Incident Response teams must increasingly be prepared to respond to threats coming from nation-state attackers

Authored by Harshil Patel and Sakshi Jaiswal 

McAfee Labs has recently uncovered a large scale CountLoader campaign that uses multiple layers of obfuscation and staged payload delivery to evade detection and maintain persistence in infected systems. The infection process relies on several layers of loaders, including PowerShell scripts, obfuscated JavaScript executed through mshta.exe, and in memory shellcode injection, each stage decrypting and launching the next. The attackers employ a custom encrypted communication protocol to interact with their C2 servers. By registering a backup domain used by the malware, we were able to sinkhole the traffic and observe thousands of infected machines connecting to the C2 infrastructure. Final payload deployed in this campaign is a cryptocurrency clipper, which monitors clipboard activity and replaces copied wallet addresses with attacker controlled ones to redirect cryptocurrency transactions. 

Sinkholing 

Sinkholing is a defensive technique in which researchers take control of malicious domains or infrastructure used by malware. Instead of allowing infected systems to communicate with attacker controlled C2 servers, the traffic is redirected to a researcher controlled server. This approach enables researchers to monitor infected hosts, collect telemetry, measure the scale and spread of a campaign. 

Key Findings 

• McAfee researchers identified a large-scale CountLoader campaign using multi-stage payload delivery and heavy obfuscation techniques. 
• Researchers successfully sinkholed malware communication using a backup C2 domain, enabling visibility into the campaign’s infrastructure and infected hosts. 
• The sinkhole received approximately 5,000 connections per minute from infected systems. 
• Telemetry collected during the investigation revealed around 86,000 unique infected machines. 
• The malware also spreads through USB drives, with approximately 9,000 infections attributed to removable media. 
• The final payload deployed in this campaign is cryptocurrency clipper malware that hijacks clipboard data to redirect cryptocurrency transactions. 

C2 Sinkholing and Geographical Prevalence  

As the malware contacts the C2 servers in the reverse order and only hell1-kitty[.]cc was used by attackers, we were able to register hell10-kitty[.]cc and were able to gain insights into the campaign. 

On average, around 5,000 infected clients contacted our server every minute. 

In total, we observed approximately 86,000 unique infections. 

Telemetry collected revealed that this CountLoader campaign has a broad global footprint. The highest number of infections were observed in India, followed by Indonesia, the United States, and several countries across Southeast Asia. 

Conclusion 

CountLoader is a multistage malware loader that uses obfuscated JavaScript and trusted Windows utilities to deliver additional payloads. It ensures persistence via scheduled tasks and uses multiple fallback C2 domains to maintain reliability. Malware employs in-memory execution and security bypass techniques to evade detection.  

In recent campaigns, it has been observed deploying cryptocurrency clipper malware to silently hijack transactions.  

McAfee Researchers identified a flaw in its communication mechanism and were able to exploit it to gain insights into the campaign. 

Technical Analysis 

The following diagram illustrates the complete infection chain used in this CountLoader campaign, from the initial execution to the deployment of the final payload. 

The infection begins when an EXE file is executed. This file launches a PowerShell command, which downloads and executes an obfuscated JavaScript loader known as CountLoader. The loader is executed using mshta.exe, a legitimate Windows utility often abused by malware to run scripts. 

Once executed, it performs several tasks: 

• Establishes persistence by creating a scheduled task that runs every 30 minutes. 

• Contacts multiple C2 servers, trying them in reverse order until a connection is successful. 

• Attempts to spread via USB drives by replacing files with malicious LNK shortcuts that execute the malware when opened. 

• Wait for the C2 server to issue commands to download and execute payloads. 

The payload execution chain consists of several stages: 

Launcher: A secondary JavaScript component creates another scheduled task that runs every 60 minutes, ensuring long term persistence. 

PowerShell Packer: The launcher executes an obfuscated PowerShell script that acts as a packer. This script decrypts and launches the next stage. 

Injector: The next PowerShell stage disables security mechanisms such as AMSI and injects shellcode into a legitimate process. 

Shellcode Execution: The injected shellcode unpacks the final payload directly in memory. 

Final Payload: The final payload is executed under the process systeminfo.exe. In this campaign, the deployed payload was identified as a cryptocurrency clipper malware, which monitors clipboard activity and replaces copied cryptocurrency wallet addresses with attacker controlled addresses. 

Stage 1– Exe 

The infection chain begins with the execution of a malicious EXE file, it immediately runs a PowerShell one-liner as shown in the below image. 

Stage 2 – PowerShell 

The PowerShell script fetched from the URL decodes a Base64-encoded string and executes the resulting content. It also employs an unusual obfuscation technique, where the variable names are crafted to resemble the highlighted pattern, making the script harder to read and analyze.

Multiple such variables are used to create a complete base64 string which is then decoded and executed through Invoke-Expression. 

Stage 3 – CountLoader 

The file is a HTA file with JavaScript that uses string obfuscation technique to evade detection. 

It starts by hiding the mshta window to ensure that the malicious activity runs silently in the background without alerting the user. 

The script then attempts to delete its own file in case it was executed locally. If the script determines that it is not being executed from a URL, it terminates immediately.  

Then the script tries to contact C2 servers, iterating through the list in reverse order.

A handshake process is performed to verify connectivity with the server. The client sends an encrypted “checkStatus” message, and the server responds with an encrypted “success” message if the connection is valid 

All communications between the client and the server are encrypted, with slightly different encryption schemes used for each direction: 

1. Client to Server:  text → (key+(base64encode(utf16le(xor(text, key))))) 
2. Server to Client:  text → (key+(base64encode(xor(text, key)))) 

The key is a randomly generated six digit number created for each message. 

If the handshake is successful, the corresponding domain is selected as the active C2 server, which is used for all subsequent communications. 

To maintain persistence on the infected system, the malware creates a scheduled task if one does not already exist. 

The scheduled task command line is slightly different if it detects CrowdStrike or Reason AV installed on the system, likely as an attempt to evade detection from these AVs. 

After establishing persistence, the malware gets a JWT token from the C2 server, which is used to authenticate further requests. 

The get_jwt_token function sends system information about the infected host to the server.

This includes details related to cryptocurrency usage, such as installed wallets and browser extensions, allowing the attackers to determine whether the victim is likely involved with cryptocurrency. 

Finally, the malware gets commands from the C2 server, which is then executed on the compromised system. 

Each command contains a taskType value that determines the action to be performed on the infected system. 

The table below shows the command codes and their actions. 

Code	Command
1	execute exe file
2	execute python file
3	execute dll file
4	uninstall itself
5	send domain info to C2
6	execute msi file
9	spread by infecting usb files
10	execute HTA file
11	execute powershell file

We observed two commands from the above list being sent to the malware as highlighted below: 

Spreading via USB drives (taskType – 9) 

When instructed by the C2 server to spread via USB drives, the malware replaces certain file types on all connected external drives with LNK shortcut files. These shortcuts are crafted so that when a user opens them, the malware executes while simultaneously opening the original file to avoid suspicion. 

Targeted file types are  exe , pdf , doc and docx. 

The build ID of the malware is appended with “_usb”. 

Deploying payload using powershell (taskType – 11) 

The CountLoader is capable of running many types of executable files, In this campaign, it deploys a separate execution chain that ultimately leads to a clipper malware. 

CountLoader launches the next stage using the following command line: 

Payload Launcher 

The Payload Launcher is very similar to CountLoader in terms of both functionality and obfuscation techniques. 

However, unlike CountLoader, which retrieves tasks from the C2 server, the launcher contains hard-coded task information. 

For persistence, it creates a scheduled task which executes  “mshata.exe {domain}/{name}“ every 60 minutes. 

In the task configuration: 

“url” specifies the url of the payload. 

“taskType” is set to 11, indicating that the payload should be executed as a PowerShell script. 

Powershell Packer 

The PowerShell script executed by the launcher acts as a simple packer. It is obfuscated using the same obfuscation technique mentioned earlier. Its primary function is to decrypt and execute another PowerShell script. 

Injector 

The next stage is another PowerShell script responsible for injecting shellcode into a running process. 

Before performing the injection, the script disables AMSI (Antimalware Scan Interface) using script from GitHub – S3cur3Th1sSh1t/Amsi-Bypass-Powershell.  

After disabling AMSI, the script executes code that performs shellcode injection, 

And injects in one of these legitimate processes: 

Shellcode 

The injected shellcode unpacks and loads the final payload directly into memory, 

Final Payload 

The payload observed in this campaign is a clipper malware. This type of malware changes cryptocurrency address in clipboard to that of attacker’s when user copies any address. 

It starts by fetching the C2 server address, which it gets by a technique called EtherHiding, where the C2 server address is fetched from Ethereum blockchain. 

Once the C2 server address is obtained, the malware begins reporting system activity to the server. 

It then continuously monitors the clipboard contents. 

McAfee Coverage 

McAfee provides extensive coverage against CountLoader:  

Trojan:Script/CountLoader4.DES
Trojan:Script/JSBackdoor.HELK!2
Trojan:Shortcut/LNKDownloader.HK
Trojan:Shortcut/Worm.HELK
Trojan:Script/ObfuPS.HELK
Trojan:Script/AMSIBypass.STS!1
Ti!5F9FF671955A
Ti!DC602CB53A9C

Indicators Of Compromise 

IOC
EXE (stage 1)	5f9ff671955a6d551595f9838aed063c496da5039be0d222fe84f96cb3e1d32a
PS url (stage 2)	https://memory-scanner[.]cc/Presentation[.]pdf
PS (stage 2)	3c278499c5e3ced3bf1a6a7287808c5267075f1dec0aa5c7be2c4c444f33f2bc
CountLoader download URLs	https://memory-scanner[.]cc/
	https://hell1-kitty[.]cc/update1_usb_usb_usb[.]VOcx4wEV8
CountLoader v3.3	c68e436d4cb984db026210806f50d0c81eec5f6e4860197dab91fab6f31ef796
CountLoader v4.1	e2faad8111e7d47349cbc549b85e62231b8678057906bc813aad7242fa95ae63
	e5e1d8ec4cd109df290752ee3d4b2cbc9de6df4360e9983548f1bc6b1d088540
CountLoader C2 Domains	hell1-kitty[.]cc
	alphazero1-endscape[.]cc
	api-microservice-us1[.]com
	bucket-aws-s1[.]com
	bucket-aws-s2[.]com
	fileless-storage-s3[.]cc
	globalsnn1-new[.]cc
	globalsnn2-new[.]cc
	globalsnn3-new[.]cc
	handle-me-sv1[.]com
	hardware-office[.]cc
	health-smooth-eu1[.]com
	health-smooth-eu2[.]com
	health-smooth-eu3[.]com
	holiday-updateservice[.]com
	memory-protection-layer1[.]cc
	memory-protection-layer2[.]cc
	microservice-update-s1-bucket[.]cc
	microservice-update-s2-bucket[.]cc
	my-smart-house1[.]com
	polystore9-servicebucket[.]cc
	s3-updatehub[.]cc
usb lnk files	10593dbe9edfde7943fdaadd7882f190216b2f6502667daf701088a6e810deaf
	0a69a9cc75d65774e5eb90a4a739bd4335d33b176dc4923acb691bd45af66bdf
	27c6a6bda2c0ef3ecb78dad9c6bb7c3abaf2e32b3ad96f372a0102c0c9c0f08d
	2cd449f1bb24f05d2e240812a74bd62f2583bbbe4d0ccc9ae5736240e29a0068
	30dcd5c71beb76d2f8df768d5fd9e9145cb8fbbfc951a63b969d26d3b64002b9
	dd4c7f5aae404816cf447b8090b620c1a1971a35c6791116aa3f871f00ae011b
	42a1fc74334c9a3b8720c79df55f84c7398bd31609eb10581e8c7155835498e3
	9c0d334aac5a6f66016dc5ce8df75c46d519a4e6d16c68cf2b1405c81189186d
	44f6313e9542c0d51937a70160fe4137012905d8c79ad27ccc0021788ecfaa4e
payload launcher url	https://hell1-kitty[.]cc/gamecenter[.]fileManager
	https://hardware-office[.]cc/foundation[.]halflife
payload launcher	cbdfb46b9265a3dfb3bc6b0aade472dde28b1660dbd3ded3b67b1530b4497cca
		packer url	http://45[.]156[.]87[.]118:3015/select
			http://45[.]156[.]87[.]62:3443/production
http://104[.]253[.]1[.]137/content
packer	4a5e1d6ee1217e1fbacf54fc6017fbf9d24a25078266b02358d56a9c7437ceb7
injector	05becb67d8bf1e49fcfccb0d346b82368a2b1c2bf07316078c364c7b020154de
shellcode	44daa1b68737b55a711963eec211c7c018bcba4cb6d68c286a4b45ea781a7d73
payload	dc602cb53a9c24abfcdaadf0ca8256b5fb5cac6d91d20ed8431bdaaf51c0cafe
payload C2	https://edr-security-bucket1[.]cc/

The post Sinkholing CountLoader: Insights into Its Recent Campaign appeared first on McAfee Blog.

Graduation season should be about launching your career, not dodging scams.

But for many new grads, the job search now comes with a hidden risk: fake recruiters, fraudulent job offers, and convincing messages designed to steal money, personal information, or both.

The threat is larger than many people realize. According to McAfee’s 2026 State of the Scamiverse report, 76% of Americans have encountered a scam, and the average person receives 14 scam messages every day through text, email, and social media. Americans now spend an estimated 114 hours each year trying to figure out what is real online and what is not.

Young adults are among the most heavily targeted groups. Nearly 3 in 10 people ages 18 to 24 (28%) report receiving conversational scams that begin with casual outreach such as “Hey, how are you?” or a “wrong number” text. Those same tactics increasingly appear in fake recruiter messages, LinkedIn outreach, and texts promoting remote job opportunities.

Today’s job scams can look highly professional. Scammers build polished LinkedIn profiles, clone legitimate company websites, and even use AI-generated interviews to appear credible. Many scams unfold quickly, with nearly half completed in less than an hour, creating pressure to act before candidates have time to verify what is real.

That’s where tools like McAfee’s Scam Detector come in—flagging suspicious emails, texts, links, and messages before you engage, so you can tell what’s real before you click. 

Here’s how to avoid job scams and stay safe with McAfee: 

How Job Scams Actually Work

Step	What Happens	Red Flags	What Scammers Want
1. The Outreach	You’re contacted via email, text, or social media about a job	Unsolicited offer, vague role, overly enthusiastic recruiter	Your attention
2. The Build-Up	They walk you through interviews or onboarding steps	No video calls, inconsistent details, fast timeline	Your trust
3. The Ask	They request personal info or payment	SSN requests, bank info, “training fees”	Identity + money
4. The Trap	They escalate the situation or disappear	More payment requests or sudden silence	Continued financial gain

A Real Example: How People Get Pulled In

Even experienced professionals fall for these scams.

In one case, a tech expert with decades of experience lost $13,000 after accepting what looked like a legitimate part-time role reviewing products.

The opportunity seemed real:

• A polished website
• Structured onboarding
• A small initial payout

Then came the shift. He was told he needed to deposit money to continue working and kept paying more to “unlock” earnings that never came.

This type of advance fee scam is increasingly common in job fraud, and it works because it builds trust first.

What the Data Says

Recent graduates are entering the workforce at a time when scams are more sophisticated, more personalized, and harder to spot than ever before. McAfee’s 2026 State of the Scamiverse report highlights why younger job seekers should be especially cautious.

Young Adults Face Higher Risk

• Younger adults report the highest rates of repeat scam victimization. McAfee’s research found that scam victims under 35 are more likely than older adults to be targeted again, suggesting that early-career professionals may be especially vulnerable as they navigate job searches, salaries, and onboarding for the first time.

Scam Messages Are Constant

• Americans receive 14 scam messages per day on average.
• 76% of Americans say they have encountered an online scam.
• People spend 114 hours per year, nearly three full workweeks, trying to determine what is real and what is fake online.

Professional Platforms Are Not Immune

• 7% of respondents reported encountering scams on LinkedIn.
• 44% have replied to suspicious messages that contained no link at all.

Many modern scams begin with a simple message such as “I came across your profile” or “We’d like to discuss an opportunity,” rather than an obviously suspicious URL.

Job Scams Move Fast

• The average scam unfolds in just 38 minutes.

Scammers often create urgency by claiming a role is limited, an offer will expire quickly, or onboarding must begin immediately.

AI Makes Fake Recruiters More Convincing

• 35% of Americans are not confident they can spot deepfake scams.
• McAfee predicts job scams will become increasingly personalized as scammers use AI to create tailored outreach, onboarding documents, and contracts that closely match a candidate’s background.

Job Scams Are a Growing Financial Threat

• FTC-reported job scam losses rose nearly 40% year over year, increasing from $543 million in 2024 to $752 million in 2025.

For new graduates eager to land their first job, the lesson is simple: if an opportunity seems rushed, asks for money, or feels too good to be true, take a step back and verify before you respond.

Where McAfee Comes In

Job scams don’t just happen in one moment. They unfold in stages—first a message, then a conversation, then a request for information or money.

That’s why protection needs to work the same way: across the entire experience. McAfee’s comprehensive protection helps you stay ahead of job scams at every step:

McAfee+ Advanced gives you multiple layers working together so you are not left figuring it out after the damage is done:

• Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast
• Personal Data Cleanup helps remove your information from data broker sites, making you harder to target in the first place
• Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage
• Safe Browsing helps block risky sites if you do click
• Device Security helps detect malicious apps or downloads
• Secure VPN keeps your data private, especially on public Wi-Fi   

The Biggest Red Flags to Watch For

These patterns show up again and again in job scams:

Red Flag	What It Looks Like	Why It’s a Problem	What to Do Instead
Requests for Sensitive Information Too Early	Asked for your Social Security number, banking info, or ID details early in the process	Scammers use this to steal your identity or access your accounts	Only share sensitive info after accepting a verified job—and through secure onboarding systems
You’re Asked to Pay to Work	Fees for training, equipment, onboarding, or background checks	Legitimate employers don’t charge candidates to get hired	Walk away immediately—this is one of the clearest signs of a scam
The Job Sounds Too Good to Be True	High pay, low hours, minimal experience required, vague responsibilities	Designed to hook attention and lower your guard	Research typical salaries and ask detailed questions about the role
The Hiring Process Moves Too Fast	Immediate job offers or rushed decisions without interviews	Real hiring processes involve multiple steps and evaluations	Be cautious of offers that skip standard hiring steps
No Real Interaction	Communication only via email or chat, refusal to do video or phone calls	Scammers avoid real-time interaction to stay anonymous	Request a video call or verify the recruiter through official company channels

How to Protect Yourself

You don’t need to overcomplicate it. Stick to a few grounded habits:

• Verify the company independently: Search the company, check official sites, confirm recruiter identities
• Keep communication on trusted platforms: Be cautious with offers coming from unexpected channels
• Never pay upfront for a job: That’s a dealbreaker
• Pause before sharing personal information: Especially early in the process
• Use tools that flag risks automatically: Scam Detector helps catch what looks legitimate, but isn’t

What to Do If You Think It’s a Scam

If something feels off:

• Stop communication immediately
• Do not send money or personal information
• Report the scam to the FTC
• Monitor your accounts for suspicious activity

If you’ve already shared sensitive information, act quickly to secure your accounts.

With McAfee’s comprehensive protection, you’re not left to figure it out on your own.

From blocking risky links to monitoring your identity and helping you respond quickly, it’s designed to help you stay one step ahead, and recover faster if needed. Because job searching is stressful enough without scammers, and you deserve to land your next job with confidence.

The post The New Grad’s Guide to Job and Recruitment Scams appeared first on McAfee Blog.

If you have ever checked your child’s grades online, submitted a college paper through a school portal, downloaded homework assignments, or received messages from a teacher through a classroom app, there is a good chance you have used Canvas, a nationwide learning management system that was just in a massive data breach. 

This is exactly the moment McAfee+ Advanced was built for. With our built-in Scam Detector to flag risky links, QR codes, and deepfakes; Identity Monitoring that alerts you when your data appears where it shouldn’t; and Personal Data Cleanup that removes your information from the dark web and data brokers, McAfee+ Advanced is an all-in-one solution for protection after a data breach.

Now let’s get into what you need to know about this breach: 

Who Is Behind the Canvas Breach? 

The ransomware group ShinyHunters is claiming responsibility for the attack. The group alleges it stole roughly 275 million records tied to nearly 9,000 schools and educational institutions worldwide. 

How Did the Canvas Cyberattack Happen? 

Instructure, the company behind Canvas, confirmed a cyber incident affecting its cloud-hosted environment. The attackers later posted claims about the breach on their leak site, where ransomware groups pressure organizations into paying by threatening to release stolen data publicly. 

What Information Was Stolen in the Canvas Breach? 

The stolen data reportedly includes: 

• Student names  
• Teacher and staff names  
• Email addresses  
• Student IDs  
• Course and enrollment information  
• School-related records  

ShinyHunters claims the breach exposed roughly 275 million records and more than 231 million unique email addresses. 

How Could the Canvas Data Breach Impact Families and Students? 

Even if financial information was not exposed, this kind of data can still be extremely valuable to scammers. Criminals can use real school names, real classes, teacher names, and student information to create highly convincing phishing emails, fake school alerts, scholarship scams, tuition scams, or password reset messages. 

A scam message referencing your child’s actual school or assignment is much harder to spot as fake. 

This is a real message from Canvas from a community college professor after yours truly took an anthropology class for fun during the pandemic. It’s full of links to apply for programs and reach out to professors. It has exact details about courses I’ve taken.  

While this correspondence is real, it’s exactly the type of messaging that scammers could fake and replicate, replacing real links with fake “paid” opportunities to pursue degrees.  

Now think of the millions of messages and specific scenarios scammers have access to, to create dubious and convincing scams. That’s why protecting yourself after a breach is key.  

What To Do Right Now 

Here are some actions you can take immediately ot protect yourself after this breach:

• Change you or your child’s Canvas password immediately, and update any other accounts where they reuse that password 
• Turn on multi-factor authentication (2FA) on parent and student accounts wherever the school permits it — Instructure’s own post-incident guidance specifically called out enforcing MFA as a recommended precaution 
• Ask your school what identity protection is being offered if sensitive data was involved 
• Consider placing a credit freeze on your or your child’s file to block new accounts from being opened in their name 
• Avoid clicking links in any messages that reference the breach, go directly to the official site instead 

---

And that, my friends, is issue number one in this week’s This Week in Scams. Let’s get into what else is on our radar in cybersecurity and scam news. 

---

Fake Amazon Recall Texts Are Targeting Shoppers  

Your phone buzzes. It’s a text from an unknown number, but the message looks official. 

“Dear Amazon Customer, we are writing to inform you that an item from your March 2026 order has been identified for recall.” There’s an order number. A link at the top of the message. A note about quality standards and a refund waiting for you. 

It looks real. It has the Amazon logo, the branded formatting, even a reference to the “Amazon Customer Safety Team.” The only thing it doesn’t have? Any connection to Amazon at all. 

This is a fake Amazon recall scam, and it is making the rounds right now. The goal is to get you to click that link, which takes you to a site designed to harvest your login credentials, payment information, or both.  

If you get a text like this, do not click the link. Go directly to amazon.com in your browser, log in, and check your orders and messages from there. Amazon does not initiate recall or refund processes through unsolicited texts with outside links. 

What Is a Fake Amazon Recall Scam And How Does It Work? 

A fake Amazon recall scam is a text message or email in which criminals impersonate Amazon to convince you that one of your recent orders has been flagged for a product recall. The message directs you to an external link leading to a phishing site designed to steal your Amazon credentials, credit card details, or personal information. 

Red Flags To Watch For 

• The text comes from an unknown number, not a short code or verified sender 
• The link goes to a domain that is not amazon.com 
• The message asks you to complete a refund through an external link 
• Small typos or awkward phrasing appear in what looks like official communication 
• The greeting says “Dear Amazon Customer” rather than your actual name 

What To Do If You Get One 

• Do not click the link 
• Go to amazon.com directly and check your orders and account notifications 
• Report the text to Amazon at stop-spoofing@amazon.com 
• Block the number 

Where McAfee Steps In (So You Don’t Have to Guess)  

Scams today are layered.  A fake email leads to stolen credentials. A breach leads to targeted phishing. And those follow-ups are getting harder to spot.  

With McAfee+ Advanced, multiple layers work together so you’re not left figuring it out after the damage is done: 

• Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast  
• Personal Data Cleanup helps remove your information from sites selling it. 
• Scam Detector flags suspicious texts, emails, links, QR codes, and even deepfake videos before you engage  
• Safe Browsing helps block risky sites, even if you do accidentally click  
• Device Security helps detect malicious apps or downloads  
• Secure VPN keeps your data private, especially on public Wi-Fi    

McAfee Safety Tips This Week 

Our advice based on this week’s scams and stories: 

• If your child’s school uses Canvas, update their password now and enable multi-factor authentication if available 
• Consider a credit freeze for your child’s identity, especially if sensitive identifiers were part of the breach 
• Never click links in unsolicited texts about refunds, recalls, or account issues — go directly to the official site instead 
• Treat any message that references your recent orders or personal account details with extra skepticism, even if it looks legitimate 
• Use Scam Detector to check suspicious links before engaging, and stay alert in the weeks and months after a breach, not just the first few days 

And we’ll be back next week with more scams and cybersecurity news making headlines. 

The post How to Protect Yourself After the Canvas Education Data Breach + Fake Amazon Recall Texts appeared first on McAfee Blog.

How come it’s still possible to ‘secure’ an online account with a six-digit string?

Scam messages are getting smarter and faster. 

According to McAfee’s 2026 State of the Scamiverse report, Americans now spend 114 hours a year trying to figure out what’s real and what’s fake online. That’s nearly three full workweeks lost to second-guessing messages, alerts, and links. 

And when scams do succeed, they move quickly. The typical scam unfolds in about 38 minutes, leaving little room for hesitation. 

That creates a gap: People want to check before they act, but the tools haven’t always met them in that moment. 

ChatGPT + McAfee is designed to close that gap, bringing scam detection directly to a platform people are already using to ask questions and make decisions. 

And it’s available to anyone. You don’t have to be a McAfee subscriber. 

This isn’t just detection. It’s guidance in the exact moment you’re deciding what to do.  

Instead of guessing, you can paste a message or drop in a screenshot and get a clear explanation of what’s risky, and what to do next, powered by McAfee’s threat intelligence. 

What You Can Do with ChatGPT + McAfee 

With this integration, checking something suspicious becomes as simple as asking a question. 

Paste a message. Drop in a link. Upload a screenshot. 

McAfee analyzes it and explains what’s going on clearly and in context. 

Here’s how it works: 

Feature	What it does	How it protects you
Link safety check	Paste a suspicious URL and get a reputational analysis based on McAfee threat intelligence	Scam links are often designed to look legitimate. A quick check helps avoid phishing and malware
Message analysis	Submit texts, emails, or social messages for evaluation	Many scams now rely on urgency and tone. Analysis helps surface subtle red flags
Screenshot uploads	Upload screenshots of messages, emails, or posts for review	Scams don’t always come as clean text. This makes it easier to check what you’re actually seeing
Clear explanations	Get a breakdown of why something is flagged as risky or safe	Not just a warning—an explanation that helps you recognize patterns next time
Guided next steps	Receive recommendations on what to do next	Helps prevent escalation, especially in moments of uncertainty

It’s a quick, accessible way to get answers in the moment. But it’s just one part of a broader system designed to protect you more comprehensively. 

Add the app to your ChatGPT account here. 

Built on McAfee’s Threat Intelligence 

Behind the scenes, ChatGPT + McAfee is powered by the same intelligence that fuels McAfee’s broader scam protection ecosystem. 

When you submit something for review: 

• Links are checked against known threat signals  
• Messages are analyzed for scam patterns and language cues  
• Results are translated into clear, human-readable explanations  

The goal isn’t just to flag risk. It’s to help you understand it. 

A New Way to Stay Ahead of Scams 

Scams aren’t slowing down. If anything, they’re becoming more convincing, more personalized, and harder to detect. 

That’s where ChatGPT + McAfee comes in. But this is only one part of a much bigger system designed to protect you before, during, and after a scam attempt. 

With McAfee+ Advanced, multiple layers work together so you’re not left figuring it out after the damage is done: 

• Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast  
• Personal Data Cleanup helps remove your information from sites selling it. 
• Scam Detector flags suspicious texts, emails, links, QR codes, and even deepfake videos before you engage  
• Safe Browsing helps block risky sites, even if you do accidentally click  
• Device Security helps detect malicious apps or downloads  
• Secure VPN keeps your data private, especially on public Wi-Fi    

The ChatGPT experience gives you a fast, intuitive way to check something in the moment. 

McAfee+ Advanced makes sure you’re protected across everything else.

The post Now Available: Use ChatGPT with McAfee to Spot Scams Faster appeared first on McAfee Blog.

You’re scrolling through Facebook or TikTok and see it. 

A flash sale from a brand you recognize. A limited-time investment opportunity. A job posting that promises quick money. 

The ad has comments. The account looks polished. Maybe someone you follow even liked it. 

So you click. 

From there, things move fast. You’re pushed to act quickly, enter your information, or send payment before the “deal” disappears. And just like that, the money is gone or your account is compromised. 

This isn’t an edge case anymore. According to new FTC data, nearly 30% of people who reported losing money to a scam in 2025 said it started on social media, with total losses hitting $2.1 billion. 

That’s why McAfee+ Advanced includes comprehensive protection designed to help you spot and stop scams at every step, including McAfee’s Scam Detector, which flags suspicious links and messages and explains why they may be risky, along with identity and privacy tools that help protect your information if a scam slips through. 

How Social Media Ad Scams Work 

A social media ad scam is when scammers use paid ads, fake profiles, or hijacked accounts on platforms like Facebook, Instagram, or TikTok to promote fake products, services, or investment opportunities in order to steal money or personal information. 

Step	What happens	What to do	How McAfee helps
1	You see an ad, post, or DM promoting a deal, job, or investment	Don’t engage immediately, even if it looks legitimate	Scam Detector flags suspicious links and messages before you interact
2	The ad links to a website or moves you into DMs	Avoid clicking unfamiliar links or continuing off-platform	Safe Browsing helps block risky or newly created websites
3	You’re pressured to act quickly or “secure your spot”	Slow down and verify the company independently	Scam Detector explains urgency tactics and why they’re risky
4	You’re asked to pay, share login info, or download something	Never send money or credentials based on a social media interaction	Identity Monitoring helps protect your personal data if exposed
5	The product never arrives, the investment disappears, or your account is compromised	Report the scam and secure your accounts immediately	Personal Data Cleanup and monitoring help reduce ongoing exposure

Red Flags To Watch For 

• Deals that feel unusually cheap or urgent  
• Ads linking to unfamiliar or slightly misspelled websites  
• Requests to move conversations off-platform quickly  
• Payment requests via apps, crypto, or wire transfer  
• Accounts with limited history or inconsistent engagement  

And that is the first part of This Week in Scams! This Friday we’re taking a different format to talk about this new FTC data and all that it reveals.  

Let’s keep digging in: 

FTC Report: Social Media Scams Are Now The Most Costly Fraud Channel 

New data from the FTC shows just how dominant social media has become in the scam landscape. 

• Social media scams drove $2.1 billion in reported losses in 2025  
• Losses have increased eightfold since 2020  
• Investment scams alone accounted for $1.1 billion of those losses 

Where Scams Are Happening And What’s Changing 

Category	What to know
Most common scams	Shopping scams lead, with over 40% of victims reporting purchases from social media ads that never arrived
Most costly scams	Investment scams drive the biggest losses, often starting with ads or group chats showing fake success
What’s changing	Scammers are using platform tools like ads, targeting, and profile data to reach people more precisely than ever

How Scams Play Out Across Platforms 

Platform	How scams typically start	What to watch for
Facebook	Ads, Marketplace listings, hacked accounts	Fake stores, duplicate listings, urgent purchase pressure
Instagram	Sponsored posts, influencer impersonation	“Limited drop” scams, fake brand collaborations
TikTok	Ads, stolen videos/profiles, comment links, bio links,	“Get rich quick” schemes, external link funnels, reselling via TikTok
WhatsApp	Group chats, investment communities	Fake testimonials, coordinated pressure to invest

 How McAfee Protects You from Scams and Cyber Threats 

McAfee+ Advanced gives you multiple layers working together so you are not left figuring it out after the damage is done:   

• Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast  
• Personal Data Cleanup helps remove your information from data broker sites, making you harder to target in the first place  
• Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage  
• Safe Browsing helps block risky sites if you do click  
• Device Security helps detect malicious apps or downloads  
• Secure VPN keeps your data private, especially on public Wi-Fi    

McAfee Safety Tips This Week 

Our advice based on this week’s scams and schemes: 

• Treat social media ads like any other unknown source, not a trusted recommendation  
• Pause before clicking, especially when urgency is involved  
• Verify brands by going directly to their official website  
• Avoid sending money or personal information through social media  
• Use tools like Scam Detector to check suspicious links before engaging  

And we’ll be back next week with more scams making headlines.

The post Ad Impersonation Scams and Record-Breaking Social Media Fraud Losses: This Week in Scams appeared first on McAfee Blog.

Secure Access adds Security Insights to speed up SOC Ops. Now, an analyst uses a three-click workflow, reducing investigation time from minutes to seconds.

Dive into the architecture behind Cisco’s holistic, mutilayered PQC strategy to understand how Cisco is operationalizing the secure communications and secure products across the communication planes, inside the chipset, and down to the firmware that loads before your operating system even boots.

A new scam making the rounds takes a familiar delivery trick and upgrades it with hyper‑realistic messaging and a QR code that looks safe to scan. 

But don’t be fooled. 

It’s the same delivery scam playbook scammers have relied on for years, just repackaged with better design and more convincing details. 

You get a message with a notice that looks something like this, a real message received by our team and tested against McAfee’s Scam Detector. 

 

That added layer of realism is what makes this version more dangerous. But it doesn’t hold up under scrutiny. McAfee’s Scam Detector flagged both the suspicious language and the QR code in this message before any interaction. 

If you receive something like this, pause. Do not scan the code. 

You can also protect yourself with McAfee’s Scam Detector, which flags suspicious links and messages, including delivery scams and QR‑based attacks, and explains why they may be risky. 

What is the USPS QR Code Scam and How Does it Work? 

The USPS QR code scam is a phishing attempt where scammers impersonate postal services and use QR codes instead of clickable links to direct victims to malicious websites. 

Once scanned, the QR code can lead to a fake USPS page that asks for payment, login credentials, or personal information. 

How the scam works 

Step	What happens	The red flags	What to do	How McAfee helps
1	You receive a text about a delivery issue or missed package	Urgency, you’re not tracking a package	Be skeptical of unsolicited delivery messages	Scam Detector flags suspicious messages
2	The message includes a QR code instead of a link	QR codes instead of official tracking links  is a red flag	Do not scan QR codes from unknown sources	QR scanning protection warns before opening risky destinations
3	You scan the code and land on a fake USPS page	Generic or slightly off branding on the webpage	Do not enter any information	Safe Browsing blocks known malicious sites
4	The page asks for payment or personal details	Requests for small “redelivery” or “processing” fees  are not normal	Exit immediately and do not submit anything	Scam Detector explains why the page is risky, and Identity Monitoring supports you when if your info gets out.

What To Do If You Get This Message 

• Do not scan the QR code  
• Go directly to the official USPS website to check tracking  
• Delete the message  
• Report it as spam  
• Monitor your accounts if you interacted with it  

And that, my friends, is scam number one in this week’s This Week in Scams. 

Let’s get into what else is on our radar. 

A Major Health Data Breach Exposes 500,000 Records 

A massive health data incident is raising new concerns about how sensitive information is handled and shared. 

According to reporting from the Associated Press, data tied to 500,000 participants in a major U.K. health research project was found listed for sale online. The dataset included biological and health-related information, though it did not contain direct identifiers like names or contact details. 

Access to the data had been granted to research institutions, but that access has since been revoked. Authorities say no purchases were made, and the listing has been removed. 

Still, the situation highlights a growing reality: once data is accessed or shared, control over it becomes harder to guarantee. 

What This Breach Says About Data Privacy 

Scams are no longer isolated events. They are layered. 

A data breach does not just stay a breach. It becomes fuel for future scams. Exposed information can be used to make phishing messages more convincing, personalize attacks, and build trust with targets. 

That is why detection alone is not enough anymore. Protection has to account for both incoming threats and what happens when data is already out there. 

How McAfee Protects You In A World of Scams and Data Breaches  

McAfee+ Advanced gives you multiple layers working together so you are not left figuring it out after the damage is done:  

• Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast 
• Personal Data Cleanup helps remove your information from data broker sites, making you harder to target in the first place 
• Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage 
• Safe Browsing helps block risky sites if you do click 
• Device Security helps detect malicious apps or downloads 
• Secure VPN keeps your data private, especially on public Wi-Fi   

McAfee Safety Tips This Week  

As always, we have some best practices and safety tips for navigating life online:  

• Pause before clicking, especially when a message creates urgency   
• Go directly to websites or apps instead of using email links   
• Be skeptical of routine account alerts that push immediate action   
• Double-check sender addresses and URLs closely   
• Use tools like McAfee’s Scam Detector to flag suspicious links and messages before interacting   
• Turn on identity monitoring so you’re alerted if your data is exposed  

And we’ll be back next week with more scams making headlines.

The post Fake USPS QR Code Text Scams and a Major Health Data Breach: This Week in Scams appeared first on McAfee Blog.

Co-Authored by Luiz Parente 

Your data might be safe today. But that doesn’t mean it’s safe forever. 

A growing number of sophisticated actors are collecting encrypted data now, with the goal of decrypting it later, when more powerful technology becomes available. 

This strategy is known as Harvest Now, Decrypt Later (HNDL). And it’s not a future problem. It’s already happening, according to research from our McAfee VPN team. 

For everyday people, that means private messages, financial records, and sensitive documents could be exposed years from now if protections don’t evolve today. 

That’s why security teams, including McAfee’s VPN engineers, are already working on ways to strengthen encryption for both today and what comes next. 

What “Harvest Now, Decrypt Later” Means 

At its core, HNDL is simple: Attackers collect encrypted data now, store it, and wait until they have the tools to unlock it later. 

Even though today’s encryption is incredibly strong, the strategy doesn’t rely on breaking it today. It relies on patience.  

A Simple Way to Think About It 

You put valuable belongings and documents in a safe at home that’s locked and secured. This works at preventing crimes of opportunity. But let’s say there’s a thief who steals the entire safe, knowing they have tools they can use later to access what’s inside. They wait, and once the tools are available, they break into your safe and access everything inside. 

That’s one way to think of HNDL. The safe is the encryption. The quantum computing is the tool they can use later.  

But in real life, you’d probably notice if your safe is gone. In the case of HNDL, if you’re not monitoring your data, you may not even notice encrypted information has been stolen to be decrypted.  

Key Terms Explained 

Term	What it means
Encryption	Scrambling data so others can’t read it
Quantum computing	A new type of computing that can break some encryption
HNDL	A strategy to collect encrypted data now and decrypt it later

Why This Matters Right Now 

This isn’t about whether your data is valuable today. It’s about whether it might be valuable later. 

Data with a long shelf life is especially at risk, including: 

• Financial records  
• Medical information  
• Private messages  
• Legal or identity documents  

Even something that feels low-stakes today could become sensitive in the future. 

And because the collection phase is already happening, the risk isn’t hypothetical. It’s already in motion. 

How This Affects VPNs (and what doesn’t change) 

VPNs remain one of the most effective ways to protect your data today. That hasn’t changed. 

But HNDL introduces a new layer of complexity. 

• What’s still strong: The encryption that protects your data in transit remains highly resilient.  
• Where the risk is: The “handshake” process (how a secure connection is established) is more vulnerable to future quantum attacks.  

In simple terms: Your data is well protected today, but parts of how that protection is set up may need to evolve for the future. 

What Quantum Computing Changes 

Traditional computers process information in a linear way. 

Quantum computers work differently. They can solve certain types of problems much faster, including the kinds of mathematical challenges that protect today’s encryption. 

That’s why attackers are willing to wait. 

Once quantum computing reaches a certain level, it could unlock data that was previously considered secure. 

What McAfee’s VPN Team is Working On 

McAfee’s VPN team is already preparing for this shift. 

• Evaluating quantum-safe encryption approaches  
• Exploring hybrid models that protect both now and long-term  
• Building toward a more resilient VPN experience  

This work builds on a broader privacy-by-design approach, where systems are designed to minimize risk from the start, not react after the fact. 

Because with HNDL, waiting isn’t an option. 

What You Can Do Now 

You don’t need to wait for quantum computing to take steps today. 

• Use a trusted VPN to encrypt your connection  
• Be mindful of long-term sensitive data you share online  
• Avoid unsecured public Wi-Fi when possible  
• Keep your apps and devices updated  

These steps help protect your data now while the industry builds toward future-ready security. 

How McAfee Helps Protect You 

McAfee+ Advanced gives you multiple layers working together so you are not left figuring it out after the damage is done:  

• Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast 
• Personal Data Cleanup helps remove your information from data broker sites, making you harder to target in the first place 
• Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage 
• Safe Browsing helps block risky sites if you do click 
• Device Security helps detect malicious apps or downloads 
• Secure VPN keeps your data private, especially on public Wi-Fi   

Frequently Asked Questions (FAQs) 

FAQ

Q: Is my data safe right now?   A: In most cases, yes—today’s encryption is extremely strong and is designed to protect your data from current threats. If you’re using trusted security tools like a VPN, safe browsing protections, and device security, your data is actively protected while it’s in transit and in use. However, no system is risk-free. Data exposed through phishing, weak passwords, breaches, or unsecured networks may still be vulnerable. And with “Harvest Now, Decrypt Later,” even properly encrypted data could be collected today and targeted for decryption in the future.

Q: What is quantum-safe encryption?  A: Quantum-safe (or post-quantum) encryption refers to new types of cryptography designed to remain secure even against future quantum computers. Today’s encryption relies on math problems that are extremely difficult for classical computers to solve, but quantum computers could eventually solve some of them much faster. Quantum-safe approaches use different mathematical foundations that are believed to resist those capabilities. In practice, many companies are moving toward hybrid encryption, combining today’s proven methods with newer quantum-resistant techniques to protect data both now and long-term.

Q: Should I still use a VPN?  A: Yes. A VPN remains one of the most effective ways to protect your data today, especially on public or unsecured networks. It encrypts your internet traffic and helps prevent interception by hackers, internet providers, or other third parties. While VPN protocols are evolving to address future quantum risks, they still provide strong, essential protection against today’s threats.

Q: When will this become a real threat?  A: The risk unfolds in two phases. The collection phase is already happening today, where sophisticated actors gather encrypted data and store it. The decryption phase depends on when quantum computing advances far enough to break certain types of encryption, which could take years but is actively progressing. This means data with a long lifespan, such as financial records, personal communications, and sensitive documents, is most at risk because it only needs to remain valuable until those capabilities exist.

The post Why Hackers Are Collecting Data They Can’t Read Yet. And How to Stay Safe appeared first on McAfee Blog.

You open your inbox and see it: Your cloud storage is full. 

There’s a warning about photos being deleted, your account being suspended, or a renewal failing. There’s a button to “fix it now.” Or a warning to “act today.” 

It looks routine. Maybe even urgent enough to click. 

That’s exactly the point. 

Cloud storage scams are making headlines again, building on patterns we flagged earlier this year in our State of the Scamiverse research.  

These emails have circulated steadily since 2025, often impersonating trusted brands like Apple, Microsoft, and Google. Many are timed to moments when people are already thinking about storage, backups, or subscriptions. 

The safest move is simple: pause and don’t click. If there’s a real issue, go directly to your account through the official app or website. 

You can also protect yourself with McAfee’s Scam Detector, which flags suspicious links and messages, including cloud storage scams, and explains why they may be risky. 

What Is A Cloud Storage Scam And How Does It Work? 

Cloud storage scams are phishing attacks designed to trick you into believing there’s an issue with your account so you’ll click a malicious link.

They often look like this, and include 3 key red flags:  

• Messages that create urgency like “act now or lose your data”  
• Generic greetings instead of your name  
• Links that don’t match the official domain  

How the scam works (step-by-step) 

Step	What happens	What to do	How McAfee helps
1. You receive a message	Email or text claims your storage is full or your account has an issue	Don’t click links directly from the message	Scam Detector flags suspicious messages before you interact
2. Urgency is introduced	Warning that files or photos will be deleted if you don’t act	Pause. Urgency is a red flag	Scam Detector identifies pressure-based scam patterns
3. You’re pushed to a link	Link mimics a real login or billing page	Go directly to the official website instead	Safe browsing tools help block malicious sites
4. You’re asked for info	Login credentials or payment details requested	Never enter info from a link you didn’t verify	Scam Detector explains why a page or link is risky
5. Data is captured	Scammers collect your data or payment	Monitor accounts and report suspicious activity	Identity monitoring alerts you if your data is exposed

 Why This Scam Works 

• Familiar brands: Messages often appear to come from trusted platforms like Apple iCloud or Google Drive  
• Emotional pressure: The threat of losing photos or files triggers quick decisions  
• Routine context: Storage alerts feel normal, so people don’t question them  

And that, my friends, is scam number one in this week’s This Week in Scams. 

Let’s get into what else is on our radar. 

FBI Report: Over $20 Billion Lost to Scams in 2025

New data from the FBI’s Internet Crime Complaint Center (ICC) shows just how large the scam economy has become. 

In 2025 alone: 

• Americans reported over $20.8 billion in losses  
• More than 1 million complaints were filed  
• That’s roughly 3,000 complaints per day  

This is where layered protection matters. It’s not just about catching one bad link. It’s about recognizing patterns across messages, platforms, and moments when something feels slightly off. 

How McAfee Protects You From Scams and Cyber Threats 

McAfee+ Advanced gives you multiple layers working together so you are not left figuring it out after the damage is done:  

• Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast 
• Personal Data Cleanup helps remove your information from data broker sites, making you harder to target in the first place 
• Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage 
• Safe Browsing helps block risky sites if you do click 
• Device Security helps detect malicious apps or downloads 
• Secure VPN keeps your data private, especially on public Wi-Fi   

McAfee Safety Tips This Week 

As always, we have some best practices and safety tips for navigating life online: 

• Pause before clicking, especially when a message creates urgency  
• Go directly to websites or apps instead of using email links  
• Be skeptical of routine account alerts that push immediate action  
• Double-check sender addresses and URLs closely  
• Use tools like McAfee’s Scam Detector to flag suspicious links and messages before interacting  
• Turn on identity monitoring so you’re alerted if your data is exposed 

And we’ll be back next week with more scams making headlines. 

The post Cloud Storage Scam Emails and Record-Breaking Fraud Losses: This Week in Scams  appeared first on McAfee Blog.

Your biggest risk may be a vendor you trust. How can SMBs map their third-party blind spots and build operational resilience?

6100 Series is an ultra-high-end firewall, delivering exceptional performance, line-rate threat protection, and modular scalability at AI-ready data centers.

Wearable health devices are designed to give you more control over your body and your data. 

But in 2026, the bigger risk isn’t someone spying on your smartwatch or smartring in real time. It’s what happens if the data connected to that device gets exposed. 

Health data, login credentials, and behavioral patterns tied to wearables can become valuable signals for cybercriminals. And once that data is out, it can fuel everything from identity theft to highly targeted scams. 

Here’s what’s actually at risk, and how to protect yourself. 

What Is Wearable Health Data (and Why It Matters) 

Wearable health data refers to the personal information collected and stored by devices like fitness trackers, smartwatches, and connected medical monitors. 

This can include: 

• Heart rate and activity levels  
• Sleep patterns  
• Location data  
• Medical metrics (like glucose levels)  
• Account credentials tied to apps and dashboards  

On its own, this data may seem harmless. But combined, it creates a highly detailed profile of your habits, routines, and health status. 

The Real Risk in 2026 Isn’t the Device. It’s the Data. 

Early conversations around wearable security focused on device hacking or surveillance. 

Today, the bigger concern is data exposure. 

If wearable platforms, apps, or connected services are breached, your data could be: 

• Sold on the dark web  
• Used to impersonate you  
• Leveraged in targeted phishing or health-related scams  

And because this data is personal and specific, scams built from it can feel far more convincing than generic spam. 

How Exposed Wearable Data Can Lead to Scams 

When cybercriminals gain access to personal data, they don’t just sit on it. They use it. 

Here’s how that plays out: 

Scenario	What It Looks Like	Why It Works
Health-related phishing	“Your insurance claim was denied” or “Update your health profile”	Feels relevant and urgent
Account takeover attempts	Password reset emails tied to known apps	Uses real account signals
Personalized scams	Messages referencing routines, devices, or conditions	Builds trust quickly
Fake alerts or services	“Device security issue detected”	Mimics real product behavior

 

This is where the risk shifts from data privacy → real-world financial and identity impact. 

6 Smart Ways to Protect Your Wearable Data 

1)Install updates immediately
Security patches fix known vulnerabilities. Delaying updates leaves gaps open.  

2) Use layered protection, not just device settings
A VPN and security software help protect data in transit and block threats before they reach you.  

3) Strengthen your login credentials
Use strong, unique passwords and enable two-factor authentication wherever possible.  

4) Limit what you share
Review app permissions and only connect devices to services you trust.  

5) Verify every message or alert
If you receive a message tied to your device or health data, double-check the source before clicking.  

6) Monitor your accounts regularly
Small signs of unusual activity can be early indicators of larger issues. 

How McAfee Helps Protect Your Data Beyond the Device 

Protecting your wearable doesn’t stop at the device itself. It extends to what happens if your data is exposed or targeted. 

Identity Monitoring 

McAfee helps track your personal information across known breach sources and alerts you if your data appears where it shouldn’t. 

This gives you early warning if wearable-related accounts or associated data are compromised. 

Scam Detector 

If your data is exposed, scammers often follow. 

McAfee’s Scam Detector helps identify suspicious messages, links, and communications before you engage, and explains why something was flagged, so you can make informed decisions quickly. 

Together, these tools help protect not just your device, but the chain reaction that can follow a data breach. 

The post Can Your Wearable Health Monitors Be Compromised? appeared first on McAfee Blog.

Cisco Secure Firewall’s post-quantum cryptography roadmap: what’s available today, what’s coming, and how to start planning.

Emails claiming to be from Social Security are making the rounds right now. 

They look official. They sound official. And they’re designed to get you to click before you think twice. 

The Social Security Administration’s Office of Inspector General is warning about a spike in messages that claim your Social Security statement is ready to download. The goal is simple. Get you to click a link or open an attachment. 

From there, things can go sideways fast. 

Before interacting with anything like this, it’s worth pausing and running it through a tool like McAfee’s Scam Detector. This is exactly the kind of message it’s built to flag. Something that looks legitimate, but feels just slightly off. 

How The Scam Works 

The email mimics official government communication, using logos, formatting, and language that feels familiar. It might say your statement is ready, your account needs attention, or you need to review a document. 

Once you click: 

• You may be sent to a fake website designed to capture your personal information  
• You may download malware without realizing it  
• Or you may be prompted to enter sensitive financial details  
• Either way, the goal is the same: get access to your identity. 

The Red Flags In These Emails 

• Messages claiming your social security statement is ready to download  
• Links or attachments labeled as official documents  
• Urgency pushing you to act quickly  
• Sender addresses that do not end in “.Gov”  

The biggest tell: Social Security does not send emails like this asking you to download statements or provide sensitive information. 

What To Do If You Get One 

• Do not click links or download attachments  
• Delete the email immediately  
• Access your account by going directly to the official SSA website  
• Report the message to the SSA Office of Inspector General  

If you already clicked: 

• Stop communication immediately  
• Contact your financial institutions  
• Monitor your accounts closely  
• Report the incident to the FTC or the FBI’s IC3  

And that, my friends, is scam number one in this week’s This Week in Scams. 

Let’s get into what else is on our radar. 

A Healthcare Data Breach That Could Lead to Follow-Up Scams 

Healthcare data breaches don’t always make headlines the same way big tech breaches do, but they can be just as serious. 

According to reporting from Fox News, CareCloud, a company that supports electronic health records for tens of thousands of providers, recently confirmed a security incident involving unauthorized access to one of its systems.  

The access lasted several hours. And while it’s still unclear whether any data was taken, that uncertainty is exactly what makes situations like this risky. 

Because even if you’ve never heard of the company, your doctor might use it. 

Why This Matters 

Healthcare data is incredibly valuable. It can include: 

• Names and social security numbers  
• Insurance details  
• Medical history  
• Billing information  

Unlike a credit card, you can’t just cancel your medical history. 

And when that kind of data is exposed or even potentially exposed, scammers often follow up with messages that feel highly specific and personal. 

What To Watch For Next 

After incidents like this, scammers often move quickly: 

• Emails or texts pretending to be your provider  
• Messages about billing issues or medical records  
• Requests to “verify” your information  
• Links to log in or update your account  

These scams work because they’re timed perfectly and feel relevant. 

This is another moment where Scam Detector can help flag suspicious links or messages before you engage, even when they reference real healthcare providers. 

How To Protect Yourself 

• Review medical bills and insurance statements for unfamiliar activity  
• Enable two-factor authentication on patient portals  
• Use strong, unique passwords  
• Avoid clicking links in unexpected healthcare-related messages  
• Consider identity monitoring to catch misuse early  

Where McAfee Steps In (So You Don’t Have to Guess) 

Scams today are layered. 

A fake email leads to stolen credentials. A breach leads to targeted phishing. And those follow-ups are getting harder to spot. 

McAfee+ Advanced gives you multiple layers working together so you are not left figuring it out after the damage is done: 

• Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast
• Personal Data Cleanup helps remove your information from data broker sites, making you harder to target in the first place
• Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage
• Safe Browsing helps block risky sites if you do click
• Device Security helps detect malicious apps or downloads
• Secure VPN keeps your data private, especially on public Wi-Fi  

Safety Tips To Carry Into Next Week 

• Be cautious of emails that look official but create urgency  
• Never trust unsolicited messages asking for personal or financial information  
• Go directly to official websites instead of clicking links  
• Stay alert after any breach or security incident makes headlines  
• Use tools like McAfee that help you verify what’s real before you act  

Because the reality is, scams are designed to look legitimate. You shouldn’t have to figure it out on your own. We’re safer together. 

We’ll be back next week with more scams making headlines. 

The post Social Security Scam Emails and a Healthcare Data Breach: This Week in Scams appeared first on McAfee Blog.

We’re excited to share that McAfee’s Scam Detector has been named a finalist in the 2026 Webby Awards. 

Recognized in the AI Experiences & Applications – Consumer Application category and named a Webby Honoree for Best Use of AI & Machine Learning, Scam Detector is being acknowledged for its effectiveness as an AI-driven consumer tool. 

This recognition of Scam Detector validates something key in research findings. According to McAfee’s 2026 State of the Scamiverse report, Americans now spend 114 hours a year trying to decide what’s real and what’s fake online. 

Scam Detector was built with this era of uncertainty in mind, designed to help people cut through confusion and identify scams as they appear. The Webby recognition reinforces to us that McAfee’s Scam Detector is doing exactly that. 

What Are the Webby Awards? 

The Webby Awards are presented by the International Academy of Digital Arts & Sciences and recognize excellence across the internet, including apps, software, AI, and digital experiences. 

Each year, thousands of entries are evaluated, with finalists representing the top work in their category globally. 

In addition to judged awards, the Webby Awards include a People’s Voice Award, which is decided by public vote. 

How McAfee’s Scam Detector Uses AI to Stop Scams 

Scam Detector is designed to help people identify scams where they’re most likely to happen, always ready to help you spot what’s real and what’s not when you least expect it. 

It uses AI to analyze and flag suspicious: 

• Text messages and emails  
• Links and websites  
• QR codes  
• Social media messages  
• AI-generated and deepfake content  

Beyond detection, Scam Detector explains why something was flagged as risky. That transparency helps show how decisions are made, so people can quickly understand the risk and feel more confident trusting what’s flagged.

As scams become more personalized and harder to detect, this combination of automatic detection and clear guidance is critical to preventing financial loss and identity theft. 

Vote for McAfee’s Scam Detector 

Scam Detector is eligible for the Webby People’s Voice Award, which is decided by public vote. 

If you would like to support McAfee’s Scam Detector, you can vote here: https://vote.webbyawards.com/PublicVoting#/2026/ai/ai-experiences-applications/consumer-application 

Voting is open through Thursday, April 16 at 11:59 pm PDT. 

Winners will be announced on April 21, 2026. 

And a big thank you to the McAfee teams who brought Scam Detector to life and who continuously improve how Scam Detector identifies new threats and adapts to the evolving world of AI-driven scams. 

The post McAfee’s Scam Detector Named Webby Awards Finalist for AI Innovation appeared first on McAfee Blog.

Threat actors are using AI to supercharge tried-and-tested TTPs. When attacks move this fast, cyber-defenders need to rethink their own strategy.

A tax system breach in Oklahoma is putting highly sensitive personal information at risk. And unfortunately, this is exactly the kind of situation scammers love to exploit. 

Hackers reportedly accessed W-2 and 1099 files through Oklahoma’s online tax portal, according to state officials, exposing the kind of information that can open the door to tax fraud, identity theft, and highly targeted phishing attempts. 

Before the follow-up scams start rolling in, this is the kind of moment where layered protection matters. McAfee+ Advanced includes identity monitoring and data cleansup that can help alert you if your personal information starts circulating where it shouldn’t, and Scam Detector can flag suspicious messages if scammers try to use this breach as a hook. 

What Happened in Oklahoma 

According to a statement by the Oklahoma Tax Commission and reported by KOCO News 5, a local ABC affiliate, suspicious activity inside the state’s Oklahoma Taxpayer Access Point system was identified in December 2025. The agency says impacted individuals have been notified directly by mail, and complimentary credit monitoring and fraud assistance are being offered. 

When W-2s, 1099s, Social Security numbers, and tax-related records are exposed, scammers can use that information to: 

• File fraudulent tax returns  
• Try to open new accounts  
• Build phishing emails or texts that feel unusually real  

Either way, the goal is the same: use real information to make the next scam more believable. 

Red Flags of a Scam After a Breach Like This 

The breach itself is real. But what often follows is a second wave of scams pretending to help. 

Watch For: 

• Emails or texts about your “tax account” that create urgency  
• Messages asking you to verify personal information  
• Fake alerts about refunds, filings, or suspicious activity  
• Links telling you to log in and “secure” your account  

That’s where people can get hit twice: once by the breach, and again by the scam that follows it. 

What To Do If You’re Impacted 

First, don’t panic. Then: 

• Take advantage of any free credit monitoring or fraud assistance being offered  
• Monitor your bank accounts, tax records, and credit reports closely  
• Consider placing a fraud alert or credit freeze if needed  
• Be extra careful with any message referencing taxes, refunds, or account access 
• Go directly to official sites instead of clicking links in emails or texts  

And that, my friends, is scam number one in this week’s This Week in Scams. 

Let’s get into what else is on our radar. 

The FBI Impersonation Scam Showing Up Across the U.S. 

Scammers pretending to be federal agents are making the rounds across the country, and this one is built to make people panic fast. 

Field offices, including Chicago and Houston, are warning the public about fraudsters posing as FBI agents in calls, texts, and emails. In some cases, the scammers claim you’re connected to an investigation. In others, they say you’re a victim of fraud and need to act immediately to protect yourself. 

Sometimes they do not stop there. They may also pretend to be bank employees working alongside the FBI, all to make the story feel more convincing and get access to your money or personal information. 

Why This Scam Works

This scam plays on the same pressure tactics we’ve seen over and over again: authority, urgency, and confusion. 

If someone claims to be a federal agent, many people freeze up and assume they need to cooperate immediately. That’s exactly what scammers are counting on. 

The FBI has been clear about this: federal law enforcement will not ask you for money or sensitive personal information over the phone, by text, or by email. 

The Red Flags in This Message

• Unsolicited outreach from someone claiming to be federal law enforcement  
• Pressure to act immediately  
• Requests for money, gift cards, prepaid cards, or personal information  
• Instructions to keep the conversation secret  
• Stories involving a bank “working with” the FBI  

If it feels dramatic, high-pressure, and just a little off, trust that instinct. 

What To Do if You Get One Of These Messages

• Do not respond  
• Do not send money or share personal information  
• Contact the agency directly using publicly listed contact information  
• Save the message for your records  
• Report it to the FBI: 1-800-CALL-FBI (225-5324), or online at tips.fbi.gov.

This is also exactly the kind of message McAfee’s Scam Detector is built to flag before you get pulled in. 

How McAfee Helps You Stay Ahead of Scams and Breaches 

McAfee+ Advanced gives you multiple layers working together so you are not left figuring it out after the damage is done: 

• Identity Monitoring alerts you if your personal info shows up where it should not, so you can act fast
• Personal Data Cleanup helps remove your information from data broker sites, making you harder to target in the first place
• Scam Detector flags suspicious texts, emails, links, and even deepfake videos before you engage
• Safe Browsing helps block risky sites if you do click
• Device Security helps detect malicious apps or downloads
• Secure VPN keeps your data private, especially on public Wi-Fi  

This kind of layered protection is critical in cases like ghost student scams, where the first sign of fraud often comes after financial damage has already happened. 

Safety tips to carry into next week 

• Be extra cautious after any real breach makes headlines  
• Do not trust unsolicited messages just because they reference real institutions  
• Never send money to someone claiming to be law enforcement  
• Go directly to official websites instead of clicking links  
• Use tools that flag suspicious messages in real time so you do not have to guess 

The reality is, scams are getting better at looking official. 

You should not have to be an expert to spot them. That’s why McAfee is here to help. We’re Safer Together.

We’ll be back next week with more scams making headlines. 

The post Oklahoma Tax Breach and FBI Impersonation Scam: This Week in Scams appeared first on McAfee Blog.