When users click on a scam link, they might suffer monetary losses, and worse, give up private info such as name and credit card details to scammers, they may also accidentally install malware on their device.
They are generally found in text messages and emails sent by scammers, designed to trick us into downloading malware or bringing us to a scam website to steal our personal identifying information. A few examples include gold bars, employment, and unpaid toll scams. Scammers send these links to the masses— with the help of AI these days. Since a lot of users fall victim to phishing scams every year, scammers haven’t changed their attack tactics over the years.
These days, smartphones try to block scam links, so scammers have adapted making links that escape detection. Users are advised to look for typos-quatting, a technique that uses spelling mistakes. For eg: 'applle' instead of 'apple'.
Most brands don’t change their domain names. If you find the domain name is different in the URL, it is a fake link.
Shortlists are generally found on social media and texts. Experts say there is no way to determine the authenticity of a shortened URL, advising users to not open them. Instead, users should check the language for any suspicious signs.
These don’t need website links, they are sent via phone numbers. Users accidentally click on a malicious phone number thinking it is their bank or someone important. Experts suggest not to interact with unknown phone numbers.
The most popular means to send scam links is via e-mail, resulting in the biggest monetary losses. To stay safe, users can copy the link in their notepad first and inspect it before opening it.
Malicious QR codes have become common in public avenues, from restaurants to parking stands. Scammers embed fake codes over real ones or fill them with phishing emails that redirect to fake sites or malware downloads.
Scammers pretend to be someone you know, they may fake a medical emergency and demand you for money to help them. Always call the person to cross-check the identity before giving money, opening a link, or revealing any personal information.
As artificial intelligence becomes more popular, scammers are using its hype to fool people. A new warning reveals that hackers are creating fake AI apps and promoting them online to trick users into downloading harmful software onto their devices.
These scams are showing up on social media apps like TikTok, where videos use robotic-sounding voices to guide viewers on how to install what they claim are “free” or “pirated” versions of expensive software. But when people follow the steps in these videos, they end up installing malware instead — which can secretly steal sensitive information from their devices.
Security researchers recently found that cybercriminals are even setting up realistic-looking websites for fake AI products. They pretend to offer free access to well-known tools like Luma AI or Canva Dream Lab. These fake websites often appear in ads on platforms like Facebook and LinkedIn, making them seem trustworthy.
Once someone downloads the files from these scam sites, their device can be infected with malware. This software may secretly collect usernames, passwords, saved login details from browsers like Chrome and Firefox, and even access personal files. It can also target cryptocurrency wallets and other private data.
One known hacker group based in Vietnam has been pushing out malware through these methods. The malicious programs don’t go away even after restarting the computer, and in some cases, hackers can take full remote control of the infected device.
Some fake AI tools are even disguised as paid services. For instance, one scam pretends to offer a free one-year trial of a tool called “NovaLeadsAI,” followed by a paid subscription. But downloading this tool installs ransomware — a type of malware that locks all your files and demands a large payment to unlock them. One version asked victims for $50,000 in cryptocurrency, falsely claiming the money would go to charity.
Other fake tools include ones pretending to be ChatGPT or video-making apps. Some of these can destroy files or make your entire device unusable.
To protect yourself, avoid downloading AI apps from unknown sources or clicking on links shared in social media ads. Stick to official websites, and if an offer seems unbelievably good, it’s probably a scam. Always double-check before installing any new program, especially ones promising free AI features.
Cybersecurity experts have found a critical unpatched security vulnerability impacting the TI WooCommerce Wishlist plugin for WordPress that unauthorized threat actors could abuse to upload arbitrary files.
TI WooCommerce Wishlist has more than 100,000 active installations. It allows e-commerce website users to save their favorite products for later and share the lists on social media platforms. According to Patchstack researcher John Castro, “The plugin is vulnerable to an arbitrary file upload vulnerability which allows attackers to upload malicious files to the server without authentication.”
Labeled as CVE-2025-47577, the vulnerability has a CVSS score of 10.0 (critical), it impacts all variants of the plugin below 2.92 released on November 29, 2024. Currently, there is no patch available.
According to the security company, the issue lies in a function called "tinvwl_upload_file_wc_fields_factory," which uses another native WordPress function "wp_handle_upload" to validate but sets the override parameters “test_form” and “test_type” to “false.”
The "test_type" override checks whether the Multipurpose Internal Mail Extension (MIME) file type is as expected, while the “test_form” verifies whether the $_POST['action'] parameter is correct.
When setting "test_type," it permits the file type validation to escape effectively, permitting any file type to be uploaded.
The TIWooCommerce Wishlist plugin is an extension for WooCommerce stores that lets users create and manage wishlists, sharing and saving their wishlist products.
Apart from social sharing options, the plugin has AJAX-based functionality and multiple-wishlist support in the premium variant, email alerts, etc.
The scale of the potential attack surface is massive. A major concern is that these are ecommerce sites, where customers spend money, this can compound the risk.
Currently, the latest variant of the plugin is 2.9.2, last updated 6 months ago. As the patch has not yet been released, concerned users are advised to deactivate and remove the plugin until a fix is issued.
The good thing here is that effective compromise is only possible on sites that also contain the WC Fields Factory plugin deployed and active, and the integration is active on the TI WooCommerce Wishlist plugin. This can make things difficult for threat actors.
Many people are changing their social media habits and opting out of many services. Facebook has witnessed a large exodus of users deserting the platform after the announcement in March that Meta was terminating the independent fact-checking on its platform. However, fact-checking has been replaced with community notes, letting users make changes to potentially false/misleading information.
Users having years of photos and posts on Facebook are confused about how to collect their data before removing their accounts. If you also feel the same problem, this post will help you delete Facebook permanently, while taking all your information on the way out.
For users who do not want to be on Facebook anymore, deleting their account is the only way to completely remove yourself from the platform. If you are not sure, deactivating your account allows you to have some life off of Facebook without account deletion.
Make sure to remove third-party Facebook logins before deleting your account.
Third-party apps like DoorDash and Spotify allow you to log in using your Facebook account. This lets you log in without remembering another password, but if you’re planning on deleting Facebook, you have to update your login settings. That is because if you delete your account, there will not be another Facebook account for the user to log in through.
Fortunately, there is another simple way to find which of your sites and applications are connected to Facebook and delete them before removing your account. Once you disconnect from other websites and applications from Facebook, you will need to adjust how you login to them.
Users should try specific applications and websites to set new passwords or passkeys or log in via a single-service sign-on option, such as Google.
If you want to stay away from Facebook, you have two choices. Either delete your account permanently, or you can disable it temporarily to deactivate it.
The CISA, NSA, and FBI teamed with cybersecurity agencies from the UK, Australia, and New Zealand to make a best-practices policy for safe AI development. The principles laid down in this document offer a strong foundation for protecting AI data and securing the reliability and accuracy of AI-driven outcomes.
The advisory comes at a crucial point, as many businesses rush to integrate AI into their workplace, but this can be a risky situation also. Governments in the West have become cautious as they believe that China, Russia, and other actors will find means to abuse AI vulnerabilities in unexpected ways.
The risks are increasing swiftly as critical infrastructure operators develop AI into operational tech that controls important parts of daily life, from scheduling meetings to paying bills to doing your taxes.
From foundational elements of AI to data consulting, the document outlines ways to protect your data at different stages of the AI life cycle such as planning, data collection, model development, installment and operations.
It requests people to use digital signature that verify modifications, secure infrastructure that prevents suspicious access and ongoing risk assessments that can track emerging threats.
The document addresses ways to prevent data quality issues, whether intentional or accidental, from compromising the reliability and safety of AI models.
Cryptographic hashes make sure that taw data is not changed once it is incorporated into a model, according to the document, and frequent curation can cancel out problems with data sets available on the web. The document also advises the use of anomaly detection algorithms that can eliminate “malicious or suspicious data points before training."
The joint guidance also highlights issues such as incorrect information, duplicate records and “data drift”, statistics bias, a natural limitation in the characteristics of the input data.
Experts are warning that working from home is making businesses more open to cyberattacks, especially as hackers use new tools like artificial intelligence (AI) to trick people. Since many employees now work remotely, scammers are taking advantage of weaker human awareness, not just flaws in technology.
Joe Jones, who runs a cybersecurity company called Pistachio, says that modern scams are no longer just about breaking into systems. Instead, they rely on fooling people. He explained how AI can now create fake voices that sound just like someone’s boss or colleague. This makes it easier for criminals to lie their way into a company’s systems.
A recent attack on the retailer Marks & Spencer (M&S) shows how dangerous this has become. Reports say cybercriminals pretended to be trusted staff members and convinced IT workers to give them access. This kind of trick is known as social engineering—when attackers focus on manipulating people, not just software.
In fact, a recent study found that almost all data breaches last year happened because of human mistakes, not system failures.
Jones believes spending money on cybersecurity tools can help, but it’s not the full answer. He said that if workers aren’t taught how to spot scams, even the best technology can’t protect a company. He compared it to buying expensive security systems for your home but forgetting to lock the door.
The M&S hack also caused problems for other well-known shops, including Co-op and Harrods. Stores had to pause online orders, and some shelves went empty, showing how these attacks can impact daily business operations.
Jude McCorry, who leads a cybersecurity group in Scotland, said this kind of attack could lead to more scam messages targeting customers. She believes companies should run regular training for employees just like they do fire drills. In her view, learning how to stay safe online should be required in both businesses and government offices.
McCorry also advised customers to update their passwords, use different passwords for each website, and turn on two-factor login wherever possible.
As we rely more and more on technology for banking, shopping, and daily services, experts say this should be a serious reminder of how fragile online systems can be when people aren’t prepared.