Security Newsletter | 12/25/25

If you take nothing else from this newsletter, just do these three things to protect yourself:

1. Use a password manager if you are not already. Password managers are the most secure way to create and store your passwords. If you’re not sure which password manager to use, the Passwords app is a great option.
2. Use multi/two-factor authentication wherever possible. Using a second form of authentication makes it harder for hackers to access your accounts even if your password is compromised. The Passwords app can generate 2FA codes for you.
3. Double-check suspicious emails. If you receive an email warning you about a large purchase that you made, that you won a large sum of money, or that just generally seems too good to be true, take a few minutes to check if the email is legitimate.

Australia Fights Back Against Scammers

Back in February, Australia passed legislation to combat scammers. This new framework requires banks, telecommunications companies, and social media companies to “proactively detect and disrupt scams and report scam activity.” Some of the ways this works is that social media companies must verify their advertisers, and when banks process transactions, they must verify who the payee is. We should find out over the next year or so how effective this framework really is, but it certainly sounds like a step in the right direction.

The Bottom Line: If you’re an Australian citizen, hopefully this legislation has been or will be beneficial to you. We’d certainly like to see this framework implemented in other countries as well.

World Governments Taking Action Against Scam Centers

One of the darkest problems we’ve reported over the past few years has been the spread of scam compounds growing up along the Thailand-Myanmar border. These facilities operate by luring foreign workers with false promises of good salaries or other benefits, but the workers are effectively enslaved and forced to run scams online. Throughout the year, we’ve seen quite a few positive stories about scam centers being shut down and workers being freed. In Myanmar’s Karen State, more than 250 people were freed by an armed militia group. Thailand itself took action as well, cutting off power to multiple locations along the border and shutting down several scam operations. The country also helped to free 7,000 victims and return each of them to their home countries. China handed out sentences to 39 members of the Ming family, a family known for running scam centers throughout Myanmar. 

Many of these scam centers rely on satellite internet provided by Starlink. After this was discovered by journalists and Congress began to take an interest, SpaceX finally took action to disable thousands of Starlink devices throughout Myanmar, crippling many scam centers. The United States has also put together a strike force to combat cryptocurrency scam centers in Myanmar. With pressure from both the US and China, the Karen State Border Guard Force (BGF) has also begun conducting raids on scam centers along the border.

The Bottom Line: Shutting down scam centers is an immense task. It’s good to see these countries working together, taking action, and freeing thousands of people.

YouTube Cracks Down on AI Content

This past summer, YouTube adjusted its monetization policies to curb the rise of AI-generated content on the platform. Since July 15, “inauthentic” content uploaded to YouTube has not been eligible for monetization. That means YouTubers making low-effort videos generated using artificial intelligence won’t be making any money off of them. According to YouTube’s Head of Editorial & Creator Liaison, Rene Ritchie, this is actually not that big of a change, as YouTube has always had rules against “inauthentic” content. However, this update to the policy clarifies what “inauthentic” content means.

The Bottom Line: It’s great that YouTube is taking action against AI-generated content. While you’ll likely still come across this type of content when browsing YouTube, you can report it, and hopefully connect more with genuine human creativity.

Passkey Portability Comes to iOS 26

Swapping password managers is now easier than ever with the iOS and macOS 26 updates. Apple has integrated passkey portability into the Passwords app, which means that now, if you want to switch password managers, you can take your passkeys with you without any trouble. This works both with moving passkeys to and from the Passwords app.

The Bottom Line: You can move your passwords and passkeys between password managers much more easily than before. If you were considering switching to the Passwords app from a third-party password manager (or vice versa), you should have no trouble doing so.

The Signal Chat: “We Are Currently Clean on OPSEC”

There have been many hilarious security fails this past year, but unfortunately, the biggest by far came back in March, when members of the Trump administration accidentally added the editor-in-chief of The Atlantic to a Signal group chat where they were discussing a military action. Somehow, in a stroke of unwitting comedy gold, US Secretary of Defense Pete Hegseth was moved to message this highly compromised chat to say: “We are currently clean on OPSEC.” (OPSEC is short for OPerational SECurity—the skills and techniques of preventing leaks.)

The Trump admin was quick to deny the incident happened and claimed that no classified material had been shared through Signal. But The Atlantic was just as quick to offer up proof. Since the material was no longer considered classified, the magazine published screenshots of the chat.

The following month, things got even worse when it was alleged that Hegseth had discussed the very same military action in a second Signal group chat that included his wife, brother, and personal lawyer. And if that wasn’t bad enough, further revelations came in May after a hacker breached the foreign company TeleMessage, which sells the modified version of Signal that the Trump admin was using, and easily accessed vast logs of supposedly secure chats. That means those secret chats were using a version of Signal that had been modified by a private company, meaning the messages could easily be intercepted by hackers or other foreign adversaries. 

The Bottom Line: As an end-to-end encrypted messaging platform, Signal is a great app for the average person who wants to maintain privacy, presuming you only use the Signal app available through the App Store, not a modified version. However, it is not set up for government use, where vetting, accountability, and oversight demands are all much greater. It all goes to show that you can never know for sure if you’re really “clean on OPSEC.”

The correct answer is 4. Deny access to your photo library. 2. and 3. aren’t always bad options either, but in the case of a calendar app, there’s not really any good reason the app should need access to your photos. Even if the app gives a good reason or the developer seems legitimate, entrusting an independent third-party with access to all of your photos is a risky move. One data breach and all your photos are in a malicious actor’s hands.

Of course, this isn’t a one-size-fits-all solution. Use your best judgment on an app-by-app basis. If it doesn’t make sense to grant access to something like your photos or your contacts, don’t give the app permission.

Stay secure this holiday season. Check out:

• How to Secure Messages on Your iPhone & iPad
• Lock Your Apple Account with a Physical Key
• Get Your iPhone Microphone to Stop Listening to You