Security Newsletter | 2/5/26

If you take nothing else from this newsletter, just do these three things to protect yourself:

1. Check what data apps collect from you. Before installing an app, scroll down and find the App Privacy section to check what data you are allowing the app to access.
2. Create new passwords using a password manager. Your password manager can create secure passwords and keep track of them for you.
3. Keep your email address private. The Hide My Email feature allows you to create dummy addresses that forward emails to your primary email address.

A new report from Gen—the parent company behind Norton, AVG, Avast, LifeLock, and other consumer-security products and companies—claims that almost a third of English-language advertisements on Facebook and Instagram in the UK and EU were malicious: either scams or pointing to malicious websites that would try to infect victims with malware. Check out the abbreviated report from Gen’s blog, where the company’s researchers offer some (sparse) details behind how they arrived at this conclusion. The researchers note that the only reason they were able to do this research at all was because of laws in the EU and UK that force Meta to make advertising data publicly available to researchers. The USA does not have similar laws, so while the rate of scams on Facebook ads here in the USA may be similar, the researchers can’t study it, so we don’t know.

The researchers found that a majority of these scams seem to stem from a small number of highly organized operations that create thousands of fraudulent webpages and swap them out for new ones at a high rate. This saturates Meta’s fraud-detection system, which is reactive and can only take down a post when it has been reported. Producing huge numbers of scam accounts easily overcomes this system.

This report comes in the wake of reporting by the Wall Street Journal, which, based on documents from Meta, suggests that the company is aware of its many scam advertisers and chooses to charge extra for ads that it suspects may be fraudulent. 

The Bottom Line: Continue to practice great caution when engaging with ads on Meta technologies: Facebook, Instagram, and Threads. These ads are saturated with scams. Likewise, continue to practice caution when engaging with private messages on Meta technologies, where moderation of scam activity does not keep up with the volume of fraudulent traffic. Consider adopting alternative social networking platforms such as Mastodon.

ICE-Spotting Apps Breached

In the past few months, there has been a surge in ICE-spotting apps, apps designed for users to report sightings of ICE in order to help warn friends and neighbors who might be undocumented. Several of these apps have seemingly been breached, with users reporting that they have received notifications and texts from the apps saying that their data had been sent to law enforcement. At least one of these apps’ developers has responded, claiming that his app, StopICE, doesn’t store the information that the threatening notifications are claiming to have leaked. Read more at 404 Media.

The Bottom Line: Security is hard to get right, especially for independent app developers who collect a lot of user data, as we’ve seen with apps like the Tea app or TeaOnHer. The best way to avoid data leaks like this is to avoid sharing the data to begin with—no matter how reputable an app seems, always ask yourself what might happen if the data you’re sending to the app is stolen. Stay away from new apps that are jumping on a fad.

Google Settles Lawsuit Alleging Its Voice Assistant Recorded User Conversations

Google is settling a $68 million class action lawsuit alleging that Google Assistant illegally recorded private conversations, similar to the lawsuit Apple faced last year regarding Siri. Google claims that its devices only record users' voices when they speak an activation phrase. However, the lawsuit claims otherwise, alleging that Google Assistant has recorded conversations about personal details, such as financial or employment information, and then shared these recordings with advertisers. Head over to CBS News for the full story.

The Bottom Line: If you are included in this lawsuit, you will likely receive an email or a letter soon with information on how you can submit a claim.

Bug in Ransomware Corrupts Files

Ransomware group Nitrogen has run into a small problem. The way ransomware works is that malware is deployed, which encrypts the victim’s file system, making it impossible for the victim to access their data, while the ransomware group has the decryption key. The group then offers to hand over the decryption key if the victim pays a large sum of money. However, a bug in the malware used by Nitrogen causes it to encrypt files with the incorrect decryption key. That means that not even the threat actor itself can decrypt the files, so anyone affected by the group's ransomware cannot regain access to any data that was stolen, even if the ransom is paid. Coveware has a more detailed write-up about the bug.

The Bottom Line: Ransomware groups cannot be trusted. There’s no guarantee you’ll get your files back even if the ransom is paid. And if you’re dealing with incompetent coders, the ransomware hackers might not even be able to give you back your files in the first place.

The correct answer was probably 1: Don’t engage with the website, close the tab, and run a malware scan. Malicious websites will try to trick you into downloading dangerous payloads—infostealers, ad-injectors, even ransomware. But on a Mac or iPhone, you’d have to actually download it most of the time, so simply not engaging with the website at all and closing the tab is your first line of defense. If you don’t download anything, then you’re most of the way there. It may occasionally be possible for malware to infect your web browser without your installing anything, so it is also a good idea to run a malware scan. As for the other two answers, clearing your browser cache isn’t a terrible idea, and rebooting your computer can help with a lot of things, but it won’t protect you from a malware infection or a browser-jacker attack.

Related: How to Get Rid of Fake Virus Alerts

Worried about viruses on your iPhone? Check out:

• Answered: Can iPhones Get Viruses?
• How to Use Lockdown Mode on iPhone