.
  • You can review location sharing settings on Android here.

6. Review “Find My/Find My Device” settings

• Modern devices come pre-installed with anti-theft services called “Find My” on iPhones and “Find My Device” on Android phones. These are the same services that many couples use to track one another’s location, and turning these services off will shut off access that other people (including exes, friends, and family) have to your location.
  • Alternatively, you can turn off location sharing with one person only rather than turning off location sharing all together. You can review location sharing settings on iPhone here.
  • You can review location sharing settings on Android here.

7. Review the location settings of individual apps

• If you want to keep location sharing on for convenience, you can review individual apps on your device and select how you would like your location to be accessed by those apps.
  • iPhones allow you to choose one of several options for how frequently apps will access and use your location: Never, Ask Next Time Or When I Share, While Using the App, or Always. You can review location sharing settings on iPhone here.
  • Android phones allow you to choose one of several options for how frequently apps will access and use your location: Allowed all the time, Allowed only while in use, and Not allowed.
  • You can review location sharing settings on Android here.

8. Maintain your ongoing security and privacy

• If you find it safe and necessary, block your ex on certain social media platforms, messaging apps, etc.
• Review the privacy settings of social media apps to ensure that your posts are not inadvertently shared with an ex.
  • Consider whether your ex could see your posts because you have mutual friends who may reveal your posts to your ex.
• Review automatic cloud backups for photos you take with your smartphone.
  • If your ex compromises your iCloud or Google Photos account—and your photos are automatically backed up to those accounts—they could retrieve sensitive photos that you want to keep private.
• When entering a new relationship, have a conversation about consensually and safely sharing your location (or choosing not to).

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

This week on the Lock and Code podcast…

On August 15, the city of San Francisco launched an entirely new fight against the world of deepfake porn—it sued the websites that make the abusive material so easy to create.

“Deepfakes,” as they’re often called, are fake images and videos that utilize artificial intelligence to swap the face of one person onto the body of another. The technology went viral in the late 2010s, as independent film editors would swap the actors of one film for another—replacing, say, Michael J. Fox in Back to the Future with Tom Holland.

But very soon into the technology’s debut, it began being used to create pornographic images of actresses, celebrities, and, more recently, everyday high schoolers and college students. Similar to the threat of “revenge porn,” in which abusive exes extort their past partners with the potential release of sexually explicit photos and videos, “deepfake porn” is sometimes used to tarnish someone’s reputation or to embarrass them amongst friends and family.

But deepfake porn is slightly different from the traditional understanding of “revenge porn” in that it can be created without any real relationship to the victim. Entire groups of strangers can take the image of one person and put it onto the body of a sex worker, or an adult film star, or another person who was filmed having sex or posing nude.

The technology to create deepfake porn is more accessible than ever, and it’s led to a global crisis for teenage girls.

In October of 2023, a reported group of more than 30 girls at a high school in New Jersey had their likenesses used by classmates to make sexually explicit and pornographic deepfakes. In March of this year, two teenage boys were arrested in Miami, Florida for allegedly creating deepfake nudes of male and female classmates who were between the ages of 12 and 13. And at the start of September, this month, the BBC reported that police in South Korea were investigating deepfake pornography rings at two major universities.

While individual schools and local police departments in the United States are tackling deepfake porn harassment as it arises—with suspensions, expulsions, and arrests—the process is slow and reactive.

Which is partly why San Francisco City Attorney David Chiu and his team took aim at not the individuals who create and spread deepfake porn, but at the websites that make it so easy to do so.

Today, on the Lock and Code podcast with host David Ruiz, we speak with San Francisco City Attorney David Chiu about his team’s lawsuit against 16 deepfake porn websites, the city’s history in protecting Californians, and the severity of abuse that these websites offer as a paid service.

“At least one of these websites specifically promotes the non-consensual nature of this. I’ll just quote: ‘Imagine wasting time taking her out on dates when you can just use website X to get her nudes.’”

David Chiu, San Francisco City Attorney

Tune in today for the full conversation.

Show notes and credits:

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
http://creativecommons.org/licenses/by/4.0/
Outro Music: “Good God” by Wowa (unminus.com)

Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.

A cybercriminal has released internal data online that they say has come from leaks at several high-profile sources, including SpaceX, CNN, and the White House.

However, there are some questions around the reliability and usefulness of the released data, so we took a closer look.

When it comes to the the SpaceX data set, the poster is apparently not a big fan of Elon Musk.

Their post on data leak site BreachForums says:

“Today I present data from Spacex, because F*** you elon musk, thats why LOL

The leak contains, Emails, Hashes, Numbers, Hosts, IP’s”

But looking at the data we spotted some strange looking entries.

For example, by searching for Elon’s email address we found all these:

SpaceX has not acknowledged this data breach, and it doesn’t seem likely that it will.

Moving on to the White House data set, we also found something that looked odd while looking at the email addresses. A lot of them seem to be composed of German words followed by the @whitehouse.gov domain name.

Again, the breach claim has not been acknowledged, nor do we expect it to be.

The same poster claims to have breached another company, Up North Pride, by impersonating a police officer:

“I sent them a fake data request from a law enforcement email, and they handed over what they had and this is what they handed over”

In this case, looking at the data, the email addresses of the partnering organizations at least look real.

The motive of the cybercriminal for posting the way they did is unclear. Many of these posters are just looking for attention, potentially hoping to sell some of the data by getting their name out there. Or they are trying to annoy some of the people they don’t like.

For now, we wait and see, but it’s probably not worth giving it the time of day.

Check your digital footprint

If you want to find out if your personal data was exposed through a data breach, you can use our free Digital Footprint scan. Fill in the email address you’re curious about (it’s best to submit the one you use most frequently to sign up for sites and services) and we’ll send you a free report.

We don’t just report on threats – we help safeguard your entire digital identity

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

Last week on Malwarebytes Labs:

• “Simply staggering” surveillance conducted by social media and streaming services, FTC finds
• Tor anonymity compromised by law enforcement. Is it still safe to use?
• Walmart customers scammed via fake shopping lists, threatened with arrest
• Snapchat wants to put your AI-generated face in its ads
• iOS 18 is out. Here are the new privacy and security features
• 23andMe to pay $30 million in settlement over 2023 data breach

Last week on ThreatDown:

• Ivanti patches admin bypass for Cloud Services Appliance
• Is it an attacker or an IT admin? Test your skills in two minutes…
• Windows MSHTML vulnerability actively exploited
• Microsoft might kick security vendors out of the Windows kernel

Stay safe!

Our business solutions remove all remnants of ransomware and prevent you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.

The US Federal Trade Commission (FTC) released a report that examines the data collection and use practices of major social media and video streaming services, finding that—and this will not come as a surprise to our regular readers—the companies engaged in vast surveillance of consumers in order to monetize their personal information while failing to adequately protect users online, especially children and teens.

The report, called A Look Behind the Scenes: Examining the Data Practices of Social Media and Video Streaming Services, is based on responses from nine companies to questions about how the companies collect, track, and use personal and demographic information, how they determine which ads and other content are shown to consumers, whether and how they apply algorithms or data analytics to personal and demographic information, and how their practices impact children and teens.

The companies that were ordered to respond own some of the household social media and streaming service names. They are Amazon (Twitch), Meta (Facebook and Instagram), YouTube, X (Twitter), Snap (Snapchat), ByteDance (TikTok), Discord, Reddit, and WhatsApp.

Some of the specific information that the FTC was looking for included:

• How social media and video streaming services collect, use, track, estimate, or derive personal and demographic information.
• How they determine which ads and other content are shown to consumers.
• Whether they apply algorithms or data analytics to personal information.
• How they measure, promote, and research user engagement.
• How their practices affect children and teens.

The conclusions seemed to upset the FTC, but we weren’t even mildly surprised:

“The amount of data collected by large tech companies is simply staggering. They track what we read, what websites we visit, whether we are married and have children, our educational level and income bracket, our location, our purchasing habits, our personal interests, and in some cases even our health conditions and religious faith. They track what we do on and off their platforms, often combining their own information with enormous data sets purchased through the largely unregulated consumer data market.”

The FTC also mentions that some of these companies increasingly rely on hidden pixels and other means of tracking visitors, not only on their own, but also on other websites, to track our behavior down to every click.

Some of the responders were even unable to identify all the data points they collected or all of the third parties they shared that data with.

The report comes to the conclusion that self-regulation is not the answer to these problems. We can see all around the news that with the rise of the artificial platforms that many of these companies are developing, the incentive to use our data for their own purposes is only growing.

“Predicting, shaping, and monetizing human behavior through commercial surveillance is extremely profitable.”

US Federal Trade Commission, “A Look Behind the Screens: Examining the Data Practices of Social Media and Video Streaming Services”

This has created a number of companies that have a huge influence on our economy, our democracy, and our society as a whole. Companies that, it appears, believe they can dodge the obligation to provide the Commission with complete answers while hiding their collection practices with limited, incomplete, or unhelpful responses that appear to have been carefully crafted to be self-serving, and to avoid revealing key pieces of information.

While their services provide us with the option to connect with the world from the palm of your hand, many of them have been at the forefront of building the infrastructure for mass commercial surveillance. They have access to information about every aspect of our lives and our behavior.

This comes not only with costs to our privacy, it harms our competitive landscape and affects the way we communicate and our well-being, especially the well-being of children and teens.

Some of the key findings of the report are:

• Many of the companies collected and could indefinitely retain troves of data from and about users and non-users, and they did so in ways consumers might not expect.
• Many of the responding companies relied on selling advertising services to other businesses based largely on using the personal information of their users. The technology powering this ecosystem took place behind the scenes and out of view to consumers, posing significant privacy risks.
• Algorithms, data analytics, and/or AI were applied to users’ and non-users’ personal information. These technologies controlled everything from content recommendation to search, advertising, and inferring personal details about users, while the users lacked any meaningful control over how personal information was used for AI-fueled systems.
• The trend among the responding companies was that they failed to adequately protect children, but especially teens, who are not covered by the Children’s Online Privacy Protection Rule (COPPA).

The recommendations of the FTC focus on legislation about the transparency of the data-usage, disclosure of sensitive personal data for advertising purposes, and the need to protect young users from the information-absorbing tech giants.

For more details and specific answers from each of the companies, you can check the 129 page report.

I want to close this off with a quote from the report that we whole-heartedly agree with:

“Our privacy cannot be the price we pay to accomplish ordinary basic daily activities”

We don’t just report on threats – we help protect your social media

Cybersecurity risks should never spread beyond a headline. Protect your social media accounts by using Cyrus, powered by Malwarebytes.

Despite people generally considering the Tor network as an essential tool for anonymous browsing, german law enforcement agencies have managed to de-anonymize Tor users after putting surveillance on Tor servers for months.

Before we go into the what the agencies did, let’s take a look at some basics of Tor.

How Tor works

On a daily basis, millions of people use the Tor network to browse privately and visit websites on the dark web. Tor enhances privacy by directing internet traffic through a minimum of three randomly chosen routers, or nodes. During this process user data is encrypted before it reaches the destination via the exit node, ensuring a user’s activities and IP address remain confidential and secure.

Here’s a closer look at how this mechanism works:

• Entry node: When you start browsing with Tor, your connection is first directed to an entry node, also known as a guard node. This is where your internet traffic enters the Tor network, with your IP address only visible to this node.
• Middle nodes: After entering the Tor network, your traffic passes through one or more middle nodes. These nodes are randomly selected, and each one knows only the IP address of the previous relay and the next relay. This prevents any single relay from knowing the complete path of your internet activity.
• Exit node: The last relay in the chain is the exit node. It decrypts the information from the middle relays and sends it out to the destination. Importantly, the exit node strips away layers of encryption to communicate with the target server but does not know the origin of the traffic, ensuring that your IP address remains hidden.

This layered security model, like peeling an onion, is where Tor gets its name. Tor is an acronym for The Onion Router. Each layer ensures that none of the nodes in the path knows where the traffic came from and where it is going, significantly increasing the user’s anonymity and making it exceedingly difficult for anyone to trace the full path of the data.

Although many researchers theoretically considered that de-anonymization was possible, in general it was thought practically unfeasible if a user followed all the necessary security measures.

How did the de-anonymization work?

German news outlet NDR reports that law enforcement agencies got hold of data while performing server surveillance which was processed in such a way that it completely cancelled Tor anonymity. The reporters saw documents that showed four successful measures in just one investigation.

After following up on a post on Reddit and two years of investigation, the reporters came to the conclusion that Tor users can be de-anonymized by correlating the timing patterns of network traffic entering and exiting the Tor network, combined with broad and long-term monitoring of Tor nodes in data centers.

If you can monitor the traffic at both the entry and the exit points of the Tor network, you may be able to correlate the timing of a user’s true IP address to the destination of their traffic. To do this, one typically needs to control or observe both the entry node and the exit node used in a Tor circuit. This does not work when connecting to onion sites however, because the traffic would never leave the Tor network in such a case.

The timing analysis uses the size of the data packets that are exchanged to link them to a user. You can imagine that with access to a middle node, you can tie the incoming and outgoing data packets to one user. While this doesn’t reveal any of the content of the messages, this could help in establishing who’s communicating with who.

Tor is still safe, says Tor

The problem that Tor faces lies in the fact that it was designed with hundreds of thousands of different nodes all over the world in mind. In reality, there are about 7,000 to 8,000 active nodes, and many of them are in data centers. As a consequence, the “minimum of three” often means “only three” which increases the potential effectiveness of timing attacks.

The Tor Project said:

“The Tor Project has not been granted access to supporting documents and has not been able to independently verify if this claim is true, if the attack took place, how it was carried out, and who was involved.”

Based on the information provided, the Tor Project concluded that one user of the long-retired application Ricochet was de-anonymized through a guard discovery attack. This was possible, at the time, because the user was using a version of the software that neither had Vanguards-lite, nor the Vanguards add on, which were introduced to protect users from this type of attack

Which means they feel confident to claim that Tor is still safe to use. However, we would like to add that users should be aware that several law enforcement agencies–and cybercriminals–run Tor nodes, which can pose risks.

If you use Tor, here are some basic rules to stay as anonymous as possible:

• Always download Tor Browser from the official Tor Project website.
• Keep Tor Browser updated to the latest version for security patches.
• Use the default Tor Browser settings – don’t install add-ons or change the settings unless you know what you are doing and what the implications are.
• Enable the “Safest” security level in Tor Browser settings.
• Only visit HTTPS-encrypted websites.
• Avoid logging into personal accounts or entering personal information. If you post your personal information somewhere that undermines the whole idea of staying anonymous.
• Be extremely cautious about downloading files or clicking links, even more so on the Dark Web.
• Disable JavaScript if possible although this may break some sites.
• Clear cookies and local site data after each browsing session.
• Use a reputable VPN in addition to Tor for an extra layer of encryption.
• Run up-to-date antivirus/anti-malware software on your device.

We don’t just report on privacy—we offer you the option to use it.

Privacy risks should never spread beyond a headline. Keep your online privacy yours by using Malwarebytes Privacy VPN.

Shopping online or attempting to get in touch with a store is a little bit like walking on a minefield: you might get lucky or take a wrong step and get scammed.

Case in point, a malicious ad campaign is abusing Walmart Lists, a kind of virtual shopping list customers can share with family and friends, by embedding rogue customer service phone numbers with the appearance and branding of the official Walmart site.

The scam ends in accusations of money laundering, threats of arrest warrant, and pressure to transfer money into a Bitcoin wallet.

In this blog, we walk through the different parts of this well executed scheme and provide helpful tips to avoid falling for this scam. We have already reported the malicious Google ads and informed Walmart of the abuse of its customer’s shopping lists.

Malicious Google ads

When searching for Walmart’s phone number, the top result on Google is for an ad (sponsored). Unless you manually checked “My Ad Center”, you would have no idea who the ad belongs to.

More importantly, because the ad snippet shows the https://www.walmart.com address, you might wrongly assume that it is a genuine advert from Walmart.

Walmart Lists

In previous cases, we have seen malicious advertisers impersonate brands by displaying their official website in the ad URL. However, this is a little bit different as the ad’s final URL actually belongs to Walmart.

On mobile, due to space limitations in the address bar, users will see walmart.com, while on desktop they will see the full URL. In both instances, this is a strong indicator of legitimacy, one which people have been trained to check for years. This is not an impostor website, it is the real one, so one might think that whatever is shown on the page must also be legitimate.

Lists is a feature that registered Walmart customers can use to add items they might be interested in purchasing. To create a list, you first need to register for an account, but it is free and does not require any form of authentication or payment method.

The scammers have created several accounts and fake lists where they can instead add custom text. Their goal is to trick people thinking this is a contact page for Walmart customer service. This is exactly what they do by using fake names like “Mr Walmart S.” and entering their own phone number in the page.

Finally, they can use a link to share this list with others, and this is the link they will use for the Google ads. As such, the ad actually does not violate Google’s policy per se since the branded ad does go to the brand’s website. But, as we know, this is all fake.

What happens next?

People who dial any of those supposed customer service phone numbers shown on the Walmart lists will be directed to a call center in Asia. On the other end of the line scammers impersonating Walmart will get their information (name, email address) before reviewing their details.

As it happens, victims will be told that a large purchase was recently made on their account. That’s the scare tactic that will allow scammers to request more personal information related to their banking, and even social security number.

The call centre uses several different people, all who play a different role to process victims:

• the Walmart customer service representative
• the higher authority or “supervisor”
• a fake bank employee
• a fake FTC investigator

When we called, the scammers claimed that our account had been used to transfer huge amounts of money to narco trafficking countries:

Now, all the banking found which was created using your personal information are transferring huge amounts of money to the narco trafficking countries such as Columbia, Mexico, some Saudi Arabia countries and Columbia.

As a result, we were told that there was an active arrest warrant against us:

Otherwise we have to take you under the custody for [inaudible] purpose, because there is an active arrest warrant also available on your name.

We were threatened several times and warned to go to our bank to withdraw as much money as the bank would allow in order to transferring those funds into a Bitcoin wallet. Oddly enough, the scammer mentions there won’t be any taxes on the transaction, which really would be the last concern on someone’s about to be arrested:

Yes, I know Sir, it’s not a checking account, it’s a Bitcoin wallet. The machines are… is installed by the [inaudible] for the anti money laundering charges. So you don’t, like, get any taxes on it as well as, the transactions done are anti money laundering. So you have to create your own wallet on that machine. How you can create it using your personal information, I will guide you step by step. I will be on the line with you all the time, you don’t need to worry about that. OK?

It’s quite scary to see how anyone can go from wanting to return an item or speak to a Walmart associate, to being falsely accused of crimes and pressured to transfer money. It’s also a reality check that scammers are constantly preying on the vulnerability of innocent people.

How to avoid falling for scams

In a fast paced world where technology can be abused, it is important to keep certain things in mind.

• Sponsored results, or ads can be dangerous due to ongoing and relentless malvertising campaigns. Learn to spot a regular search result from an ad, and if possible avoid clicking on ads.
• Even if you are on an official website, the content you see may not be legitimate. This is a particularly hard one because people will naturally trust that the brand’s own site will be safe. But scammers and spammers can inject content in comments, or custom pages.
• Scare tactics and pressure to act quickly are almost always malicious. Unfortunately, most brands also have these promotions that expire soon and customers believe they need to buy the product now or they will lose on a deal. Having said that, your local store will never threaten you on the phone with an arrest warrant.
• Scammers will often tell their victims to keep everything confidential and not discuss it with other family members or bank clerks. This is only in the scammers’ interest to not be exposed; by all means you should ask for clarification and seek help from others.

We don’t just report on threats – we help safeguard your entire digital identity

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.