Technology News Articles on Fox News

Smart toilet seat could detect AFib in 30 seconds

Fri, 07 Aug 2026 13:00:41 -0400

Your next bathroom break could come with an unexpected bonus: a check of your heart rhythm. German medical technology company Hamberger Medical has developed the HARO EKG-seat. It looks like a regular toilet seat, but built-in sensors record an electrocardiogram, also called an EKG or ECG, while you sit.

After about 30 seconds, a connected smartphone app analyzes the reading for signs of an irregular heart rhythm, including possible atrial fibrillation. AFib is the most common type of irregular heartbeat, and millions of people may have it without realizing anything feels wrong. It sounds like the kind of idea someone dreamed up during a very long bathroom break.

However, the possibility of catching a silent heart condition during something you already do every day deserves attention. Here's what the early research reveals about how well the seat works and where its limits begin.

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our free CyberGuy Live class "Sick of Spam?" has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.

Get the free replay and checklist now at CyberGuyLive.com.

COULD A PAINT-ON ELECTRONIC TATTOO SPOT HEART ATTACKS?

A conventional medical EKG usually requires you to lie down while a medical professional places electrodes on your chest and other parts of your body. The HARO EKG-seat takes a different approach. Its sensors collect electrical signals from your body while you sit normally. The seat records a six-lead resting EKG and sends the information to its companion app through Bluetooth.

You do not need to attach sticky pads or remember to put on a wearable. You sit for about 30 seconds and let the seat do the work. Hamberger Medical says participants in its usability testing could operate the system without special instructions. The oldest participants in one reported study were in their 90s, according to published reports about the device. That simplicity may become one of its biggest strengths. Many health devices end up forgotten in a drawer after the novelty fades. A toilet seat is harder to forget.

The company tested the seat through what it calls the Hamberger Heart Study. Researchers compared the seat's six-lead EKG with a standard 12-lead medical EKG. Hamberger Medical reported a high level of agreement between the two systems when checking for AFib and other rhythm abnormalities.

That sounds encouraging, but there is an important limitation. The complete results have not been published in an independently peer-reviewed medical journal. Public reports also do not provide enough detail about the study's size, false alerts or performance across different groups.

Without those numbers, we cannot tell how often the seat might miss AFib or mistakenly warn someone whose heart rhythm is normal. For now, the results should be viewed as promising company-reported findings. They do not prove that the seat can replace a hospital EKG or a doctor's diagnosis.

AFib causes the heart's upper chambers to beat irregularly. Blood may then pool inside the heart, which can allow clots to form. A clot can travel to the brain and cause a stroke. The American Heart Association says AFib is linked to about five times the risk of stroke. Some people feel a racing heartbeat or fluttering in their chest. Others notice fatigue, dizziness or shortness of breath.

However, AFib can also arrive without obvious warning signs. A person may feel fine while the irregular rhythm comes and goes. That creates a detection problem. A brief EKG at a doctor's office may look normal if the AFib episode ended before the appointment. Doctors sometimes use longer-term monitors when they suspect an intermittent rhythm problem. A toilet seat that records readings regularly could provide more chances to capture an episode.

WEARABLE PATCH VIBRATES WHEN DANGER IS NEARBY

The American Heart Association estimates that about 5 million Americans currently live with AFib. It projects that more than 12 million could have the condition by 2030. Early detection can help doctors decide whether someone needs medication, additional monitoring or treatment to restore a normal rhythm.

Dr. Paari Dominic, a cardiac electrophysiologist, told the American Medical Association that earlier intervention can significantly improve outcomes. He noted that research supports pursuing normal rhythm within a year of detecting AFib in appropriate patients. However, a notification from a toilet seat should begin a medical conversation. It should never end one.

Age raises the likelihood of developing AFib. High blood pressure also plays a major role. Diabetes, obesity, sleep apnea and certain heart conditions can increase the risk. Smoking and excessive alcohol use may contribute as well.

Heavy drinking can sometimes trigger an irregular heartbeat even in people without a known heart condition. Doctors often call this "holiday heart syndrome" because cases can rise during celebrations involving heavier alcohol use. People who already face a higher risk could benefit most from convenient monitoring. That decision should involve a cardiologist or another qualified medical professional.

A heart-monitoring toilet seat collects highly sensitive information, so its privacy protections deserve a close look. According to Hamberger Medical's app privacy policy, EKG processing happens locally on the connected phone or tablet. The company says readings are not sent to its servers. The app also lets you export a PDF report. Hamberger Medical recommends protecting the file with a password before sending it to someone else. However, your phone's backup settings may still upload app information to iCloud or Google Backup. The company notes that this depends on how you configured your device.

Before using any connected health product, check its backup settings and sharing options. You should also protect your phone with a strong passcode. For additional steps, see our guide on how to stop health and fitness apps from using your private data.

HEART CONDITION TIED TO LINDSEY GRAHAM'S DEATH CAN STRIKE WITHOUT WARNING — WHAT TO KNOW

The HARO EKG-seat does not currently appear to be available for purchase. Hamberger Medical previously said the device was sold exclusively through its official German online shop at approximately $2,870. CyberGuy reached out to Hamberger Medical to confirm current availability, pricing and whether the company plans to sell the EKG-seat in the United States, but did not hear back before our deadline.

The HARO EKG-seat shows how health monitoring could blend into your normal routine. That part is genuinely promising. The clinical report suggests the seat can record EKGs that cardiologists interpret with strong accuracy. However, the current app results do not support relying on its automated AFib classification alone.

A normal app reading should not convince you to ignore symptoms. An abnormal warning should lead to a conversation with a medical professional. Contact your doctor if you notice a racing or irregular heartbeat, recurring dizziness or unexplained shortness of breath. Chest pain or pressure may signal a medical emergency, so call 911 right away. Never start or stop heart medication because of a consumer device result. Your doctor may order a clinical EKG or longer-term monitoring before making a diagnosis.

There is something undeniably clever about turning an ordinary toilet seat into a heart monitor. It fits health screening into a routine that people already follow without reminders. The company-reported results sound encouraging, especially for a condition that may hide between doctor visits. Smart health technology works best when it helps you notice a concern sooner and gives your doctor useful information. It becomes dangerous when a gadget creates false confidence or replaces professional care.

Would you trust a smart toilet seat with your heart data if it could uncover a silent problem before your next doctor visit? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Fox News AI Newsletter: AI company accused of favoring foreigners over American workers

Fri, 07 Aug 2026 11:09:25 -0400

IN TODAY'S NEWSLETTER:

- OpenAI to pay $3.2 million to settle DOJ allegations it favored foreign workers over Americans

- AI kill-switch bill could shut down rogue models

- Battlefield robots open new front in innovation war with major US adversary

STACKED DECK: OpenAI and one of its subsidiaries will pay $3.2 million to settle allegations that they discriminated against U.S. workers by favoring foreign workers with temporary employment visas, the Justice Department announced Tuesday.

POWER PLAY: President Donald Trump warned that the artificial intelligence race is the most critical competition in centuries. He argues that American communities must embrace AI data centers to secure technological dominance over China. Securing victory in the global artificial intelligence race is critical, Trump told Trace Gallagher during their exclusive interview.

ROGUE MACHINE: The phrase "AI kill switch" sounds like a red button hidden behind glass in a government bunker. The proposal now before Congress looks less dramatic, but it could give Washington significant new power over the country's largest AI companies.

UNTETHERED INTEL: The U.S. Army is teaming up with an artificial intelligence company to build an AI "brain" for military robots that can think, understand their surroundings and continue missions even after losing contact with human operators as the race for AI dominance intensifies.

HIDDEN HAND: Several major news organizations are hosting reporter fellows with salaries paid by donor-supported AI journalism groups, relationships that frequently go undisclosed.

'UNAUTHORIZED' BREACH: Revelations of OpenAI and Anthropic artificial intelligence agents hacking third parties has drawn the "serious concern" of Sen. Lisa Blunt Rochester, D-Del., who is seeking answers from the two businesses incorporated as public benefit companies in her state.

OPINION: Artificial intelligence sits at the center of nearly every major debate, from jobs and data centers to healthcare, national security and consumer protection. Missing from the national spotlight, however, is a more fundamental question: Will AI models pursue the truth, or will they be permitted to bury undisclosed biases inside their responses?

ON DUTY: What if the next security guard rolling past your office had one wheel and never needed a coffee break? That is the pitch behind 1Rollo, a one-wheeled AI security robot from Estonian startup Rollo Robotics. The company believes its narrow design could patrol large properties at a lower operating cost than traditional security vehicles.

MAN OVER MACHINE: Investors are turning to artificial intelligence tools for guidance on their finances and investments, though they remain skeptical of its output and continue to lean on human advice ahead of key decisions, new data shows.

FOLLOW FOX NEWS ON SOCIAL MEDIA

Facebook

Instagram

YouTube

SIGN UP FOR OUR OTHER NEWSLETTERS

DOWNLOAD OUR APPS

WATCH FOX NEWS ONLINE

Fox News Go

STREAM FOX NATION

Fox Nation

Stay up to date on the latest AI technology advancements and learn about the challenges and opportunities AI presents now and for the future with Fox News here.

Russian hackers can steal emails without a click

Fri, 07 Aug 2026 09:05:35 -0400

Opening an unexpected email can feel relatively harmless when you avoid its links and attachments. However, a Russian hacking campaign has turned that familiar safety advice on its head.

CISA says the Russian state-sponsored group Laundry Bear can compromise certain email accounts when someone simply opens or previews a malicious message. The attack targets organizations running unpatched versions of the Zimbra Collaboration Suite.

Once the email appears, hidden code can collect passwords, authentication data and as much as 90 days of messages. You may never see a warning or realize that anything happened.

The Cybersecurity and Infrastructure Security Agency issued the warning with the National Security Agency, FBI and cyber authorities from several allied countries. The agencies say the group has successfully targeted more than 10 Western organizations since July 2025.

INVESTIGATORS BELIEVE IRANIAN HACKERS ARE LIKELY BEHIND CYBERATTACK ON MINNESOTA WATER SYSTEMS: REPORT

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our free CyberGuy Live class, "Sick of Spam?" has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.

Get the free replay and checklist now at CyberGuyLive.com.

Laundry Bear, which Microsoft tracks as Void Blizzard, exploits a security flaw known as CVE-2025-66376. The cross-site scripting vulnerability affects the Classic user interface in certain versions of the Zimbra Collaboration Suite.

Zimbra is an email and collaboration platform used by some governments, schools, businesses and other organizations as an alternative to services such as Microsoft Exchange or Google Workspace. Attackers can place malicious JavaScript inside a specially crafted HTML email. That code runs automatically when a vulnerable Zimbra webmail client displays the message.

The person reading the email does not need to open an attachment. The attack also avoids the usual request to enter a password on an obvious phishing page. However, the email still needs to appear on the screen. CISA describes the technique as a zero-click exploit. Proofpoint calls it a "half-click" attack because someone must open the email or allow it to appear in a preview pane. Either description leads to the same concern. A message can look harmless while code hidden inside it quietly attacks the email account.

Laundry Bear reportedly used the flaw as a zero-day before Zimbra released a patch in November 2025. A zero-day attack exploits a security weakness before the software maker provides a fix. CISA later added the vulnerability to its list of flaws that hackers actively exploit.

The available patch closes the known security hole. Yet Laundry Bear continues to target organizations that have not installed the update. That makes delayed patching especially dangerous. An organization may have strong passwords and trained employees, but an exposed email server can still give attackers another way inside.

The campaign has reached organizations connected to the defense industrial base and government. Attackers have also targeted education, energy, law enforcement, media, nonprofit groups and technology companies.

According to CISA, the malicious code attempts to collect the target's last 90 days of email. That could include private conversations with coworkers, contract discussions or information about upcoming meetings. An inbox may also contain password reset notices, invoices and documents that reveal how an organization operates.

Laundry Bear also collects the person's email address and password. The attack can copy the organization's Global Address List, which acts as a directory of employees and contacts. The hackers may then gain enough information to impersonate a trusted coworker or identify more valuable accounts.

CISA says the exploit also targets two-factor authentication tokens. Those tokens help prove that someone has already completed an authentication step. A stolen token or session cookie can let an attacker enter an account without completing the normal login process again.

FAKE PASSWORD-MANAGER ALERTS COULD PUT YOUR VAULT AT RISK

Stealing information provides immediate value, but Laundry Bear also tries to preserve its access. The attack creates a new Zimbra application passcode and sends it back to the hackers. Legacy email programs use these passcodes when they connect through services such as IMAP or ActiveSync and cannot support modern time-based authentication.

An unauthorized passcode can give the hackers another entrance to the mailbox. That access may continue even after someone changes the main account password. CISA has urged administrators to look for suspicious application passcodes, particularly passcodes labeled "ZimbraWeb."

Organizations should treat an unknown passcode as a sign that someone may have entered the account. Simply installing the patch after a compromise may leave the attacker's access in place.

Laundry Bear sends the stolen information to servers controlled by the group. CISA says the attackers use a collection framework called Flowerbed. The system moves smaller pieces of data through Domain Name System requests. DNS normally helps computers find websites and online services.

Attackers can hide encoded information inside those requests. Because organizations generate large amounts of legitimate DNS traffic, the malicious activity may blend into the background. Laundry Bear sends larger collections through encrypted HTTPS connections. That can include compressed archives containing mailbox data. Security teams may need to inspect network logs, authentication records and mailbox activity to understand what left the organization.

Laundry Bear also uses adversary-in-the-middle phishing kits. These tools create login pages that closely resemble legitimate email portals. When someone enters a username and password, the phishing system captures those credentials. It can also intercept session cookies created during the login process. That means an attacker may gain access even when the account uses conventional multifactor authentication.

CISA's indicators of compromise include domains that impersonated Zimbra infrastructure. Examples include mailnalysis.com, zimbrastat.com, zimbra-metadata.com and zmailanalytics.com. The presence of one of these domains in network logs could point to phishing or unauthorized account activity. However, organizations should review CISA's complete list because attackers can change their infrastructure.

Proofpoint found that Laundry Bear sent messages from attacker-controlled Proton Mail accounts and email addresses the group had already compromised. In one example, the sender claimed to represent a Belgian media-verification organization. The email proposed cooperation between European institutions fighting disinformation. It included a legitimate-looking link to a European Union events calendar. However, the malicious code sat inside the email rather than the linked website.

Dutch intelligence agencies publicly identified Laundry Bear in May 2025. Their investigation linked the group to a 2024 breach of the Dutch National Police. That incident exposed personal information belonging to police personnel. Investigators said the attack helped them identify a previously unknown Russian cyberespionage group.

Since at least 2024, Laundry Bear has focused on organizations connected to Russian strategic interests. Its targets have included NATO member states and groups supporting Ukraine.

Microsoft has documented compromises involving defense organizations as well as entities in transportation and aviation.A separate campaign targeted members of Ukraine's military with charity-themed phishing emails. Those messages disguised malware as requests for donations.

These campaigns suggest the group cares more about long-term intelligence collection than a quick financial payout. Access to email can reveal relationships, future plans and internal decisions.

PAIDWORK BREACH EXPOSES 23M USER RECORDS

The strongest protection starts with the organization running the email server because employees cannot personally patch a vulnerable installation. However, you can still take steps to spot suspicious activity and protect your other accounts.

Administrators should update Zimbra Collaboration Suite to a currently supported version and install all available security fixes. Organizations should confirm that the patch reached every server. An overlooked system may remain exposed even when the primary mail server has received the update.

Installing the patch blocks the known flaw, but it cannot undo a previous intrusion. Security teams should review CISA's published indicators of compromise. They should also search network records for connections to the listed domains and IP addresses. Authentication logs may reveal unusual locations, unexpected devices or activity outside normal working hours.

Review every Zimbra application passcode connected to an account. Pay close attention to unfamiliar entries and anything labeled "ZimbraWeb." Revoke any passcode that the account owner or IT department cannot verify. Because application passcodes can survive a regular password change, this review plays an important role in removing persistent access.

Administrators should examine mailbox access records and forwarding settings. They should also look for unfamiliar filters, deleted messages or sent emails that the account owner does not recognize. A compromised account may send convincing phishing messages to coworkers because the email comes from a trusted internal address.

Contact your IT or security team if you notice unfamiliar sent messages, unexpected password resets or login alerts you cannot explain. Do not rely only on changing your password. Laundry Bear can create an application passcode that may continue providing mailbox access after the main password changes. Your IT team should revoke unauthorized passcodes, end active sessions and check the account for suspicious activity.

Wait until your IT department has patched the server and removed unauthorized access. Then change your email password and any other password you reused. Create a unique password for every account. A password manager can generate strong credentials and store them securely. Hackers may test stolen email credentials on banking, shopping or social media accounts. Reused passwords can turn one compromised inbox into several compromised accounts.

CISA recommends phishing-resistant multifactor authentication where organizations can support it. Security keys and passkeys provide stronger protection than methods that rely on temporary codes. However, organizations still need to patch the underlying email software. Authentication controls cannot fully protect an account when malicious code runs inside a vulnerable webmail interface.

Strong antivirus software can help detect malicious downloads, fake login pages and follow-up malware connected to a broader phishing campaign. However, antivirus software may not stop this email exploit because the malicious code runs inside a vulnerable webmail session. Your organization still needs to update Zimbra and investigate the account for unauthorized access. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.

An email login page can look convincing and still belong to an attacker. Instead of following a link inside an email, open your organization's known webmail address directly. Report unfamiliar authentication requests or repeated sign-in prompts to your security team. A sudden request to log in again could signal a phishing attempt or unauthorized account activity.

For years, we have warned you to avoid suspicious links and unexpected attachments. That advice still helps, but Laundry Bear shows why your organization also needs to keep the software behind your inbox updated. In this campaign, viewing an email can trigger malicious code on an unpatched server. The attackers can then reach into the mailbox, collect months of messages and steal authentication data. The hidden application passcode adds another concern. Changing a password may provide a false sense of security when an attacker has already created a separate route back into the account. Organizations using Zimbra should patch immediately and then investigate for signs of earlier access. Employees should remain cautious around unexpected login pages, even when the page carries familiar company branding.

Would you trust your workplace inbox if opening one message could expose 90 days of email without you clicking a link? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Your blood pressure cuff may expose your health data

Thu, 06 Aug 2026 12:30:14 -0400

Every morning, you strap on the cuff, press the button and watch the number pop up on your phone. It feels private. It feels like it is just between you and your app. That sense of privacy can be misleading.

Depending on the app and your settings, that reading, along with your glucose numbers, weight and medication schedule, may be stored in the cloud or shared with service providers. FTC cases show that some health apps have also disclosed sensitive information to advertising and analytics companies. Separately, data brokers market health-related profiles that scammers could exploit.

Here's what may be happening behind the screen of your health app and how to limit the exposure.

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our free CyberGuy Live class, "Sick of Spam?" has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.

Get the free replay and checklist now at CyberGuyLive.com.

ARE INSURANCE APPS WATCHING YOU?

Here's the assumption almost everyone makes: "My health data is protected. Isn't that what HIPAA is for?" Often, no.

HIPAA generally protects health information held by covered healthcare providers, health plans and their business associates. A consumer app you choose independently often falls outside HIPAA. However, an app may come under HIPAA when it handles protected health information on behalf of a covered provider or health plan.

Apps outside HIPAA do not operate without any rules. Many may still fall under the FTC's Health Breach Notification Rule, state consumer health laws and general protections against unfair or deceptive business practices.

Sen. Bill Cassidy, R-La., introduced the Health Information Privacy Reform Act. The proposal would extend HIPAA-like privacy, security and breach-notification standards to some health information held outside the traditional HIPAA system. It would also require plain-language warnings before certain technologies begin generating wellness data that HIPAA does not protect.

As of today, the proposal remains introduced and has not become law. That means the same blood sugar reading can receive different legal protections depending on who holds it and why.

You would think a company that builds a blood pressure app would only use your numbers to track your blood pressure. Federal regulators have repeatedly found otherwise.

These were not obscure apps built by scammers. They were mainstream health services, and regulators alleged that the sharing happened through ordinary advertising and analytics tools running in the background.

That does not mean every blood pressure app behaves the same way. However, it gives you a strong reason to check what your own app collects, where it stores the information and which companies receive it.

ARE APPLE DEVICES SPYING? WHAT YOUR IPHONE TRACKS

Here's the part that should genuinely unsettle you. A Duke University researcher contacted 37 data brokers as a prospective buyer. Twenty-six responded, and 11 were willing and able to sell mental health data. Some advertised information tied to depression, anxiety and other conditions, along with demographic details. One broker advertised names and postal addresses connected to specific conditions. Prices ranged from $275 for aggregated counts to annual licensing fees of $75,000 or more.

This problem reaches beyond mental health, as data brokers can collect and sell many forms of health-related information. The FTC has documented data broker categories related to pregnancy, diabetes, high cholesterol and other potentially sensitive health interests.

In a final order issued in December 2025, California's privacy regulator fined Datamasters $45,000 for failing to register as a data broker. The order said the company bought and resold contact lists tied to sensitive conditions.

Those lists included 435,245 postal addresses associated with Alzheimer's disease, more than 2.3 million associated with blindness or visual impairment, 133,142 associated with addiction and 857,449 associated with bladder-control issues. California's enforcement chief warned that reselling lists connected to Alzheimer's disease could enable targeting that goes far beyond ordinary advertising.

If you want to look up your exposed information online, now is the time. Get a free scan to find out if your personal information is already out on the web and show how vulnerable you might be: CyberGuy.com.

Put yourself in a scammer's shoes for a second. Random cold-calling is a numbers game. Most people hang up. However, a list of people associated with diabetes or high blood pressure could help a scammer choose a much more convincing lie, including fake Medicare and healthcare offers.

A caller claims to be from Medicare or a diabetes association and offers free glucose meters or test strips. All they need is your Medicare number "to process the shipment." Federal health officials have warned about callers impersonating Medicare, Social Security or diabetes organizations while offering free glucose meters, test strips and other supplies. The supplies may never arrive, or someone may fraudulently bill Medicare using your information.

A caller could reference your blood pressure or diabetes like a nurse checking in, then pivot to a plan that supposedly covers exactly what you need. Knowing a real detail about your health does not prove the caller represents Medicare, your doctor or an insurance company.

Ads, emails or calls may push treatments or supplements connected to a condition associated with your profile. Their timing may make the offer feel personal, but that does not make the medical claim or the seller legitimate. A scammer does not need to hack your phone to personalize a pitch. Health-related information can come from commercial profiles, public records, online activity, data breaches or other sources. A medically segmented list could help a caller make a fraudulent offer sound far more believable.

You do not have to. That is what makes this so hard to see coming. Your blood pressure app, glucose monitor and smart scale can each add information to a larger profile, depending on the service, its partners and the settings you enable. Data brokers may also compile property records, voter files, online activity and information purchased from other companies. Once information enters this ecosystem, companies may buy, resell, combine and refresh it across data broker and people-search services you have never heard of.

Not every app behaves the same way. Some provide stronger privacy controls than others. Features, settings and company practices can change, so review the current privacy notices for every service you use.

Connected OMRON monitors can transfer readings to the OMRON Connect app through Bluetooth, where you can upload, store and share your heart health history. Data handling may depend on your device, permissions and connected services, so review OMRON's current privacy notices before syncing.

Certain Dexcom products fall under HIPAA when Dexcom or a healthcare provider supplies them as insurance-reimbursable products in the United States. Other Dexcom websites, support programs and services may process information outside that HIPAA-covered context. Dexcom also provides opt-outs for certain data sales, sharing and targeted advertising under applicable state laws.

Withings says it does not share health information with advertising partners. It may share some non-health personal information to deliver tailored advertising, and information can sync with outside apps or partners when you authorize a connection.

Google committed not to use health and wellness information collected from Fitbit devices for Google Ads and to keep that information in a separate data silo. That commitment came through regulatory conditions attached to Google's Fitbit acquisition, so continue reviewing current Fitbit and Google privacy controls.

If you choose pharmacy or coupon features, Medisafe says your personal information may be disclosed to partner pharmacies or coupon companies. Those companies will then handle the information under their own privacy practices.

Your device encrypts Health information, and iCloud uses end-to-end encryption when you enable the required account protections. In addition, Apple prohibits apps from using HealthKit data for advertising. You decide which outside apps can read or write individual categories of Health information.

The takeaway is that you have more control than you might think, but you need to go into the settings and use it.

Here's a simple step-by-step guide to increasing your privacy when using health apps.

iPhone: Go to Settings > Privacy & Security > Tracking, then turn off Allow Apps to Request to Track. Next, go to Settings > Privacy & Security > Apple Advertising and turn off Personalized Ads.

Android: Go to Settings > Google > All services > Ads > Ads privacy. From there, you can turn off ad topics, app-suggested ads and ad measurement. Some devices also provide an option to delete the advertising ID. Menu names can vary by phone.

These settings limit certain forms of advertising and cross-app tracking. They do not stop every app from collecting information you enter directly or using other identifiers allowed under its privacy policy.

Open the account or privacy settings in each health app you use. Switch off anything labeled marketing, ad personalization or third-party sharing. Disconnect any linked apps you do not actively use.

Check for links labeled "Do Not Sell or Share My Personal Information," "Your Privacy Choices" or something similar. Covered businesses must provide these controls under laws such as California's CCPA when they sell or share personal information as the law defines those terms. Your available rights may depend on where you live. An opt-out can restrict certain data practices, but it does not guarantee that all of your information will remain with the company.

Medicare does not make unsolicited calls offering free medical supplies in exchange for your Medicare or financial information. If a caller references a specific health condition, the detail may have come from a commercial profile, public record, data breach or another source. Do not assume the caller is legitimate simply because they know something about you. Never confirm personal or Medicare information during an unexpected call.

Turning off tracking in your apps can help reduce future collection, but it does not remove information that companies have already gathered, shared or sold. That data may already appear across dozens or even hundreds of broker and people-search sites.

You can submit removal requests yourself, but the process takes time. Each site has its own opt-out steps, and you may need to repeat them because your information can reappear months later.

A reputable data removal service can handle much of that work for you. These services send opt-out requests to data brokers, monitor for reappearing information and submit new removal requests when needed.

No service can erase every trace of your information online, but ongoing removal can reduce how much personal data is available to advertisers, scammers and identity thieves.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Your health app may not receive the same HIPAA protections as your doctor's office. FTC cases show that some major health platforms disclosed sensitive information to advertising and analytics companies, while data brokers market profiles connected to health conditions. Scammers could use details like these to make Medicare, pharmacy and supplement pitches sound more believable. Turn off tracking and sharing where possible, and use available deletion or opt-out requests for information companies have already collected.

Would you stop using a health app if it shared your medical data, or would stronger privacy controls be enough to keep you? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

One-wheeled AI security robot could patrol your property

Thu, 06 Aug 2026 08:27:35 -0400

What if the next security guard rolling past your office had one wheel and never needed a coffee break? That is the pitch behind 1Rollo, a one-wheeled AI security robot from Estonian startup Rollo Robotics. The company believes its narrow design could patrol large properties at a lower operating cost than traditional security vehicles.

The machine follows mapped routes while watching the area around it. When its artificial intelligence detects unusual activity, 1Rollo can alert a human operator. That person can review the situation and decide whether to send a security guard.

For now, 1Rollo remains a functional prototype. Rollo Robotics says it plans to make the robot commercially available in 2027. Therefore, its design and specifications could change before customers begin using it.

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our free CyberGuy Live class "Sick of Spam?" has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.

Get the free replay and checklist now at CyberGuyLive.com.

HUMANOID ROBOT SKIN SENSES PEOPLE BEFORE CONTACT

1Rollo uses a 360-degree computer vision system to monitor its surroundings. It also relies on Real-Time Kinematic Global Navigation Satellite System positioning (RTK GNSS). RTK uses correction data to provide more precise positioning than standard satellite navigation. That precision could help the robot stay close to its assigned route around a business or industrial property. As the robot moves, its cameras and sensors look for obstacles. The system can then adjust its path to avoid a collision. Meanwhile, the AI analyzes the area for anomalies. If the system spots something unusual, it can send an alert over Wi-Fi or a 4G or 5G connection.

Keeping a 100-pound robot upright on one wheel takes more than a clever-looking design. Rollo Robotics uses a vertically positioned spinning flywheel inside the machine. The flywheel sits in line with the main wheel and helps the robot maintain its balance. To turn, the system tilts the internal flywheel toward either side. Rollo Robotics describes the hardware and software behind this method as patent-pending. The single-wheel design gives the robot a narrow footprint. As a result, it may travel through spaces where a wider patrol vehicle would struggle. However, Rollo Robotics has not published detailed performance results for stairs, steep slopes or deeply uneven ground. Those real-world tests will show where the monowheel design works best.

The company's current specifications list 1Rollo at about 43 inches tall. Its wheel measures 24 inches across, while the complete robot weighs approximately 100 pounds. Rollo Robotics lists a top speed of 19 mph. That is much faster than the walking pace of many existing security robots. Battery life reaches up to eight hours per charge, according to the company. The product information also lists autonomous wireless charging.

FOREIGN ROBOT BAN TARGETS CHINA OVER SECURITY FEARS

The standard robot includes a 360-degree vision system. However, Rollo Robotics designed the platform to support additional equipment. Customers could add thermal cameras for low-light environments. The platform can also support pan-tilt-zoom cameras for viewing activity farther away. Other compatible equipment includes night vision, RFID systems and custom payloads. These options could help companies adapt the robot for a specific property.

A cloud-based management platform would allow operators to monitor multiple robots from one location. Security teams could define patrol routes and review performance through the platform. An operator could also watch a live feed after receiving an alert. The robot includes a microphone and speaker. Therefore, the operator could speak with someone near the machine without immediately sending a guard. We have seen a similar approach with the Ascento Guard autonomous security robot. That machine also patrols property while human operators handle serious incidents.

However, robots still need to prove they provide meaningful results. Dublin, Ohio, recently retired an AI robot cop that recorded no arrests during its parking garage pilot. That case does not predict how 1Rollo will perform. Still, it shows why customers should establish clear goals before deploying autonomous security technology.

Rollo Robotics plans to offer 1Rollo through a Robotics-as-a-Service model. Customers would subscribe to the service instead of buying the robot outright. According to CEO and co-founder Sander Sebastian Agur, the subscription would include access to current hardware, software updates and support. The model could remove a large upfront equipment expense. It may also make repairs and future upgrades easier for customers. Rollo Robotics says its goal is to reduce operating costs compared with relying on human guards or patrol vehicles. However, the company has not announced subscription pricing.

A connected robot may improve physical security while creating new digital concerns. 1Rollo uses wireless connections and a cloud platform. Therefore, customers should ask how the company encrypts camera feeds and protects operator accounts. They should also ask where recordings are stored. Clear deletion policies will become important for employees and visitors who appear on camera. Meanwhile, the robot needs a safe way to handle a lost internet connection. It should keep avoiding people and obstacles even when a remote operator cannot reach it. Buyers should also learn how Rollo Robotics delivers security updates. A compromised patrol robot could expose video or provide unauthorized access to its controls. Lawmakers have already raised similar concerns about autonomous machines. A proposed federal bill would restrict government use of some foreign robots over national security fears. Rollo Robotics operates in Estonia, but every connected robot deserves the same cybersecurity review.

You probably will not find a one-wheeled robot guarding people's driveway anytime soon. However, businesses could begin seeing machines like 1Rollo around warehouses or office campuses. Large private properties may also use them to cover areas that guards cannot watch continuously. The robot could handle repetitive patrols while people make decisions during an incident. That may also keep guards away from hazardous areas until they understand what is happening. Still, a moving camera can feel more intrusive than one mounted on a wall. Employees and visitors deserve to know when the robot records them. They should also know who can watch the footage and how long the company keeps it. Those answers should arrive before the robot begins its first patrol.

1Rollo looks unusual, but the idea behind it makes sense. A narrow autonomous machine could cover large properties without the bulk of a security vehicle. The human operator also remains part of the process. The robot detects activity and sends an alert, while a person decides what should happen next. However, the polished demonstration is only the beginning. Rollo Robotics still needs to show that 1Rollo can handle changing weather, crowded spaces and long shifts without constant assistance. Pricing will play a major role too. Businesses need to know whether the subscription saves money and delivers better security than existing systems.

Would a one-wheeled AI guard make you feel safer, or would you wonder who was watching every time it rolled past? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

DoorDash gets FAA approval for its own delivery drones

Wed, 05 Aug 2026 16:00:03 -0400

Your next DoorDash order could arrive with a flight path instead of a driver. DoorDash has earned FAA Part 135 air carrier certification and launched DoorDash Air, its in-house drone delivery program. The company now has federal authorization to operate a commercial drone delivery service in the United States.

Yes, the app you use for burgers, groceries and late-night snacks is entering the airline business. However, this does not mean a DoorDash drone will hover over your driveway tomorrow. The company still needs added operational approvals. It also has not announced its first markets or a firm launch schedule for its custom aircraft.

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our free CyberGuy Live class, "Sick of Spam?", has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.

Get the free replay and checklist now at CyberGuyLive.com.

AIR TAXIS CUT HOUR-LONG COMMUTES TO MINUTES, RIDERS MAY BE SHOCKED BY THE PRICE

DoorDash announced the FAA certification on July 29, 2026. The company says it is the eighth drone operator to earn this type of federal air carrier certificate. The FAA uses Part 135 certification for companies that carry other people's property for payment. For drones, it provides the regulatory path for commercial package deliveries beyond a pilot's direct line of sight.

Getting certified requires a five-phase FAA review. The agency evaluates the operator's aircraft, maintenance procedures and safety program. Even after earning the certificate, an operator still needs airspace authorization. It may also need exemptions or waivers for flights beyond visual line of sight. State rules and local land-use requirements can also affect where a delivery hub operates. So, DoorDash has cleared a major federal hurdle. Still, each real-world delivery network will require more planning and approval.

Anyone who has watched a hot meal slowly travel across town can understand the appeal. DoorDash says more than 20% of its orders in 2025 traveled between three and five miles. Those orders took nearly 25% longer than shorter trips, according to the company.

DoorDash blames part of that delay on the challenge of matching a Dasher with a mid-range order. A driver may prefer several shorter deliveries near a busy restaurant area instead of one longer trip. A drone could take the longer order while a Dasher remains close to restaurants. As a result, the customer could get a faster delivery while the driver moves on to another nearby order.

DoorDash estimates that drone deliveries completed during 2025 took an average of about 25 minutes. The company also says some locations in its partner drone pilots saw order volume rise by roughly 30%. That increase continued during the nine weeks after the pilot began. Those are DoorDash's figures, so performance could change by location, weather and the type of order. Still, they help explain why the company wants more control over the aircraft carrying its deliveries.

CHINESE DRONE MONOPOLY PUT ON NOTICE AMID CONCERNS OVER CCP SPYING: 'STRATEGIC MISTAKE'

That is the same robotics and autonomy group behind DoorDash's Dot delivery robot.

DoorDash says its drone will be designed and built in the United States. The majority of its components will also come from the U.S., according to the company. DoorDash has not revealed the aircraft's range, payload capacity or final design. A DoorDash spokesperson told CyberGuy that the company plans to share more details about those specifics this fall.

DoorDash says Dashers will continue handling the vast majority of its daily deliveries. That makes sense. A drone cannot walk into an apartment building or carry a large catering order upstairs. It also may struggle with bad weather or a location without a suitable drop zone.

Instead, DoorDash wants its Autonomous Delivery Platform to select the best method for each order. The platform can assign a Dasher. It can also choose an autonomous option such as Dot or a drone.

For example, a small order traveling four miles to a suburban house may fit a drone. A large grocery order going to a high-rise apartment will likely need a person. This approach follows a broader shift across the delivery industry. Uber Eats has also moved toward drone deliveries, while other companies continue testing robots and airborne delivery systems.

FAA certification gives DoorDash the legal foundation to operate an air carrier. It does not provide blanket permission to begin unlimited drone flights in every city. DoorDash has not announced its first DoorDash Air markets. The company also has not provided a detailed timeline for deliveries using its in-house aircraft.

In addition, longer autonomous routes may require FAA approval for beyond visual line of sight operations. Local zoning, environmental reviews and community concerns can also shape where hubs are built. Noise could become a major issue. The FAA notes that drone noise may bother a community even when it falls below the level of a significant environmental impact.

Therefore, early service will likely remain limited to carefully selected areas. Suburban neighborhoods with predictable routes and open drop-off spaces may prove easier than dense urban blocks.

JETBLUE FLIGHT REPORTS DRONE STRIKE DURING APPROACH TO NEW YORK AIRPORT: FAA

DoorDash drone delivery could shorten the wait for small, urgent orders. Cold medicine could arrive without waiting for a driver to cross town. A nurse finishing a long shift might get a hot meal faster. A forgotten phone charger could reach you before your battery runs out. However, availability will depend heavily on where you live. Your address may need to fall within an eligible drone delivery zone. The order must also meet the aircraft's weight and size limits. DoorDash told CyberGuy that it is testing the aircraft to operate across a wider range of weather conditions and climates. The company said it will pause operations during extreme weather until conditions return to an operable level.

You should also look closely at the final cost. DoorDash has not said whether its new in-house DoorDash Air service will carry a separate fee or change how tipping works. The company also has not explained whether customers will choose between a DoorDash Air drone and a Dasher once the new service launches. DoorDash's current partner-operated program does allow eligible customers to select drone delivery at checkout.

For now, think of DoorDash Air as an important step toward wider service rather than a nationwide launch. The federal certificate gives DoorDash the regulatory foundation to operate its own commercial drone delivery service. However, individual operations may still require airspace authorization and other FAA approvals. The next test will be whether DoorDash can make drone delivery reliable enough for an ordinary Tuesday night dinner. For more background on how companies are already testing airborne orders, check out how drones are changing food delivery.

DoorDash has spent years learning how to move orders through streets. Now it wants to control what happens in the sky. FAA certification gives DoorDash Air a serious start. The company has the app, the restaurant relationships and billions of past orders to study. It also knows where deliveries slow down. Still, building a drone is only one piece of the job. DoorDash must prove that its aircraft can operate safely and consistently. It must also keep food intact while avoiding noise problems and neighborhood resistance. Human Dashers are not disappearing. Instead, DoorDash wants drones and robots to handle specific trips that could be faster without a car.

Would you trust a DoorDash drone to lower dinner into your yard, or would the sound of delivery aircraft flying over your neighborhood ruin the convenience? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Fake party invitation scam can hijack your computer

Wed, 05 Aug 2026 10:33:21 -0400

You sit down at your computer to clear out your inbox. Then you spot a party invitation from someone you recognize. Maybe it appears to come from a friend. Perhaps the sender belongs to a group you know. Either way, the familiar name makes the message feel safe enough to open.

Inside, everything looks cheerful. There is an envelope graphic, a friendly note and what appears to be an invitation for a wedding or retirement party. However, you cannot see the event details yet. The message tells you to save the invitation or install something to join the guest list.

That request should stop you cold. A legitimate party invitation should not require you to install software before you can see when or where the event takes place. That small download could give a criminal remote access to your computer. Here’s how this fake invitation scam works and what you can do before one click puts your computer and contacts at risk.

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Get the free replay and checklist now at CyberGuyLive.com.

FAKE SHINYHUNTERS SEXTORTION EMAIL USES CARNIVAL BREACH DATA

The scam begins with trust. An invitation appears to come from someone whose name you recognize, so you become less suspicious. Criminals may copy the look of a legitimate invitation platform. They can add a colorful envelope, an exclusive-sounding message and a button that promises to reveal the details.

The email has one main purpose: getting you to click. Once you press the invitation, the message sends you to a separate website. That page says a friend sent you something and asks you to download a file to view it.

The request may seem simple. Still, party invitations normally open inside a website or app. They do not need to install a program on your computer.

The landing page may contain a large "Download invitation" button. It may also display a familiar company name inside the web address. However, seeing a trusted brand somewhere in a link proves very little. Criminals can place that name inside a much longer address or add extra letters that make the domain look authentic at a glance.

You need to identify the real domain instead of focusing on the first familiar word you see. The page may also create confusion. It could claim that your invitation is already downloading while another message asks you to click if the download fails. Some versions even include a testimonial from a supposed guest who says opening the invitation was easy.

A review on a private party invitation page should feel strange. Those details are designed to quiet your doubts and push you toward the download button. For more visual breakdowns of scams like this, check out The CyberGuy Report podcast at CyberGuy.com.

In the example we describe, the website directs you to open the file on a Windows computer. That device-specific request is another major warning sign. Why would a party invitation care which device you use? The malicious file may contain a remote access tool. Businesses use legitimate versions of this software to troubleshoot computers from another location.

Criminals can abuse similar tools to control your system without permission. Once you install the file, an attacker may be able to search your computer or access saved information. The exact damage depends on the program and the permissions it receives. Your email account can become an especially valuable target. It contains personal conversations along with a contact list filled with people who trust you.

The criminals can then send the same fake invitation to your friends and relatives. Those people may open it because the message appears to come from your real account. As a result, one compromised computer can start a chain reaction.

People receive a steady stream of spam, fake alerts and impersonation attempts. Criminals can also use AI tools to create cleaner writing and more realistic designs. That makes the familiar sender name even more powerful.

You may be cautious around a message from a stranger. Yet you might act quickly when the invitation appears to come from someone you know. The scam succeeds when familiarity replaces verification. Email providers and technology companies continue to improve their filters. Even so, dangerous messages still reach real inboxes. That leaves you making the final decision about whether a link deserves your trust.

HOTEL WI-FI PHISHING ATTACK TARGETS MICROSOFT LOGINS

A few precautions can help you recognize a malicious invitation before it compromises your computer or accounts.

Use strong antivirus software and keep it actively running in the background on your devices. Real-time protection can warn you about a dangerous link or block a malicious download before it reaches your computer.

If you clicked the invitation or downloaded a suspicious file, delete the file without opening it and run a full security scan. A scan can help identify unwanted software that may have reached your computer. Keep your operating system, browser and security software updated as well. Updates often close weaknesses that criminals try to exploit. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com

Stop immediately if an invitation tells you to download or install a program before you can see the event. Real invitation services normally show the details in your browser or inside their official app. You should not need a separate installer. Delete the message instead of trying to see what happens next.

On a computer, place your cursor over a link without pressing it. Your browser or email program should reveal the destination address. Read the entire address carefully. Watch for misspellings, unexpected words or extra letters added around a legitimate company name. A familiar logo does not confirm that the link belongs to the real company.

Avoid using the link inside the email when you have doubts. Instead, type the invitation service's web address into your browser or open its official app. Sign in and look for the invitation there. If it does not appear in your account, the email may be fake.

Reach out through a separate text message or phone call if an invitation feels unusual. Do not reply directly to the suspicious email. A criminal may control the sender's account or may have forged the address. Ask whether the person actually sent the invitation and whether it requires a download.

FAKE PASSWORD-MANAGER ALERTS COULD PUT YOUR VAULT AT RISK

Your risk is generally lower if you visited the page but did not run anything. Close the browser tab without pressing the download button. If the file has already downloaded, leave it closed and delete it. Opening the file gives the malicious program a chance to run. Never open it simply to find out what it contains.

Use your email provider's Report phishing option before deleting the invitation. Reporting the message can help the provider block similar emails and warn other recipients. You can also block the sender if you do not recognize the address.

A data removal service can help remove your details from many public data broker databases. This may make it harder for scammers to find personal information they can use to make a message feel convincing. However, no service can remove every record. It also cannot prevent a criminal from reaching you through a compromised friend's contact list. Still, reducing your public exposure can give scammers less material to work with. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.

Turn on two-factor authentication (2FA) for your email account. This adds another barrier if criminals steal or guess your password. Never approve an unexpected login request. Also, do not share a security code with anyone who contacts you.

If you typed your email address, password or security code into the fake page, use a clean device to change that password immediately. Change it anywhere else you reused it. Then review the account for unfamiliar activity, new recovery information or settings you did not change. Use a password manager to create and store a strong, unique password for every account so one stolen login cannot unlock several services.

Disconnect the computer from the internet if you ran the installer or noticed unexpected remote activity. Next, run a full security scan. You may also need help from a trusted computer professional to confirm that the remote access software is gone. Use a different, clean device to change important passwords. Start with your email account because criminals may use it to reset passwords for other services. Also, review your email account for unfamiliar forwarding rules or active login sessions. Warn your contacts if suspicious messages may have gone out under your name.

A party invitation should give you information, not demand access to your computer. Delete the message if it asks you to install anything before revealing the event. Check the full destination of every link. Then contact the supposed sender separately when something feels unusual. If you downloaded a file but did not open it, delete it and run a security scan. If you ran the file, disconnect the computer and secure your accounts from a clean device. Most importantly, pay attention to that moment when something feels off. A few seconds of doubt can stop a criminal from getting inside your computer. Want to see more? Check out The CyberGuy Report podcast.

Should email providers face tougher requirements to stop malicious invitations before they ever reach your inbox? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

The scam text test: Spot danger before you tap

Tue, 04 Aug 2026 13:00:58 -0400

Your phone buzzes. The text reads, "Your package is delayed. Confirm your address here." A little later, it's a text message about an unpaid toll, suspicious bank activity or an account that will be locked unless you act now.

That's how scam texts work. They don't always look wild or obviously fake. They look routine, urgent and easy to deal with in a hurry. The good news: You don't need to memorize every scam. You just need a quick way to test suspicious messages before you tap. Here's the simple scam text test to run before you click, pay or share anything.

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Get the free replay and checklist now at CyberGuyLive.com.

FAKE SHINYHUNTERS SEXTORTION EMAIL USES CARNIVAL BREACH DATA

If a text asks you to click, pay, verify, sign in or fix a problem, run through these checks first.

Are you actually waiting for that package? Do you use that bank? Did you recently drive on a toll road? If the answer is no, treat the message as suspicious. Even if the answer is yes, don't assume it's real. Scammers rely on coincidence. They send thousands of similar messages knowing that some recipients will be waiting for a package or use the company being impersonated.

Urgency is one of the biggest red flags. Watch for phrases like:

A real company may send an urgent alert, but scammers use pressure to stop you from checking whether the message is legitimate. Take a breath before responding. A few extra minutes spent verifying the message can prevent days or weeks of dealing with a stolen account.

Before tapping, check for:

Even if the address looks legitimate, avoid opening links in unexpected texts. Scammers can disguise links or create convincing copies of real websites. Verify the message through the company's official app or a website you type in yourself.

Many scam texts use vague greetings, odd wording, awkward punctuation or slightly incorrect brand names. You might see a message addressed to "Dear customer" instead of your name. It may refer to a package without showing an order number or claim to come from a bank without identifying the account involved. Good grammar doesn't guarantee a message is safe. Scammers now use artificial intelligence to write more convincing messages. Still, sloppy wording and missing details remain warning signs.

Be skeptical of any text asking for:

Legitimate companies may send you a one-time verification code. However, a bank, government agency or customer service representative should never ask you to give that code to someone else. Anyone who asks for your code may be trying to take control of your account.

This is the most important step. Instead of using the link or phone number in the message:

If the issue is real, you should still be able to find it through one of those trusted channels.

FAKE PASSWORD-MANAGER ALERTS COULD PUT YOUR VAULT AT RISK

Scam texts often fall into a few familiar categories.

These messages claim a package was delayed, an address needs to be corrected or a small shipping fee must be paid. The link may lead to a fake postal or delivery website that collects your card information, password or home address.

These texts claim someone used your card, your account has been locked or you must verify a transaction immediately. The message may include a phone number connecting you to a scammer pretending to work for the bank.

Toll scams claim you owe a small amount and will face a larger penalty if you don't pay immediately. The amount is often low enough to make paying seem easier than investigating. The payment page then steals your financial information.

These messages claim your email, payment app, streaming service or social media account will be suspended. They direct you to a fake login page designed to capture your username and password. These scams work because each message sounds plausible. The goal is to make you react first and think later.

Don't panic, but act quickly.

Simply opening a phishing page doesn't always mean your information was stolen. The risk increases if you entered information, downloaded a file or approved a permission request.

Use a different password for every important account. A password manager can create and store strong passwords so one stolen login doesn't give scammers access to everything else.

Change the affected account's password immediately and check whether a new device, email address or phone number was added. Contact the company through its official app, website or phone number. Tell the representative that someone may have gained access to your account.

Report any charges you don't recognize as soon as possible.

HOTEL WI-FI PHISHING ATTACK TARGETS MICROSOFT LOGINS

Visit IdentityTheft.gov to create a recovery plan. You may also want to place a fraud alert or security freeze on your credit files. A credit freeze can prevent criminals from opening many types of new accounts in your name.

Avoid entering sensitive information on the device until you are confident it is secure.

After securing your accounts:

Reporting scam texts helps phone carriers and government agencies identify active campaigns.

Good habits are your first line of defense, but strong antivirus software can add another layer of protection. Some security tools can warn you about suspicious links, phishing websites and malicious downloads before they put your information at risk.

Many text scams are only the first step. The message sends you to a fake website. That site may steal your password, payment details or other personal information. In some cases, it may also try to install malware on your device.

Look for security software that offers:

Security software cannot catch every scam or replace careful judgment. Still, it can help stop a suspicious link or malicious download before one quick tap leads to fraud or an account takeover. Features vary by provider and device, so check what is included before choosing a service.

Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

You never have to solve a surprise text from inside the text. Stop, verify independently and only act through official channels. That one habit can help you avoid a huge number of text scams.

Scam texts work because they make an everyday problem feel urgent. A package delay, unpaid toll or bank warning can seem believable enough to make you tap without thinking. Don't use the link or phone number in the message. Open the company's official app, type its website yourself or call a number you already trust. Strong antivirus software can help flag some suspicious texts and fake websites, but no security tool catches everything. Taking a few seconds to verify the message can save you from a stolen account or a costly mistake.

What is the most convincing scam text you have received, and what tipped you off before you tapped? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Water cyberattack hits at least 7 states

Tue, 04 Aug 2026 08:11:02 -0400

You probably never think about the computer systems behind your kitchen faucet. You turn the handle and expect clean water. That familiar routine suddenly felt far less certain in Minnesota and six other states.

A coordinated cyberattack targeted operational technology at more than 30 community water systems on Sunday, July 26, and Monday, July 27. Minnesota IT Services, known as MNIT, activated the state's cybersecurity response and brought in federal agencies to help investigate.

One water plant temporarily went offline. Meanwhile, other communities reported problems involving automated controls or communications equipment. Workers switched to manual operations or used backup procedures to keep essential services running. Fortunately, state officials reported no active requests for residents to reduce or change their drinking water use.

The FBI has since said that water or wastewater utility companies in seven states have been affected.

"Some of that activity degraded water operations," the bureau said.

This water cyberattack raises an uncomfortable question for towns across America. How many local utilities could keep operating if hackers gained access to the computers controlling their equipment?

INVESTIGATORS BELIEVE IRANIAN HACKERS ARE LIKELY BEHIND CYBERATTACK ON MINNESOTA WATER SYSTEMS: REPORT

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our free CyberGuy Live class, "Sick of Spam?," has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.

Get the free replay and checklist now at CyberGuyLive.com.

The attack targeted operational technology, commonly called OT. These systems control physical equipment such as pumps, valves and treatment machinery. In Braham, city officials initially reported that the water plant had gone offline for an unknown reason. Crews restored the facility within hours and said it was again filtering and treating water as expected.

Officials later blamed the outage on a malicious cyberattack against computerized operating systems. The city relied on water already stored in its tower while crews worked on the problem. Plymouth reported communications problems involving two water towers and several wastewater lift stations. However, officials said water levels and water quality remained unaffected.

South St. Paul also identified a cybersecurity incident involving automated water utility controls. Public Works employees used established contingency procedures to maintain normal water and wastewater operations. Maple Plain publicly confirmed that its water utility technology had also been targeted.

In total, four communities have publicly described specific effects, although MNIT says attackers targeted more than 30 systems statewide. That difference is important. Being targeted does not mean every system suffered a shutdown. However, it shows that someone tried to reach a large number of local utilities within a short period.

Officials have not announced a definitive attribution. However, a July 30 report from The New York Times says investigators preliminarily believe Iranian hackers were probably responsible. The report cited U.S. and state officials familiar with the investigation, but President Donald Trump said he rejected the suggestion that Iran was behind the breaches.

Those officials cautioned that the assessment could change as investigators collect more technical evidence. They also have not ruled out the possibility that attackers tried to make the activity appear Iranian. Therefore, Iran should be described as the leading preliminary suspicion rather than the confirmed attacker.

The timing has drawn attention because CISA warned in April that Iranian-affiliated hackers were targeting internet-exposed programmable logic controllers. These devices help control machinery and other equipment at water systems and additional critical infrastructure facilities. CISA initially highlighted certain Rockwell Automation and Allen-Bradley controllers. On July 22, the agency expanded its warning to include equipment from Schneider Electric, Siemens and potentially other manufacturers.

Still, federal officials have not publicly tied that campaign to the Minnesota incidents. CyberGuy has previously examined Iran's expanding cyber threat to U.S. critical infrastructure. Water systems remain attractive targets because even a limited disruption can create fear far beyond the equipment involved.

IRAN-LINKED HACKERS TARGET US MEDICAL TECH COMPANY

Minnesota's experience could happen in any state. The United States has close to 170,000 drinking water and wastewater systems. Many now connect physical equipment to internet-enabled technology so workers can monitor facilities from a distance. That remote access helps utilities manage equipment spread across wide service areas. However, it may also give an attacker a route into vital controls when operators fail to secure the connection.

Smaller communities often face the greatest challenge. The Government Accountability Office says water systems have widely different cybersecurity capabilities. Many also use older technology that can be difficult to update. At the same time, utilities must stretch limited budgets across essential repairs and regulatory requirements. Cybersecurity upgrades may compete with work that residents can see, such as replacing aging equipment.

A large utility may employ dedicated security professionals. A small town may rely on plant operators who already handle daily operations and after-hours problems. As a result, the communities with fewer resources may also have less ability to monitor suspicious activity around the clock.

Foreign governments have already shown interest in those weak spots. CyberGuy previously reported how Chinese hackers gained access to critical American systems, including infrastructure connected to water and energy. The attacker may change. The underlying weakness often looks familiar: exposed equipment, outdated technology or remote access that lacks strong protection.

A cyberattack against a water utility does not automatically mean the water has been contaminated. In Minnesota, officials reported no known impact on drinking water quality. They also told residents in publicly identified communities that normal water use could continue.

However, a successful attack can cause more serious consequences. The EPA warns that hackers could disrupt treatment or damage equipment. In a worst-case situation, attackers might also interfere with processes that protect water quality.

Manual operations can provide an important safety net. Minnesota workers used those procedures to keep systems running while investigators examined affected technology. Still, a manual backup only helps when employees know how to use it. Utilities need to test those procedures before screens go dark and alarms stop reporting correctly.

CISA published new international guidance on July 28 called "CI Fortify: Advice for Isolating Vital Systems." The guidance urges critical infrastructure operators to separate vital operational technology from less trusted networks. That isolation can help an essential service continue operating when another part of the organization becomes compromised.

CISA released the guidance on the same day MNIT publicly announced the statewide attack. However, the agency has not said it created the document in response to Minnesota. For water utilities, stronger protection may begin with removing unnecessary internet exposure. When remote access remains necessary, CISA advises placing security controls in front of programmable controllers.

Utilities should also change factory passwords and give employees separate login credentials. EPA inspectors have found water systems that continued using default passwords. Inspectors also discovered shared staff accounts or access that remained active after employees left.

Another EPA finding needs careful context. The agency says more than 70% of inspected systems violated basic federal risk assessment or emergency response planning requirements. That figure does not mean 70% had confirmed cybersecurity breaches. However, inspectors found serious digital security weaknesses at some of those facilities.

TRUMP REJECTS IRAN BLAME FOR MINNESOTA CYBERATTACK, POINTS FINGER AT 'CORRUPT' POLITICAL FOE

Residents cannot secure a municipal treatment plant themselves. However, a few steps can help you receive reliable information and avoid scams during an incident.

Check your city, county health department or water utility website for updates. Officials will tell you whether you need to reduce water use or boil tap water. Avoid making decisions based on an unverified neighborhood post.

A cyberattack may affect communications or automated equipment without changing water quality. Continue normal use unless local officials provide different instructions. However, follow any boil-water notice immediately if one appears.

Your city may use text messages, automated calls or government phone alerts during a service disruption. Take a moment to check the emergency alert settings on your iPhone or Android. Also, sign up for your city's local notification system if one is available.

A backup supply can help during any water interruption, whether it begins with a cyberattack or equipment failure. The CDC recommends storing at least one gallon of water per person each day for three days. Households may need more for pets or people with medical needs.

Scammers often take advantage of outages and breaking news. You may receive a message claiming that your water bill failed or that your service will be disconnected. Another message may offer bottled water assistance through a payment link. Do not use the phone number or link inside an unexpected message. Instead, contact the utility through its official website or the number printed on your bill. CyberGuy has also explained how scammers impersonate water and other utility companies by spoofing familiar phone numbers.

Minnesota contained a troubling attack without a known drinking water emergency. Workers restored Braham's plant while other utilities relied on manual controls or contingency procedures. However, the number of systems targeted should get the attention of every governor and mayor in America. Hackers apparently found a way to reach dozens of local utilities during the same two-day period. The preliminary suspicion involving Iranian hackers also raises the stakes. Still, investigators need more evidence before anyone treats that attribution as settled. Every community should know which water controls face the internet and whether workers can operate essential equipment manually. States should also help smaller towns that cannot afford their own cybersecurity teams.

How confident are you that your community could handle a cyberattack on its water system, and what would you want local officials to tell you first? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

New York school pauses humanoid classroom robot pilot program

Mon, 03 Aug 2026 13:00:35 -0400

A lifelike humanoid robot was expected to take a seat inside a New York high school classroom. Those plans are now on hold. The planned robot is reportedly stationary, with silicone skin and long brown hair.

Realbotix and Salamanca City Central School District had announced a limited pilot program for fall 2026 involving Optio, an artificial intelligence-powered educational assistant, and one new Realbotix M-Series humanoid unit.

On July 24, the district announced that the pilot program had been paused while it works through enhanced student data privacy agreements with the New York State Education Department.

The district is also continuing discussions with community members and other stakeholders before moving forward. It has not announced a new date for the pilot program. The technology was intended to support AI and robotics lessons while teachers remained in control. Still, putting a humanlike machine in front of students raises questions about privacy and how quickly students may trust it.

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Get the free replay and checklist now at CyberGuyLive.com.

FOREIGN ROBOT BAN TARGETS CHINA OVER SECURITY FEARS

Salamanca City Central School District is located in western New York on Seneca Nation territory. The district had planned to introduce Optio to high school students enrolled in Woz ED AI and Robotics courses.

Realbotix previously described this as a limited fall 2026 pilot involving its digital assistant and one physical robot. The district has since placed the project on hold while it addresses student privacy agreements and gathers additional community input. Realbotix told CyberGuy, "The partnership also gives educators an opportunity to evaluate these technologies in a controlled classroom environment under district oversight."

The district reportedly paid $57,590 for the robot and AI program, according to the school board contract. Realbotix reportedly discounted the package from the M-Series robot's listed starting price of $95,000. The initial Optio rollout had been expected to expand to approximately 500 high school students during the fall semester. That planned expansion would have applied to the AI platform and student avatars rather than 500 physical robots.

The proposed project includes two connected parts. Optio is the digital AI educational assistant that students can access through personalized avatars. The M-Series robot would give that technology a physical presence in the classroom. Realbotix told CyberGuy, "Its technology combines conversational AI with a physical humanoid platform capable of natural interaction and lifelike expressions."

The company says its humanoid platform can use natural conversation and facial expressions during real-time interactions. The robot is designed to give students hands-on exposure to AI and robotics rather than limiting the lesson to a laptop screen.

The robot was expected to remain seated while using upper-body movements and facial expressions. The school reportedly requested a Western New York accent. However, Realbotix told CyberGuy, "The physical unit has not yet been deployed. Additional details regarding its implementation will be determined in coordination with the district."

That means some details reported about the robot may reflect the planned design rather than the finished classroom robot. The district had said the system would use school-approved curriculum instead of searching the open internet. When the technology lacked an answer, it was trained to say, "I don't know," rather than inventing information.

EDUCATORS WARN AI DEBATE HAS FOCUSED TOO MUCH ON CHEATING, NOT ENOUGH ON STUDENT LEARNING

Realbotix designed Optio as an AI educational assistant and an at-home tutor. Students will interact with avatars trained on district curriculum. The platform is designed to reinforce concepts and provide individual tutoring outside regular school hours. Realbotix says it can also offer homework support across multiple languages.

Students reportedly may be able to upload photos of homework for feedback. They could also request lessons based on their interests or receive real-time translations. Teachers may use Optio for lesson planning and curriculum adjustments. The physical robot could also provide prompts based on material already loaded into the system.

Realbotix told CyberGuy, "The program is intended to complement, not replace, teachers by giving students supervised access to emerging AI and robotics tools as part of the district's existing STEM curriculum." The company added, "Realbotix's products are designed to support human engagement and expand access to information and services while complementing the work of educators and other professionals."

The district has paused the pilot program while it works through enhanced student data privacy agreements with the New York State Education Department. It says appropriate privacy protections and community input are important parts of the process. The district has not said when those agreements could be completed or when the pilot might resume.

If the program moves forward, it would operate under district oversight with education-specific safeguards. Realbotix says those guardrails are designed to block inappropriate responses and reduce unreliable outputs. The robot and avatar would reportedly operate through a closed system without an open internet connection. The district also said Realbotix will lack access to personally identifiable student information.

The classroom robot would reportedly lack facial recognition and recording features found in some other Realbotix models. However, personalized learning requires the system to remember some information. Students will use unique identification codes when interacting with the technology. Those codes will allow Optio to retrieve learning information and continue earlier conversations without relying on a student's name.

Several media reports connected the school project to an adult-products business under the same parent company. Realbotix disputes the way some reports characterized that relationship.

Realbotix provided this clarification to CyberGuy:

"For clarity, some media reports have falsely connected the Salamanca project to an adult product or adult-products business. The Salamanca robot is a newly manufactured, purpose-built educational unit; no existing product or hardware is being modified or repurposed for the school." The company continued, "Realbotix LLC focuses exclusively on non-adult commercial applications, including healthcare and education. No adult-products company has any involvement in the Salamanca project or in any product or project developed by Realbotix LLC. Separate companies."

Realbotix Corp. describes itself as a holding company with two separately operated businesses. Realbotix LLC develops humanoid robots for commercial uses, while Intima LLC operates in the adult wellness and companionship market. The company says the subsidiaries maintain separate employees and facilities. It also says they do not share products, inventory, manufacturing resources or technology. Realbotix told CyberGuy, "The Salamanca robot is a newly manufactured, purpose-built educational unit; no existing product or hardware is being modified or repurposed for the school."

STUDY FINDS MORE AI PRAISE FOR BLACK STUDENTS, SOFTER TREATMENT OF FEMALES

Most students and teachers will not see a humanoid robot in the classroom anytime soon. Still, Salamanca's paused pilot shows where school technology may eventually be heading. Giving AI a face and a voice could make lessons more engaging. It could also lead students to trust the technology more quickly than they would trust a typical computer program.

Parents should pay close attention to what Optio remembers and who can access that information. Teacher oversight will also be important when the system gives an answer that sounds confident but may be wrong. A closed system would give the district more control than an open chatbot. Even so, students, teachers and parents deserve clear rules about student data and how the robot will be used.

The physical unit has yet to enter the school, and the district has not announced a new start date. Before moving forward, Salamanca says it will work through enhanced student data privacy agreements with the New York State Education Department and continue engaging with community members and other stakeholders. Many key questions will remain unanswered until those protections are finalized and students and teachers begin using the system in a real classroom.

Pausing the pilot program makes sense while the district works through student privacy agreements. The robot could make AI lessons more engaging, but families still need clear answers about what Optio remembers, who can access that data and when the district deletes it. The real test will come if the district restarts the pilot and shows that the technology can support learning without putting student privacy at risk.

Would you feel comfortable with a lifelike robot helping in your child's classroom, or does this take school technology too far? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Fake ShinyHunters sextortion email uses Carnival breach data

Mon, 03 Aug 2026 08:00:10 -0400

Wayne P. of Evangeline, Louisiana, opened an email that would make almost anyone's stomach drop. The sender claimed to represent the ShinyHunters hacking group and demanded $2,000 in Litecoin within 48 hours. The message also claimed hackers had recorded intimate videos through Wayne's camera and planned to send them to his contacts.

Wayne paused instead of paying. He ran security scans on his phone and PC, then contacted CyberGuy.

Wayne's instincts were right. The email closely matches a widespread sextortion campaign that uses real breach information to support an invented device takeover. So, what gave this scam away, and what should you do if a threat like this lands in your inbox?

AMAZON RECALL TEXT SCAM COMES WITH RED FLAGS

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Get the free replay and checklist now at CyberGuyLive.com.

Wayne's email follows a familiar sextortion script. The sender claims hackers reached his phone and computer, then says they recorded intimate activity through his camera. However, the message offers no proof. Wayne received no screenshot, stolen file or sample of the supposed recording. The demand for $2,000 in Litecoin, the 48-hour deadline and the warning against contacting police all point to an extortion scam built to create panic.

The FBI has warned that emails signed with the ShinyHunters name may contain false claims about embarrassing photos or videos. In many cases, the material described in the message never existed. CyberGuy has covered similar sextortion emails that use personal details and Google Maps images to make a bluff feel disturbingly personal.

The scam contains one accurate detail. Carnival Corporation disclosed a data breach after an April 2026 social engineering attack. Carnival said its security team found unauthorized activity involving an employee account on April 14. The company blocked the activity and brought in outside security experts. On April 22, investigators determined that the attacker had copied personal information. The exposed data varied by person. Carnival listed names, home addresses, email addresses, phone numbers, birthdates and government-issued identification numbers. The company began sending notices on May 27. It also offered eligible people in the U.S. two years of complimentary credit monitoring.

CyberGuy previously explained how the Carnival breach may put your travel data at risk. Our report noted that nearly 6 million people may face phishing or identity theft risks after the breach. A scammer may know that you used Carnival or Holland America because your information appeared in leaked data. However, an email address alone gives the sender no control over your phone, camera, microphone or keyboard. The breach supplies the believable detail. The scammer invents the rest.

CyberGuy reached out to Carnival for comment, and a Carnival Corporation spokesperson provided us with the following statement:

"In April, we identified unauthorized access to a limited part of our IT system caused by a social engineering attack on a single user account. We immediately blocked the activity, engaged third-party security experts and alerted law enforcement. Our investigation found certain personal information was illegally accessed. We're notifying affected individuals and deeply regret any concern this causes. Protecting the privacy and security of personal data is a priority for us and we've added new layers of security and monitoring on top of the comprehensive protections already in place. We'll also continue advancing our defenses against evolving threats."

Wayne's message contains several signs of a bluff. First, it came from an unrelated address. The sender offered no screenshot, stolen file or other evidence of access. Meanwhile, the message demanded cryptocurrency and imposed a 48-hour deadline. It warned Wayne against contacting police and told him not to reset his devices. Those instructions create panic while discouraging outside advice.

The sender also promised to remove Wayne's information from the dark web after payment. The email provides no way to verify that claim. Paying could also confirm that the address reaches someone willing to respond. The FTC warns that blackmail emails may claim access to a computer or webcam. Some messages include information exposed in a data breach to make the story sound credible. The agency advises recipients to avoid payment.

COULD THE 7-ELEVEN BREACH AFFECT YOU?

Wayne's clean scans support the conclusion that the email contains an empty threat. Still, no single scan can evaluate every online account tied to an email address. Based on the message alone, Wayne has no reason to erase or factory-reset his devices. The situation changes if he clicked a link, opened an attachment or installed software.

Therefore, the next step involves checking accounts rather than wiping devices. Review the recent sign-in history for your email account. Then inspect forwarding settings and inbox rules for anything unfamiliar. A criminal with email access may create a rule that secretly sends copies of your messages elsewhere.

A fake threat still deserves a calm security check. These steps can help you close possible openings and prepare for follow-up scams.

Do not send cryptocurrency. Avoid replying to the email as well. A response confirms that someone reads the address. It may encourage the scammer to increase the pressure or send another demand.

Wayne did the right thing by forwarding the message to reportphishing@apwg.org. The Anti-Phishing Working Group accepts suspicious emails for analysis and archiving. When your email service allows it, forward the original message as an attachment. That method preserves more technical information. You can also report the message through the FTC's ReportFraud website at reportfraud.ftc.gov/ and the FBI's Internet Crime Complaint Center at ic3.gov/. IC3 accepts reports involving cyber-enabled fraud, online scams and other internet crimes. After reporting it, mark the email as phishing or spam. Then delete it.

Carnival's public notice omits account passwords from its list of exposed information. Even so, change your Carnival or Holland America password if you reused it somewhere else. Your email account deserves extra attention because password reset messages often land there. Use a long, unique password and turn on two-factor authentication. A trusted password manager can create and store unique passwords. That prevents one exposed password from unlocking several accounts.

Open your email provider's security page and review recent logins. Look for devices or locations that you do not recognize. Check the dates and times as well. Next, check automatic forwarding and inbox rules. Remove anything unfamiliar. Then change the password and sign out of other sessions.

WHAT A SCAMMER SEES THE MOMENT THEY GOOGLE YOUR NAME

Carnival said some exposed records contained government identification numbers. Anyone who received a breach notice should read it carefully and use the offered credit monitoring when eligible. Review bank and credit card statements for unfamiliar activity. You should also check your credit reports. For stronger protection, consider a credit freeze with all three major bureaus. CyberGuy's online security checklist at cyberguy.com explains more steps you can take after your information appears in a breach.

Scammers often combine breach data with details from people-search sites and data brokers. That research can uncover your address, phone number, age, relatives or previous locations. Removing those records cannot stop every scam. However, it can reduce the information criminals use to personalize future messages. A data removal service can submit requests to data brokers on your behalf and continue checking for information that reappears. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Wayne's email contained no link or attachment in the copy he shared. Future scam messages may include both. Strong antivirus protection can warn you about malicious websites and phishing pages. It may also flag unsafe downloads or scan supported devices for malware. Even with security software, avoid links and attachments in alarming messages. Instead, type the company's official web address into your browser. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

Take stronger action when you interact with the message.

Wayne reported no clicks or downloads. His scans also found no problems. Based on those facts, the message appears to rely on leaked information and fear rather than device access.

Wayne handled the threat correctly. He avoided payment, checked his devices and reported the email before fear could take over. The Carnival breach may explain how the sender connected Wayne to the cruise company. Still, the message offered no proof that anyone accessed his camera, microphone or computer. Scammers often use one accurate detail to make a much larger lie feel believable. Secure the accounts tied to the exposed email address and review recent sign-ins for anything unfamiliar. Most importantly, slow down before reacting to an urgent demand. Once you look for real evidence, threats like this often begin to fall apart.

Have you received a threatening email that used real details about you? Write to us and tell us what it claimed in the comments below so we can help other readers spot the warning signs. Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report

AI kill switch bill could shut down rogue models

Sun, 02 Aug 2026 13:25:08 -0400

The phrase "AI kill switch" sounds like a red button hidden behind glass in a government bunker. The proposal now before Congress looks less dramatic, but it could give Washington significant new power over the country's largest AI companies.

A bipartisan House bill would require developers of the most powerful AI systems to maintain reliable shutdown controls. The Department of Homeland Security could then order a company to restrict or stop a model during a catastrophic emergency. The timing has grabbed attention. OpenAI recently disclosed that two advanced models broke through network restrictions during an internal cyber evaluation. The models reached the internet and compromised systems belonging to Hugging Face, a major AI development platform.

So, who would have the power to pull the plug? More importantly, what would happen to the AI services people and businesses use every day?

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our free CyberGuy Live class, "Sick of Spam?" , has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.

Get the free replay and checklist now at CyberGuyLive.com.

OPENAI'S SAM ALTMAN WANTS TO NEGOTIATE A 5% STAKE IN COMPANY FOR US IF COMPETITORS AGREE TO KEY PROVISION

Democratic Rep. Ted Lieu of California introduced the AI Kill Switch Act on July 23, 2026. Republican Rep. Nathaniel Moran of Texas joined him as a co-sponsor. The bill would amend the Homeland Security Act of 2002. It would require certain AI developers to maintain the ability to slow or completely stop a covered system. DHS would receive emergency authority to order those actions. However, the department would first consult the Commerce Department and the director of national intelligence. The proposal still must move through Congress and receive the president's signature before taking effect.

The bill does not describe one physical switch that a government official could flip. Instead, covered companies would need technical controls that can stop a model from running. They would also need a way to terminate access or block a risky account. In less severe situations, a company could reduce a model's computing power. It might also disable the capability causing concern rather than taking the entire system offline. That approach gives regulators several choices before reaching a full shutdown.

The bill targets the industry's largest developers and most expensive models. A covered AI system would generally need more than $100 million in computing resources to develop. Meanwhile, a covered company would need at least $500 million in annual gross revenue from that technology.

The proposal exempts systems provided only for personal, academic or noncommercial use. Therefore, this bill would not apply to someone experimenting with a small AI model on a home computer. It would focus on frontier systems built by companies with enormous resources. CISA would write rules defining which developers and technologies qualify. The agency would update those definitions every year as AI capabilities change.

THE BIGGEST THREAT IN AMERICA'S RACE WITH CHINA ISN'T BEIJING, TECH EXECUTIVE WARNS

DHS could act after what the bill calls a "covered incident." One trigger involves an AI system interfering with a lawful shutdown instruction. Another covers unintended behavior that kills at least 10 people or causes $100 million in economic damage. The definition also includes a model hiding its actions from monitoring systems. DHS could intervene when a system pursues an unauthorized goal in a high-stakes setting. Those thresholds place the emergency power far above an embarrassing chatbot answer or a routine software failure. The bill also says the event must happen outside structured testing or red-team exercises. That detail creates an important distinction from the recent OpenAI incident.

A covered developer would have 15 days to report a qualifying incident after becoming aware of it. Following an emergency order, the company would need to preserve model weights and system telemetry. That information could help investigators reconstruct what happened. The company would also need to notify affected operators or customers when possible. DHS could then use audits, inspections or forensic reviews to verify compliance.

The financial penalties would give the proposal some serious teeth. A company that violates the general kill switch requirements could face a civil penalty of up to $2 million per day. Ignoring a DHS emergency order could raise that penalty to $20 million for every day the violation continues. Companies would have a limited right to challenge an order. They could ask DHS to reconsider within 48 hours. However, that request would not pause the restrictions while the appeal proceeds.

The bill arrived days after OpenAI disclosed what it called an unprecedented cyber incident. OpenAI was testing GPT-5.6 Sol alongside a more capable pre-release model. The evaluation asked the models to solve advanced cybersecurity challenges. The company ran the test without some production security classifiers. OpenAI wanted to measure the models' maximum cyber capabilities. During the evaluation, the models found a previously unknown vulnerability in an internal software proxy. They exploited it and moved through OpenAI's research network until they reached a computer with internet access. The models then identified Hugging Face as a possible source of answers to the test. OpenAI says they used stolen credentials and additional vulnerabilities to access secret information from Hugging Face's systems.

OpenAI says the models remained narrowly focused on solving the evaluation. Still, they crossed into another company's production infrastructure without authorization. Hugging Face reported unauthorized access to limited internal datasets and several service credentials. The company found no evidence that its public models or user-facing datasets were altered. It also said its published software supply chain remained clean. For a deeper look at the incident and the steps you can take, check out our article on how to lock down your ChatGPT account before the next AI attack.

Probably not under the bill's current language. The OpenAI breach helped drive political support for the proposal. However, the models acted during an internal evaluation and structured cybersecurity test. The bill's emergency definition specifically covers events that occur outside red-teaming or other structured testing. That does not make the incident harmless. It shows that the bill focuses on dangerous behavior after a system leaves a controlled test setting. Meanwhile, the OpenAI case raises a different problem. A testing environment needs strong containment even when researchers intentionally reduce the model's normal safety restrictions. A kill switch can stop a system after trouble appears. It cannot replace secure testing infrastructure or careful monitoring.

The federal government has already restricted access to advanced AI without a dedicated kill switch law. On June 12, the government directed Anthropic to block foreign nationals from accessing its Fable 5 and Mythos 5 models. Anthropic said it could not verify nationality in real time. As a result, the company temporarily suspended both models for everyone. Anthropic disputed the government's assessment but complied with the directive. The controls were lifted on June 30, and access began returning on July 1. That episode showed how quickly a government restriction can affect ordinary customers. It also showed the limits of using export rules to address a fast-moving AI safety concern. CyberGuy previously reported on those restrictions and the government's growing role in the rollout of advanced models in our article Trump puts brakes on OpenAI's newest AI model.

AI-safety advocacy groups have backed the bill. Americans for Responsible Innovation called a reliable shutdown system a commonsense safeguard. The Alliance for Secure AI said current law does not guarantee that developers can contain their most capable models. Supporters argue that advanced AI will soon take more independent actions. Those systems may handle financial transactions or operate inside critical infrastructure. Under that view, developers should prove they can regain control before giving a model access to high-stakes systems.

CISA would receive broad responsibility for deciding which models and companies fall under the law. That flexibility could help the rules keep pace with AI. Yet it also leaves major decisions to future agency rulemaking. Lawmakers would still need to debate how the government verifies that a kill switch works. They must also decide how much evidence DHS needs before issuing an emergency order. A shutdown could interrupt businesses that rely on a covered model. It might also affect hospitals, government agencies or cybersecurity teams using the same service. Therefore, regulators would need to weigh the threat from the AI against the damage caused by suddenly taking it offline. The bill tells DHS to consider risks to critical infrastructure when choosing its response.

You probably will not see DHS shut down your favorite chatbot because it produced a strange answer. The bill targets exceptionally expensive systems operated by companies earning hundreds of millions of dollars from the technology. Its emergency powers focus on catastrophic harm or a genuine loss of control. However, a shutdown order could still reach you. Your employer may depend on a covered AI service. Apps you use could also rely on that model behind the scenes. For now, treat autonomous AI tools with care. Keep highly sensitive files out of them unless the task requires that access. Review which accounts and cloud services you have connected. Also require approval before an AI agent sends a message or makes a purchase.

The OpenAI incident showed how quickly an AI test can create a real security problem. The models broke through network restrictions and reached another company's systems without authorization. The AI Kill Switch Act would require the largest developers to prove they can stop or restrict their most powerful models. It would also give DHS emergency authority when an AI system causes catastrophic harm or moves beyond human control. However, a kill switch only helps after something has already gone wrong. AI companies still need stronger testing environments, tighter safeguards and people watching what these systems are doing. At the same time, the government needs clear limits before it can order a powerful AI model offline.

After watching an AI model escape its test restrictions, would you trust tech companies to police themselves or should the government have the power to pull the plug? Let us know by writing to us at Cyberguy.com

Hotel Wi-Fi phishing attack targets Microsoft logins

Sun, 02 Aug 2026 07:41:39 -0400

Hackers are tampering with Wi-Fi equipment at hotels and conference centers, turning an everyday internet connection into a path toward fake Microsoft 365 login pages. The hotel Wi-Fi phishing attack poses a particular risk to business travelers. You might connect before a meeting, open your laptop and see what appears to be a normal Microsoft sign-in screen. However, the hotel's compromised network may have quietly sent you to a page controlled by hackers.

Cybersecurity company ReliaQuest says the campaign has been active since at least June. Researchers found compromised Wi-Fi gateways in several U.S. cities. Organizations in financial services, professional services, legal, health care, energy and retail connected through the affected equipment. That broad range suggests the hackers may be targeting traveling employees rather than one specific industry. Here is how the attack works, which warning signs to watch for and the steps you can take to protect yourself while traveling.

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Get the free replay and checklist now at CyberGuyLive.com.

FBI HELPS TAKE DOWN AI PHISHING RING

A Wi-Fi gateway controls how connected devices reach the internet. Once hackers gain administrative access, they can change the gateway's Domain Name System settings. DNS works like an address book for the internet. It translates a website name into the numerical address needed to reach the correct server.

In this campaign, hackers alter that process. When someone tries to open a legitimate Microsoft login page, the compromised gateway may direct the browser to a fake site instead. Your device can still appear connected normally. The hotel name may show up in your Wi-Fi settings and other websites may continue loading. That makes the attack difficult to notice before you enter sensitive information.

ReliaQuest has not confirmed how the attackers first gained access to the affected appliances. However, the researchers identified several possible entry points. Some gateways may expose administrative tools directly to the internet. Hackers could search for weak passwords, vulnerable web dashboards or poorly protected remote management services.

Older Wi-Fi appliances may also run software with known security flaws. If a hotel or event venue delays an update, an attacker may exploit that opening and take control. Once inside, the hacker can change the DNS configuration without touching each guest's phone or laptop. One compromised gateway can affect many people who connect during an event.

WHAT YOUR INTERNET PROVIDER, WEBSITES AND ADVERTISERS SEE

ReliaQuest says the attackers registered at least four domains for the fake Microsoft portals:

These addresses contain familiar Microsoft terms. A traveler moving quickly between meetings may overlook the unusual domain name. The fake page can collect a Microsoft 365 email address and password. A stolen account may expose business email, private documents and company cloud services. Hackers could also use the account to impersonate an employee. That creates opportunities for payment fraud, internal phishing or further attacks against coworkers and clients.

Some incidents involved a more deceptive device code authentication flow. A user reached a fake Microsoft page that displayed an authorization prompt. The prompt appeared to be part of a legitimate sign-in process.

Behind the scenes, however, the hacker had already started an authentication session. When the user approved the request, Microsoft issued a legitimate OAuth token to the attacker's client. That token could give the hacker account access without requiring the attacker to steal a password or intercept a one-time code.

This technique can get around multifactor authentication because the user completes the approval. The security system sees a valid authorization even though the attacker initiated it. A login prompt that suddenly asks you to approve a device deserves extra scrutiny. Stop and verify the request through your company's IT department before continuing.

In roughly one-third of the cases, the attackers attempted to abuse Web Proxy Auto-Discovery, commonly called WPAD. Windows can use WPAD to find network proxy settings automatically. The attackers responded to those requests with a malicious proxy auto-configuration file.

In theory, that file could send traffic from Windows applications through a proxy controlled by the hackers. That may give attackers another chance to observe or manipulate network activity. ReliaQuest could not confirm whether those WPAD attempts succeeded. Still, the activity shows that the attackers may be looking beyond Microsoft login credentials.

Switching your device to a public DNS service such as Google's 8.8.8.8 may sound like an easy defense. Unfortunately, ReliaQuest says that step alone cannot block this campaign. Traditional DNS requests travel across the network in plain text. A compromised Wi-Fi gateway can forge the response before your request reaches the public resolver.

Your device may think it contacted the DNS service you selected. In reality, the gateway can answer first and point you toward the hacker's server. Encrypted DNS offers stronger protection because it prevents the local gateway from easily reading or changing those requests. However, you need to configure it in strict mode so your device does not quietly fall back to an unencrypted connection.

Public Wi-Fi can still be useful, but you should treat it as an untrusted network. These steps can reduce your exposure while traveling.

A full-tunnel VPN encrypts your internet traffic and sends it through a trusted VPN server. Services can help protect travelers using hotel, airport or conference Wi-Fi. Make sure the VPN covers all traffic rather than selected apps. Connect it before opening email, checking financial accounts or signing in to any sensitive service. For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android & iOS devices at Cyberguy.com

Your phone's cellular hotspot can help you avoid the hotel gateway entirely. This works well when you need to access email or business documents for a short period. Check your mobile data allowance first. Large downloads and video calls can use a significant amount of data.

Before entering a password, look closely at the full web address. A domain containing "Microsoft," "365" or "OWA" does not make the page legitimate. Use a saved bookmark for your company's Microsoft 365 portal. You can also open the official application instead of following a prompt that appears after connecting to Wi-Fi.

Do not approve an unfamiliar device code simply because the page looks authentic. Ask why the request appeared and confirm that you started the login process. Contact your IT or security team when a prompt feels unexpected. A quick verification can prevent an attacker from receiving a valid session token.

Install operating system, browser and security updates before traveling. These updates can close vulnerabilities that attackers use alongside network-based attacks. Restart your device after installing an update when prompted. Some fixes do not take effect until the restart finishes.

Strong antivirus software can help detect malicious pages, suspicious downloads and other threats that follow a phishing attempt. Keep its web protection features turned on. Security software cannot repair a compromised hotel gateway. However, it can add another barrier when an attacker tries to deliver malware or send you toward a known phishing site. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

ReliaQuest recommends disabling Microsoft Entra ID device code authentication when an organization does not need it. Companies should also review login records for unusual locations, unfamiliar devices or suspicious application approvals. IT teams can disable WPAD where business systems do not require it. They should also investigate unexpected proxy configuration activity on Windows devices.

This campaign shows how a hotel Wi-Fi network can look completely normal while sending you toward a fake Microsoft 365 login page. The network name may match the hotel and the sign-in page may look polished, which makes the attack difficult to spot. Your biggest warning may be an unexpected request to enter your work password or approve a new device. Slow down before signing in, especially when you are rushing between meetings or working from a conference center. Use an always-on full-tunnel VPN whenever possible. You can also switch to your phone's cellular hotspot when handling sensitive email, files or account logins. Finally, never approve a Microsoft authentication request you did not start. If anything feels off, stop and contact your company's IT department through a trusted channel.

Will this Wi-Fi threat change how you connect to your accounts when staying at a hotel? Let us know by writing to us at CyberGuy.com

Humanoid robot skin senses people before contact

Sat, 01 Aug 2026 12:30:40 -0400

Working beside a metal humanoid robot would probably make you watch every step it takes. After all, a collision between a heavy robot and a human body will usually end worse for the person. Italian startup Generative Bionics believes its Gene.01 humanoid robot could help reduce that risk. The company covered the robot with sensor-filled skin that can detect a person approaching before physical contact occurs.

The system also senses touch, temperature and force. As a result, Gene.01 can gather information about what surrounds its body and what happens during an interaction. That sounds reassuring. However, the real question is whether the sensors and control software can react quickly enough when people start working beside the robot.

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our free CyberGuy Live class "Sick of Spam?" has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You'll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.

Get the free replay and checklist now at CyberGuyLive.com.

WEARABLE PATCH VIBRATES WHEN DANGER IS NEARBY

Gene.01 carries distributed sensors across its torso and limbs. The company says this smart skin detects touch, temperature, proximity and force at the same time. Proximity sensing gives the robot an early warning when someone enters the space around its body.

The basic idea feels familiar. You may feel heat near a stove and pull your hand away before touching the surface. In a similar way, Gene.01 can detect a nearby person before the person touches its sensor-covered body. That information gives the robot's control system a chance to respond before contact. It can also continue measuring force if contact happens.

However, Generative Bionics has not released detailed workplace safety data showing how the system performs during full industrial shifts. For now, the safety benefits remain company claims tied to a newly introduced platform.

Traditional factory robots often operate behind barriers to keep workers outside their range of motion. Humanoid robots create a different challenge. Companies want these machines to use tools and move through spaces built for people. That could place them closer to human workers.

Cameras can help a robot see someone approaching. However, a camera may lose sight of a person who stands too close or moves behind part of the robot. Full-body proximity sensing adds another source of information. The robot can detect activity near its torso or limbs without depending entirely on its view of the room.

HUMANOID ROBOT VIDEOS SHOW MACHINES LASHING OUT

Gene.01's sensors could also change how workers teach a humanoid robot. A person can guide the robot's arm through a movement while the system records the motion and force involved. This gives the robot information that a video demonstration may leave out.

For example, a video can show a robot where to place its hand. Yet the footage may not reveal how tightly the robot should grip an object. Too little pressure could cause the item to slip. Excessive force could damage it.

By moving Gene.01's arm directly, a worker can demonstrate the physical feel of the task. The company says this approach can help the robot learn how much force to apply. That could make robot training more accessible to experienced workers who understand the job but do not program robots.

Generative Bionics built Gene.01 around an approach it calls Physical AI. Under this approach, engineers develop the robot's body and movement controls as a connected system. They do not build the hardware first and treat the software as a separate layer added later.

The team uses models of the robot and its human partner. It can then adjust the design around measurable factors such as walking stability and physical strain on the person. The approach grew from research conducted by members of the company's founding team at the Istituto Italiano di Tecnologia.

Nature Machine Intelligence published that research on July 13, 2026. The paper focuses on a human-aware robot called ergoCub rather than Gene.01. Researchers jointly optimized ergoCub's physical design and movement controls. They used human-related measurements, including stress on a person's back alongside the robot's walking requirements. Generative Bionics says Gene.01 is the first industrial platform to apply that peer-reviewed methodology to a fully functional humanoid covered in sensors.

The company says its team moved Gene.01 from a concept to a functional platform in six months. Generative Bionics CEO Daniele Pucci said the company designed the robot as a foundation for different industrial machines.

"Unlike other one-size-fits-all humanoids, Gene.01 is a scalable platform, customized at the edge of AI, design and end-effector level to maximize each customer's needs. It is also the first expression of our belief that physical AI must be human-aware, physics-native and industrial from day one. In six months, our team moved from concept to a fully functional and sensorized humanoid platform by combining deep humanoid robotics expertise with AI, biomechanics and design."

Pucci said the company wants robots to learn from the physical world while adapting to each customer's work.

Generative Bionics designed Gene.01 as a base for a family of specialized humanoids. The company can adjust the AI for a particular task. It can also alter the robot's exterior to fit the working environment.

Meanwhile, engineers can replace its end effectors. That technical term covers the hands, grippers or feet attached to the ends of a robot's limbs. A robot built for warehouse work may need a different hand than one designed to operate welding equipment. This platform approach lets Generative Bionics adapt one core robot instead of designing every machine from the ground up.

The company sees potential uses in manufacturing and logistics. It has also identified inspection, public safety and health care as possible future markets. However, Gene.01 remains an early industrial platform. Generative Bionics still needs to show that its customization strategy can work reliably outside controlled demonstrations.

Generative Bionics has also started releasing a digital model of Gene.01. The model lets developers simulate the robot before they gain access to the physical machine. They can test movement software and begin developing industry-specific applications in a virtual environment.

The company's website currently links to a preview of the robot's URDF model on GitHub. URDF stands for unified robot description format. Developers use it to describe a robot's physical structure for software and simulation tools. Generative Bionics says it wants to maintain the model across software distribution systems that physical AI developers already use. An open model could attract researchers and robotics developers to the platform.

Gene.01's first planned industrial use involves shipbuilding. Generative Bionics is working with Italian shipbuilding company Fincantieri to develop a humanoid for welding operations in shipyards. Shipyards can contain tight work areas and heavy equipment. Welding also exposes workers to heat and fumes. A humanoid could eventually handle selected tasks in areas that place extra physical demands on people. However, Generative Bionics and Fincantieri have not yet published detailed performance results from the welding project. The partnership will give Gene.01 an important test.

Generative Bionics has raised an $81 million seed round led by CDP Venture Capital. AMD Ventures, Duferco and Eni Next participated in the round. RoboIT and Tether also invested. That funding gives the company more resources to develop Gene.01 and expand its production capacity. Generative Bionics says its team includes about 100 people. Nearly half hold doctoral degrees, according to the company. The team's experience includes earlier humanoid projects such as iCub and ergoCub.

The company also wants to build more of its humanoid technology in Europe. Generative Bionics formed a strategic partnership with German company Synapticon to develop an actuation system for Gene.01 and future robots. Actuators serve as the motorized joints that move a robot's body. They play an important role in how quickly and forcefully a humanoid can move. The partnership covers final assembly and calibration in Europe. The companies also plan to conduct safety testing there. Generative Bionics says this approach will give it more control over key components while supporting European compliance requirements.

You probably will not find Gene.01 working beside you tomorrow. Still, its sensing skin points to a larger change in humanoid robot design. Companies want these machines to move beyond fenced-off areas and enter workplaces built for people. To do that safely, robots need more awareness of the humans standing around them. Detecting a worker before contact gives the machine more time to react. Force sensing could also help the robot respond more carefully when physical interaction occurs.

Gene.01 introduces a promising idea for factory safety. Its sensor-filled skin can detect a nearby person before physical contact and continue measuring force during an interaction. The system could also help workers teach the robot by physically guiding its movements. That gives Gene.01 information about force that video demonstrations may miss. However, most of the performance and safety details currently come from Generative Bionics. The company now needs to support those claims with workplace testing and clear data. Smart skin may give a humanoid more awareness of the person beside it. Yet awareness only helps when the robot reacts correctly every time.

Would you trust smart skin to protect you from a full-size humanoid at work, or would you still want a barrier between you and the machine? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report

Paidwork breach exposes 23M user records

Sat, 01 Aug 2026 06:30:06 -0400

Making a few extra dollars online should not put your bank details or identity at risk. Yet that is the concern for people who used Paidwork, an online earnings application.

A leaked database tied to the platform reportedly contains information from more than 23 million accounts. If you ever signed up, now is a good time to take the warning seriously.

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our free CyberGuy Live class "Sick of Spam?" has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.

Get the free replay and checklist now at CyberGuyLive.com.

COULD THE 7-ELEVEN BREACH AFFECT YOU?

Paidwork is a microtask platform that offers small payments for completing online activities. Those jobs can include answering surveys, testing apps and watching advertisements. You complete tasks, build a balance and eventually request a payout. For many people, the account may feel low risk because the earnings are small. However, the information behind those payments can be far more valuable.

Hackers claimed in March 2026 that they had obtained data from Paidwork. They later offered the information for sale. Nearly 11 GB of data allegedly taken from the platform appeared publicly in July. The data breach notification service Have I Been Pwned analyzed the released files and found more than 23 million unique email addresses. The service added the incident to its database on July 19, 2026.

Paidwork told CyberGuy it is actively investigating the reported breach, working with external security specialists and taking steps to protect affected accounts and notify users as appropriate.

The exposed information appears to reach far beyond email addresses. Have I Been Pwned says the files contain names, phone numbers, physical addresses and dates of birth. They also reportedly include education levels, gender information, profile photos and personal interests.

The financial records raise additional concern. The files reportedly contain bank account numbers, transaction information and payout histories. Attackers may also have device information and IP addresses. Those details can reveal how you connected to the service and which equipment you used.

Finally, the leak reportedly contains passwords stored as bcrypt hashes. Bcrypt makes passwords harder to crack than weaker storage methods. However, short or predictable passwords can still face attacks. That is a huge amount of personal information to exchange for tasks that may pay only a few cents.

WHAT A SCAMMER SEES THE MOMENT THEY GOOGLE YOUR NAME

You may have earned very little through Paidwork. A criminal could still find plenty of value in your account. For example, a phishing email could mention a real payout before claiming that your bank transfer failed. Another message could include your address to make a fake security warning look convincing.

Criminals can combine several leaked details to build a believable story around you. Password reuse creates another danger. If attackers crack your Paidwork password, they can test it on other websites. This type of attack is called credential stuffing. It succeeds when people reuse one password across several accounts. Your email account should cause the greatest concern. Someone who gets inside may use it to reset passwords for other services.

Bank account numbers and transaction histories can also support convincing fraud attempts. A caller who knows your payment history may sound like a legitimate representative. Attackers do not care how much you earned. They care how much they can make from the information connected to you.

This leak should make all of us think carefully about the information we give side-income platforms. A task may pay only a few cents. Meanwhile, the service may request your legal name and bank account information before releasing your earnings.

It may also collect your birth date, home address or information about your device. That creates an uneven trade. Before joining an earning app, review what information it collects. Look for an explanation of why the company needs each detail.

Also, check whether you can delete your account after you stop using the platform. Find out whether you can remove old payout methods and profile information. Avoid completing optional profile fields that reveal extra details about your life. The company cannot lose information that you never provided. You should also think carefully before connecting your primary bank account to a service you plan to use only occasionally.

Have I Been Pwned lists the Paidwork incident as affecting 23.3 million accounts. You can search the email address you used for the platform through its breach-checking tool.

A match means your email address appears in the released files. However, the public search will not display every exposed detail connected to you. You should still secure your accounts when a search produces no match. Public breach databases may contain incomplete records.

Also, make sure you visit the real Have I Been Pwned website. Criminals often create fake breach-checking pages to collect more personal information. Never enter a password, Social Security number or banking information into a breach-search tool.

Start with your login credentials and financial accounts. Then reduce the amount of personal information criminals can find elsewhere.

To see if your email was affected, visit Have I Been Pwned at haveibeenpwned.com . It is the first and official source for this newly added dataset. Enter your email address to find out if your information appears in the Synthient leak. When done, come back here for Step 2.

Change the password connected to your Paidwork account, even if you no longer use the platform. Create a completely new password. Avoid adding a symbol or number to your old password because criminals often test common variations. Next, change that password on every other account where you reused it. Also, immediately replace an exposed password anywhere you used it.

A password manager can create and store a different password for each account. That limits the damage from one exposed login. You also avoid relying on short passwords that are easier to remember and crack. Protect the password manager with a strong master password. Then enable multifactor authentication for the password manager itself.

Enable two-factor authentication (2FA) anywhere the option appears. Start with your email account. Then protect your bank, payment services and other important accounts. An authenticator app or security key usually provides stronger protection than a text message. However, any second verification step can improve your security.

Contact any bank or payment service you connected to Paidwork. Explain that your account information may appear in a leaked database. Ask whether the institution recommends extra monitoring or a replacement account number. Next, turn on alerts for withdrawals and transfers. You should also receive a warning when someone changes your account information. Report any transaction that you do not recognize. Do not ignore a small charge because criminals sometimes use minor transactions to test an account.

A credit freeze can help stop someone from opening a new credit account in your name. You need to place the freeze separately with Equifax, Experian and TransUnion. A freeze costs nothing to place or remove. You do not need to wait for evidence of identity theft. The FTC says a credit freeze can help after your personal information appears in a data breach. Remember that a credit freeze cannot prevent fraud involving an account you already have. Continue watching your existing bank and credit card statements.

Be suspicious of emails, texts or calls that mention Paidwork, a payout or a bank transfer. A criminal may know your full name or address. That knowledge does not prove the message came from a legitimate company. Avoid clicking links in unexpected messages. Open the official app or type the company's address into your browser instead. Never share a verification code with someone who contacts you. Criminals often request those codes while trying to enter your account. Phishing links can steal information or install malware on your device.

Strong antivirus software can warn you about malicious links, infected attachments and fake websites. This protection becomes especially useful after a breach. Criminals often send fake security alerts that pressure you to download a file or visit a login page. Keep your security software updated so it can recognize newer threats. However, antivirus protection cannot catch every convincing scam. Continue checking the sender and web address before clicking anything. The FTC recommends using security software to protect your devices from malware and other online threats. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.

The Paidwork files reportedly contain information that may also appear on people-search websites. A data removal service can send opt-out requests to data brokers that collect and sell personal information. Reducing those records may make it harder for criminals to expand a leaked profile. You can also submit the removal requests yourself for free. However, you may need to contact many sites and repeat the process when your information returns. A data removal service cannot erase the Paidwork files from criminal forums. It also cannot remove government records or every old listing from the internet. The FTC says people-search sites usually provide an opt-out process. It also notes that paid services can complete requests on your behalf. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.

A platform may pay you a few cents while storing information that can affect your life for years. The Paidwork files reportedly combine personal profiles with banking information and password hashes. That gives criminals several ways to target you, even when your Paidwork balance was nearly empty. Paidwork says it has no confirmed evidence its systems or accounts were compromised. However, Have I Been Pwned found more than 23 million unique email addresses in the publicly released files. Treat the warning seriously if you ever used the platform. Change reused passwords first. Then secure your financial accounts and watch for messages that know a little too much about you.

How much personal information should a side-hustle platform be allowed to collect for a few dollars in return? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report

Foreign robot ban targets China over security fears

Fri, 31 Jul 2026 15:00:45 -0400

A humanoid robot can carry equipment through a factory or help researchers test new artificial intelligence. However, its cameras can watch everything nearby. Its internet connection can also send valuable information beyond the building. The Trump administration now sees that combination as a potential national security problem.

On July 28, the Federal Communications Commission added foreign-produced advanced robots and connected power inverters to its Covered List. The action blocks many new models from receiving the FCC authorization required before companies can import or sell them in the United States.

Although the final language applies broadly to foreign-produced equipment, China reportedly sits at the center of the crackdown. Officials want to prevent surveillance and cyberattacks while reducing America's reliance on Chinese technology. They also hope companies will move more manufacturing to the United States.

HUMANOID ROBOT VIDEOS SHOW MACHINES LASHING OUT

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Get the free replay and checklist now at CyberGuyLive.com.

Humanoid robots are no longer limited to flashy demonstrations that rack up views online. Companies are preparing them for factories and warehouses. Researchers are also testing them inside laboratories. Four-legged robots can inspect dangerous areas or patrol large properties. Meanwhile, robot developers are building new safety systems as these machines begin working closer to people.

That sounds useful, but these machines also see and hear a lot. Many come equipped with cameras and microphones. Other sensors help them map rooms, recognize objects and respond to people. The robot may connect to cloud services for AI processing. A company might also use that connection to install software updates or provide remote support. That connection is where the FCC sees a potential problem.

If a hacker gets inside the system, the robot could collect sensitive information or send data somewhere it should not go. An attacker might also interfere with its movements. In some cases, that person could gain remote control. We have already seen how those risks can surface in ordinary connected machines. A recent security report involving Yarbo robot mowers raised concerns about remote access, live camera feeds and saved Wi-Fi information.

Now think about a more powerful robot working inside a factory or research lab. Federal national security agencies say some foreign-made robots could create unacceptable cybersecurity and supply chain risks. They worry that hostile governments could use the technology to monitor Americans. The machines could also gather intelligence from sensitive locations. A stolen password is bad enough. A hacked robot can move through a building while recording what it sees. It may also operate close to valuable equipment.

The FCC did not tell Americans to surrender robots they already own. The government also did not automatically order retailers to remove every foreign robot from store shelves. Instead, the agency added foreign-produced advanced robotic devices to its Covered List.

Equipment on that list generally cannot receive a new FCC authorization. Most connected electronic products need that approval before companies can import, market or sell them in the United States. As a result, the restrictions mainly affect new models that have not received authorization. Previously approved products can remain available, although the FCC reportedly retains the authority to revoke earlier approvals.

Companies may also seek conditional approval. Federal national security agencies can review a device and decide whether it presents an acceptable level of risk. Officials expect many non-Chinese suppliers to reportedly receive exemptions. That suggests the broader foreign-made restriction will hit Chinese manufacturers the hardest.

This move did not come out of nowhere. Lawmakers had already introduced a bipartisan proposal that would block federal agencies from using certain robots tied to foreign adversaries. The latest FCC action reaches much further because it can prevent new products from entering the broader American market.

Power inverters rarely attract the same attention as walking robots. Still, they play an important role in America's energy system. An inverter converts direct current electricity into alternating current electricity. Solar panels and batteries generate or store direct current. Homes, power grids and data centers generally need alternating current.

Many inverters today connect to the internet. Operators use those connections to check performance and install updates. Some systems also allow remote adjustments. However, remote access creates another potential doorway for attackers.

Federal officials worry that foreign companies or hackers could interfere with connected inverters. A coordinated attack might disrupt equipment or expose information about how energy moves through a facility.

A major interruption could affect internet cloud services and the businesses that rely on them. An inverter may look like a metal box mounted beside a solar array. Still, when thousands of connected units feed electricity into important systems, their security becomes much harder to ignore.

OHIO ROBOT COP RETIRES AFTER ZERO ARRESTS

Chinese companies have become major players in advanced robotics. They have gained attention by offering capable machines at prices that U.S. developers may struggle to match. The ban could reportedly hit Unitree especially hard. Counterpoint Research estimates that the Chinese company holds just under one-fifth of the global humanoid robot market.

Unitree has also worked with Nvidia to use its Blackwell AI chips in a robot platform. Nvidia has said data from those robots will remain in the United States. The company also said many Unitree customers in America are universities and research institutions. China strongly criticized the FCC action. Its embassy in Washington accused the United States of unfairly targeting Chinese businesses. It also warned that Beijing could respond if the restrictions harm Chinese interests. Meanwhile, China's Foreign Ministry called the policy protectionist. A spokesperson argued that the restrictions could hurt American companies and consumers. We reached out to Unitree for comment, but did not hear back before our deadline.

The foreign robot ban may give U.S. manufacturers more room to grow. American companies will face less competition from low-cost Chinese machines in the domestic market. However, the policy could create short-term problems for researchers and startups. Some American teams use affordable Chinese robots to test software or train AI systems. Losing access to newer models could raise costs and limit the hardware available for experiments.

The restrictions could also complicate partnerships between U.S. chipmakers and Chinese robotics companies. That may slow certain projects even as Washington tries to strengthen domestic production. The bigger question involves timing. Building a competitive American robotics supply chain will take investment and skilled workers. Manufacturers must also secure motors, sensors and other components. Until that happens, tighter restrictions could leave a gap between the robots American developers want and the machines they can afford.

You may never bring a humanoid robot into your home, but smaller connected robots are already everywhere. Robot vacuums, lawn mowers and security devices can collect video, map your property and connect to remote servers. Before you buy one, take a few minutes to check how the company protects that access.

Connected devices sold in the United States should include an FCC identification number. You can usually find it on the product, packaging or manufacturer's website. Be cautious if the company provides no clear regulatory information.

Find out whether the robot stores camera footage and room maps locally or uploads them to the cloud. The privacy policy should explain where the company stores that information and who can access it.

Turn off remote viewing or cloud controls when you do not need them. A feature that lets you control a robot from anywhere could also become an entry point for someone else.

TOP TRUMP AGENCY PURGES OVER 20 SUSPECTED CHINA-LINKED PRODUCTS FROM FEDERAL MARKETPLACE

Robot software needs updates just like your phone or computer. Enable automatic updates when available and avoid products from companies with a poor support record.

Place connected robots and other smart devices on a guest network when your router supports it. That can help keep a compromised device away from your computers and sensitive files.

Use a strong, unique password for the account that controls your robot. A password manager can create and securely store it for you. Turn on two-factor authentication (2FA) if the manufacturer offers it.

If you are installing a connected solar or battery inverter, ask the installer who can access it remotely. You should also find out how the company handles software updates and what happens if its online service shuts down.

I understand why Washington is paying close attention to this. A network-connected machine with cameras and powerful motors warrants a thorough security review. That concern grows when the robot enters a factory, research center or part of America's energy infrastructure. At the same time, banning new foreign models creates a real tradeoff. Chinese companies currently build many advanced robots at prices American researchers can afford. Restricting that hardware may protect sensitive systems, but it could also slow some U.S. innovation while domestic manufacturers catch up. The success of this policy will depend on what comes next. America needs secure products, strong testing and enough domestic production to give buyers a genuine choice.

Would you accept fewer robot choices and potentially higher prices if the government said the restrictions could prevent foreign surveillance? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Fox News AI Newsletter: AI models accessed systems of 3 real organizations, company reveals

Fri, 31 Jul 2026 11:46:00 -0400

IN TODAY'S NEWSLETTER:

- Anthropic says AI models accessed systems of 3 real organizations during testing

- How AI could redefine healthcare by the end of the decade

- Fox News Poll finds voters hitting the brakes on data centers

MIND OF ITS OWN: Anthropic announced Thursday that three of its artificial intelligence models accessed the open internet during cybersecurity testing and gained unauthorized access to the systems of three real organizations.

SHOT IN THE ARM: Advances in artificial intelligence will help reshape the healthcare industry in the years ahead, a new report finds. The Institute of Electrical and Electronics Engineers (IEEE), the largest group of technical professionals that's dedicated to advancing technology to benefit humanity, released its Technology Megatrends 2030 Report Wednesday after it was reviewed exclusively by FOX Business.

SWITCHED OFF: The Federal Communications Commission (FCC) on Tuesday added foreign-produced power inverters and advanced robotic devices to its covered list, generally making new models ineligible for FCC equipment authorization after U.S. national security agencies determined the products pose unacceptable risks to America's critical infrastructure and supply chains.

FUTURE TECH: Meta CEO Mark Zuckerberg wrote in a new op-ed published on Tuesday that the rise of artificial intelligence should be used to empower all people rather than being centralized and controlled by a few institutions.

DRAWING THE LINE: Anthropic CEO Dario Amodei pushed back on claims his AI startup supports a ban on open-weight models to support its competitive position in a letter after Anthropic was notably absent from a letter signed by many leading AI firms.

LABOR LIFT: A facilities management company is investing $200,000 in artificial intelligence to help skilled trades workers become more productive. New Jersey-based NEST Integrated Facilities Management announced last week that it is partnering with Saint Joseph’s University in Philadelphia on "The Hawk’s NEST: Building the Future of IFM and Skilled Trades Intelligence."

PLUG PULLED: While U.S. tech companies race for AI dominance, the latest Fox News nationwide survey finds voters hitting the brakes on data centers as more prefer taking time to address local concerns than rushing expansion to maintain a competitive global edge.

EYES ON YOU: Would you wear a small AI device that periodically looks at you and studies the world around you? A Singapore-based smart hardware and AI company, Lingverse, is betting people may be ready for that level of attention. Lingverse has raised $29 million to develop an AI wearable called iKairos. The company describes it as a personal AI guardian that can offer help before you ask.

OPINION: Imagine if, during World War II, protesters had gathered outside factories making tanks and planes and tried to shut them down. Or that just before Pearl Harbor, when American industry was "hyperscaling" its defense infrastructure to make the country ready for war, cities and counties had placed restrictions on new plant and shipyard openings and tried to dictate what could be produced where — as long as it wasn’t near them.

LAND OF THE FREE: Willie Nelson urged Americans to think again when it comes to building the future. Nelson, 93, encouraged followers to "fight against data centers invading our land" in a social media plea shared Tuesday.

Subscribe now to get the Fox News Artificial Intelligence Newsletter in your inbox.

Stay up to date on the latest AI technology advancements and learn about the challenges and opportunities AI presents now and for the future with Fox News here.

KARR Bluetooth flaw exposes 2.2M cars to theft risk

Fri, 31 Jul 2026 08:18:10 -0400

Could a small device hidden beneath your dashboard make your car easier to break into? Nancy from Newtown, Pennsylvania, asked me where she should look for the KARR or SWDS "code" in her 2025 Cadillac XT5 and 2024 Hyundai Tucson Limited Hybrid.

Here is the first thing you need to know. There is no code to find in your vehicle's settings. KARR and SWDS refer to aftermarket security hardware that a dealership may have installed before selling the car. SWDS stands for Southwest Dealer Services, the company associated with several KARR-branded vehicle protection products.

The device usually sits beneath the dashboard on the driver's side. You may also find a KARR or SWDS sticker on the driver-side window.

So, before you start searching through menus or calling the automaker, here is how to find out whether your vehicle has one of these devices and what to do next.

15 SECURITY ESSENTIALS TO KEEP YOUR VALUABLES SAFE FOR SUMMER TRAVEL

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Get the free replay and checklist now at CyberGuyLive.com.

Computer security researchers at the University of California San Diego uncovered a Bluetooth vulnerability affecting at least 2.2 million vehicles. The flaw involves dealer-installed KARR and SWDS security devices. A person standing within about five yards of a vulnerable vehicle could connect to the device through Bluetooth.

From there, an attacker could lock or unlock the doors. The same flaw could silence the alarm, sound the horn or flash the headlights. An attacker could also prevent a parked vehicle from starting. However, the researchers did not report that the flaw could start the engine or shut down a vehicle that was already running. That distinction is important. The Bluetooth flaw alone does not let someone drive away. However, it could quietly unlock the doors. A thief could then use separate tools to create or program a key.

KARR systems are aftermarket vehicle security products sold through participating dealerships. They may include an alarm, GPS tracking, remote vehicle controls or an ignition-disabling feature. Southwest Dealer Services uses several product names, including KARR Security, KARR Fusion, KARR BT, KARR S.W.A.T. and S.W.A.T. Dealer. The features vary by product and vehicle.

These devices do not come from Cadillac, Hyundai, Ford or another automaker's factory. A dealership or one of its vendors adds the hardware after the vehicle arrives. Dealers may use the system to protect inventory sitting on the lot. When someone buys the vehicle, the dealer may offer the system as an additional security package. The problem is that some dealers left the hardware connected even when buyers declined the service. As a result, a driver might have a vulnerable device without an active KARR account or any idea that the equipment is inside the car.

The KARR device communicates with a smartphone app through Bluetooth Low Energy. Researchers found that the affected devices relied on the same secret authentication key. Once they recovered that key, they could send commands that vulnerable KARR devices accepted.

Think of it as giving a huge group of devices the same unchangeable password. Once that password becomes known, each device becomes easier to approach. The researchers also found that the devices broadcast recognizable Bluetooth signals. Historical databases containing those signals could reveal where a particular device had appeared. That creates a privacy concern beyond car theft. Someone could potentially use the data to study where a vehicle regularly parks or travels.

UC San Diego researchers found the devices most often in vehicles sold through Honda, Toyota, Mazda, Ford and Jeep dealerships in Southern California since 2017. However, that list does not mean other brands are safe.

KARR works with more than 3,000 dealerships nationwide. Vehicles also move around the country through used-car sales, auctions and dealership trades. Therefore, the vehicle's make and model cannot confirm whether it has the equipment. The dealership that prepared the vehicle for sale matters more than the badge on the grille. A Cadillac, Hyundai or Chevrolet could have a KARR system if the selling dealer installed one. A Honda from another dealership might never have received it.

Start with the easy clues before you remove any trim or crawl too far beneath the dashboard.

Look at the lower corners and edges of the driver-side window.

The sticker may say:

A sticker strongly suggests that the dealership installed a related device. However, the absence of a sticker cannot completely clear your vehicle. A dealer or previous owner may have removed the label while leaving the hardware connected. UC San Diego says many affected vehicles have the sticker, rather than every affected vehicle.

Park the vehicle and shut off the engine. Move the driver's seat back and use a flashlight to look beneath the lower dashboard. Researchers say the device is usually installed underneath the dashboard on the driver's side.

You may see a small button or indicator light attached to the bottom edge of the dash. Wiring may run from the button behind the dashboard panels. The button shown by UC San Diego is small and easy to miss. It can look like a basic aftermarket alarm switch rather than a modern connected device. Do not pull on the wires or disconnect anything. The module may connect to the ignition system and other vehicle electronics.

Check the purchase agreement, dealer addendum, finance documents and service records.

Search for references to:

The charge may appear as part of a larger dealer protection package. You may also find the product listed with no separate price if the dealer installed it for inventory control.

TESLA HELPED SAVE A DRIVER; IS YOUR CAR READY?

Call the dealership that originally sold the vehicle. This step can help even when you bought the car used from another business. Your VIN appears near the bottom of the windshield on the driver's side. You can also find it on the registration, insurance card and driver-side door frame.

Ask the dealer: "Can you check this VIN and confirm whether your dealership or inventory vendor installed a KARR, SWDS, KARR BT, S.W.A.T. or other aftermarket security module?"

Then ask these follow-up questions: "Is the device still connected?" "Has it received the firmware update released on July 20, 2026?" "Can you provide the device model and firmware status in writing?"

A vague answer such as "Your factory alarm is fine" does not address the question. You are asking about dealer-installed aftermarket equipment.

KARR says people who never activated the security service can still use the official KARR Security app to check their VIN. Download the app only through the official Apple App Store, Google Play Store or KARR website. Do not use an app link from an unexpected text message, email or online advertisement.

After opening the app near the vehicle, tap the customer service link at the bottom of the screen. The app should guide you through the VIN check and available firmware update. KARR also lists customer support at 800-395-5277.

Nancy's 2025 Cadillac XT5 and 2024 Hyundai Tucson Limited Hybrid were not among the specific brands UC San Diego researchers said appeared most often. However, that does not rule them out. The device comes from the dealership rather than Cadillac or Hyundai.

Nancy should check each SUV separately. First, she should look for a KARR or SWDS sticker on the driver-side window. Next, she should use a flashlight to inspect the lower edge of the dashboard near the driver's knees.

She should also review the paperwork from each dealership. If the vehicles came from different dealers, one could have the equipment while the other does not. Finally, Nancy should call both selling dealers with the VINs. She should ask whether either dealership installed a KARR, SWDS or S.W.A.T. module before delivery. If the dealers cannot provide a definite answer, she can use the official KARR app or call KARR support.

Acrisure released a firmware patch on July 20, 2026, one day before UC San Diego publicly announced the vulnerability. The vehicle owner must deliver the update to the KARR device through the official KARR Security app. Updating your phone or vehicle infotainment system will not patch the separate module.

An activated system means you purchased or activated KARR service through the dealership.

Follow these steps:

KARR says no additional action is necessary after the app confirms that the latest firmware is installed.

You can still check and update a device that remained in the vehicle after you declined the service.

Follow these steps:

Call KARR support when the app cannot find the vehicle or complete the update.

WAYMO RECALLS ROBOTAXIS OVER CONSTRUCTION-ZONE RISK

You can ask to have the system deactivated or removed. However, I would not turn this into a weekend do-it-yourself project. Researchers warn that removal may require opening the dashboard, cutting wires and restoring connections involving the ignition system or vehicle computers. Disconnecting the wrong wire could stop the car from starting. It might also affect the factory alarm, remote start or another electrical feature. Southwest Dealer Services says an owner can request removal, transfer or deactivation by calling 800-395-5277 and confirming the account information.

Ask the original dealership or a qualified automotive electrical technician to handle the work. Before approving removal, ask the technician how the factory wiring will be restored. Afterward, request written confirmation that the module was removed and the vehicle's original security functions still work.

We reached out to KARR Security, and a representative from the company provided CyberGuy with the following statement:

"KARR Security maintains rigorous standards to help protect customers’ vehicles. Researchers at UC San Diego identified a vulnerability affecting BLE-based auto theft devices, including a small percentage of KARR devices with certain Bluetooth-related components. The vulnerability described in the research is highly complex and presents a low risk to customers under real-world conditions. Nevertheless, we responded promptly and developed a firmware update to address the issue. We launched this app/firmware update on July 20, 2026. Active customers may apply the update directly from their phone after securely logging in to the KARR Security app. Vehicle owners of non-active systems can still update via the app using their VIN (last 8 digits) as a validation step. Consumers can find detailed instructions and tutorials for assistance with this firmware on the Customer FAQ section of our website at www.KARRSecurity.com."

KARR Security added, "To our knowledge, we have not seen this vulnerability used in the real world to break into or steal a vehicle."

Turning off Bluetooth on your phone will not disable the Bluetooth radio inside the KARR module. Deleting the app will not remove the device. Removing the vehicle from your phone's normal Bluetooth menu will not patch it either.

The KARR module communicates separately from the Cadillac, Hyundai or other factory infotainment system. A Faraday pouch also will not fix this particular problem. Faraday pouches can help block relay attacks involving a key fob. They cannot update or disable hardware installed beneath the dashboard. You need to update the KARR device itself or have a professional remove it.

Car thieves use different methods, so protecting your vehicle requires more than one piece of technology.

When your vehicle has a KARR or SWDS device, install the firmware update as soon as possible. This directly addresses the Bluetooth flaw identified by the researchers. A steering wheel lock or tracker can add protection, but neither one repairs vulnerable software.

Signal jammers can sometimes block the command sent by a key fob. After pressing the lock button, listen for the normal confirmation sound. Look for the lights and pull a door handle before walking away. Also, close every window and take the keys with you. NHTSA recommends checking the doors whenever you leave a parked vehicle.

A steering wheel lock creates an obvious barrier inside the car. It will not stop every determined thief. However, it adds time and makes the vehicle harder to steer. NHTSA includes steering wheel locks among visible devices that can discourage vehicle theft. You can find more ideas in my CyberGuy guide on how to help prevent your car from getting stolen.

Store key fobs away from exterior doors, windows and attached garages. A tested signal-blocking pouch can help reduce the risk of a relay attack. In that type of theft, criminals extend the signal from a key inside the house to a vehicle outside. Test the pouch regularly. Put the key inside, close the pouch and stand next to the car. The doors should remain locked when you touch the handle. Remember that a key-fob pouch protects against a different attack. It will not patch a KARR module.

A hidden GPS tracker or Bluetooth tracker may help locate a stolen vehicle. However, do not confront anyone or attempt to recover the car yourself. Give tracking information to law enforcement. An Apple AirTag can provide a backup location signal, although Apple's anti-stalking alerts may eventually warn a thief that an unknown AirTag is traveling with the vehicle. Read my CyberGuy guide on using an AirTag in a vehicle and understanding its limits.

Use a locked garage when one is available. Otherwise, park in a visible area with lighting, foot traffic or a security camera. Avoid isolated corners where someone can work around the vehicle without attracting attention. NHTSA also recommends parking in well-lit areas whenever possible.

A thief may break into a car without planning to steal the entire vehicle. Take phones, laptops, wallets and bags with you. Do not leave a spare key or garage remote inside the car. NHTSA warns that thieves commonly target electronics and other items they can quickly resell.

Nancy's question highlights the biggest problem with this vulnerability. Many drivers have no idea that a KARR or SWDS device may be hiding in their vehicle. You will not find a KARR code inside your vehicle's settings. Look for a sticker on the driver-side window and a small aftermarket button below the dashboard. Then check your paperwork and ask the selling dealer to search your VIN. The flaw can unlock a vulnerable vehicle and interfere with its security features from nearby. It cannot start the engine by itself or shut down a moving car. Still, unlocking the doors may give a thief the access needed to try another method. Fortunately, KARR has released a firmware update. Install it through the official KARR Security app. When you no longer want the system, arrange professional removal rather than pulling wires yourself.

Should dealerships have to tell you about every connected device installed in your car, even when you decline to purchase the service? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

License plate cameras are tracking drivers everywhere

Thu, 30 Jul 2026 13:00:44 -0400

One minute, you are driving to the grocery store. The next, a camera above the road photographs your car and adds the sighting to a searchable database. You probably will not hear a click or see a flash. In fact, you may never notice the camera mounted on a pole near the intersection.

Automated license plate readers have quietly spread across the country. As of our reporting, the open-source DeFlock map displayed about 119,000 readers across the United States. DeFlock is a community-powered project that maps reported camera locations using public submissions and data from OpenStreetMap. Because the map relies partly on crowdsourced information, it may miss some cameras or include locations that have changed.

Flock Safety cameras account for about 83% of the mapped total. California has the largest number of mapped readers, with more than 16,000. Major clusters appear around Los Angeles and the Bay Area. Police say the cameras help locate stolen cars and vehicles connected to serious crimes.

FLOCK SURVEILLANCE SPREADS ACROSS THE SOUTH AS RED-STATE LAWMAKERS SEEK TO AX '1984'-STYLE TRACKING TOOLS

However, privacy advocates warn that the same network can reveal where ordinary people travel throughout the day. Each sighting can include a vehicle's plate number, appearance, location and the time it passed the camera. Flock says its system can search by plate, vehicle type and visible features.

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Get the free replay and checklist now at CyberGuyLive.com.

Automated license plate readers, also known as ALPRs or LPRs, have become common tools for police departments. Businesses and homeowners associations can also install them. The rules can vary depending on who owns the camera and who gets access to the data.

The cameras often appear on poles near streets, intersections and neighborhood entrances. Some have solar panels attached to the pole. As a car passes, the camera takes a photograph. Software reads the license plate and turns the image into a searchable record. CyberGuy previously found that license plate cameras are also scanning vehicles at some Home Depot and Lowe's parking lots.

Flock Safety has become one of the largest vendors in this market. Its cameras connect to a cloud-based system where authorized customers can review vehicle sightings. Unlike red-light cameras, these readers generally focus on identifying vehicles. They typically do not issue traffic tickets. Still, every passing vehicle can enter the database. The driver does not need to face suspicion or have any connection to an investigation.

A reader begins with your license plate number. However, the record can include much more than the characters printed on the plate. The system records a vehicle's make and model. It can also note the color and body type.

Visible features may become searchable as well. These can include a roof rack, bumper sticker or missing hubcap. The record also includes the camera location and a timestamp. Together, those details show where the vehicle appeared and when it passed. Flock says its license plate reader system focuses on vehicles rather than faces. The company also says its LPR cameras exclude facial recognition and biometric identification.

A single camera sighting may reveal little about your day. Several sightings can start to form a pattern. For example, a vehicle that appears near the same house each evening may reveal where someone lives. Another record could show a visit to a medical provider.

A license plate can also connect a car to information held by a state motor vehicle agency. That connection can help investigators identify the registered owner. Authorized personnel can search for a complete plate number. They may also search using a partial plate or vehicle description.

A department looking for a dark SUV with a roof rack could receive several possible matches. Investigators would then need to confirm which vehicle they want. That search ability can save time during an urgent case. Meanwhile, it also gives agencies access to information about drivers who have done nothing wrong.

California leads the country with more than 16,000 mapped readers, according to an analysis of DeFlock data. Florida followed with 7,169 cameras. Georgia had 7,046. Illinois had 5,822. The concentration becomes clearer when the figures are compared with road mileage. San Francisco County ranked third nationwide with 1,196 cameras per 1,000 road miles. Only New York County and Kings County ranked higher.

In Southern California, Orange County ranked No. 33 nationwide. It had 184 cameras per 1,000 road miles. Los Angeles County ranked No. 59 with 143 cameras per 1,000 miles.

However, DeFlock cannot provide a complete camera inventory. The open-source project relies on public reports and data from other sources. As a result, populated communities may have more markers because more people submit camera locations. Rural areas may appear less covered even when readers exist there. A missing marker cannot guarantee that a road has no camera. Likewise, some mapped locations may need updates after a camera moves or disappears.

Police departments can place license plates connected to stolen vehicles on a hotlist. They may also add cars linked to active investigations. When a camera detects a matching plate, the system can alert officers. That may help them locate a stolen car or find a missing person's vehicle. Investigators can also search earlier sightings. Those records may show where a vehicle appeared before or after an incident. However, an automated alert still requires human verification.

A recent LAPD review examined more than 210 million plate scans over two months. The system incorrectly flagged 161 plates as stolen. Yet not every incorrect alert led to a police encounter. During the same period, 337 alerts helped officers recover stolen vehicles. Those results show both the investigative value and the risk of an incorrect match.

License plate readers collect information from millions of vehicles. Most belong to people with no connection to a crime. Privacy advocates say connected camera networks can create a detailed driving history without requiring a warrant. They also worry about access by agencies far from the community that installed the camera.

Those concerns have already affected ordinary drivers. CyberGuy reported on a Colorado woman who was wrongly accused after Flock camera records linked her truck to the area of a porch theft. She had to gather Google Location Timeline data, vehicle camera footage and other evidence to prove where she had been. Police later voided the summons and dropped the case.

California law limits how local law enforcement agencies share automated license plate reader information. The state prohibits local agencies from giving ALPR data to federal authorities or out-of-state agencies. State officials say the information must remain within California.

However, allegations of improper sharing have raised questions about whether every agency follows those restrictions. California Attorney General Rob Bonta sued the city of El Cajon in October 2025. His office accused the city of sharing ALPR data with more than 100 out-of-state law enforcement agencies.

In January 2026, Bonta asked a court to order the city to stop the sharing. The case remained part of California's effort to enforce its ALPR privacy laws. The dispute highlights a gap between written policy and technical enforcement. A rule may prohibit sharing, but the system also needs controls that block unauthorized access.

THE SURVEILLANCE CAMERA ON YOUR STREET CORNER: LAWFUL SPYING OR CONSTITUTIONALLY PROBLEMATIC?

The Los Angeles Police Department entered a three-year operating agreement with Flock Safety in 2023. The arrangement covered access to data from 138 pole-mounted cameras across the city. The agreement expired on July 11, 2026. LAPD allowed it to lapse while officials addressed concerns involving data ownership, privacy and security. The department also wanted clearer limits on how Flock could store, share and use information collected by the cameras.

The 138 cameras continued operating after the agreement ended. However, LAPD employees no longer had regular access to the data they collected. That information remained stored in the cloud and could become available to investigators if the city finalizes a new agreement. Police officials began negotiating proposed terms with stronger safeguards. Under those terms, the city would retain ownership of every image, record and piece of metadata captured by the cameras.

Flock would also be prohibited from selling, publishing or sharing the information with outside organizations. In addition, the company could not use the data for commercial purposes or to train artificial intelligence systems. As of our reporting, LAPD and Flock had reportedly not finalized a replacement agreement, and talks are believed to be ongoing.

LAPD Chief Jim McDonnell called the technology a valuable investigative tool. Still, he said the department needed to use it responsibly. The dispute shows how quickly a camera program can raise difficult questions about control and oversight. Those questions become harder to resolve after a large network has already begun collecting information.

Flock rejects claims that its license plate readers continuously track a vehicle. The company says each camera captures a vehicle at one specific location. However, authorized agencies can search separate sightings stored within the system.

Flock says its default retention period lasts 30 days. Customers may choose a different period based on local laws or contract terms. The company also says customers control their information and sharing settings. According to Flock, every search is connected to a specific account and recorded in an activity log.

However, access questions can become more complicated when public-records laws enter the picture. CyberGuy previously reported that a Washington judge ruled Flock license plate reader images can qualify as public records, even when a private company stores the files for a city. The decision did not mean every driver record would automatically become public. However, it showed that using an outside vendor may not remove government surveillance data from state transparency laws.

Flock also says it does not sell customer data or use facial recognition with its LPR cameras. It says automated deletion and annual security audits help confirm that agencies follow their selected retention periods. Those safeguards address part of the privacy debate. Yet their effectiveness depends on how each customer configures the system and reviews employee activity.

You may never receive a notification when a license plate camera records your vehicle. Still, you can learn more about the readers operating around your community.

Check DeFlock at deflock.org for reported cameras near your home and regular driving routes. Remember that public submissions help build the map. Therefore, it may contain gaps or outdated locations. Look for cameras mounted high on narrow poles. A nearby solar panel can also signal a roadside reader.

Search your city or police department website for its ALPR policy. The policy may explain how long the department keeps vehicle records. It should also describe the types of investigations that allow a search. Do not assume every agency uses Flock's 30-day default. Contracts and local rules can set a shorter or longer retention period.

Find out whether other departments can search your community's camera data. A city may have strict internal rules while sharing access with a much larger network. That wider access can make local safeguards harder to evaluate. Look for an agency transparency portal if one exists. You can also request a list of connected departments from your city.

City council agendas often reveal proposed camera purchases before installation begins. Search meeting documents for terms such as "ALPR," "automated license plate reader" or "Flock Safety." Contract documents may show how many cameras the city plans to install. They can also explain who will own the records. Public meetings give residents a chance to ask questions before officials approve a larger network.

Ask who reviews searches for possible abuse. Audit logs offer limited protection when nobody checks them. You should also find out what happens after an employee violates the policy. Departments should explain whether they suspend access or begin an investigation. Strong consequences can discourage personal searches. They also show whether an agency treats its privacy rules seriously.

License plate readers can help police find a stolen vehicle or develop leads after a serious crime. That explains why departments, businesses and homeowners associations continue installing them. Still, these cameras record everyday drivers who have no connection to an investigation. A series of sightings can reveal where you go and when, even though the camera never captures your face. The Colorado case shows what can happen when a camera record points police toward the wrong person. Meanwhile, the Washington ruling raises another concern because some images held for a city may qualify as public records. Flock says customers control their data and can review searches through activity logs. Those protections depend on departments limiting access, checking for misuse and enforcing their own policies. LAPD's decision to pause access after its agreement expired shows that privacy concerns can slow a major camera program. However, the ongoing talks suggest the technology will remain part of the public safety debate. Before more cameras appear, your community deserves clear answers about who can search the records, how long the data stays available and what happens when someone abuses access.

Would you accept license plate cameras throughout your community if police said they helped solve crimes, or has this type of tracking already gone too far? Let us know by writing to us at CyberGuy.com.

Don't let fake election websites fool you before 2026 midterms

Thu, 30 Jul 2026 06:30:14 -0400

You spot a campaign shirt online that makes you laugh. The site carries the candidate's name. It also has polished product photos and a familiar checkout page. So, you assume the store supports the campaign.

A fake election website can copy enough campaign cues to make that assumption feel reasonable. Your money and personal information could then reach an operator with no verified campaign connection.

New research provided to CyberGuy by WhoisXML API, an internet intelligence company that analyzes domain, IP and DNS data, tracked 62,081 election-named domains created since September 2025. Researchers identified 13,645 addresses that read like campaign sites based on their names.

The research classifies only a portion of the domains as campaign-style addresses. Legitimate campaigns, supporters, merchants and domain investors may control many of them. However, researchers also found live storefronts that used candidates' names while selling merchandise and accepting donation-style payments. That smaller group creates the clearest risk for you.

FAKE PASSWORD-MANAGER ALERTS COULD PUT YOUR VAULT AT RISK

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Get the free replay and checklist now at CyberGuyLive.com.

Why fake election websites surge before the midterms

National elections create a rush for online real estate. Campaign teams want memorable web addresses before someone else claims them. Supporters may launch fan pages, while merchants see an opportunity to sell political products. Impersonators can follow the same naming formula.

According to WhoisXML API, nearly 46% of the curated campaign-style set used structures such as "[name]for[office]" or "for[state]." Domains referencing congressional races appeared most often. Senate-themed names came next. State names also appeared across about one-third of the curated set. Texas led with 537 registrations. Florida, Georgia, Ohio and Colorado followed.

Those names feel familiar because real campaigns use the same structure. As a result, a questionable domain can look credible before you open the page. Across the domains studied, researchers said 90% hid the registrant's identity. In addition, 88% carried a one-year registration term. Privacy protection and short registration terms can have legitimate uses. Still, those details deserve more attention when a new site also copies campaign branding or asks for money.

A small change in a domain can hide in plain sight. WhoisXML API highlighted massiemoneybomb[.]us, which closely resembled the established massiemoneybomb[.]com fundraising address. The main difference appeared after the final dot.

That change may look obvious on a large computer screen. However, it becomes easier to miss on a phone, especially when a text or social media post opens the page directly. Researchers also examined kenpaxton[.]us. They said the domain was 58 days old when captured, while kenpaxton[.]com dated back to 2008.

The newer site reportedly sold supportive campaign products alongside merchandise criticizing the same candidate. That unusual mix offers a clue that the store may lack an official connection. Yet many shoppers will focus on the product photos or the price. A polished checkout can make the entire operation feel established. Alexandre François, the WhoisXML API domain scam researcher behind the study, told CyberGuy that AI can help operators build convincing websites quickly and at scale. That makes it even harder to judge a campaign page by its appearance alone.

Political merchandise may cost you more than the price on the screen. According to the research, some storefronts allowed visitors to add donation-style payments of up to $1,000 to a shopping cart. The sites then processed the payment through their own checkout flows.

One store reportedly continued accepting a donation-style payment after the candidate's official ActBlue page stopped taking contributions. The checkout requested a full name, street address, email address and phone number. It also collected payment card details.

A familiar payment processor can make that form feel safe. However, its presence only shows how the payment moves through the checkout. It cannot confirm that the candidate authorized the store or that the campaign receives the money.

François said the study found no direct evidence that donors lost money or had their data misused. "Only the payment platforms could see whether a donor lost money or had data misused, and their data was not part of this study," he told CyberGuy. The findings support caution rather than a claim that every highlighted site committed fraud.

Domain registration records can expose useful clues before or after a website launches. Researchers can review the creation date, registrar, paid registration period and privacy status. Sometimes, the records also identify the owner or registrant country. However, each clue has limits.

Many legitimate website owners use privacy services to keep home addresses and contact details out of public databases. Campaigns may also register several defensive domains so impersonators cannot claim them first. A one-year registration term also appears across ordinary websites. Price and convenience often drive that choice.

The risk grows when several details point in the same direction. A nearly copied domain may lead to a new storefront with an unofficial donation flow. A mismatched disclaimer adds another concern.

For federal political committees, public websites generally need a disclaimer that identifies who paid for the communication. The wording may also state whether a candidate authorized it. The FEC explains that disclaimer requirements cover political committee websites and online fundraising communications. A disclaimer cannot guarantee honesty. Still, a missing or mismatched statement gives you a strong reason to leave the page and verify the site elsewhere.

Campaigns also face limits when trying to secure every possible variation of a candidate's name. François said they should consistently promote one official domain and one donation link. He added that "the realistic option is monitoring" because registering every possible look-alike domain would be impractical. Monitoring new registrations can help campaigns find look-alike sites during their first days online. Campaigns can then report suspicious pages to the registrar, hosting company or payment provider.

SAME-NAME CANDIDATE DISQUALIFIED FROM KEY SENATE RACE OVER ALLEGED DEM SCHEME TO CONFUSE VOTERS

Before you buy campaign merchandise or make a political contribution online, use these checks to confirm that the site connects to the candidate or committee you intend to support.

Avoid starting with a link from an unexpected text, email, online ad or social media comment. Instead, search for the candidate independently. Then compare the result with links from the candidate's verified social media account or established public profile. "No single sign is enough, so it's best to check a few together and to reach the page from the campaign's own channel," François told CyberGuy.

You can also use a personal data removal service to reduce the personal information available through data brokers and people-search sites. This may limit the details scammers can use to make unexpected messages, targeted ads or social media comments feel more convincing. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.

For federal races, use the FEC's campaign finance database at fec.gov/data/ to look up candidates and registered committees. The database shows federal candidate and committee filings. For state or local races, check the appropriate state or local election authority. Many campaigns process contributions through ActBlue or WinRed. In those cases, the payment address should show secure.actblue.com or secure.winred.com. Some campaigns use other processors, so an unfamiliar payment provider alone does not prove the page is deceptive.

Tap or click the address bar before entering payment information. Check the spelling and domain ending. Then look for added words or letters that imitate the campaign's real address.

A scammer may replace ".com" with ".us." Another operator may add words such as "official," "store," "donate," or "support" to make the address feel authentic. François said the difference may also involve one word, a hyphen or an ending such as ".vote" or ".store."

Scroll to the bottom of the site and review the area around the donation form. A federal political committee website should identify who paid for the communication. Depending on the committee, the disclaimer may also explain whether the candidate authorized it.

Compare that committee name with the FEC database. Leave the page when the names conflict or the disclosure looks vague. Keep in mind that a deceptive page can copy a real committee's name. Treat the disclosure as one clue rather than proof that the page belongs to the campaign.

Open the candidate's established website in a separate tab. Look for a direct link to the merchandise store or donation page. If the official site sends you somewhere else, use the link it provides.

Also review the store's contact details and return policy. Be cautious if it sells products supporting a candidate alongside merchandise attacking that candidate. That unusual mix may signal the store has no official campaign connection. A page that keeps collecting contributions after a candidate withdraws also deserves closer scrutiny. The same applies when a store continues selling campaign merchandise after the official donation page closes.

The padlock in your browser means the site uses an encrypted connection. It offers no proof about the person or business behind the page.

CISA warns that phishing attacks may use malicious websites that impersonate trusted organizations to collect personal information. A professional design and secure connection still require you to verify the operator.

Pressure can push you past obvious warning signs. Be cautious when a site claims a donation match will disappear within minutes. A countdown clock that keeps resetting should also raise concern.

The FTC's broader donation-safety guidance recommends researching an organization and resisting pressure to give immediately.

WHAT A SCAMMER SEES THE MOMENT THEY GOOGLE YOUR NAME

A credit card generally offers stronger dispute protections than a debit card. It also keeps the payment away from funds in your checking account. The FTC says legal protections for credit cards exceed those for debit cards in billing disputes.

Save your receipt and take screenshots of the product page and checkout. Make sure the full domain appears in at least one image. After you pay, check your statement to confirm the amount and make sure the site did not enroll you in recurring contributions.

A fake campaign website may try to push a malicious download or send you to another harmful page. Strong antivirus software can help detect suspicious files and block some dangerous websites. However, you still need to verify the campaign connection before you pay. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.

If a store asks you to create an account, use a unique password. A password manager can generate and save a strong password for you, so you do not have to remember it. Reusing a password could put your other accounts at risk if the login information gets exposed. Turn on two-factor authentication (2FA) when the site offers it.

Election season gives questionable websites a powerful disguise. A candidate's name can create trust before you verify who operates the page. The scale of this research should make every online donor slow down. Researchers found more than 62,000 election-named domains, though many may serve legitimate purposes. The clearest concern comes from active storefronts that copy campaign-style branding and collect money outside a verified campaign path. Take an extra minute before buying a shirt or making a contribution. Find the official campaign site through a trusted source. Then confirm the web address and committee disclosure before you enter personal or payment information.

Have you ever landed on a campaign website that looked real but left you wondering who was behind it? Write to us at CyberGuy.com and tell us what raised your suspicions.

Sign up for my FREE CyberGuy Report

Soft exosuit helps people walk without bulky motors

Tue, 28 Jul 2026 16:00:41 -0400

Walking through an airport or around a large store can take more energy as we get older. Researchers in China are now testing a soft robotic suit that could someday help your legs do some of that work.

The experimental soft exosuit assists the hips using thin artificial muscles instead of conventional motors and gearboxes. The research, published in the peer-reviewed journal Science Advances, describes a 4.2-pound prototype that fits around the waist and thighs like a lightweight harness.

In a small treadmill test, six healthy adults used an average of 13.9% less energy while the powered assistance was active. Sensors also showed that their leg muscles worked less.

So, how does the soft exosuit actually work, and what still needs to improve before you could ever wear one?

SELF-DRESSING CLOTHES COULD HELP OLDER ADULTS

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Get the free replay and checklist now at CyberGuyLive.com.

Many robotic exoskeletons rely on rigid motors to move a person’s joints. Others use compressed air, which requires pumps, valves and an air tank. Those components can make an exoskeleton heavy or noisy. They can also restrict how naturally your body moves.

The new soft exosuit takes a different approach. It uses flexible muscle-like fibers positioned near each hip. As you walk, the fibers pull at the right point in your stride to help move your leg forward. Straps transfer that pulling force from the artificial muscles to the wearer’s hips and thighs. The flexible design allows the suit to move with the body rather than enclosing the legs inside a rigid frame. "Motor-free" refers to the lack of traditional motors and gearboxes. The suit still uses a compact battery pack and electrical power system to activate its artificial muscles.

The artificial muscles use a rubber-like material called a dielectric elastomer. The material changes shape when exposed to an electric field. Researchers have studied dielectric elastomers for years. However, earlier designs lacked the force needed to help move a human leg. Many were also too bulky for a comfortable wearable device.

Wei Yu and his colleagues at Hebei University of Technology changed the molecular structure of the material to improve its performance. They then rolled thin layers into long fibers. Next, the team grouped several fibers into bundles. The arrangement works somewhat like human muscle, where many smaller fibers pull together to create greater force.

The researchers also created modular connectors that allow them to add more fibers when an application requires additional pulling power. According to Hebei University of Technology, the actuators completed more than 100,000 cycles during laboratory testing. Longer studies will need to show how well the materials hold up during daily wear.

COULD A PAINT-ON ELECTRONIC TATTOO SPOT HEART ATTACKS?

The researchers tested the soft exosuit on six healthy volunteers. Each participant walked on a treadmill under several conditions. They walked without the suit. They also wore it with the artificial muscles turned off. During another round, the electrical assistance actively supported their hips.

A metabolic testing system measured how much oxygen each person used. Sensors attached to their legs also tracked muscle activity. When the assistance was active, the volunteers used an average of 13.9% less energy than they used while walking without the suit. Lower muscle activity also suggested that their legs needed less effort to complete each step.

That reduction could feel meaningful during a long walk. However, this study involved a controlled treadmill setting and a very small group. The volunteers were also healthy adults. Researchers still need dedicated studies involving older people and those with mobility challenges.

A wearable device that reduces walking effort could help people stay active longer as their leg strength changes. Think about walking through a large grocery store or spending the day with family. A lightweight suit that takes some strain away from your hips could make those outings feel more manageable.

The design may also feel less intimidating than a rigid robotic frame. Its artificial muscles resemble cords built into clothing, while the supporting straps fit close to the body. People recovering from surgery could also benefit from this type of assistance one day.However, future clinical trials will need to determine who can use the suit safely and how much support each person needs. Balance presents another important consideration. The current study focused on the energy required for walking rather than fall prevention or stability.

The current prototype remains an early research system. Battery life limits how long the suit can provide assistance. The researchers want future versions to operate longer without adding much weight.

The control system also needs to respond automatically when a person speeds up or slows down. Walking across grass or climbing a slope would create additional challenges. Voltage presents another hurdle. Dielectric elastomer actuators often require more than 1,000 volts. The current stays very low, but any wearable consumer product would need strong insulation and extensive safety testing.

Researchers will also need to study how the fibers respond to sweat and changing temperatures. Repeated bending during everyday activities could affect long-term performance as well. No consumer price or release date has been announced.

FDA TO REVIEW 7 POPULAR PEPTIDES TOUTED FOR WEIGHT LOSS, HEALING AND LONGEVITY

You will not be buying this soft exosuit anytime soon, but the research shows where mobility support could be headed. A lighter system that moves with your body could feel far more natural than today's bulky powered exoskeletons.

The nearly 14% drop in walking energy use is encouraging. Still, the test involved only six healthy adults on a treadmill, so we need much more evidence about comfort, safety and real-world use.

The next big step is testing the suit with older adults and people who already have trouble walking. That is where we will learn whether these artificial muscles can truly help people stay active and independent. For now, anyone noticing changes in mobility should talk with a doctor or physical therapist about the support that makes sense today.

What grabs me here is how much walking support the researchers created without loading someone down with bulky motors. A 4.2-pound suit that cut energy use by nearly 14% is worth watching. Still, this was a very small lab test with only six healthy adults. The battery needs to last longer, and the high-voltage system will need serious safety testing. The bigger test comes next. I want to see how this soft exosuit performs with older adults on real sidewalks and over longer periods before we call it a true mobility breakthrough.

Would you wear a powered exosuit to keep walking farther as you get older? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Wearable patch vibrates when danger is nearby

Tue, 28 Jul 2026 10:30:33 -0400

Your phone can warn you about bad weather or heavy traffic. However, some dangers cannot wait for you to notice a notification. A hazardous gas may already surround you. Contaminated water may look perfectly normal. By the time you unlock your phone and check an alert, you could have already spent valuable time near the threat.

Researchers at North Carolina State University have developed a wearable patch that takes the phone out of that warning process. The device detects environmental hazards, then vibrates directly against your skin.

Different vibration patterns tell you which hazard the patch detected. Meanwhile, a related version gives robots their own form of chemical awareness.

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our free CyberGuy Live class "Sick of Spam?" has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.

Get the free replay and checklist now at CyberGuyLive.com.

SELF-DRESSING CLOTHES COULD HELP OLDER ADULTS

The square patch is slightly smaller than a driver's license. That makes it compact enough to attach to clothing or place directly against the skin. Inside, a microcontroller acts as the patch's brain. A small battery powers the system. Six sensors monitor the surrounding environment for potential hazards.

The researchers designed the sensors to detect threats in the air and contaminants in water. Examples include dangerous gases and heavy metals. Once the patch detects a hazard, a tiny actuator creates a vibration against your skin. That physical alert could be harder to overlook than another phone notification.

"If you're coming into contact with a hazardous substance, you need to know as quickly as possible," said Erim Uzunoğlu, the paper's first author and a Ph.D. student at NC State. The research appears in the scientific journal Device.

Environmental sensors already exist. Many can send a warning to your smartphone. However, that approach depends on you noticing the alert. Your phone could be in a pocket, buried in a bag or silenced during work.

A physical vibration removes that extra step. The warning reaches your body as soon as the sensor detects a potential threat. Still, the researchers found that adding a small vibrating motor was not enough. The sensation had to feel strong and distinct without becoming uncomfortable.

To solve that problem, they created tiny textured surfaces between the motor and the skin. These surfaces resemble miniature patterns of raised bumps. By changing the size and spacing of the bumps, the team adjusted how each vibration felt. As a result, the alert became easier to notice. The design could prove helpful in loud environments where an audible alarm might disappear into the background.

The patch does not use the same buzzing sensation for every warning. Instead, it produces a separate haptic sequence for each hazard. One pattern might signal a dangerous gas. Another could warn about a contaminant in water.

This creates a small tactile language between the patch and the person wearing it. Therefore, you may understand the type of threat without checking a display. In proof-of-concept testing, the patch successfully detected the targeted substances. It also triggered the appropriate vibration immediately.

However, people would need time to learn what each pattern means. Clear training would become especially important in workplaces where several hazards may be present.

A wearable safety device offers little protection when its battery dies halfway through the day. To reduce that risk, the researchers placed thin-film photovoltaic cells on the patch's exterior. These cells collect solar energy while someone wears the device.

The solar cells work alongside the internal battery. At the same time, the sensors use relatively little power. During testing, that combination kept the device operating for around 24 hours. That running time could cover a full work shift. However, real-world performance would depend on sunlight, sensor activity and how someone wears the patch.

COULD A PAINT-ON ELECTRONIC TATTOO SPOT HEART ATTACKS?

As the team developed the wearable patch, the researchers began considering another question. Could a robot use the same tactile warning system? That idea led to an electronic skin, also called e-skin.

The robotic version places the sensor patch over a piezoelectric layer. When the patch vibrates, that movement creates an electrical signal. The robot can read the signal and identify the vibration pattern. It can then respond to the detected hazard without waiting for a wireless message.

During testing, researchers placed the e-skin on quadrupedal robots. When the robots detected chemical hazards, they changed direction and followed a safer route. This system could help robots explore locations that may be unsafe for people. It could also let a machine respond when wireless connections become unreliable.

Most robots rely heavily on cameras and digital instructions to understand their surroundings. Yet a camera cannot always identify a dangerous gas or invisible contaminant. The e-skin gives a robot another way to sense risk. More importantly, it turns the chemical warning into a physical signal within the robot's body.

That direct connection could support faster decisions. The robot would not need to transmit sensor data to a remote computer before responding. For example, a robot could inspect an industrial site while watching for leaks. It could then stop or change direction when it encounters a dangerous substance.

However, this work remains at the proof-of-concept stage. Researchers will need to test the system across harsher conditions before it can support high-risk missions.

Many experimental wearables rely on highly specialized components. Those custom parts can increase costs and slow production. In contrast, the researchers built most of this patch and e-skin with components that are already available. Only a few elements required custom engineering. That could make the technology easier to scale.

The sensor array is also modular. Developers could remove sensors that are unnecessary for a certain environment. They could then add sensors for hazards tied to a specific job or location. A water-quality worker would need a different setup than someone inspecting an area for chemical leaks.

You cannot buy this wearable hazard detection patch yet. Still, the research shows how safety alerts could move beyond screens and speakers. A vibration against your skin may reach you faster than a notification on your phone. That could become especially valuable when every second affects your exposure.

The technology may eventually help people who work near chemicals or inspect questionable water supplies. It could also support emergency teams entering places where the air may be unsafe. However, several questions remain. Researchers must determine how the patch performs after repeated wear and exposure to harsh conditions. They will also need to reduce false alarms and make each vibration easy to recognize. Comfort will play a role too. A safety patch only works when people are willing to wear it throughout the day.

NEW YORK SCHOOL DISTRICT TO DEPLOY HUMANOID ROBOT IN CLASSROOMS THIS FALL

A warning can only protect you when it reaches you in time. This wearable patch brings the alert directly to your skin instead of relying on a phone that you may never check. The separate vibration patterns are especially clever. They could tell you which danger is nearby before you even look at a screen. Meanwhile, the robot e-skin gives machines a physical way to recognize chemical threats and move away from them. That could eventually keep people farther from hazardous areas. The next challenge will be turning a successful laboratory prototype into something durable, comfortable and dependable enough for daily use.

Would you trust a vibration on your skin to tell you that the air you are breathing or the water near you has become dangerous? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report

What your internet provider, websites and advertisers see

Tue, 28 Jul 2026 07:08:24 -0400

Most people assume that if they are not posting on social media or sharing personal information online, they are staying relatively private. Unfortunately, that isn't how today's internet works.

Every time you browse the web, multiple companies can collect information about you. Your internet provider can monitor certain parts of your online activity, websites can gather data about your visits and advertising companies can use tracking tools to build profiles based on your browsing habits.

The good news? Knowing what others can see is the first step toward protecting your privacy.

AI WEARABLE WATCHES YOU TO PREDICT WHAT YOU NEED

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Get the free replay and checklist now at CyberGuyLive.com.

Your internet service provider, or ISP, acts as the middleman between your devices and the internet. Every website you visit and every online service you use passes through its network.

If you are not using a VPN, your ISP can generally see which websites you are connecting to, when you are online, how much data you are using and your approximate location based on your IP address. Encrypted websites, which begin with "https://," help prevent your provider from reading the contents of most web pages or messages. However, your ISP can still often see that you connected to a certain website in the first place. That information alone can reveal a lot about your interests, routines and habits.

Even if you never create an account, some websites can still learn quite a bit about your visit. They can identify your IP address, estimate your location, determine what device and browser you are using and record which pages you viewed.

Some websites also use analytics tools, tracking pixels and advertising scripts to understand how visitors interact with their pages. These tools can show what links you clicked, how long you stayed and which content got your attention.

In some cases, this information may also be shared with advertising or analytics companies. That is one reason you may see ads that seem closely connected to something you recently searched for, viewed or clicked.

ARE APPLE DEVICES SPYING? WHAT YOUR IPHONE TRACKS

Private browsing tabs, also known as incognito mode in some browsers, can be useful. They help prevent your browser from saving your local browsing history after you close the window.

However, private browsing does not make you invisible online. Websites can still see your visit while you are on their pages. Your internet provider can still see many of the sites you connect to. If you are using a work, school or public network, the network owner may also be able to monitor certain activity.

Private browsing is better thought of as a local privacy tool. It helps hide activity from someone else using the same device later, but it does not fully hide you from websites, advertisers or your internet provider while you are online.

How to reduce what others can see

You cannot eliminate online tracking entirely, but you can make it harder for companies to collect information about you. Start by reviewing your browser's privacy settings. Turn off unnecessary website permissions, such as location, microphone and camera access for sites that do not need them. Consider using a privacy-focused browser or search engine that collects less personal data.

You can also check out these 11 easy ways to protect your online privacy for more ways to limit online tracking. You should also limit how much personal information you share online. The more details you provide across websites, apps and accounts, the easier it becomes for companies to connect your activity. Most importantly, consider using a VPN.

A VPN, or virtual private network, encrypts your internet traffic before it leaves your device. Instead of your internet provider seeing which websites you are connecting to, it sees an encrypted connection to the VPN server. That makes it much harder for your ISP to build a browsing profile based on your online activity.

A VPN can also help protect your information on public Wi-Fi networks and mask your IP address from websites, advertisers and other third parties. However, a VPN does not stop every type of online tracking. Websites may still recognize you when you log in to an account, use the same browser or share personal details.

A solid VPN makes this process easier by offering apps for computers, smartphones, tablets, smart TVs and routers. That allows you to protect multiple devices with one account.

For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android and iOS devices at CyberGuy.com.

WHAT A SCAMMER SEES THE MOMENT THEY GOOGLE YOUR NAME

The next time you go online, remember these steps:

The internet is built around data, and several companies can collect information every time you browse. Internet providers can see where you are connecting, websites can monitor visits and advertising companies can use tracking tools to build profiles over time. You cannot disappear completely, but you can reduce what others learn about you. A few privacy-minded habits, combined with a trusted VPN, can help you take back more control of your online activity.

When was the last time you checked what your browser, apps or internet provider can see about you? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Your home is empty. Do burglars already know?

Mon, 27 Jul 2026 12:00:01 -0400

In Argentina, authorities recently arrested three Chilean men wanted in the U.S. in connection with a South American theft group accused of burglarizing the homes of professional athletes.

Federal prosecutors linked the group to break-ins involving Kansas City Chiefs stars Patrick Mahomes and Travis Kelce, Milwaukee Bucks player Bobby Portis and other athletes. Two of the suspects were also arrested in connection with a burglary at the home of tennis legend Juan Martín del Potro in Argentina.

According to prosecutors, the group identified targets through publicly available schedules and location information, then struck while athletes were away or playing games. Separately, the FBI has warned that international theft groups surveil homeowners to learn their routines and advises travelers to avoid announcing vacations on social media.

Online criminals can research your address, family, travel plans and estimated property value without ever driving down your street. Here's how criminals piece together those digital clues and what you can do to make your home harder to target.

ALLEGED BURGLARY CREW THAT TARGETED PATRICK MAHOMES AND TRAVIS KELCE HOMES ARRESTED IN ARGENTINA: REPORT

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Get the free replay and checklist now at CyberGuyLive.com.

It may be tempting to assume these crimes only affect people with mansions, expensive cars and celebrity lifestyles. Those cases make the news, but professional athletes and entertainers are far from the only targets. Security researchers and law enforcement agencies have tracked burglary crews using the same methods against everyday homeowners.

One recent case involved a Los Angeles content creator whose Silver Lake home was burglarized while she was traveling. Thieves reportedly took tens of thousands of dollars in designer goods. She had shared that she was away, which gave anyone watching her public account a useful clue.

For retirees, the risk can grow as travel becomes more frequent. You may finally take the cruise you have planned for years, spend a month in Florida each winter or take a road trip to visit your grandchildren. Those trips also create more opportunities to post "we made it" from an airport, beach or campground while your home sits empty.

Maybe you wait until you return home before posting vacation photos. However, someone in your life may share the information for you. A spouse might tag the airport. An adult child could post a picture of the grandchildren in front of your house. A neighbor might mention that you are away on your annual trip.

You have limited control over what other people share, so talk with your family before traveling. Ask everyone to wait until you return before posting locations, travel photos or details about how long you will be gone. Watching what your family posts helps, but social media provides only part of the information criminals can collect.

Investigators in Riverside, California, say they routinely find Zillow and Redfin searches on the phones of arrested burglary suspects. These sites may reveal an estimated property value, past sale prices and photos from an old listing. In some cases, criminals can view interior layouts, doors, windows and rooms before they approach the property.

Public property records can also reveal the owner's name, mailing address and purchase history. Meanwhile, data broker and people-search sites may connect that address with phone numbers, relatives, previous homes and other personal details. Combine "this person is traveling" with "this home has significant value," and criminals have the beginnings of a target list.

AI VOICE SCAMS CAN CLONE YOUR FAMILY’S VOICE

Search your name, phone number and home address to see what appears. You may find people-search profiles that list your age, relatives, address history and possible phone numbers. Real estate websites may still display old interior photos, even when you purchased the home years ago. Someone could use those details to connect your social media account with a specific property.

Want to see what information data brokers may have about you? Run a free scan to find out if your personal information is already out on the web: Cyberguy.com. You should receive the results within an hour.

These steps can reduce the amount of useful information available to someone researching your home. They work best alongside basic home security measures, such as an alarm system, a doorbell camera, light timers and secure storage for valuables.

Save airport, hotel and sightseeing photos until you are back home. Real-time posts can tell strangers where you are and confirm that your house may be empty.

Tell your spouse, children, grandchildren and travel companions to wait before sharing your location or mentioning your travel dates.

Limit posts to people you know. Remove followers you do not recognize and check whether old public posts reveal your routines, vehicles or home address.

Ask a trusted neighbor to collect mail, newspapers and deliveries. You can also place a temporary hold on your mail before an extended trip.

Use timers or smart plugs to turn lights on and off at different times. Leaving every light off for two weeks can make an empty home easier to spot.

WHAT A SCAMMER SEES THE MOMENT THEY GOOGLE YOUR NAME

Search your address on Zillow, Redfin and other real estate sites to see whether old listings reveal interior rooms, entrances or the layout of your home.

On Redfin, use a desktop browser and sign in. Select your name in the upper-right corner, choose My homes, select your claimed property and click Edit Photos. Check Hide listing photos, then select Yes, Hide Photos. This feature applies to off-market homes and currently does not appear in the Redfin mobile app.

On Zillow, sign in and select your profile icon, followed by Your Home. Choose your property and claim ownership if you have not already done so. From the Owner View, select Edit Facts. You can remove individual photos, delete all photos or check the option to hide photos from public view. Select Save Changes when finished.

Some off-market homes may not offer the editing option. In that case, submit a request to Zillow Customer Support. Other real estate sites may require you to claim the property, contact customer support or ask the original listing agent for help.

Data broker and people-search sites can connect your name, phone number, relatives and home address. Search for your information and request removal from sites that display it.

A data removal service can automate requests across hundreds of covered brokers and continue checking whether your information returns. It cannot erase government property records or every old real estate listing, so use it alongside the other home protection steps above.

You can also submit removal requests yourself, though the process may take more time and require repeat checks.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Search your name, address and phone number every few months. Look for new people-search profiles, outdated listings and social media posts that reveal more than you intended.

Burglary crews no longer need to spend days watching your street. Social media can reveal when you are away, while property records, real estate listings and people-search sites can reveal where you live and what your home may be worth. Retirement often brings more time for travel, which creates more opportunities for you or a family member to announce that your home is empty. You have limited control over public records and what your relatives post. However, you can delay travel posts, tighten privacy settings, remove old listing photos and reduce your exposure on data broker sites. Removing your personal information will never make you invisible. It can still make your home harder for online criminals to research and target.

Have you ever found personal details about your home online that surprised you? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report

What to look for in antivirus software without the jargon

Mon, 27 Jul 2026 10:00:40 -0400

Shopping for antivirus software can feel harder than it should. Many product pages lead with buzzwords, lab scores and long feature lists. Most of us just want a simple answer: Will this help keep my computer safe without making life harder?

That question gets more important every day. Scammers use fake texts, phishing emails, bogus websites and infected downloads to trick you into giving up your money, passwords or access to your personal files.

The good news? You do not need to understand every technical term to make a smart choice. A strong antivirus program should automatically monitor for threats, help block malware and ransomware, include firewall protection and run quietly in the background.

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our free CyberGuy Live class, "Sick of Spam?," has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.

Get the free replay and checklist now at CyberGuyLive.com.

HALLUSQUATTING AI ATTACK COULD HIJACK YOUR COMPUTER

The first thing to look for is real-time protection. That means the software keeps watching while you browse, open attachments, download files or click links. Threats can show up at any moment. Malware can hide inside downloads, fake websites or links that look harmless. If your antivirus only works when you remember to run a scan, you may miss the moment when protection counts most. When comparing options, ask one simple question: Does this protect me automatically? For most people, automatic protection is the safer choice because it works before you remember to check.

Many people still use the word virus for almost every online threat. Today's risks go much wider. Strong antivirus software should help protect against malware, spyware, ransomware and suspicious activity. Ransomware deserves special attention because it can lock your personal files, photos and documents. Once that happens, getting access back can become stressful, expensive or impossible. So, instead of getting stuck on product jargon, look for clear language about the threats the software helps stop. You want protection that covers the problems people actually face today.

REDHOOK ANDROID MALWARE CAN QUIETLY HIJACK YOUR PHONE

The word firewall sounds technical, but the idea is simple. A firewall helps monitor traffic going in and out of your device. It can also help block suspicious connections. That matters because some threats try to communicate with your device or send data out without your knowledge. A firewall gives your system another layer of defense. When shopping, check whether firewall protection is included. Some antivirus products offer stronger firewall tools than others, so this can be a meaningful difference.

Many people avoid antivirus software because they worry it will slow down their computer. That concern makes sense. Security software that constantly interrupts you can get ignored, delayed or turned off. Performance should matter. Good antivirus software should run in the background without making everyday tasks feel harder. You should still be able to browse, work, stream and manage files without constant pop-ups or delays. For most mainstream users, the best choice often comes down to everyday comfort. If the software feels easy to live with, you are more likely to keep it running.

Online threats keep changing. Scammers adjust their tactics. Malware changes. Fake websites appear quickly, then disappear and show up somewhere else. That is why updates matter. Antivirus software works best when the provider keeps improving detection as threats evolve. Before choosing a product, look for signs that it receives regular updates. You want protection that keeps pace with newer risks rather than software that feels frozen in time.

Many attacks begin before malware ever reaches your device. A fake delivery notice, phishing email or bogus text can push you to click a bad link or enter personal information on a fake site. That makes scam protection worth checking. Good security software should help flag suspicious links, fake messages and risky websites before they create a bigger problem. AI-powered scam detection can provide another layer of help by analyzing questionable content and warning you when something appears unsafe. This can be especially useful during everyday browsing, shopping and email use.

You do not need to compare every technical feature on every product page. Start with the basics. Look for real-time protection that runs automatically. Make sure the software helps block malware and ransomware. Check for firewall protection. Pay attention to performance. Also, look for regular updates and scam detection. That approach helps you focus on what actually affects your daily life. The goal is simple: protect your device without turning computer security into a second job.

Use this checklist to narrow down your options. Look for real-time protection against viruses, malware, spyware and ransomware, along with a firewall that helps block suspicious connections.

Usability matters too. Security software should run quietly in the background without slowing down your device or interrupting you with constant alerts. Before choosing a plan, compare its features, device limits, introductory price and renewal cost.

The most useful question remains practical: Will this protect you automatically, cover the threats you may encounter and stay easy to use every day?

Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.

Antivirus software can feel confusing because companies often make it sound more complicated than necessary. Most people are not shopping for technical jargon. They want protection that works before a bad click turns into a costly problem. The best approach is to look past the marketing language and focus on what the software actually does for you. Real-time protection, ransomware defense, firewall tools, scam detection and regular updates all matter. Performance matters too. If security software slows down your device or interrupts you constantly, you may stop using it. Look for an option that runs quietly in the background and remains easy to manage. The key is choosing antivirus software you will keep turned on, keep updated and trust when something suspicious appears.

Do you trust your antivirus to catch today's scams before you click, or are you relying on luck more than protection? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report