Scammers are sending job seekers fake interview invites with a link to what looks like a Calendly page for a call with a Meta recruiter. You pick a slot, then it asks you to log into Facebook and then Google “for security” — but the login windows are fakes, right down to a web address bar showing a real Facebook address. They grab your password and your 2FA code, and pass the code to the real site straight away, before it expires. Full write-up from Malwarebytes Labs.
The moveBooking a call never needs your Facebook or Google password — so if a job page asks you to log in, close it and check the invite by going to the company’s real careers site yourself.
Scammers are sending texts that say little more than your name and a question mark, hoping you’ll fire back a quick ‘Who’s this?’ out of politeness. The thing is, any reply at all proves your number is live and that you’ll chat — which is exactly what they’re after. From there they can resell your number or slowly spin the chat into a fake friendship that ends in a crypto or investment con.
The moveDon’t reply at all — not even ‘wrong number’ — then report the text in your messaging app and block the sender. If you think it might actually be someone you know, reach them on a number or app you already trust.
Scammers are planting fake entries in people’s calendars — a meeting you don’t remember, a “new voicemail”, or a warning that a subscription’s about to renew. The Guardian reports that people are being targeted via calendar apps like Google Calendar, which can add invites automatically — so the event just appears, even if you never opened the email. The entry pushes you to a fake Google, Microsoft or PayPal login page, or to a fake “support” number to cancel a charge that never happened.
The moveDon’t tap the link or ring the number, and don’t hit Decline — that tells them your email’s live. Deleting the event can send a decline too, so report it as spam if you can, then open the real app or site yourself to check. In Google Calendar settings, set “Add invitations to my calendar” to “Only if the sender is known”.
Researchers at Bitdefender found malware called ‘Midnight Mimosa’ already installed on some budget Android phones when people got them — reportedly on thousands of devices across 150+ countries. It runs as part of the phone’s system, so you can’t just uninstall it: it secretly clicks ads you never see and can relay strangers’ internet traffic through your connection. As well as some cheap budget brands, it turned up on knock-offs pretending to be Samsungs and iPhones — full writeup here.
The moveBuying a phone? Check the seller, not just the price: a ‘Samsung’ or ‘iPhone’ that’s way cheaper than normal is a reason to look harder. If apps you didn’t install keep turning up, or come back after you delete them, don’t log into anything on that phone and get a trusted adult to help you contact the seller.
Creators are being targeted with fake paid-sponsorship emails that name real brands like Nike and Spotify and even reference your actual videos, according to ESET researchers. After a bit of back-and-forth, you’re sent to a slick ‘collaboration platform’ that asks you to sign in with Google. A fake login page there can steal your password and one-time code, and with them your whole Google account; a permissions request can hand over control of your channel. Once scammers are in your account, they can swap your recovery details to make it much harder to get back.
The moveA brand deal is never a reason to type your Google password or a one-time code into someone else’s site. Find the brand’s contact details yourself, check the offer’s real, and loop in a trusted adult. If a sign-in screen asks to manage your channel, say no.
Criminals can now rent ready-made phishing kits that put up pixel-perfect fake login pages for apps like TikTok, Gmail, Apple and Amazon in about ten minutes, with a built-in AI to write the scam texts and emails that point to them. The twist: when you sign in, the page can also grab the session cookie that keeps you logged in, so they can walk straight into your account, 2FA code or not. Full write-up from Malwarebytes Labs.
The moveNever sign in through a link in a message — open the real app or a saved bookmark instead, and if you ever do enter details after a dodgy link, change your password and sign out of all sessions straight away.
Hackers appear to have used the ASOS app to send a push notification to shoppers’ phones. It was really a message to ASOS itself: they claimed to have broken into the company’s data and threatened to leak it unless ASOS got in touch. Receiving it doesn’t by itself mean your phone has been hacked.
The moveDon’t tap anything in a weird notification — check the company’s official site or socials yourself before you act, and learn to tell real from fake.
Scammers are sending out-of-the-blue texts asking ‘Is this still available?’ with a fake Facebook Marketplace listing attached, and it shows your own name as the seller. The fake listing is bait to get you replying. That confirms your number is active and can open the door to more scams. Your name and number may have come from a data breach. Spotted by Malwarebytes Labs.
The moveDon’t reply, don’t tap any links or scan any QR codes — if you’re worried someone’s impersonating you, open Facebook yourself and check your own Marketplace activity.
Loads of new apps are now built fast with AI, sometimes by one person in a weekend. Plenty are fine, but some leave what you give them (your email, photos, messages) where anyone can find it. In February a researcher reported 16 security holes, six of them critical, in one AI-built app for exam questions and grades. They exposed the details of more than 18,000 users, thousands of them students. You can’t tell by looking which apps cut corners.
The moveGive a new app as little as you can: no ID or selfies it doesn’t need, a password you don’t use anywhere else, and a no to any permission it doesn’t obviously need to work.
People playing Roblox are being targeted with ‘free Robux’ offers in YouTube and TikTok comments and Discord chats, often with a ‘few hours only’ deadline. Tap the link and you land on a login page that looks exactly like the real Roblox one, but it grabs your username, password and even your 2FA codes, then bounces you to the real site so nothing seems off. By then the scammers can empty your Robux. More from The Guardian.
The moveOnly ever log in by opening Roblox yourself through the official app or site, never through a link someone posted, and treat 2FA codes like passwords you hand to no one.
Camera glasses like Meta Ray-Ban and other wearables can take photos, video and audio hands-free, with no phone in sight and a recording light that’s easy to miss, or covered up. There are reported cases of people being filmed in public without agreeing to it, with the footage posted for views or used to demand money, and photos taken this way can be fed into AI tools to make deepfakes.
The moveIf someone’s recording you with glasses or a wearable without asking — especially in changing rooms or toilets — step out of frame and tell a teacher or trusted adult, and always ask before you record anyone else.
A viral AI ‘actress’ is offering video calls — but to get in you scan your face for an age check, and once you’re talking it reads your mood the whole time and you can’t switch that off. Calls are recorded and transcribed too. It’s 18+ anyway, but it’s a good look at what ‘fun’ AI chats can quietly take.
The moveSkip this one — it’s adults only. For any app that wants your face or your camera, check what you’re really agreeing to before you tap accept.
Facebook has a feature that uploads snaps from your camera roll to the cloud so its AI can suggest edits. It asks first with a pop-up, but it’s easy to tap yes without clocking that it can upload photos you never chose to post.
The moveIn the Facebook app, go to Settings, find ‘Camera roll sharing suggestions’ and switch off cloud processing. Then check what access the app has to your photos.
Twitch Enhanced Viewer | JeetBot, a browser extension promising ad-free Twitch, 1080p and auto channel points, was sending users’ login tokens to a bot company’s servers, where they sat in plain text in its logs. It had more than 30,000 installs on Chrome and Firefox. That token lets someone act as you without your password. The developer says version 85.8.7 has stopped sending tokens, but that’s their claim, not an independent check.
The moveRemove the extension, then disconnect all sessions in your Twitch settings and log back in — that kills any token already taken. 2FA alone won’t stop someone using an already-stolen token.
Scammers are posing as your bank, the police or a regulator on a WhatsApp or FaceTime call, claiming something dodgy has happened to your account and asking you to share your screen so they can ‘help’ — or to install an app so they can take the wheel. Once they can see your screen, every code that pops up is theirs, and they quietly drain the account. It’s mostly aimed at adults, so it could just as easily be a parent’s phone as yours.
The moveNever screen-share with, or install anything for, someone who contacted you first. Hang up, then ring the bank on the number from the card or the app. Already sharing? End the call, flick on airplane mode, then ring the bank — and if it’s a parent’s phone, tell them straight away.
Internet Matters put out a warning this week: AI makes it dead easy to whip up fake images, videos and stories that look completely real, and they’re spreading fast through feeds and group chats. The clever bit isn’t the tech — it’s that a convincing fake gets shared before anyone thinks to check.
The moveBefore you believe it or repost it, slow down and check: search the claim and see if a real news site has it, and reverse-image-search the picture. If nobody trustworthy is reporting it, don’t pass it on.
Criminals built over 119,000 online stores that look totally legit but exist for one reason: to steal your card details as you type them into checkout. The product never ships — because there was never a product. They copy a real brand’s products, photos and even its support email, then lean on huge discounts to rush you through checkout.
The moveGot there from an ad or a link, and the price is way under everyone else’s? Don’t buy from that tab — search the brand and go to its real site or app yourself before typing in your card details (or a parent’s).
People are being targeted with AI-generated fake photos and videos of themselves, including fake nudes, made without their say-so. Whoever made or shared it may have broken the law — you are not the one in trouble. You don’t have to sort this out on your own.
The moveDon’t forward it or save extra copies — keep the link and the account name, and only share it through official reporting routes. Report it in the app and tell an adult you trust. Under 18? Report Remove (Childline + IWF) can help get it removed from public sites and block reuploads, and you don’t need a parent to use it.
Fraudsters are now feeding AI your public posts to build a scarily detailed profile, then using those personal details to make a scam feel like it’s really meant for you. So a DM that knows your school, your club and your mate’s name isn’t proof it’s real any more. The good news: a lot of that raw material is still in your control.
The moveLook at your public profile the way a stranger would: can they get your school, your club and your birthday from it? Lock down what you find — and remember, a DM knowing that stuff doesn’t make it real.
Some fake CAPTCHAs tell you to press Windows + R (or open Terminal), paste something in and hit Enter ‘to prove you’re human’. That’s not a human check — it’s you installing the malware yourself. They turn up on legit sites too, so the tell isn’t the site, it’s the ask: a real CAPTCHA never asks you to do anything outside the browser.
The moveIf a ‘human check’ wants you to press keys, paste or run anything outside the browser, close the tab. Already done it? Go offline, run a virus scan, and change your passwords from a different device.
WhatsApp is rolling out stronger account locks, including passkeys and a beefed-up two-step verification. Turn them on and it’s a lot tougher for anyone to slide into your account and take over your chats.
The moveHead to WhatsApp Settings > Account and switch on two-step verification (and a passkey if you can) — and never hand anyone your one-time code.
Thieves who’ve swiped an iPhone are running polished AI voice calls posing as Apple Support, all to trick you into handing over your device passcode. Once they’ve got it, they wipe the phone and sell it on. The whole thing is automated, so the pressure and the polish feel real.
The moveNever read out a passcode or one-time code to anyone who calls you — hang up and check anything through the official Apple app or website yourself.
People are being hit with fake texts claiming their Apple Pay has been suspended, pushing them to tap a link and ‘fix’ it. The link goes to a fake page built to swipe your details — the panic is the whole point.
The moveDon’t tap the link — open Wallet or Settings yourself and check Apple Pay there. If you’re still unsure, call your bank on a number you trust (in the UK, 159 puts you through to your bank and can’t be faked).
People are getting spammed with fake calendar invites on iPhone, packed with dodgy links. The trap isn’t just the links — tapping Accept, Maybe or Decline sends a reply that confirms your email address is live, so the spam keeps coming.
The moveDon’t tap Accept, Maybe or Decline, and don’t open the links. If deleting the event doesn’t shift it, remove it through your calendar account settings and report the email as phishing in your mail app. Practise spotting the safe tap with Would You Click?.
WhatsApp is rolling out an optional Scam Alert feature that uses on-device AI to flag messages that look like a scam before you reply. It’s a heads-up, not a verdict — it just gives you a reason to pause on anything sketchy landing in your chats.
The moveSwitch it on, but still trust your gut: if a flagged message pushes you to act fast, slow down and verify through another channel before replying. Sharpen your radar with Swipe to Survive.
The FBI is warning that hackers are hijacking people’s social media accounts to steal private or explicit photos and videos. They get in through fake login pages, passwords reused from old leaks, or by tricking you into handing over login codes — then they dig through your DMs, saved media, or anything private in the account.
The moveTurn on two-factor authentication now, and never read out or forward a one-time code to anyone — no real login ever needs that. And if a login link lands in your DMs, don’t tap it: open the app or type the site yourself.
Brazilian regulators ordered Discord to suspend its Go Live streaming feature after linking it to the death of a 13-year-old. The risk isn’t the button itself — it’s the people in the room who push you, dare you, or pile on while you’re live and can’t step back.
The moveIf a live stream turns into pressure or dares, end the stream, block and report whoever’s behind it in Discord, and tell an adult you trust.
AI tutoring apps can be genuinely useful for schoolwork, but they vary a lot in how much of your data they hoover up and how reliable their answers actually are. Some are solid; others quietly collect way more than they need, or confidently hand you stuff that’s just wrong.
The moveBefore you lean on any AI tutor, check what permissions and data it’s asking for and only allow what it actually needs.
People are being targeted via TikTok Shop by fraudsters who then break into their Amazon accounts and go on a spending spree. One victim lost £1,400 this way. The usual trick is getting you to hand over a login or one-time code without realising who you’re really talking to.
The moveTurn on 2FA everywhere and never read out a one-time code to anyone — real companies never ask for it.
People hunting for free VPNs on Chrome got hit: hundreds of extensions posed as popular services but secretly pushed your internet traffic through servers run by strangers. A VPN is supposed to hide your traffic, so one that funnels it through someone else’s proxy is the opposite of private.
The moveBefore you install any extension, check the publisher and read exactly what permissions it wants — if a free tool asks to see all your traffic, walk away. Try Permission Panic to sharpen your instinct.
Copies of the Xeno cheat tool for Roblox are secretly packing malware that grabs your saved passwords and hands attackers remote control of your PC. It’s the classic trap: the ‘hack’ that promises an edge quietly owns your whole machine instead.
The moveDon’t run Roblox executors or script launchers at all — there’s no clean copy to find, and the one you install is the one that takes your logins.
A screenshot of a payment or a message can be edited in seconds, so ‘look, I sent it’ isn’t actual proof of anything. People use fake screenshots to make you believe a payment landed or a deal’s legit when it never happened.
The moveOpen the real app or account and check the payment actually arrived before you send anything back.
People are being targeted with fake fixes on Steam game forums. A forum reply promises to solve a bug or crash, but the steps they provide walk you into pasting a command into Windows PowerShell. That command installs a hidden cryptominer that quietly hogs your PC — and the same trick can be used to drop password-stealing malware.
The moveDon’t paste commands from forum replies into PowerShell or Terminal. If a ‘fix’ tells you to run one, go to the official game site or Steam support yourself and check there.
Europol says 4,340 URLs tied to violent online networks were flagged for removal. The playbook’s always the same — they act like a mate, get you onside, then use secrets, flattery and threats to push you into doing harmful things and keep you quiet.
The moveThe pressure to keep a secret or ‘prove yourself’ is the red flag — not whether the person seems sound. Don’t go along with it and don’t deal with it alone: block, screenshot, and tell a trusted adult straight away (or report it to CEOP).