Dive into data-backed insights from our Threat Labs team. Each report distills real trends uncovered through the Gen family of brands' products, technology and global research, revealing how scams and emerging threats evolve in the real world. We turn billions of signals into stories that help people stay alert, informed, and one step ahead.

Threat Research Team

Reports

<h2>Foreword</h2>It’s time to take a closer look at the trends shaping the cyber safety landscape.&nbsp;Welcome to the Gen Q4 2025 Threat Report. In Q4, we blocked 1.43 billion attacks, and our global risk ratio rose 17.6% quarter over quarter.

If you spent any time online this quarter, the pattern will feel familiar. You open a browser to look something up. A friend messages you. A bank or payment app asks you to confirm something small. Somewhere in that stream is a link to click, a QR code to scan, a pairing request to approve, or a code to enter. What looks like ordinary digital noise is often the setup for a scam.The center of gravity hasn’t shifted away from people. It has spread across the places they spend their digital lives: browsers, chats and money apps. What changed this quarter is how often that tiny, routine action is the scam. The attack no longer comes later. It happens the moment the door is quietly opened. We also see more campaigns that only work if the victim does the “technical” step themselves. Fake tutorials and download sites persuade users to fetch and run the payload. Device linking tricks people into adding an attacker’s browser as a trusted companion to their messaging app. Verification screens quietly turn into pairing flows that mirror conversations and contacts. Infostealers, spyware and other classics are still there, but some of the most damaging incidents start from what looks like a harmless confirmation dialog.AI sits underneath a lot of this, usually without being named. It is behind fluent, local chats in cloned Steam profiles that sound exactly like a real friend. It can also turn just a few seconds of audio into a believable emergency call from a relative. It lets small groups produce convincing videos that look like investment advice, giveaways or charity requests and drop them into the same feeds people already trust for entertainment and news. At the sharper edge, we have seen state-backed actors using AI systems to handle much of the reconnaissance and scripting work in intrusions, and experimental malware that asks a model how to rewrite itself each time it runs. On the defensive side, AI is just as present in our own security stack, from spotting strange login journeys to flagging scam videos during playback, but there is still a gap between what security technology can see and what people feel they can understand.Privacy and identity continue to act as long-term fuel for abuse. A single&nbsp;<a href="https://blog.avast.com/whatsapp-vulnerability-nearly-leaked-billions-of-phone-numbers" target="_blank">weakness in WhatsApp’s number</a> lookup exposed how easy it was to map billions of phone numbers to active accounts before the issue was fixed. A support vendor for a popular chat platform leaked tens of thousands of government ID photos collected for age checks. Data brokers handed out “samples” that revealed precise daily movements of European officials, easily linked to homes and workplaces. End-to-end encryption is essential, but it can’t protect you once spyware has compromised the device itself. The Landfall campaign showed again that endpoint compromise bypasses privacy promises made at the network layer. &nbsp;Across our own identity alerts and in external research, the pattern is consistent. Breaches, leaks and data sales rarely end with a single notification email. Instead, they resurface months later as account takeovers, fake professionals, synthetic identities and long, difficult recovery cycles.Financial threats are now visible nearly every time people make daily money decisions. They show up when someone opens a new account, tips a creator, pays a bill or reacts to a text that looks like it came from their bank. Stolen identity data is used to pose as the “ideal” new customers applying for loans. Payment features designed for convenience, such as tipping and post settlement adjustments, are used to turn one-dollar transactions into five-figure debits. Microtransactions in games and social apps are increasingly abused for chargeback and refund fraud, where attackers reclaim purchases that were unauthorized after digital goods have already been spent or transferred, shifting the loss onto platforms and merchants. Old-fashioned SMS phishing, upgraded with better language and more convincing lures, still drives some of the largest direct losses when it persuades people to hand over one-time codes that bypass nearly every other safeguard.As we wrapped up 2025, the most striking changes we see are no longer brand new types of malware; it is how tightly attacks are woven into every fiber of our everyday digital routines. Browsers, SMS, chat apps, social media and the tools people use to manage their money now form one continuous surface where trust, identity, privacy and finances intersect. Attackers lean on that continuity, on familiar brands and interfaces, then add automation and AI to reach more people with less effort and less noise.Our job, and the purpose of this report, is to spot those patterns early, measure how they evolve from quarter to quarter and keep shifting protections closer to the small moments where people actually make these choices. Thank you for taking the time to read it, and I hope you enjoy the report.Luis Corrons, Security Evangelist (aka Threat Whisperer)<h2>Threat Landscape Highlights: Q4/2025</h2><h3 class="text-align-justify">Security Threats &amp; Scams</h3>Across Q4, we saw the same core pattern as earlier in the year: most attacks today are not about exotic exploits; they are about getting people to lower their own defenses. What changed last quarter is how many of those scripts now hopped between devices and channels. It started in the browser, continued on the phone, then maybe even landed directly in the calendar instead of the inbox. In parallel, mobile spyware and enterprise extortion continued to evolve under pressure from law enforcement and falling ransom payments, while platforms and business software remained a very profitable surface for scams.<h4 class="text-align-justify">Scam-Yourself Attacks</h4>The Scam-Yourself pattern we highlighted in the past quarters is still very much alive, now with cleaner and more focused campaigns that are easy to see in our data. In November, a single “fake tutorial” domain drove a sharp spike in Scam-Yourself detections. The lure is familiar: users search for tips or cracked software, and land on a page that pretends to walk them through an installation. The twist is that the instructions explicitly ask them to “scan” the screen with their phone camera to continue, pushing the second half of the attack chain onto mobile, where they are more likely to grant extra permissions or install side-loaded apps. A separate campaign in the same period, again dominated by a single domain, used similar tactics to pull people into bogus investment apps on mobile. In both cases, the criminals are not fighting the security model; they are persuading users to carry the payload across device boundaries for them.

<h4 class="text-align-justify">A New Frontier: Calendar Invite Scams</h4>We also saw classic tech support scams arrive through a new front door: <a href="https://us.norton.com/blog/online-scams/norton-calendar-scam" target="_blank">calendar invites</a>. In this scam, instead of a spam email, victims receive an unexpected calendar event that claims a security product subscription has just renewed for hundreds of dollars and includes a phone number “for support.” In our telemetry, tens of thousands of these invites were blocked in a single month. When our testers called one of the numbers, the script followed the same path we have seen for years in phone-based tech support fraud: the agent anchored the fake charge, insisted on remote access to “fix” the issue, and walked the victim through installing a remote access tool such as AnyDesk. The branding was almost incidental. In one call, the calendar mentioned Norton while the scammer talked about “your McAfee subscription.” The details may change; however, the core playbook is stable: steer the conversation to remote control and financial data as quickly as possible.&nbsp; &nbsp;<h4 class="text-align-justify">Mobile Threats</h4>On mobile, <a href="https://us.norton.com/blog/malware/spyware" target="_blank">spyware</a> continued to trend upward in the first half of Q4 and became more invasive. Two Android families, Tambir and SpyMax, dominated our spyware detections in Q4, with a clear peak in November. SpyMax, commonly masquerading as legitimate apps such as Chrome or Netflix, requested network and package-installation permissions, and then used those to silently install additional components with full spying and monitoring capabilities. The impact was global but not uniform, with hotspots in countries such as Morocco, Yemen, Azerbaijan, Portugal and Türkiye. In one of the more sophisticated spyware campaigns of the quarter, researchers uncovered a new commercial-grade Android spyware family called Landfall. This spyware exploited a zero-day vulnerability in Samsung’s image processing library (CVE-2025-21042), which allowed attackers to compromise Galaxy devices via malicious image files, including files sent over apps such as WhatsApp. At this scale, a person’s trust becomes part of the attack surface. While encryption protects data transit, it cannot defend a device that has already been compromised.&nbsp;

The flaw was quickly added to CISA’s Known Exploited Vulnerabilities catalog and patched, but it underlines how messaging and media apps are now both social-engineering channels and mechanisms for exploit delivery.

The economic and legal pressure around spyware increased as well. <a href="https://security.apple.com/blog/apple-security-bounty-evolved/" target="_blank">Apple</a> doubled its top bug bounty award to 2 million dollars for exploit chains that can achieve mercenary-spyware-level access, with bonuses that can push the total award above 5 million. In parallel, a US court granted a permanent injunction <a href="https://www.reuters.com/sustainability/society-equity/us-court-orders-spyware-company-nso-stop-targeting-whatsapp-reduces-damages-2025-10-18/" target="_blank">barring NSO Group</a> from targeting WhatsApp users with spyware, after finding the company liable for hacking hundreds of accounts, although it significantly reduced an earlier damages award. Combined with the <a href="https://techcrunch.com/2025/11/07/landfall-spyware-abused-zero-day-to-hack-samsung-galaxy-phones/" target="_blank">Landfall case</a> and our own spyware telemetry, the picture is clear: phones are now the primary surveillance target for both everyday stalkerware-like campaigns and highly resourced actors, and the market value of mobile zero-days has risen accordingly.<h4 class="text-align-justify">Ransomware</h4><a href="https://www.avast.com/c-what-is-ransomware" target="_blank">Ransomware</a> and extortion remained active but showed signs of stress. On the consumer side, ransomware encounters in our telemetry declined 6.8% year over year in 2025,&nbsp;staying well below the elevated levels we saw during the Magniber-driven highs that began in 2024 and persisted until this summer, when the campaign was stopped. We still observed smaller, more targeted incidents, including new Trinity-family ransomware samples going after small and mid-sized businesses, but not a broad return of mass-spread ransomware lockers.&nbsp;Externally, incident response data points in the same direction. Coveware <a href="https://www.securityweek.com/ransomware-payments-dropped-in-q3-2025-analysis/" target="_blank">reported</a> that only about 23 percent of ransomware victims paid in Q3 2025, a historical low, with average and median payments dropping by roughly two-thirds compared to the previous quarter as big enterprises increasingly refuse to pay and mid-market firms negotiate smaller amounts. Chainalysis, looking at blockchain flows, estimated that <a href="https://www.theguardian.com/technology/2025/feb/05/global-ransomware-payments-plunge-by-a-third-amid-crackdown" target="_blank">global ransomware payments in 2024 fell</a> from 1.25 billion dollars to around 813 million, roughly a one-third drop year on year, a proof point that consumers and businesses alike are becoming more educated on how to manage ransomware extortion. Taken together, this suggests that the traditional encrypt-and-extort model is under real pressure, even though the number of groups and leak sites remains high.&nbsp;<h4 class="text-align-justify">Infostealers, Vulnerabilities and Other Exploits</h4>Law enforcement pressure also spilled over into commodity crimeware infrastructure. In November, Operation Endgame, a coordinated international action, disrupted infrastructure used by infostealers such as Rhadamanthys, VenomRAT and Elysium, taking large numbers of servers and several domains offline. In our telemetry, Rhadamanthys detections dropped sharply after mid-November and remained low throughout the rest of the quarter. This marks a rare instance where a public takedown aligns with a clear and sustained decline in activity from a specific threat family.&nbsp;The broader infostealer ecosystem, however, did not disappear. And other stealer families continued to operate. Something to think about here: do high-profile disruptions like this meaningfully change attacker behavior over the long term, or do they simply create space for the next malware-as-a-service brand to emerge?

One structural shift that happened in the background during Q4 is the nearing of the end of <a href="https://support.norton.com/sp/jp/in/home/current/solutions/v20250829220006792">support for Windows 10</a>, which will leave millions of still-active PCs on an increasingly unpatched operating system. That long tail of unsupported devices keeps older exploit chains profitable and turns legacy Windows into a standing pool of soft targets, from ransomware affiliates and botnet herders to infostealer operators.In the world of extortion, this quarter, the Cl0p group and other actors ran large-scale extortion campaigns against organizations using Oracle E-Business Suite, exploiting a critical unauthenticated remote code execution flaw, <a href="https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation">CVE-2025-61882</a>, to break into internet-facing instances and exfiltrate data. Victims ranged from universities and airlines to health providers and media outlets, many of whom only discovered the breach when they received extortion emails or saw their data listed on leak sites. Separately, the Scattered Lapsus$ Hunters collective claimed to have stolen more than a billion customer records from companies that rely on Salesforce, and published samples tied to firms in sectors such as insurance, airlines and credit reporting. In both cases, the pattern is similar: rather than encrypting endpoints, attackers look for central business platforms, exploit a single point of failure and then treat stolen data as the primary ransom lever.<h4 class="text-align-justify">Scams</h4>Last but certainly not least, scams continued to scale by riding on top of mainstream platforms and trusted infrastructure. Scams, overall, continue to be a leading problem for consumer cyber safety. In 2025, there were 41 scams blocked every second, on average.In our Q4 analysis of scams originating on social platforms, one theme stands out: concentration. Facebook alone accounts for 78.04% of social-origin scam blocks on desktop. When combined with YouTube, that figure rises to 95.71%. In plain terms, the vast majority of risky scam clicks begin in just two places: the social feed and the video loop.The second defining pattern is what those clicks are designed to do. In Q4, e-shop scams dominate at 65.4% of social-origin blocks. Phishing followed at 15.09%, then generic scams (7.58%), tech support scams (6.28%), dating scams (3.45%) and financial scams (2.12%).&nbsp;Each scam type also has its own “platform fingerprint.” For example, tech support scams are almost entirely Facebook-driven (99.25%), while phishing spreads more widely across Facebook (77.34%), YouTube (13.66%) and Reddit (3.94%).Where the scam click starts (platforms)<ol><li data-list-item-id="eb40370c21eef3b7317f242e605fadf5c">Facebook, 78.04%</li><li data-list-item-id="edce3c32d95987f7ab5c473e3392b7acb">YouTube, 17.67%</li><li data-list-item-id="ebb0b9f86762211dc36c60026bd66053c">Instagram, 2.16%</li><li data-list-item-id="e528f6738c8aeb1a0fe8d7858cb7b1758">Reddit, 0.65%</li><li data-list-item-id="e5513daffc673bcda2ed6e14baea51272">X, 0.60%</li><li data-list-item-id="e71c768777d2fb909c2ec0633b4d75b6d">TikTok, 0.38%</li></ol>What the scam is trying to do (types)<ol><li data-list-item-id="e9a62c7b410b345bc939103042b237a07">E-shop scams, 65.40%</li><li data-list-item-id="e8c12513e9af7b1db743ce2ccb5e48ec1">Phishing, 15.09%</li><li data-list-item-id="e6d341fbb668c55de4950b76bbf8e93eb">Generic scams, 7.58%</li><li data-list-item-id="ee2d1344f48aa9608afd2bcf9e58d6a7d">Tech support scams, 6.28%</li><li data-list-item-id="ea041a1217cef799ca06468f7fe9b5671">Dating scams, 3.46%</li><li data-list-item-id="e27b966549b1aaaf3fe1199c86e46ffe4">Financial scams, 2.12%</li></ol>Our telemetry also showed a marked increase in e-shop scams in Q4 on both desktop and mobile. In fact, roughly half of all e-shop scam blocks we recorded in 2025 occurred in Q4, reflecting a surge in blocked fraudulent shops. The data is unsurprising considering the holiday period and public reports showing that Meta made around <a href="https://www.reuters.com/investigations/meta-is-earning-fortune-deluge-fraudulent-ads-documents-show-2025-11-06/" target="_blank">10 percent of its annual revenue in 2024</a>, roughly 16 billion dollars, from fraudulent ads and banned product listings, based on internal documents discussed in recent investigations. Those reports describe billions of scam-related ads per day, with some internal systems rating ads as highly likely to be fraudulent yet allowing them to run. For ordinary users, the distinction between an “ad platform” and a “scam delivery system” is increasingly academic. On the supply-chain side, the <a href="https://thehackernews.com/2025/11/shai-hulud-v2-campaign-spreads-from-npm.html" target="_blank">discovery</a> of the ShaiHulud v2 malware in npm packages reinforced how popular developer ecosystems can be abused to push info-stealers and backdoors into thousands of build environments with minimal friction.

In short, Q4’s security threats and scams were less about brand-new malware families and more about the reuse of proven scripts and approaches across new channels: fake tutorials that jump from screen to phone, tech support scams that land in calendars instead of inboxes, spyware that hides inside image files and extortion crews that skip encryption and go straight for the data. Law-enforcement takedowns and falling ransom payments are clearly having an impact; the broader crime stack, from Scam-Yourself flows to platform-scale scams and enterprise app exploits, remains very active and continues to evolve.<h3 class="text-align-justify">AI-Driven Attacks &amp; Defenses</h3>Across nearly all threat types we monitored this quarter, AI stopped being a side topic and became part of the default background for both attackers and defenders. We saw three clear shifts: 1. Threat actors are starting to treat LLM exploits and “agentic” workflows as ordinary tools, 2. Social-engineering scams are being upgraded with AI voices, faces and scripts, and 3. On the defensive side, both platform providers and security products are racing to build AI-native protections.On the offensive side, LLM abuse is moving from experiments into the real economy. Recent investigations into LLM <a href="https://www.darknet.org.uk/2025/10/llm-black-markets-in-2025-prompt-injection-jailbreak-sales-model-leaks/" target="_blank">black markets</a> describe sellers offering jailbreak prompt packs, prompt injection recipes, and access to leaked models or stolen API keys, packaged much like exploit kits or malware builders. Rather than inventing their own jailbreaks, criminals can now buy prompts that work against the most popular models and plug them into phishing frameworks, fraud bots or custom tools.

The most visible AI abuse leap in Q4 came from the nation-state space. <a href="https://www.anthropic.com/news/disrupting-AI-espionage" target="_blank">Anthropic</a> disclosed that a China-linked group jailbroke its Claude Code model and used it to orchestrate a multi-step espionage campaign against roughly thirty organizations, including financial and government-related targets. According to Anthropic, the AI handled approximately eighty to ninety percent of the workflow, from reconnaissance and code generation to log parsing and data staging, with humans mostly approving steps and correcting mistakes. This is no longer “AI helped me write some malware”; it is AI acting as a junior operator across an entire campaign.<a href="https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools" target="_blank">Google</a>’s Threat Intelligence Group reported something similar at the tooling level. Its AI Threat Tracker documents experimental malware such as PROMPTFLUX and PROMPTSTEAL, droppers that call an LLM at runtime to rewrite their own Visual Basic Script, change obfuscation and adjust evasion on the fly. Instead of shipping a static payload, attackers ship a template that asks an AI model how to change itself every time it runs. This matches the “just in time” self-modification pattern we highlighted in earlier quarters, but now in code that actually runs on victim machines.Operating systems are also becoming more “agentic,” which opens a new front. Microsoft’s new agent workspace features for Windows 11 are designed to let AI assistants perform tasks for the user with their own desktop, local account and access to folders such as Documents, Downloads and Desktop, when enabled. In its own security guidance, Microsoft warns that these agents introduce novel risks such as cross-prompt injection, where malicious content embedded in a document or user interface can override agent instructions and trigger data exfiltration or software installation. For now, these features are disabled by default and limited to preview builds, but the direction is clear. If you let an AI agent act inside the OS, anything that can steer it becomes part of the attack surface.

Where AI touches people directly, the main shift is in social engineering, which already accounted for over 90% of all blocked attacks in 2025. Voice cloning has already changed “grandparent scams” and family emergency fraud. Police in Canada, among others, have warned about an uptick in cases where criminals use a <a href="https://www.pcmag.com/news/microsofts-ai-program-can-clone-your-voice-from-a-3-second-audio-clip" target="_blank">few seconds of audio</a> from social media or voicemail to generate a convincing copy of a relative’s voice, pair it with a scripted accident or kidnapping story, and pressure victims into urgent transfers. In our featured story Love at machine speed, we zoom in on this broader pattern. AI makes romance scams and sextortion campaigns feel like full-on relationships, with coherent photos, voice notes, short videos and even documents that all feel fully authentic. The scam does not have to be linguistically brilliant; it just has to feel consistent and emotionally tuned, then pivot into money asks, “verification” flows or intimate exchanges that can be turned into extortion.We also see smaller, more personal versions of these emotional, relational scams happening on gaming platforms. On Steam, for example, we have observed waves of friend requests from cloned or lookalike accounts that mirror real contacts, followed by smooth, localized chat messages that clearly have an LLM “feel” to them. The goal is not to impress anyone with language skills. It is to lower suspicion in your native language, then steer the conversation toward off-platform links, giveaways or trading “opportunities”.Our featured story How AI made video scams personal, one viewer at a time looks at the same trend from the video side. In 2025, YouTube and other platforms became fixtures of living-room TV time, not just phone habits, and video recommendation engines now shape a large share of what people watch. That shift is exactly why we built <a href="https://support.norton.com/sp/en/us/home/current/solutions/v2025051222180272">Deepfake Protection</a> around the intersection of manipulated media and scam intent, using multi-modal signals from the clip itself (including indicators of cloned or heavily edited audio) plus contextual cues like money requests, urgency scripts, and off-platform handoffs. Early telemetry shows that most blocked AI scam videos cluster on a handful of major platforms, with YouTube leading by share of blocks and Facebook and X behind it. The majority are not spectacular, viral deepfakes. They are ordinary-looking clips, often with cloned or heavily edited audio, tied to financial and cryptocurrency lures. That is why the story argues that AI in a clip is not a risk signal by itself; the meaningful signal is AI paired with a request for money, an off-platform handoff or a time pressure script.AI also shows up around account takeovers. In The code that steals your WhatsApp, we follow a device-linking abuse pattern – what we call GhostPairing – where a simple “I found your photo” message lures victims to a fake login page that uses WhatsApp’s own pairing flow to add the attacker’s browser as a ghost device on the account. The core trick is pure social engineering around a legitimate feature; however, the consequences line up with our AI concerns. Once a WhatsApp account is silently mirrored, attackers can read private chats, learn which contacts are most trusted, and harvest voice notes and photos that can later be fed into voice cloning and synthetic media tools. The attack itself is not “AI-malware," but it builds the raw material that AI-powered fraud will later exploit.Outside of personal relationships and messaging, AI is also being used to impersonate professionals and institutions. Reporting from the <a href="https://www.thebureauinvestigates.com/stories/2025-11-26/scammers-use-ai-to-impersonate-real-lawyers-on-fiverr">Bureau of Investigative Journalism</a> found dozens of Fiverr listings where scammers posed as real UK solicitors (attorneys), stealing names and registration numbers from the Solicitors Regulation Authority and pairing them with AI-generated headshots and boilerplate text. These profiles advertised legal services and, in some cases, boasted about using AI to draft contracts. The same playbook maps easily onto other roles, such as investment advisors or “remote employees.” We deliberately handle those themes more fully in the Trust and Identity section, but they belong in the AI picture as well.Meanwhile, defenders are adapting, although not always as quickly as attackers. On the platform side, Anthropic, Google and Microsoft all treat AI misuse as a security problem, not just a policy issue. Anthropic’s disruption of the Claude-driven <a href="https://www.anthropic.com/news/disrupting-AI-espionage" target="_blank">espionage campaign</a> fed directly into new monitoring and safeguards against similar abuse. Google’s AI Threat Tracker is building a <a href="https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools" target="_blank">public catalogue</a> of how state-backed and financially motivated actors use AI across reconnaissance, exploitation and post-compromise stages. Microsoft’s agentic security guidance, while still evolving, at least names cross-prompt injection and agent containment as core design problems for the Windows ecosystem.&nbsp;In our own security stack, AI runs on both sides of the line. The same technology that helps criminals localize scripts and industrialize lures also helps our protections spot subtle combinations of signals that only make sense in context, not as single keyword rules. That includes login and device linking flows that deviate from legitimate patterns, payment journeys that show telltale friction points and coercion cues, and video or audio that pairs polished, synthetic-sounding narration with high-pressure financial pitches and off-platform handoffs. In Q4, on devices where our video scam detection feature was enabled, we detected 159,378 unique deepfake scam video instances that matched this intersection of manipulated media and scam intent.&nbsp;The three featured stories in this report are case studies of how this plays out in the real world: deepfake-style media stitched into financial scams, AI-orchestrated romance and sextortion scripts, and messaging account takeovers that quietly gather the raw material for future AI misuse.The common thread in most research on AI is that it has become part of the normal toolkit, not a special effect. Some campaigns, such as the Anthropic case and PROMPTFLUX, use AI inside the malware and command chain. Others, such as AI video scams, romance fraud and GhostPairing, use AI to shape what victims see and hear. On the defensive side, both cloud providers and endpoint protection are starting to respond in kind. For people and organizations, the practical rule is straightforward. Any tool that can act on your behalf or strongly shape what you see and hear now deserves the same caution as a high privilege application: less access, explicit approval for sensitive actions, and a healthy suspicion of any AI-shaped request that tries to move money, data or trust onto someone else’s schedule.<h3 class="text-align-justify">Privacy</h3>This quarter also demonstrated how fragile privacy still is when convenience, third-party vendors and opaque data markets collide. Even as lawmakers tighten some rules and platforms announce new “privacy-preserving” architectures, our own telemetry and outside incidents point to the same pattern: data collected for one purpose keeps landing in the wrong hands, and the basic identifiers that anchor digital life, especially phone numbers and device IDs, remain sought after.<h4 class="text-align-justify">Data keeps leaking through the side doors</h4>

Two incidents captured the structural risk of outsourcing sensitive data handling, from identity verification to location tracking, to third parties. Discord <a href="https://www.theguardian.com/media/2025/oct/09/hack-age-verification-firm-discord-users-id-photos" target="_blank">disclosed</a> that a breach at a customer-support vendor exposed around 70,000 government ID photos used for age verification, meaning a single helpdesk relationship turned into a trove of passport-level data.&nbsp;In Europe, <a href="https://netzpolitik.org/2025/databroker-files-targeting-the-eu/" target="_blank">investigative reporters</a> demonstrated how easy it is to buy precise mobile location trails from data brokers. A “free sample” dataset contained hundreds of millions of location points that could be tied back to individual EU officials simply by matching daily patterns to home and work addresses. Both cases illustrate the same trend: once data is collected for “support” or “advertising,” it can be repackaged, resold, and analyzed in ways users never anticipated.

The biggest privacy shock of the quarter came from WhatsApp’s contact discovery system. Researchers from the University of Vienna and SBA Research showed that by abusing an under-protected API, they could enumerate roughly <a href="https://www.wired.com/story/a-simple-whatsapp-security-flaw-exposed-billions-phone-numbers/" target="_blank">3.5 billion WhatsApp accounts</a>, confirming whether a given phone number is registered and, for many users, retrieving profile photos and “about” text. Meta has now tightened rate limiting, and our own blog, <a href="https://www.gendigital.com/blog/insights/leadership-perspectives/whatsapp-phone-number-privacy" target="_blank">The WhatsApp privacy scare you probably missed</a>, walks through why “no evidence of abuse” is not the same as “no risk” and how a single phone number can be the thread that links old and new data leaks together.&nbsp;Commercial spyware campaigns offered another stark reminder that once a device is compromised, theoretical privacy guarantees collapse. The Landfall spyware <a href="https://arstechnica.com/gadgets/2025/11/commercial-spyware-landfall-ran-rampant-on-samsung-phones-for-almost-a-year/" target="_blank">abused</a> a zero-day in Samsung’s image processing to infect Galaxy phones via malicious pictures sent in WhatsApp, then silently accessed photos, messages, contacts, call logs, the microphone and precise location for months. At that level of compromise, encryption and consent banners offer little more than the appearance of protection.<h4 class="text-align-justify">Our telemetry: trackers stabilize while breaches continue to climb</h4>On the tracking side, our Norton AntiTrack Windows telemetry shows that classic browser tracking and fingerprinting remain pervasive, but there are early signs of stabilization. The number of trackers and fingerprinting attempts detected per device on Windows flattened and even decreased in Q4 compared with earlier quarters, although overall volumes remain high. In practical terms, this means that the underlying tracking ecosystem has not gone away, even as some platforms talk about moving “beyond cookies.” Tools that actively block trackers and fingerprinting continue to do real work in the background.

<h4 class="text-align-justify">Global privacy rules are drifting in different directions</h4>Regulators did not stand still this quarter, but the net effect is patchwork rather than a clear global standard.In the EU, the Commission’s proposed “<a href="https://www.reuters.com/sustainability/boards-policy-regulation/critics-call-proposed-changes-landmark-eu-privacy-law-death-by-thousand-cuts-2025-11-10/" target="_blank">Digital Omnibus</a>” package would delay key “high-risk” AI rules until late 2027 and relax how companies can use sensitive data, including health and biometric information, for AI training under “legitimate interest.” Heated discussions are expected ahead as data access will need to be balanced with privacy needs.India moved in the opposite direction by activating its <a href="https://www.facebook.com/pibindia/posts/digital-personal-data-protection-dpdp-rules-2025-notifieda-citizen-centric-frame/1396013389233122/" target="_blank">Digital Personal Data Protection Rules 2025</a>, which formalize a consent-centric regime with tighter rules on purpose limitation and breach notification for everyday apps and digital services. In the United States, the proposed <a href="https://www.globalpolicywatch.com/2025/11/u-s-senate-introduces-the-health-information-privacy-reform-act/" target="_blank">Health Information Privacy Reform Act</a> (HIPRA) would extend HIPAA-style protections to health and fitness apps that have historically lived in a legal grey zone, reflecting concern over the volume of sensitive health telemetry collected by wearables and wellness platforms.&nbsp;At the state level, California continued to blaze new frontiers. The new “<a href="https://www.cdflaborlaw.com/blog/web-browsers-must-allow-users-to-opt-out" target="_blank">Opt Me Out Act</a>” (AB 566) will require browsers to offer a built-in global opt-out signal by 2027, and websites subject to the California Consumer Privacy Act (CCPA) will have to honor that signal as a valid “do not sell or share” request. The <a href="https://cppa.ca.gov/meetings/materials/20251107.html" target="_blank">California Privacy Protection Agency</a> is also progressing separate work on deletion and opt-out platforms and child-focused privacy safeguards. Together, these moves suggest that browser-level privacy controls and automated opt-out signals are becoming a default expectation in key US states.<h4 class="text-align-justify">Big tech recalibrates privacy promises, but tracking lives on</h4>Platform responses to these pressures have been mixed. Google effectively <a href="https://www.thurrott.com/cloud/328530/its-official-googles-privacy-sandbox-is-dead" target="_blank">shut down</a> most of its Privacy Sandbox initiative, acknowledging that the proposed replacements for third-party cookies saw limited adoption and heavy scrutiny. In practice, this means that conventional tracking cookies and related techniques will stick around longer than many anticipated, which matches what we continue to see in our AntiTrack telemetry.

At the same time, Google introduced its <a href="https://blog.google/technology/ai/google-private-ai-compute/">Private AI Compute</a> architecture, a cloud environment that promises to run powerful Gemini models on user data inside hardware-isolated, encrypted enclaves that even Google cannot directly inspect. Apple, for its part, <a href="https://techcrunch.com/2025/11/13/apples-new-app-review-guidelines-clamp-down-on-apps-sharing-personal-data-with-third-party-ai/">updated App Store Review Guidelines</a> so that apps must explicitly tell users and obtain permission before sending personal data to third-party AI services.&nbsp;These are meaningful steps, but they do not remove the core risk that sensitive data is leaving the device. They shift the conversation from “whether” to share data with cloud AI to “under what rules and guarantees”. As long as traditional web tracking also persists, we expect anti-tracking and anti-fingerprinting controls to remain critical scaffolding for any realistic privacy posture.<h4 class="text-align-justify">What this adds up to</h4>Across all of these signals, the privacy story this quarter is less about a single spectacular leak and more about accumulation. Third-party vendors and data brokers expand the surface where sensitive information can escape. Messaging flaws and commercial spyware show how metadata and on-device compromise can undo the comfort of end-to-end encryption. Regulators are pushing in different directions, with some jurisdictions tightening controls while others are making AI training easier. Platforms are quietly backing away from ambitious tracking replacements while introducing new AI-centric data flows.&nbsp;For our customers, that combination means privacy is no longer a static setting. It is a moving target that depends on how many third parties touch their data, how their devices are secured, and whether they run tools that can strip out trackers, flag breaches early and warn when their identifiers, from phone numbers to government IDs, are being reused in risky ways. Increasingly, that also includes services like <a href="https://us.norton.com/products/privacy-monitor-assistant">Privacy Monitor Assistant</a>, which automatically scans data broker sites for their personal information and requests its removal when it resurfaces.<h3 class="text-align-justify">Trust &amp; Identity&nbsp;</h3>Trust used to be about whether a website had a padlock or a caller knew your name. In Q4, it is increasingly about whether the person, service or document on the other side is even real. Identity is no longer just a target; it is the main attack surface. Our data and external research both show the same pattern: more identity-based fraud, more synthetic and stolen personas, and a fast-growing ecosystem of tools that claim to protect people from exactly that.<h4 class="text-align-justify">Identity fraud moves from edge case to default risk</h4>Across industries, businesses report that fraud is increasingly identity-led rather than purely transactional. AuthenticID’s latest analysis of enterprise customers shows a 42 percent year-over-year <a href="https://www.sdxcentral.com/news/authenticid-report-reveals-surge-in-identity-based-fraud-across-businesses/">surge in fake IDs and suspicious biometric matches</a>, with overall fraud rates hitting 2.10 percent, the highest level in three years. In the same survey, nearly 70 percent of organizations said they were concerned about generative AI making <a href="https://lifelock.norton.com/how-it-works/what-is-identity-theft" target="_blank">identity fraud</a> harder to spot, and more than two-thirds had already experienced workforce-related fraud in the last year, often involving compromised or fabricated identities rather than simple account misuse.&nbsp;The <a href="https://www.experian.com/thought-leadership/business/identity-and-fraud-report">2025 Global Identity and Fraud</a> report tells a similar story. Around 90 percent of businesses say they are worried about fraud, and almost 60 percent report higher fraud losses year on year, with identity theft, account takeover and payment fraud at the top of the list. Many have already increased their fraud prevention budgets and expect AI-generated deepfakes and synthetic identities to be major challenges by 2026. Consumers, however, are not reassured. A majority still feel uneasy about having more of their lives online, and there is a noticeable gap between the confidence businesses have in their own controls and the level of trust people actually report.&nbsp;In short, identity is where attackers invest and where defenses are playing catch-up. That is exactly what we see in our own telemetry.<h4 class="text-align-justify">What our identity alerts say about real people</h4>Our LifeLock data looks at consumer-focused identity events over time: new records, suspicious transactions, dark web exposure and scam-driven alerts, all converted into risk ratios so we can see what share of our customers are actually at risk during a given period.In Q4 2025, several types of alerts climbed noticeably, the figures below show the quarter-over-quarter change in average monthly alerted users:<ul><li data-list-item-id="e382f3a066147c01399197f6ac26a4706">Property-related record alerts (unauthorized filings): +252.27%</li><li data-list-item-id="e3351da7a455692c66228a4f18611b703">Breach alerts&nbsp;(possibly data exposure, even when the source isn’t yet known): +221.72%</li><li data-list-item-id="e61ae9b31e95e64f09b524430348eaedc">Bank account activity alerts (suspicious activity beyond credit lines): +112.34%&nbsp;</li></ul>We also introduced and started tracking a set of new alerts that monitor identity abuse deeper in the financial system. These include:<ul><li data-list-item-id="ec68775737df65ae46281d8b9ac773316">Alerts on suspicious activity within credit-based accounts, such as credit cards or lines of credit.</li><li data-list-item-id="ea9e82c04405a8560b47600da78413906">Alerts on new applications for installment loans, leases and retail cards opened in a customer’s name.</li><li data-list-item-id="e7cecafcf128d099b1034c3c661c5f11e">Transaction-level alerts on credit cards and installment loans that flag unusual or high-risk payments.&nbsp;</li></ul>These alerts do not just add volume. They move protection closer to the first moment where a stolen or synthetic identity turns into a concrete financial obligation: a new loan, a new lease, a new credit line, or a suspicious transaction. The rising risk ratios in these categories reinforce what external reports suggest: identity fraud is getting more layered, touching property records, deposits, credit instruments and scam-driven social engineering in parallel.

Data breach events accelerated sharply in Q4, both in frequency and scale (based on our product users). Monthly breach events rose from a low of 307 in January to a peak of 3k+ in November, before closing the year at 2,243 incidents in December, representing a +175.23% quarter-over-quarter increase in total breach events.&nbsp;The volume of exposed data followed a similar trajectory: breached records climbed from 557k in July to more than 2.09 million records in December, driven by a sharp spike in November (1.4 million records). Overall, the amount of breached data increased +157.36% QoQ, underscoring not just more frequent breaches, but larger and more consequential exposure events as the quarter progressed.To interpret the identity alert ratio correctly, it helps to separate volume from severity. The identity alert ratio shows the share of active users who received at least one alert of a given type in the period, including early warning signals as well as higher-impact events. Some alerts are low-friction indicators; others point to concrete exposure, such as an unrequested loan application, suspicious account activity, or confirmed data exposure. Taken together, the trend suggests identity-related issues are affecting a growing portion of our user base, not just a small unlucky subset.

<h4 class="text-align-justify">Personal identifiers are becoming skeleton keys</h4>The WhatsApp incident covered in our blog, “<a href="https://www.gendigital.com/blog/insights/leadership-perspectives/whatsapp-phone-number-privacy" target="_blank">The WhatsApp privacy scare you probably missed</a>”, was a clear reminder that a single identifier can unlock a lot more than people realize. The underlying lesson – and risk – is not limited to WhatsApp. Phone numbers and similar identifiers are increasingly treated as universal keys across messaging apps, banking, recovery flows and two-factor prompts. When they leak, attackers can combine them with old breach data, open profile information and cheap lookup tools to reconstruct profiles of who you are, where you live, who you talk to and which services you most likely use. These profiles make it much easier to craft believable <a href="https://www.avast.com/c-phishing" target="_blank">phishing</a>, SIM-swap attempts, fake support calls or password reset tricks that look “just personalized enough."We see the same pattern in our LifeLock alerts when scam or phishing events spike at the same time as breach notifications and new financial applications. Your identity is usually not compromised in a single dramatic event. It is probed, enriched and reused over time, with each exposed data point making the next attack more convincing.Two of this quarter’s featured stories highlight this trajectory at a personal level. The GhostPairing WhatsApp takeover piece shows how a single pairing code can silently add a “ghost” device to your account, turning your own chat history, voice notes, and contacts into tools for further impersonation. The AI-assisted romance scams story shows how photos, voice and social profiles can be stitched into complete synthetic partners that feel real to victims while they are being nudged toward verification pages, investment portals or intimate exchanges. Both cases build on the same idea: your identifiers and traces become the raw material for someone else’s script.<h4 class="text-align-justify">Synthetic professionals and ghost employees</h4>It is not only individuals who are dealing with identity risk. Organizations are also being fooled by fake colleagues and professionals who exist only on paper and in pixels.In the United States, several defendants <a href="https://www.techradar.com/pro/security/north-korean-fake-worker-scheme-caught-live-on-camera" target="_blank">pleaded guilty</a> in a case that revealed how North Korean IT workers, operating under false names and using stolen or borrowed US identities, managed to secure remote jobs at hundreds of companies. They funneled salaries and back to North Korea, bypassing sanctions and giving access to corporate networks and codebases were being handled by people very different from the resumes on file.On the services side, investigations into the freelance marketplace Fiverr exposed dozens of profiles that <a href="https://www.solicitorsjournal.com/sjarticle/scammers-exploit-fiverr-posing-as-solicitors?category=News" target="_blank">impersonated real UK solicitors</a> using stolen Solicitors Regulation Authority credentials paired with AI-generated headshots. Some of these fake “lawyers” openly admitted to using AI tools to generate legal documents for clients, while regulators reported more than 1,400 scams involving impersonation during the year.&nbsp;The common thread in these cases is not just that criminals are lying about who they are. It is that they are hijacking institutional trust signals: bar numbers, professional registries, corporate HR processes, video calls and polished headshots. When these markers are cheap to fake and hard to verify at scale, both individuals and organizations end up making high-stakes decisions based on identities that never really existed.Again, our internal telemetry aligns with this. The uptick in new applications for credit products and leases under LifeLock monitoring is consistent with synthetic identities being used to open lines of credit or rent assets that will never be paid for.<h4 class="text-align-justify">Defenses are catching up, but trust is fragile</h4>The defensive side of this picture is evolving quickly. Global investment in digital identity protection, fraud detection and financial crime technology continues to grow. <a href="https://www.researchandmarkets.com/reports/5792959/identity-theft-protection-services-market-report?srsltid=AfmBOorwPIgcrhHEzd4_Lkl69j4E2egwKuTMc51EQBIWB7g0Lc2mdh48" target="_blank">Analyst reports</a> on the identity theft protection market, for example, expect the global sector to rise from roughly 14.5 billion dollars in 2025 to more than 23 billion by 2029, with double-digit annual growth as more consumers pay for dedicated monitoring and restoration services.&nbsp;In regulated industries like banking and insurance, digital identity protection is now treated as core infrastructure rather than a nice-to-have. <a href="https://www.everestgrp.com/press-releases/everest-group-releases-three-latest-reports-focusing-on-digital-identity-generative-ai-and-leading-technology-providers-in-financial-crime-and-compliance.html" target="_blank">Everest Group</a>’s recent work on digital identity and financial crime notes that financial institutions are moving toward layered systems that combine identity verification, strong authentication and compliance automation, increasingly with AI and biometrics in the loop.&nbsp;The challenge is that technology alone does not fix the trust gap. An <a href="https://www.experian.com/thought-leadership/business/identity-and-fraud-report" target="_blank">Experian</a> survey shows that more than 80 percent of people expect companies to take active steps to protect their identity and privacy, yet far fewer actually trust that those companies are doing enough. Many people want both stronger protection and less friction, which is a hard combination to deliver. When identity checks are too intrusive or wrongly block legitimate users, people quickly lose patience. When checks are invisible and permissive, fraud finds the gaps.&nbsp;Our own experience echoes that tension. Adding new alert types makes it easier to spot the early stages of identity abuse, but it also increases how often we ask people to verify themselves. If every warning feels urgent, users tune out. If one critical alert looks like every marketing email, it gets ignored – our products work hard to balance these tensions to ensure people are alerted appropriately.<h4 class="text-align-justify">Where this leaves people</h4>The trend in Trust &amp; Identity this quarter is clear: more of the risk people face is expressed as identity events rather than isolated <a href="https://us.norton.com/blog/emerging-threats/malware" target="_blank">malware infections</a>. Stolen or fabricated identities show up as new property records, breach notifications, suspicious deposits, new credit lines and scam-driven alerts in customers’ accounts. Businesses are ramping up their use of digital identity tools and AI-assisted fraud detection, yet still struggle to keep pace with criminals who can cheaply clone faces, voices, documents and resumes.For individuals, the practical implications are simple but uncomfortable:<ul><li data-list-item-id="e9bfa5e1ad7f8ff266e03dc2617c2af3a">Your phone number, email, government IDs and professional credentials are treated as universal keys across many systems. When one of them leaks, it is not a minor nuisance; it is a long-term risk factor.</li><li data-list-item-id="e691e20569c743a5ceb7641b86dc940c3">“Verified” is not binary anymore. A bar number, a corporate email or a polished profile can be perfectly fake, especially when AI does the heavy lifting.</li><li data-list-item-id="e76da762ee8d5d0bd9ea977451f45bb80">Digital identity protection is becoming something you must maintain continuously, not a one-time fix after a breach notice.</li></ul>In the remainder of this report, we will show how these abstract trends play out in concrete stories, from account takeovers that add ghost devices to your chats, to AI-orchestrated romance scripts that wrap themselves around your emotions, finances and documents. Taken together, these stories show that the real battleground is not a login page; it is the evolving relationship between who you think you are online and who your data claims you are.<h3 class="text-align-justify">Financial Wellness&nbsp;</h3><a href="https://lifelock.norton.com/learn/fraud/bank-scams" target="_blank">Financial scams</a> follow money habits. They show up wherever people check bank balances, apply for loans, move money between accounts, or try to stretch a paycheck. Until now, our view of that space came mostly from classic cyber telemetry, for example, banking phishing, fake investment portals and payment fraud.In 2025, Gen added MoneyLion to its portfolio, empowering consumers to confidently manage and protect their digital and financial lives. <a href="https://www.moneylion.com/" target="_blank">MoneyLion</a> democratizes&nbsp;access to financial tools like credit-building, savings, and personalized advice through a single mobile app. &nbsp;With MoneyLion now part of Gen, we have a new vantage point on how financial risk appears in real life, at the exact moment when people are choosing products and making decisions about their money.Across Q4, four patterns stand out. They do not look like traditional “banking Trojans,” but together they show how fraud is threading itself into everyday financial behavior.<ol><li class="ck-list-marker-bold" data-list-item-id="e7e5b91c69e23ca392e68ce54808e1b95">Stolen identities are pushed into onboarding, not just into logins</li></ol>In November 2025, MoneyLion’s data science team flagged a burst of new account applications that looked legitimate on the surface but failed deeper checks. Follow-up analysis showed three constants:<ul><li data-list-item-id="ed2fecb160927f3c7b558568969d700ed">The identity data looked real, not invented, and was good enough to pass basic<a href="https://www.gendigital.com/blog/insights/reports/threat-taxonomy" target="_blank"> Know Your Customer (KYC) processes</a>.</li><li data-list-item-id="e8bc0cf7d814b2d781fd826d1ec1eb81f">Deeper checks on devices, IP addresses and declared locations did not line up, with discrepancies between IP and claimed home address or very recent sightings of those devices.</li><li data-list-item-id="eeef860c353f9f3ef512d8650db1e956d">A clear clustering around the same external bank as the linked account.</li></ul>In other words, this was not a random spray of fake applications. It was a low-volume, high-quality push using stolen identity kits and existing bank accounts to try to pass as “perfect new customers” for a banking-style product. MoneyLion’s layered controls, including step-up identity verification backed by risk scoring, stopped all of these attempts, so there were no recorded losses from this wave.What we learned from this pattern is important. It repeats behavior seen earlier against other US institutions, such as Citizens Bank (2023) and Varo Bank (2024): once attackers have clean identity and account data, the next logical step is to walk that data through fintech and credit products, not just use it for brute force logins. Fraud volumes stay deliberately low to avoid bot and velocity checks, which means the quality of each identity matters more than the number of attempts.<ol start="2"><li class="ck-list-marker-bold" data-list-item-id="e4099d29e094fa4197a6b364197005a60">Tipping and post-settlement edits are an attractive fraud surface</li></ol>A second pattern involves how cards handle tips and post-settlement changes. MoneyLion has been fighting a recurring fraud method where a fraudster:<ol><li data-list-item-id="e1962e138bd4e963d4fd6814bbe4dcf8f">Acquires or controls a bank account with a small balance, for example, five dollars.</li><li data-list-item-id="e2bf91adc4b348ee9131f256dbda3431a">Seeks authorization for a tiny transaction, often one dollar, which easily passes.</li><li data-list-item-id="e8bd6a6b5960bb9b0b1f879d03209d74f">After authorization, the settlement amount dramatically increased, for example, to fifty thousand dollars.</li></ol>Because the authorization has already gone through, the system often treats the later settlement as approved and pushes the burden of recovery into slow dispute processes. In Q4, two incidents illustrate the impact:<ul><li data-list-item-id="e3d97b724ce1daf63e2de9de11ea794f2">In October 2025, one actor used this method to create potential losses of around 33,000 dollars.</li><li data-list-item-id="e713b00e13a03a1837e3a29f8721f0378">In November 2025, a single user caused about 16,000 dollars of loss in a single day while on a cruise.</li></ul>On a monthly basis, forced post-settlement abuse still represents a small share of overall revenue, measured in a few basis points. This approach exploits a feature originally designed for hospitality and tipping, where post-transaction adjustments are normal. If platforms let new or lightly vetted merchants perform large modifications without extra checks, a handful of actors can repeatedly convert one-dollar tests into five-figure hits.

&nbsp; &nbsp;3.&nbsp; &nbsp; Microtransaction disputes blur the line between customer and fraudsterMicrotransaction abuse shows up at the intersection of creators, social platforms and financial apps. The basic approach looks like this:<ul><li data-list-item-id="e0d94f673cb2c70c4583ecb242b260d6e">A user connects a bank account to a money app,</li><li data-list-item-id="ecdf376ca3acfcfdaecbe826c5255c33c">They send a high volume of small tips or purchases to a creator on platforms such as TikTok or Meta,</li><li data-list-item-id="e9d98b9ae3cae5052220e968381fce719">Once the funds have cleared, they dispute all the transactions, claiming they were unauthorized or that goods were not received.</li></ul>Sometimes the creator is an unwitting victim, seeing their income clawed back. In other cases, there is a collusion between the account holder and the creator, who split the proceeds. Either way, the economic incentive for banks and processors is often to accept the disputes, because fighting thousands of small chargebacks costs more than writing them off.MoneyLion’s view is that, since January 2025, the use of microtransactions has been rising across gaming and social platforms, and in some months, dispute volumes linked to this behavior can balloon into the 20,000 to 30,000 dollar range if all those transactions are auto-approved and later contested. That is real money at the scale of a single merchant or creator ecosystem.From a financial wellness perspective, this is where first-party fraud stops being a rounding error. People are being coached online to treat chargeback abuse as a “trick” against big platforms, not as fraud that raises costs for everyone. At the same time, some genuine consumers, including families managing kids’ in-app spending, are nudged into overspending through manipulative in-app purchase design, then fall back on disputes when bills arrive. Both sides push more friction and higher fees into the system.

&nbsp; &nbsp;4. &nbsp; &nbsp;Phishing and account takeover still drive the biggest direct lossesThe most traditional pattern in MoneyLion’s data is also the most expensive: SMS phishing that leads to full account takeover. The recent waves share a familiar anatomy:<ul><li data-list-item-id="ec05dd658f05d5045bceb2652a5c48457">Attackers obtain phone numbers and partial identity data for real customers, often from breaches at other financial institutions or data brokers.</li><li data-list-item-id="e08d4729f3a58c76836c8b08351cc32a5">They send localized SMS messages that mimic MoneyLion alerts and direct people to a fake login page,</li><li data-list-item-id="ebe1ad55a9eed32650608941d3f5f982c">The fake page collects credentials and one-time passcodes, which are then replayed immediately against the real service.</li></ul>This method has the potential to cause substantial losses, even when baseline verification and risk systems block many attempts. In response, MoneyLion applies a layered approach that escalates checks at the moments of highest risk, including targeted re-verification when activity deviates from legitimate patterns. The tradeoff is friction; stronger checks can occasionally surface for legitimate customers. Looking ahead, that balance will get harder as AI-assisted fraud attempts improve at spoofing identity signals, increasing the need for resilient liveness and deepfake-aware verification. Across incidents, device profiling also showed consistent environment indicators, including repeated locale and input-setting artifacts, but these signals should be treated as investigative context, not attribution.These campaigns also tie back to the broader identity picture in this report. The same compromised phone numbers and partial profiles that make WhatsApp or banking phishing so effective are often sourced from earlier breaches or data sales. Once an attacker can get a customer to hand over a temporary code, every other safeguard has to be fast and precise enough to recognise the session as abnormal in real time.MoneyLion’s answer has been to invest in stronger multi-factor orchestration and alternative authentication methods that are harder to replay through phishing proxies, for example, device-bound approvals and more aggressive step-up checks when fresh devices or locations appear.<h4 class="text-align-justify">What this adds up to for financial wellness</h4>Taken together, these patterns show financial fraud moving closer to everyday behavior:<ul><li data-list-item-id="ed94ca1b90ea0da5c1e283cb8f21118d0">Stolen identity data is being spent first on high-quality onboarding attempts, not only on brute force logins.</li><li data-list-item-id="eaf5d8ad8af3d6eb49a592bfa0281a14e">Legacy payment features such as tipping and post-settlement edits are being bent into tools for outsized paydays.</li><li data-list-item-id="edd82ef96ae7d037201da06f56938487f">Microtransactions and creator economies create fertile ground for chargeback abuse and collusive “friendly” fraud.</li><li data-list-item-id="eb778f3415db6e3be1bac3f3d6e19488f">Classic phishing and account takeover remain a primary driver of direct dollar losses, powered by recycled identity data and convincing lures.</li></ul>For Gen, MoneyLion’s signals let us see those risks at the moment they touch real customers: when an application is blocked before funds move, when a one-dollar test suddenly settles as a five-figure charge, when dozens of micro tips are quietly disputed, or when an SMS lure turns into a drained account. That is where financial wellness is decided in practice, not in a spreadsheet of average balances, but in the repeated small moments where people either keep control of their money or quietly lose it.Patrik Holop, Associate Manager, Data Science Luis Corrons,&nbsp;Security Evangelist<h2>Featured Stories:&nbsp;how current threats play out in real life</h2>The numbers in this report show how large the problem has become. These stories show how threats come to life in our daily lives. Each of the following featured stories zooms in on a specific campaign or technique we investigated in depth, from account takeovers spreading through trusted apps to AI-shaped scams and media manipulation designed to make people hand over control of their device or account with a single tap or scan. The common thread is not a particular piece of malware, but a pattern of behavior. Attackers exploit familiar brands, everyday tools and believable scenarios, then use automation and AI to scale those tricks across millions of people. These cases reveal where attackers are concentrating their efforts, what defenses have proved effective, and which risks are likely to accelerate in the year ahead.<h2 class="text-align-justify">How AI made video scams personal, one viewer at a time</h2>

We live in a digital feed that never sleeps. Within a few years, our habits have shifted from group chats and photos to an always-on stream of short and long videos, social posts and streaming. YouTube has become a fixture of living-room TV time in many countries, and is no longer just a mobile pastime. In August 2025, it captured <a href="https://www.yahoo.com/news/articles/youtube-tv-viewership-streak-continues-120000274.html?guccounter=1&amp;guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&amp;guce_referrer_sig=AQAAAG8OIgGxXI3s83CwHnvwudXD8DPRK63Hy9F6YZCJkGYm17g444YvKv_lKEz_pNN9Ame8XSB_kH1VGY2xAj-oAUFrMLZvqfdgxoLpGD_RVuUF-kCjab9JXx9gPKq8vnNhG3D_GsSE18dKKZoM9jc8OmwnM3ZkhkYxpdKb6MO_cWhu" target="_blank">13.4% of all U.S. television viewing</a>, its second-highest share on record, a clear sign of how mainstream video creators have become stars in homes across the country. In the UK, regulators report that 41% of YouTube viewing happens on TV sets, another sign that social video has migrated from phones to sofas. Streaming overall keeps expanding its share of home TV use, and that shift brings more advertising and recommendation engines into connected TV, shaping what people see next.&nbsp;At the same time, AI has quietly carved out a key role in video production. AI is no longer a novelty technology; it is often the most important tool for creators and marketers. Adobe’s latest global survey found <a href="https://news.adobe.com/news/2025/10/adobe-max-2025-creators-survey" target="_blank">86%</a> of creators are using generative AI somewhere in their workflow, and most say it allows them to create content they never could before. Analysts forecast that a growing share of outbound marketing messages will be synthetically generated, which means persuasion at scale will arrive with fewer human bottlenecks. Put simply, a larger portion of the videos that reach people will have AI fingerprints on them, whether that is to clean up audio, generate B-roll, clone a voice, or stitch a composite face or content that combines all of the above.Criminals always follow the audience and the tooling. The same advances that let a small team produce studio-grade content also let a small criminal crew fabricate a convincing plea for money or a fake endorsement. That does not always mean chasing virality. It often means crafting clips that look and sound intimate enough to convert a small group of potential victims.<h3 class="text-align-justify">What the data shows</h3>In the second half of 2025, we added on-device video scam detection to our Windows protection. The goal is simple: focus on content intending harm, not just novelty, and flag videos where manipulated media and scam intent come together.&nbsp;The feature is new and not on every device yet, so results reflect where we have coverage, for example, which platforms and countries have more users with it. To keep the picture fair, we show shares by platform and country, not absolute numbers.&nbsp;YouTube dominates the overall share of blocked AI scam videos, followed by Facebook as a distant second, and X in third place. The most danger comes from longer, engaged watches as opposed to short snippets. This lines up with where attention sits today, many people consume creator video in lean-back sessions on TVs and PCs, which gives scammers longer windows to persuade.&nbsp;

In our Q4 telemetry from Windows devices where this feature was enabled, the distribution of blocked AI scam videos was highly concentrated on a small set of platforms. YouTube accounted for 64.8% of blocks, followed by Facebook at 11.1%. Other platforms each represented a small share in this dataset, including X (0.5%), TikTok (0.4%), Vimeo (0.2%), and Instagram (0.1%). These shares should be read as where blocks occurred within covered Windows PCs, not as a ranking of overall platform risk across the internet. Mobile-first viewing and app-only behaviors are not captured here, which can materially underrepresent platforms that are primarily consumed on phones.This is not a verdict on those platforms at large; it is a reflection of where our customers actually encountered scam videos when on their PC. The dominance of YouTube likely reflects where people spend their video hours, and how recommendations string clips together in longer sessions on TVs and PCs.By country share of blocked AI scam videos, the United States leads, followed by Australia, the United Kingdom, Canada and Germany. All other countries together make up a bigger share than any single country. We treat this as a ranking of where our protection intercepted scams, not a map of overall risk, because results still depend on where the feature is installed and most widely used. As adoption grows, we will add a per-user risk view, users with at least one block divided by active users with the feature.

We stopped most attacks in real time during playback. These scams appeared during playback – while you watched the video – not in downloads or attachments.&nbsp;Most scam videos blocked were general scam content, with financial and cryptocurrency lures close behind. In other words, AI manipulation is not the entire scam but a working part of a larger money play. We are continuously working on refining the automatic classification of these scams to have more granular insights.&nbsp;<h3 class="text-align-justify">AI itself is neutral. Danger comes from intent</h3>There is far more AI-generated or AI-edited video in the wild than outright scam video. That is expected and healthy. The presence of AI in a clip is not a useful risk signal on its own. Much of what AI does is benign or even helpful, for example, noise reduction, captioning, translation, and providing stock footage. The risk appears when AI capability is paired with a request for money, data, an urgent ask or an off-platform handoff – when AI and the scam meet.This is why our telemetry tracks only the intersection: AI-made or AI-assisted media that is also a scam.&nbsp;In Q4,&nbsp;on devices where the feature was enabled, we detected 159,378 unique deepfake video scam attempts within this intersection,&nbsp;most of which&nbsp;blended into ordinary content, often voice-led clips embedded in otherwise normal videos. In the smaller, clearly labeled set, the top themes are money-related, finance and crypto.&nbsp;As AI becomes the default ingredient in media production, the right way to judge risk is by intent and behavior, not by whether AI touched the file.

<h3 class="text-align-justify">What the signals suggest:</h3><ol><li data-list-item-id="e7f3231e6b5edfe1418f60aacedcb8a1c">Scammers follow the audience. Wherever people spend time watching videos, that is where scammers go. If they can slip their content into normal playlists on the biggest platforms, they do not need huge view counts. They only need to look believable enough for a small percentage of viewers to fall for it.</li><li data-list-item-id="e254bd855999ddfb48a99f05758ed5eb3">Finance remains the North Star. Our detections show a strong concentration of investment, trading, and giveaway content. This mirrors broader shifts in digital media spend, where AI-targeted ads and calls to action are flooding connected TV and social video. The same tools that amplify legitimate campaigns are also lowering the barrier for fraud.</li><li data-list-item-id="e498e39ba881d8a292a83ab80460e6c99">AI is normal, so AI misuse is normal too. With creator-level adoption this widespread, it would be surprising if criminal crews were not using the same tools. The difference is intent. Our detections focus specifically on AI-touched media that is also a scam, not every video that happens to include AI.</li></ol><h3 class="text-align-justify">Why this matters for consumer harm</h3>The risk is not just the astonishing fake. It is the ordinary-looking clip that blends seamlessly into your subscriptions. A cloned voice reading a script over stock footage is enough to move money when it is seen next to a trusted logo or comes from a familiar face or a creator you already follow. &nbsp;This represents a very different problem from yesterday’s focus on spotting viral deepfakes.<h3 class="text-align-justify">What people can do right now</h3>Beyond using deepfake protection products, here’s a list of actions that can help protect you across platforms:&nbsp;<ul><li data-list-item-id="ed5e924f49954d4b79723f2675a107b37">Do not trust a clip to stand on its own. If it asks you to move money, pause and switch channels. Verify through a known contact method or an official website you type in yourself.</li><li data-list-item-id="eadde55fbaf50aada8bbace50bb860e4a">Ignore urgency and exclusivity. Timers, limited slots, or “only for subscribers” offers are classic pressure cues for investment and giveaway scams.</li><li data-list-item-id="e0a458a289fe7f0919089e948e7ce2a95">Check audio more than visuals. Many scams hinge on cloned or stitched audio. Listen for pacing that never breaks, awkward breaths, and mismatched tone or echoes.</li><li data-list-item-id="e01fb8612979a2e07ce2e6da63d304521">Treat QR codes and pinned comments as links from strangers. Search for the destination yourself instead of scanning codes and clicking links.</li><li data-list-item-id="eed7c9767acc12473ecee649631576ac7">Report and move on. If you spot a scam, report it. Platform reporting helps downrank bad content faster and reduces the chance others will see it.</li></ul>Criminals do not need a million views; they need the right viewer at the right time. Audio is the quiet driver. Cloned or heavily edited narrations can project authority or urgency, while ordinary visuals avoid attention. Together, this lowers skepticism, exploits fluency bias and presents the message as guidance rather than persuasion. A clip labeled as an interview or a tutorial feels safe, especially if the voice sounds familiar, even if the visuals are generic or the proof is just an overlay. &nbsp;That dynamic helps explain why almost all intercepts happen during playback, showing where protection is most critical.AI is now normal in content production, and there is likely no turning back from this – rather, the inclusion of AI in the media we consume will only increase. The question is not whether AI is in the loop; it is whether the clip uses AI to push a fraudulent action. This is our first share-based read on AI-made or AI-assisted scam videos across platforms and countries, and it lets us set a baseline and move from anecdotes to patterns. You will see these figures evolve as adoption grows, and we will keep calling out two things clearly in future quarters: where people are actually getting hit and which lures are costing them money.&nbsp;<h2 class="text-align-justify">Love at machine speed</h2>At one time,<a href="https://www.avast.com/c-romance-scams" target="_blank"> romance scams</a> were clumsy cons, full of spelling mistakes and obvious lies. That changed the moment AI learned to play humans. Today, a scam can arrive in your inbox as a fully formed character, complete with a believable face, a convincing voice, a life history, and a pattern of small, attentive gestures that feel, to the target, exactly like falling in love.

Imagine the scene: You match with someone on a dating app. Their profile pictures are glossy but intimate, a mix of sunny holidays, a coffee shop selfie, a dog framed by a living room bookcase. Their messages are clever – they remember details about your weekend that you barely mentioned, and they send sweet voice notes that sound warm and somehow familiar. Over a few weeks, the conversation deepens, the stranger remembers that you prefer black coffee, asks about the scar on your knee, and sends a private clip where they say your name. It all feels painfully real. Unfortunately, what you are experiencing is not human love; it is an engineered performance, orchestrated by AI tools that fill in every gap where human deception used to stumble.What makes today’s romance scams so effective is not just the synthetic photos or the cloned voices. It is the emotional precision. In psychology, you sometimes see this described as a “dark empath,” someone who can read your cues and mirror your emotions but uses that insight instrumentally to manipulate you. AI helps scammers mimic that behavior at scale, remembering tiny details, matching tone, and timing warmth or vulnerability so it feels like real care, right up until the ask arrives.&nbsp;Although we often speak about this type of con in relation to dating apps, the same playbook runs across mainstream social media. You can meet an almost perfect partner on Facebook, trade DMs on Instagram, stumble into a flirty TikTok live, or move a chat from X into a private channel, and the mechanics do not change. AI supplies the photos, voice notes, and short videos. The account looks lived in with a few reposts and friendly comments, and the conversation builds the same rhythm of attention and trust. The pivot comes later – a request for money, a verification link, a parcel fee, or an intimate exchange that later turns into extortion. Regardless of the platform, the script is the same.<h3 class="text-align-justify">Different stories, same end goal&nbsp;</h3>Before naming specific schemes, it helps to recognize the pattern. First, the relationship feels real. The details stay consistent across photos, voice notes, short videos, and even documents. Then the story branches. Some paths guide you toward “safe” investments. Others steer you to verification pages that harvest IDs or payment information. Some rely on urgency, using a voice that sounds like a loved one, while others turn intimacy into pressure and threats. These flavors often overlap. Criminals pivot as soon as you hesitate. The goal is always the same: turn trust and emotion into money or data. Below are the most common variants, with plain explanations and simple examples you can recognize in the wild.<ol><li class="ck-list-marker-bold" data-list-item-id="e4a87fd3a24ff95050acfa5629d947fb6">The classic romance turned investment trap – pig butchering</li></ol>What starts as a genuine emotional bond gradually shifts into financial manipulation. The scammer, posing as a caring partner, introduces the victim to a safe investment or crypto opportunity. The app or website looks legitimate, shows fake profits, and once the victim invests more, everything disappears.Example: After weeks of flirting, your new partner persuades you to test an exclusive trading platform. You top up, and the site disappears with your money.<ol start="2"><li class="ck-list-marker-bold" data-list-item-id="ef8315ac63de23c390c69bd9092028585">Deepfake lover or influencer impersonation</li></ol>Scammers use AI-generated photos, videos, and voice clones to impersonate attractive strangers or even celebrities. These fakes feel personal and intimate, convincing victims they are speaking to someone real.Example: A short clip arrives with a familiar face saying your name, inviting you to a private chat that leads to paid perks.<ol start="3"><li class="ck-list-marker-bold" data-list-item-id="ee2613e7b3a223fec51b41c61504d5b2c">Sextortion through synthetic intimacy</li></ol>Here, the scam escalates quickly. After some flirtation or exchange of images, the victim receives a doctored photo or AI generated video that appears to show them in a compromising situation. The criminal then demands payment to keep it private.Example: A blurred video appears to show your face on someone else’s body, followed by a threat: pay or I will send this to your contacts.<ol start="4"><li class="ck-list-marker-bold" data-list-item-id="edac4907c839fd8d30190b8a6969300df">Reciprocal sextortion, AI-assisted trust building</li></ol>The scammer sends AI-created nudes first to lower defenses, promises reciprocity, then pressures the victim to send real images. Once the victim complies, the scammer extorts them using those real photos.Example: Someone on a dating app offers to prove trust by sending a nude; it looks real thanks to AI. You send one back, then receive demands to pay or it will be shared with your contacts.<ol start="5"><li class="ck-list-marker-bold" data-list-item-id="e07a9c5c19efac9df0c1e67600499107e">Voice cloned loved one in distress</li></ol>A few seconds of audio are enough to create a believable call from a partner or family member, claiming to be in an emergency and needing immediate help.Example: A frantic call that sounds exactly like your sibling, claiming they are stuck overseas and need cash for a hotel or medical bill.<ol start="6"><li class="ck-list-marker-bold" data-list-item-id="e4a463aa7393ccc73ce019964b562db2d">Fake verification or dating platform scams</li></ol>The lure is safety and trust. The scammer asks you to verify your identity on a separate site, which actually collects payment details and personal information.Example: To keep us both safe, please verify your profile here. The site looks official, but it is a front to steal your card data.<h3 class="text-align-justify">What falling for these scams actually costs</h3>The damage is wider than a single transfer. It usually includes direct financial loss, ongoing blackmail or harassment, identity theft from “verification” flows, account takeovers, and a long tail of recovery costs and stress. At the population level, the losses are substantial.&nbsp;The&nbsp;<a href="https://www.fbi.gov/news/press-releases/fbi-releases-annual-internet-crime-report" target="_blank">FBI’s Internet Crime Complaint Center</a> recorded more than 16 billion dollars in reported cybercrime losses in 2024, a 33 percent jump over 2023, and notes that the true figure is likely higher. The U.S.&nbsp;<a href="https://www.ftc.gov/news-events/news/press-releases/2025/03/new-ftc-data-show-big-jump-reported-losses-fraud-125-billion-2024" target="_blank">Federal Trade Commission</a> reported 12.5 billion dollars in total fraud losses in 2024, up 25 percent year over year, and highlighted that scams starting online account for billions of those losses. Within that, romance scams remain among the costliest imposter scams, with 2023 reports alone totaling <a href="https://www.ftc.gov/business-guidance/blog/2024/02/love-stinks-when-scammer-involved" target="_blank">1.14 billion dollars</a> and a median loss of 2,000 dollars per person. Older adults are hit hard: an FBI report tallied more than&nbsp;<a href="https://apnews.com/article/c0da7899f667f9daace4926d5ff3f427" target="_blank">3.4 billion dollars</a> stolen from Americans 60 and over in the latest year, with thousands losing over 100,000 dollars each.&nbsp;Loss is not only about money. Sextortion cases bring sustained threats, reputational harm, and doxxing attempts. Identity documents uploaded to fake “safety checks” can be reused for new accounts and loans. Voice-clone emergencies corrode trust inside families and, in extreme cases, trigger dangerous real-world confrontations. Finally, victims are often targeted again by “recovery” scammers who promise refunds for a fee.<h3 class="text-align-justify">What our telemetry shows in 2025</h3>Many attacks that start with a romance setup pivot quickly into other scams, for example, investment portals, sextortion, refund or parcel fees, or fake verification that harvests IDs. We tag an event as “dating-scam” only when the lure or page clearly uses a romance or dating pretext. If a conversation shifts early into investments, parcel fees, refund tricks, fake verification, or generic phishing, it is blocked under other categories. In other words, the dating-scam data understates the true volume of attacks that begin with a romantic hook.In recent months, we have seen a steady rise in romance-themed scam attempts in our telemetry, as reflected in the below graph. There were over 17 million dating scam attacks blocked in Q4 2025, an over 19% increase from the same period in 2024.&nbsp;

<h3 class="text-align-justify">How to stay safe, without killing the mood</h3>You may be thinking: Do careful people still fall for these types of scams?&nbsp;The answer is a resounding yes. These scams target judgment, not knowledge. When photos, voice notes, videos, and paperwork all line up, our brains overweigh coherence. AI is excellent at making everything feel seamless. The fix is not paranoia; it is adding small moments of friction where reality is forced to show up.First, treat any money request inside a romantic context as high risk. Pause between the message and any payment, even if the amount is small or framed as a refundable fee. If you need to verify a person, do it with a live, unpredictable check that is hard to pre-record. Ask them to join a video, write a phrase you choose on paper, hold it with both hands visible, then pan to a nearby window or street sign. If the connection is always too poor for that, keep your guard up. When someone invites you to invest, only use platforms you already trust and reach on your own, not links sent in chat. Refuse off-platform verification pages. For parcels, type the courier website yourself, and do not click tracking links sent in DMs.Set a personal rule not to send explicit content. Scammers now send convincing AI nudes first to lower defenses. The goal is to make you send something real, then quickly change the conversation to threats. If you already shared something intimate and are being extorted, stop contact, save evidence, report the account on the platform, and file a report with local authorities. Payment rarely ends harassment and often increases demands. Tell a trusted friend so shame cannot be used against you.Real love online exists. That is exactly why these scams work. You do not need to switch off your heart to stay safe. Just keep three habits at the top of your mind: pause before paying, verify on a channel you control, and refuse high-risk moves on someone else’s schedule. These small steps are enough to break most scripts.<h2>The code that steals your WhatsApp&nbsp;</h2><h3 class="text-align-justify">How device linking enables takeover, persistence, and rapid spread across your contacts</h3>You are chopping vegetables when your phone buzzes. A WhatsApp from a friend you trust. “Hey, I just found your photo!” The preview shows what looks like a Facebook post. You tap.

The page looks familiar, clean and a bit boring, which is exactly the point. There is a Facebook login box, then a blue button that says you need to verify to view the photo. When you press it, the next screen shows a six-digit code and a short instruction telling you to open WhatsApp and enter it to confirm the login.You want to get back to dinner, so you do what the page tells you. A second later, nothing obvious happens, so you put the phone down.What actually happened is the whole story.<h3 class="text-align-justify">What the attacker just got</h3>That code was not a Facebook thing. It came from WhatsApp’s own device linking feature and it belonged to the attacker’s browser. When you entered it in WhatsApp, you quietly granted the attacker a live session to your account. They can now read your chats, see new messages arrive in real time, and write to your contacts as if they were you. No SIM swap, no code theft, no forced logout on your phone. It feels invisible because WhatsApp treats that browser as one of your own devices.<h3 class="text-align-justify">How the trick actually works</h3>Most people think linking WhatsApp Web only works by scanning a QR code. WhatsApp actually has a second method for pairing devices, one almost nobody knows about: linking a device using only your phone number and a numeric code sent inside the app. It was designed as a convenience feature, but it looks so similar to a standard security confirmation that attackers have turned it into the perfect social engineering tool.Here is what really happens in the background. When you land on the fake Facebook page, the site forwards your phone number to the real WhatsApp Web linking flow. WhatsApp then generates a pairing code that the rightful user must enter in the app to approve the new device. Instead of keeping that code on their own screen, the attacker simply prints it on the fake page and tells you that you must “confirm this login in WhatsApp to view the photo.” To most people, this looks like a normal verification step, the kind you see every time you log in somewhere.

The moment you enter that number into WhatsApp, you are not verifying anything related to Facebook. You are authorizing a new linked device and giving the attacker’s browser the same level of access as your own laptop. That is why this takeover feels so clean. There is no password theft, no malware, no obvious alert. The attacker just slips into your account and quietly becomes you.Technically, the same abuse is also possible with QR-based linking. In practice, however, that is much harder to drive at scale when both the browser and WhatsApp run on the same phone. Asking people to deal with a numeric code on screen is far more realistic, which is why the campaigns we see rely on the phone number plus pairing code flow.For a deeper technical walkthrough of the device-linking abuse, including additional examples and infrastructure details, see our supporting blog post, “<a href="https://www.gendigital.com/blog/insights/research/ghostpairing-whatsapp-attack" target="_blank">GhostPairing Attacks: from phone number to full access: abusing WhatsApp’s device linking.</a>”<h3 class="text-align-justify">How the snowball forms</h3>While you finish dinner, the attacker gets busy. Your family group receives the same short message and link. So do your school chats, your work chats, and the neighbor who checks your dog. The words feel like you wrote them, short and casual, so people click. Each new victim goes through the same “verification” step, entering their own pairing code in WhatsApp and linking a new attacker-controlled browser. Each account becomes another megaphone. That is why this spreads fast. It is not a random number texting you. It is a friend.If anyone reports you for spam, WhatsApp may temporarily limit your account. That helps, but it does not remove the attacker’s linked browser. When the limit expires, the session is still there unless you manually revoke it. Persistence is part of the playbook.<h3 class="text-align-justify">Why this technique matters</h3>End-to-end encryption protects messages in transit, but device linking changes the threat model. A single scan or code approval gives the attacker the same view of your chats that you see on your laptop. Once inside, they do not need to rush. They can watch, learn who your closest contacts are, and wait for the perfect moment. A voice note you recorded last week becomes training data for a voice clone. A holiday photo becomes the backdrop of a payment request that looks and sounds exactly like you.We refer to this pattern as a GhostPairing Attack. The attacker’s browser becomes a kind of ghost device on your account, present in every conversation, even though you never see it on your phone.The scam starts as a two-minute trick. It evolves into slow, patient social engineering supported by the kind of personal data only a compromised WhatsApp account can provide.<h3 class="text-align-justify">Inside the kit</h3>Everything about this flow suggests a packaged kit. A short lure localized for a specific country. A generic Facebook skin. A reusable linking step that connects directly to WhatsApp’s legitimate device pairing logic. The domains are disposable and interchangeable, from photobox[.]life to yourphoto[.]world to postsphoto[.]life. Tomorrow, there will be new ones with the same HTML and a different logo. This is production line fraud.<h3 class="text-align-justify">What to do right now</h3><ol><li data-list-item-id="eff946c84183c0e06565922397aeebba6">Open WhatsApp, go to Settings, Linked devices, and log out of any device you do not recognize. If you see a desktop browser you never use, remove it.</li><li data-list-item-id="e9f496a802fac4d1657997abf34ca7e7d">Turn on Two-Step Verification in WhatsApp and set a unique 6-digit PIN. Add a recovery email so you can reset the PIN if needed.</li><li data-list-item-id="e6ffaea11f69d4cd590608aec2a873a87">Treat any code or QR that asks you to link WhatsApp as sensitive. If a website says you must link WhatsApp to view a photo or parcel, close the tab.</li><li data-list-item-id="ef3ab296a2af9f6bd2753baeb3ccde1be">Share a simple warning in your family or school groups. People listen when it comes from someone they know. A single screenshot of the lure plus the linked devices instructions is often enough to stop the chain.</li></ol>&nbsp;<h3 class="text-align-justify">What platforms can fix</h3>This attack succeeds because pairing is too easy to misdirect and too sticky once granted. Three changes would reduce the impact significantly. • Show a clear warning before linking that names the browser, location, and context. • Rate limit linking attempts by browser fingerprint and region to stop mass campaigns. • Auto-unlink unknown sessions when an account is rate-limited for spam.<h3 class="text-align-justify">The takeaway</h3>What makes this scam dangerous is not the message or even the fake page. It is how invisible the compromise is. One quick scan links your WhatsApp to someone else’s browser, no malware required. From there, every private chat becomes an open door, every trusted contact a new target. The same mechanism could be reused anywhere device linking exists, from messaging apps to productivity tools.The moment you approve the link, your account becomes a broadcast channel and a data source for future pressure. The defense is simple once you know it exists. Check linked devices, remove strangers, and think twice before entering a code or scanning a QR that is not inside the official WhatsApp app.&nbsp; &nbsp;Luis Corrons,&nbsp;Security Evangelist Martin Chlumecký, Malware Researcher Patrik Holop, Associate Manager, Data Science<h2 class="text-align-justify">In Closing</h2>&nbsp;As we close this report, one thing is clear: the threat landscape is not chaotic; it is consistent. The tools and brands may change, but the core playbook does not. Criminals lean on trust, routine and speed. They show up in the same browser where you watch tutorials, in the same chats where you talk to family, in the same apps where you check your balance. The most damaging attacks are the ones that feel like everyday tasks until one small decision goes wrong.Across the telemetry and examples in this report, there are three main threads. First, many attacks only work if people do the last step themselves: installing the file, scanning the QR code, approving the pairing, and entering the code. Second, AI has become part of the plumbing on both sides, quietly shaping scams and defenses rather than acting as a headline feature. Third, the harm is increasingly counted in identities and money, fake partners, fake professionals, bad loans, drained accounts and long recovery journeys, not just in machines cleaned and files restored.The good news is that the same patterns that make these attacks scalable also give us repeatable ways to break them. Small moments of friction, clearer warnings around device linking, stronger defaults for privacy and tracking, better authentication flows, and protections that watch what content is trying to make you do, not only where it came from. Our own data from browsers, devices, identity alerts and day-to-day money decisions shows that when those safeguards are in place, many of the “Scam Yourself” tricks simply fail to land.None of this removes the need for skepticism. There will always be a new lure, a fresh logo, a more polished voice or video. But you do not need to chase every novelty. If you treat rushed requests, unexpected verifications and off-platform handoffs as high risk by default, you already cut off a large share of what we see here. A short pause, a second channel to verify, and a habit of saying no to surprise links are still some of the most effective defenses most people have.Thank you for taking the time to explore this report. The work behind it comes from researchers, analysts, engineers and writers across Gen who spend their days trying to translate complex signals into something useful for real people. We hope it helps you understand not just what criminals are doing, but how to stay one step ahead of them in the places where you actually live your digital life.

<h2 id="download-the-q3/2025-threat-report-key-highlights">Download the <a href="https://www.gendigital.com/blog/sites/default/files/2026-01/Q42025%20Threat%20Report%20Key%20Highlights.pdf" target="_blank">Q4/2025 Threat Report Key Highlights</a></h2>Visit our <a href="https://www.gendigital.com/blog/insights/reports/threat-taxonomy" target="_blank" title="Glossary">Glossary and Taxonomy</a> for clear definitions and insights into how we classify today’s cyberthreats.

Fake ads dominated consumer cyberthreats in 2025

Gen Q4/2025 Threat Report

Security Evangelist at Gen

<h3>When you get a message you didn’t expect, and definitely didn’t want</h3>You're having a normal day when your phone buzzes with a new message: "Your parcel couldn’t be delivered – reschedule now: [shortened link]" It even comes from the same thread where you previously got updates from your real delivery company. Seems legit, right?It’s not.That message wasn’t from your courier. It was from a scammer pretending to be one. And if you click the link, enter your details, or install a suggested “app,” you could end up with a drained bank account, lost data, or unwanted spyware or other dangerous applications compromising your device..In this blog, we’ll break down:<ul><li>What SMS threats really are</li><li>The most common types of scams you’ll find in your inbox</li><li>What scammers are searching for</li><li>How to spot scams (and what to do) if one shows up on your phone</li></ul>We’ll even show you real-world examples of these scams in action.<h3>What is smishing?</h3>SMS is the technical acronym meaning Short Message Service – in many places around the world, people refer to SMS messages simply as text messages or texts.&nbsp;Smishing is short for SMS phishing. It happens when scammers use text messages to trick you into taking an action: usually clicking a malicious link, downloading an app, sending a code, or replying with personal or payment information.Sometimes these messages pretend to be your bank. Other times, a government agency, delivery service, family member or even someone offering a too-good-to-be-true job. These messages are designed to look urgent, convincing, and familiar, so you act before thinking.🧠Why SMS? Because it works. We check texts quickly, we trust them more than email, and many phones automatically group texts into brand-labeled threads – making it even easier for scammers to sneak in undetected.&nbsp;<h3>Why you’re seeing more of these messages now</h3><ul><li>Phone numbers are everywhere. Have you shared your number for a raffle? Coupon code? Loyalty card? On social media? That’s all it takes.</li><li>Global scams are industrialized. These are not one-person operations. Criminal groups now run massive SMS campaigns using stolen or breached databases, message automation, and spoofed sender IDs.</li><li>Smartphones are now wallets. With banking, two-factor authentication (2FA), and shopping on your phone, it’s a prime target for fraudsters.</li><li>They only need a few people to fall for it. And statistically, someone always does.</li></ul><h3>The many faces of SMS threats</h3>Let’s walk through the most common SMS scam types. For each one, we’ll explain how it works, what the scammers want, and what you should do.&nbsp;1. The fake account alert (banks, email, crypto, social)Hook: “Unusual login detected” / “Your account is locked” / “Urgent security check.” Goal: Steal your username, password, and possibly 2FA code. How it works: Link opens a perfect copy of a login page (bank, email, crypto exchange). Some variants tell you to call a number to “secure” your account. What to do: Don’t tap. Open the official app or type the address yourself. Never call numbers in the SMS. If you logged in, change your password and enable an authenticator app for 2FA.

2. The OTP (code) theftHook: “Reply with the 6-digit code to cancel your transaction” / “We sent a code to secure your account – please confirm.”&nbsp; Goal: Steal your one-time password to break into your account. How it works: Scammer triggers a real OTP from your service and tries to trick you into sharing it. What to do: Never share codes. If you didn’t request it, someone else probably did.

3. The undelivered packageHook: “We couldn’t deliver your package – pay €1.50 to reschedule.” Goal: Harvest credit card info or trick you into downloading malware. How it works: You’re sent to a fake delivery site with a small payment form or prompted to install a “tracking app” (especially on Android). What to do: Don’t follow the link. Track packages only via the delivery company’s official app or website.&nbsp;

4. The tax refund or fineHook: “You have a tax refund waiting– claim now.” Goal: Payment and identity theft on a convincing look-alike site. How it works: Uses branding from national tax offices, toll agencies, or other government institutions. Creates a sense of urgency with strict deadlines, and asks for card + personal data. Some texts use weird characters to bypass filters. What to do: Always access government and other official &nbsp;portals directly from the official site.&nbsp;

5. The fake refundHook: “You are owed a refund for your flight– click here to claim.” Goal: Steal credit card details, ID info, or sign you up for paid services. How it works: Polished “claim” page with language that creates urgency. Some use homoglyphs (look-alike characters) in brand names to seem legitimate. What to do: Check your account or booking site directly– never through a link in a text.

6. Jobs &amp; side gigs (“mystery shopper”, “brand recruitment”)Hook: “Earn $200/day from home. No experience needed!” Goal: Get you to move to WhatsApp or Telegram and then steal personal info or scam you into paying “recruitment fees.” How it works: Friendly recruiter builds trust, then pressures you into sending personal documents or paying small fees to "start." What to do: Treat unsolicited job texts as scams. Verify roles on official careers pages; never pay to apply.&nbsp;

7. The crypto or investment baitHook: “Hot crypto tip! Double your money in 7 days.” Goal: Move you off-platform and scam you into depositing funds. How it works: Often starts with an SMS and continues on WhatsApp or Telegram. What to do: Ignore unsolicited tips. Real investments don’t arrive by random text.

8. Cloud storage &amp; account expiration scamsHook: “Your storage is full– photos tied to your number will disappear.” Goal: Steal account credentials or payment details; sometimes push you to install a malicious app. How it works: The message warns that your cloud account is about to expire or that photos will be deleted unless you act now. Victims are directed to a fake login page (to harvest credentials) or to a payment form (to steal card details). Some versions even include your phone number in the message to make it feel personal. What to do: Don’t click the link. Instead, check your cloud account directly through the official app or by typing the provider’s website yourself. If you entered your login on a fake page, change your password immediately and turn on two-factor authentication. If you installed an app, uninstall it and run a trusted security scan.

9. The “your phone is infected” / fake tech supportHook: “Phone infected– install our security app” / “Call support now.” Goal: Install a rogue app or gain remote control of your device. How it works: Provides a fake antivirus/security product page, sometimes customized to your device. What to do: Don’t install from links. Use official app stores; never grant remote access to strangers.

10. Prizes, surveys, couponsHook: “You’ve won a phone!” / “Complete a survey for a gift.” Goal: Enroll you in a premium-rate subscription or steal your data. How it works: Fun quiz → “verification” with your number/card → recurring charges. What to do: Skip prize texts. If you clicked, check your mobile bill, Apple subscriptions and cancel new services.

11. Callback smishing → vishing (voice scam)Hook: “There’s a problem with your bank account. Call us now.” Goal: Trick you into calling a scammer pretending to be your bank. How it works: Realistic phone scripts convince you to “verify” your card details or install remote control apps. What to do: Never call back a number from an SMS. Use the number on your card, inside the official app, or on the company’s website.

12. The support link to WhatsAppHook: “Chat with our agent on WhatsApp to verify your identity.” Goal: Move off SMS (harder to monitor) and harvest IDs, selfies, payments. How it works: Deep-link opens a chat with a fake “agent” who requests documents/fees. What to do: Never follow links from SMS to chat apps unless you initiated the conversation.

13. SIM-swap scamsHook: “Your number will be deactivated– update your info.” Goal: Gather enough info to steal your phone number and access your accounts. How it works: Scammers collect info to impersonate you with your mobile carrier. What to do: Contact your phone company directly and ask about SIM-swap protection.

14. Family/friend impersonation (“Hi Mom/Dad, new number”)Hook: “Dad save this new number” / “Hi Mom, I broke my phone– message me here.” Goal: Pull you into a quick “emergency” payment or move you to WhatsApp. How it works: Emotional pressure + urgency; requests instant transfers or vouchers. What to do: Don’t reply. Call the real number you already have for that person to verify.]

15. Messaging-app takeover (“I sent you a code by mistake”)Hook: “I accidentally sent my login code to your number, can you share it back?” Goal: Steal your WhatsApp/other messenger account by grabbing the login code. How it works: If you share the code, they register your account on their device and lock you out. What to do: Never share codes. Turn on in-app two-step verification (a separate PIN).

16. “Recovery” and refund-rescue scams (meta-scam)Hook: “Scammed? &lt;Name&gt; offers trusted recovery support. wa.me/&lt;number&gt;” Goal: Target people who were already scammed and charge “recovery fees.” How it works: Promise to get your money back; ask for upfront payment or more personal data. What to do: Avoid anyone who cold contacts you offering recovery. Report to your bank/police instead.

<h3>Tips &amp; Tricks</h3>There are a number of red flags to watch out for in and SMS. The top signs include:<ul><li>Urgency + consequence: language like “today,” “final notice,” “account lock” drive people to panic and act before they think</li><li>Unexpected links:&nbsp; shortened or unfamiliar domains should always be treated as suspicious</li><li>Code requests: messages like “send back the 6-digit code”</li><li>Channel switch: requests to “Message us on WhatsApp” or “Call this number now” can show intention of planning untraceable, malicious behaviors</li><li>Weird wording/characters: awkward phrasing, unusual spelling or look-alike characters in brand names should always cause pause</li><li>Payment pressure: vouchers, crypto, or wire transfers should be managed carefully over SMS</li></ul>What to do if you receive a suspicious SMS<ol><li>Don’t ever click links and don’t reply. Instead, go to the official website to get information, official phone numbers and emails.</li><li>Do not call any number shown in the SMS. Use the&nbsp;official app, the number on your&nbsp;card, or the company’s&nbsp;website.</li><li>Report it to your mobile provider (many regions use&nbsp;7726/“SPAM”) and to your national reporting channel.</li><li>If you entered details: change passwords immediately; enable 2FA with an&nbsp;authenticator app; watch bank/credit statements and contact your bank if payment info was entered.</li><li>If you installed an app (Android): airplane mode → uninstall → run a trusted mobile security scan; if banking details were involved, contact your bank and consider a full reset as a last resort.</li></ol><h3>Final thoughts: tiny texts, big threats</h3>Scam messages may look harmless (just a few words, maybe a link), but they can be the start of a serious attack. The good news? If you know what to watch for, most of them are easy to spot and avoid.Stay skeptical. Stay informed. And remember: no real service will ever ask for your password or code over SMS.

Scam text messages may be small, but their impact can be huge.

SMS threats: the many faces of a tiny text

<h2 class="text-align-justify">Foreword&nbsp;</h2>The third quarter of 2025 confirmed what many of us have felt all year: the center of gravity in cybercrime is people. Criminals are not only trying to break into devices. They are working to walk users into traps that look and feel legitimate, at scale and with speed. Generative AI has lowered the cost of persuasion and raised the polish of deception. The result is a threat landscape where a convincing message, a nicely branded web page, or a friendly voice can be as dangerous as a zero-day exploit.&nbsp;The patterns we highlighted earlier this year have become more pronounced. “Scam-Yourself” techniques continue to spread across everyday channels like SMS, email, and social media. Phishing moved further from crude copies to what we call VibeScams, where the trick is less in the code and more in the feeling a site gives you at first glance. Attackers are also blending formats. A text message can point to a look-alike login, which then routes a victim to a live chat or voice follow-up. The route is simple. The coordination behind it is criminal.&nbsp;Defenders are adapting too. Our Gen Threat Labs work on both sides of the problem: understanding the criminal playbook and delivering protection that helps real people in real time. On any given week, that can mean reverse engineering a ransomware family to help victims recover their files without paying, training models to spot hidden scam patterns inside inboxes, or publishing practical guidance that families can act on in minutes. We believe research must translate into impact.&nbsp;What you will find in this report reflects that approach. Our Feature Stories highlight real-world examples of what we see, the first of which examines VibeScams, the rise of AI-built phishing factories, and why “looking right” for two seconds is now enough to steal money or credentials. The second story zooms in on SMS – text messages remain one of the most universal and most exploited channels, and this quarter brought fresh tactics that pair automation with human-style tone and timing. The third story covers a new decryptor release and what it revealed about attacker tradecraft, economics, and mistakes. It is a reminder that ransomware is not only about prevention. It is also about giving victims a way back when the worst has already happened.&nbsp;Beyond the Feature Stories, the Threat Landscape connects the dots from first touch to final loss. A sponsored link leads to a look-alike page, an SMS nudges the next click, and an inbox “verification” finishes the job. We document these handoffs with telemetry and case studies, highlight malvertising as a frequent starting point, and show the growing link between social browsing and off-platform fraud. Where numbers can be confusing, we add short notes on definitions and scope.&nbsp;We also track social-to-commerce abuse, where “shop now” and creator tagging push users to off-platform checkout traps; the growing role of AI in the loop, with voice clones and live-chat assistants paired with SMS or email to close the scam; and shifts in payment rails toward instant transfers and refund bait that compress the recovery window.&nbsp;Thank you to everyone who contributed, and to every reader using this report to protect families and teams. Criminals trade on trust. We work to deny that trade, click by click.&nbsp;Read on, stay skeptical, and keep the advantage.&nbsp;Luis Corrons, Security Evangelist (aka Threat Whisperer)

<h2>Threat Landscape Highlights: Q3/2025&nbsp;</h2>In Q3 2025, cybersecurity threats continued to evolve across mobile and desktop platforms, with mobile scams and adware dominating the landscape. Mobile users were particularly targeted by <a href="https://www.gendigital.com/blog/insights/research/ai-generated-personas-deepfake-tactics-scam-yourself-attacks" target="_blank" rel="noreferrer noopener">Scam-Yourself Attacks</a> and HiddenAds adware disguised as fake apps, often distributed through official stores. On desktops, Remote Access Trojans like Wincir remained active, while sextortion, gambling scams, and TechScam campaigns persisted in various regions.&nbsp;&nbsp;Beyond device-level threats, data breaches rose in frequency, with financial data remaining an important concern, led by payday loan misuse, suspicious bank activity, and emerging web skimming and invoice scams.&nbsp;<h3 class="text-align-justify">Security Threats &amp; Scams&nbsp;</h3>Q3 highlighted how closely security threats and scams are now intertwined, evolving together across mobile, desktop, and beyond.&nbsp;&nbsp;<a href="https://us.norton.com/blog/malware/adware" target="_blank" rel="noreferrer noopener">Adware</a> shifted from desktop to mobile this quarter. After last quarter’s desktop spike and the return of <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q2-2025#:~:text=The%20return%20of%20DealPly%3A%20Adware%E2%80%99s%20unexpected%20revival&amp;text=The%20return%20of%20DealPly%3A%20Adware%E2%80%99s%20unexpected%20revival" target="_blank" rel="noreferrer noopener">Dealply</a>, we saw a clear increase on Android. The number of blocked adware attacks rose by 77% quarter over quarter on mobile, driven mainly by HiddenAds-style apps that use obfuscation and hide after install, often posing as simple games. A notable share came through the official Google Play Store, which helps explain the growth, since people trust the store and many devices still run without active protection.&nbsp;

On desktop, Remote Access Trojans (RATs) remained persistent with a 10.67% Q/Q increase in risk ratio. The <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q2-2025#:~:text=Remote%20access%20exploited%20by%20threat%20actors" target="_blank" rel="noreferrer noopener">Wincir-driven</a> rise from last quarter continued after a mid-year lull, and we saw noticeable RAT spikes in regions like Chile (+77.89%), Spain (+43.87%) and Brazil (+40.75%).&nbsp;&nbsp;Some attacks now travel through trusted update channels. In August, criminals briefly slipped a bad update into a popular developer tool (Nx) that tried to copy passwords and other secrets from the computer. The takeaway is simple. Even software from familiar places can be harmful if a bad update runs. Basics still help: keep automatic updates on, install fewer add-ons, stick to well-known publishers, and if something looks odd, change your passwords and sign out of connected apps.&nbsp;These risks are not abstract; they spill into daily life when critical systems go down. We are more dependent on connected systems than ever, which makes outages and attacks felt in the real world. Two Q3 examples show this clearly. Jaguar Land Rover’s UK plants paused production for more than three weeks after a cyberattack, with officials now assessing the wider supply chain fallout. And on September 20, a cyberattack on Collins Aerospace’s MUSE check-in and boarding software disrupted operations at major European airports including Heathrow, Brussels, Berlin, and Dublin, forcing manual check-ins and causing delays and cancellations.&nbsp;Scam-Yourself Attacks, a new type of threat trend we have tracked in previous quarters on web and desktop, clearly extended to mobile in Q3. On Android and iOS we observed a rise in Fake Scans, a type of Scam-Yourself Attack that imitates system warnings, claiming malware was found and steering users to click malicious links. Today’s mobile threats remain mostly scam-driven rather than exploit-driven.&nbsp;Sextortion activity clustered in August, reaching levels similar to previous peaks. Gambling scams also flared briefly, luring users to place bets then refusing payouts, often using URLs with words like “luck” to lure victims. TechScam continued climbing, with notable spikes in Mexico (1,650%), Chile (1,326%), Czech Republic (974%) and Colombia (700%), typically fronted by fake prompts asking for one-time PINs to “restore” access to messaging or social media.&nbsp;Scams are everywhere, and they move across borders as easily as a text message or email. Law enforcement and security companies are pushing back to stop or at least minimize the impact. A good example is an INTERPOL-coordinated sweep this summer called <a href="https://www.interpol.int/en/News-and-Events/News/2025/African-authorities-dismantle-massive-cybercrime-and-fraud-networks-recover-millions" target="_blank" rel="noreferrer noopener">Operation Serengeti 2.0</a>. Running from June to August across 18 African countries with support from the UK, it led to 1,209 arrests, disrupted nearly 88,000 victimizations, recovered 97.4 million USD, and dismantled 11,432 malicious infrastructures used for scams and cybercrime.&nbsp;The Operation Serengeti 2.0 cases ranged from day-to-day fraud to large networks. In Zambia, authorities broke up a crypto investment scheme tied to 65,000 victims and an estimated 300 million USD in losses. In Angola, police shut 25 illicit crypto mining centers and seized 45 illegal power stations. In Côte d’Ivoire, investigators took down a transnational inheritance scam with losses around 1.6 million USD. INTERPOL says the operation worked because police shared indicators like suspicious IPs, domains, and command servers ahead of time, with private-sector partners contributing threat intelligence and training. Results like these show that coordinated action can claw back funds, take down infrastructure, and make the next wave of scams a little less effective.&nbsp;&nbsp;Coordinated action cannot stop every scam, but it raises costs and removes infrastructure that would otherwise keep hitting consumers.&nbsp;&nbsp;<h3 class="text-align-justify">AI-Driven Attacks &amp; Defenses&nbsp;</h3>In Q3, the AI layer moved from the novelty and research sphere to being a serious part of the real attack surface. Three trends stood out: attackers manipulating AI assistants, targeting add-ons and extensions that power AI tools, and experimenting with ways to embed AI directly into attacks. These trends have been building all year, helping explain why scams now feel faster and more convincing.&nbsp;

The most visible pressure point was assistant and agent abuse. Researchers demonstrated ways to nudge or quietly redirect popular enterprise assistants into revealing information or taking unintended actions. The lesson is simple. If an assistant can access your files or calendar, it deserves the same level of care as any powerful app, with strict permissions and a healthy habit of saying no to unexpected prompts.&nbsp;We also saw supply-chain risk emerge inside AI tooling. In July, the Amazon Q Developer extension for Visual Studio Code briefly shipped with malicious commands after an attacker tampered with the code path. Amazon fixed the issue quickly, but the incident showed that even trusted AI extensions can become a delivery route for harmful actions through normal updates. Extensions and plugins should be treated like apps: keep them updated, choose verified publishers, and remove what you do not use.&nbsp;In an example of how AI is shifting traditional threats, our previous Threat Report covered <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q2-2025#:~:text=and%20ultimately%2C%20dismantled.-,Beating%20FunkSec%3A%20When%20ransomware%20meets%20AI,-It%20started%20like" target="_blank" rel="noreferrer noopener">FunkSec</a>, the first ransomware where criminals used AI to help them write ransomware code. This quarter, researchers reported a proof-of-concept (not real malware found in the wild) called PromptLock, that goes one step further. Instead of using AI during development, it uses a small model on the device during the attack to generate commands in real time. This makes the behavior more flexible and, in theory, harder for older, static detection methods to catch. Even as a demo, it points to how ransomware might evolve due to AI.&nbsp;Persuasion research also stood out this quarter. Simple framing cues like authority and urgency made chatbots more likely to answer questions they should refuse. That same psychology fuels today’s “vibe-correct” phishing, where fake pages look and feel legitimate at first glance. AI helps criminals scale the look, the language, and the timing, which is why our VibeScams featured story is so timely.&nbsp;We are also seeing state actors adopt the same playbook. In mid-July, security researchers reported a Kimsuky campaign that used ChatGPT to generate realistic images of South Korean military ID cards to make spear-phishing emails look official; the link delivered malware, not an ID. The same report ties the activity to earlier <a href="https://www.gendigital.com/blog/insights/research/deceptive-nvidia-attack" target="_blank" rel="noreferrer noopener">ClickFix</a>-style lures and shows how AI is used to polish the “front end” of an attack. Separately, Anthropic <a href="https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf" target="_blank" rel="noreferrer noopener">documented</a> North Korean operators using Claude to fabricate identities and pass coding tests for remote jobs. Together, these cases show AI as a force multiplier for social engineering, not just code writing.&nbsp;&nbsp;The same AI boost shows up in text messages. Our SMS Threats featured story explains how AI tools now draft and localize smishing messages that match brand tone, include believable details, and land at the right hour. This is why delivery notices, bank alerts, and account lock texts feel more urgent and legitimate than they used to.&nbsp;As mentioned previously, <a href="https://lifelock.norton.com/learn/internet-security/ai-scams" target="_blank" rel="noreferrer noopener">AI-enabled scams</a> are now a real part of the threat landscape. Similarly, we are starting to see the early trends of video scams and deepfakes in our Gen telemetry. Q3 is our first quarter with telemetry from Media Shield, our new on-device deepfake protection for Windows AI PCs. The feature is still in early rollout with a limited installed base, so these results are indicative rather than market-wide. Even so, some patterns stand out. Most detections were flagged as deepfake audio, with a smaller share of scam videos. Within those scams, cryptocurrency and financial lures dominated, while the rest were more generic fraud attempts. Importantly, almost all of the scam clips were low-reach, with very few above 10,000 views, suggesting that deepfake scams are more common in niche content than in widely viral videos.&nbsp;These are early indicators, not population-wide trends, but they show how manipulated media is being used today: less about chasing virality, more about convincing smaller audiences to part with money.&nbsp;The picture that emerges is clear. Attackers are getting results through orchestration and persuasion, not only through clever code. Defenders are moving from written rules to built-in protections that act while you use the product: clearer guardrails in the chat, safer default settings, and tighter limits on what assistant tools can access. For consumers, the practical takeaway is to be extra careful with anything that asks an assistant to reach into your files, messages, or finances, to limit what plugins can do, and to treat perfect-looking pages with healthy doubt, especially when they ask for passwords or payments.&nbsp;<h3 class="text-align-justify">Privacy&nbsp;</h3>When you use digital products, you leave a trail. Sites and apps collect details about your device, browser, and how you move around a page. Combined, these signals form a “digital fingerprint” that can identify a person across different sites and sessions. Fingerprinting is widely used on the web and can track people even without cookies, which is why it matters for consumers who think clearing cookies is enough.&nbsp;

Our telemetry shows that since July 2025 we have blocked an average of 247 million trackers per month, and we are seeing almost 37 million digital fingerprints per month, a 1% quarter-over-quarter increase. This tells us that tracking is alive and growing. Fingerprinting keeps you identifiable even without cookies, letting companies and data brokers stitch together a detailed record of what you read, buy, and search. That profile can shape the prices you see, fuel relentless targeting, and give scammers enough detail to make fake messages feel real.&nbsp;While digital fingerprints allow your every move to be tracked online, encryption keeps everyday chats, photos, and backups private – and it can also frustrate criminal investigations. Some policymakers argue for special access for law enforcement, while security and privacy experts warn that any built-in workaround weakens protection for everyone. This quarter, in the UK, encryption policy reminded everyone that this is not a settled debate. In February, Apple removed its Advanced Data Protection option for iCloud in the UK after receiving a secret legal order under the Investigatory Powers Act and took the matter to the Investigatory Powers Tribunal. In August, the tide appeared to turn when the U.S. Director of National Intelligence said the UK had agreed to drop the backdoor demand. For consumers, the signal is simple: strong encryption still has heavyweight defenders, but it remains a live policy fight. &nbsp;Across the EU, governments are still arguing over the proposal nicknamed “Chat Control,” which would let authorities issue detection orders that require services to scan for child-abuse material and grooming. Parliament’s position rejects generalized scanning and seeks to protect end-to-end encryption, while the Council remains split, with several countries including Germany opposing client-side scanning and others backing it ahead of scheduled votes. The upshot is that messaging privacy rules are still being decided, and outcomes could vary by country in the months ahead.&nbsp;&nbsp;Another privacy reminder came to us this quarter from Sam Altman, OpenAI’s CEO. He has warned that therapy-style chats with ChatGPT are not protected like conversations with a doctor or lawyer, and that transcripts could be requested in a lawsuit. Treat AI chats like any other online form: if you would not say it in a crowded room, do not paste it into a chatbot, especially anything about health, legal matters, or finances.&nbsp;&nbsp;<h3 class="text-align-justify">Trust and Identity &nbsp;</h3>Digital identity theft is clustering around fast-cash products and routine account probing. Criminals are applying for short-term loans and new cards in victims’ names, then testing access to existing bank accounts.&nbsp;This quarter we saw more instances of breach events but smaller ones. The total number of breach events increased by 76%, while the overall volume of leaked records fell by 81%. In simple terms, there were more incidents, but each affected fewer people. What makes this trend concerning is the type of data exposed. The share of breaches containing passwords rose sharply to over 83%, even as breaches with email addresses declined. That means the “quality” of stolen data improved from a criminal’s perspective, as credentials are far more valuable than contact lists.&nbsp;A breach event represents each separate case where data was exposed, while breached data refers to the total number of individual records leaked. So even if the total number of records goes down, more events mean more unique services and users potentially affected. The combination of smaller, more frequent breaches with richer data shows that attackers are focusing on precision and value rather than scale.&nbsp;

Across financial alerts in Q3, payday loans represent the largest share of unique alerted users at 32%, followed by new credit card applications at 15%, typically fraudulent attempts to open cards in a victim’s name. Protective lock blocks on payday loans accounted for 10%, reflecting successful blocks applied after a fraud attempt. Existing bank-account updates (unauthorized changes) and new auto applications each represent 6%.&nbsp;On the transaction side, alerts are led by suspicious bank-account activity (42%) and credit card activity (20%). Smaller but notable shares include gray charges -small, technically authorized recurring fees like trial rollovers and add-on “clubs”- (9%), unusual charges (8%), and login errors at financial institutions (7%). The pattern reflects a familiar playbook: move fast to turn access into cash, then test the limits of existing accounts.&nbsp;

Alert patterns mirror a broader trend in which third-party access and support systems serve as frequent entry points. This quarter, a wave of attacks exploited company Salesforce ecosystems, often through connected third-party integrations. The FBI issued an advisory on two clusters—UNC6040 and UNC6395—describing tactics such as vishing for support credentials and abusing compromised OAuth tokens from the Salesloft–Drift integration to export customer data. Those exports can include support ticket text containing names, contact details, and even embedded secrets. The result: highly convincing <a href="https://us.norton.com/blog/online-scams/what-is-phishing" target="_blank" rel="noreferrer noopener">phishing</a> that references real cases.&nbsp;Several firms confirmed exposure tied to this activity. Cloudflare reported exfiltration from its Salesforce tenant between August 12 and 17, 2025, limited to support case objects. Trade and tech press covered similar confirmations and mitigation steps across the industry.&nbsp;A number of breaches also impacted well-known, non-tech brands. Air France–KLM said a third-party platform used by its contact centers was compromised in the week of July 28, exposing customer contact and loyalty details. These incidents do not always include passwords or card numbers, but they give scammers exactly what they need to personalize lures and create successful account-reset attacks.&nbsp;Luxury retail provided another example of why “profile” data matters. In mid-September, Kering confirmed a June intrusion that led to theft of customer data for brands including Gucci and Balenciaga. Reports noted contact details and total spend amounts, which can be used to target high-value buyers with bespoke fraud.&nbsp;<h3 class="text-align-justify">Financial Wellness &nbsp;</h3>Criminals are shifting financial theft to where payments actually happen: online checkout pages and accounts payable. We saw two key patterns emerge in financial theft in Q3: more attempts to skim card data directly from merchant payment pages and a rebound in fake or altered invoices that reroute money during vendor payments.&nbsp;On desktop, web skimming attempts increased quarter over quarter. These are attacks that inject code into a store’s checkout page to capture card numbers and billing details as you type. We also saw invoice-scam activity rise again after a summer dip, with renewed waves targeting people who handle bills and supplier payments.&nbsp;&nbsp;

Independent threat reporting <a href="https://www.recordedfuture.com/research/h1-2025-malware-and-vulnerability-trends" target="_blank" rel="noreferrer noopener">says</a> web skimming levels remained high through 2025, with thousands of ecommerce sites affected in H1 and beyond. One July campaign hit OpenCart shops by hiding skimmers among analytics tags like Google Tag Manager and Meta Pixel. Researchers also described variants that validate cards via a legacy Stripe API and even move skimming into malicious browser extensions. When looking at these trends together, it is clear that client-side checkout is a hot target.&nbsp;Payment industry standards have reacted. PCI DSS 4 emphasizes script authorization and change detection for checkout pages, reflecting how much risk now sits in third-party and client-side code. For consumers, the implication is simple: a site can look trustworthy and still be compromised on the page where you pay.&nbsp;Invoice scams also increased in Q3 after a short summer lull, with attackers impersonating trusted vendors and official bodies to reroute payments. This echoes wider signals from regulators and law enforcement, including a Europol–EUIPO report in May that flagged a significant rise in fraudulent invoices across the EU, often boosted by email spoofing and lookalike domains, and the FBI’s latest IC3 report noting record losses with business email compromise still driving invoice diversion and vendor payment fraud.&nbsp;

Patrik Holop, Principal Data Scientist&nbsp; Luis Corrons, Security Evangelist&nbsp; Peter Kováč, Lead Data Scientist&nbsp; Jakub Vávra, Sr Threat Analysis Engineer&nbsp;<h2 class="text-align-justify">Featured Stories: Consumers Under Siege&nbsp;</h2>Cyber threats don’t usually announce themselves with flashing warnings or complex exploits. Increasingly, they arrive in the everyday moments of people’s lives: a website that “feels” right, a text that buzzes during morning coffee, a file that suddenly locks on your desktop. What unites these attacks isn’t just the technology behind them, but the way they prey on routine, trust, and timing.&nbsp;This quarter’s featured stories spotlight three very different fronts of this same battle. Our story on VibeScams shows how AI-powered web builders are turning phishing into a plug-and-play service, where the danger isn’t a sloppy code but a flawless “vibe.” The SMS Threats feature reveals how the tiniest of texts can funnel victims into large-scale fraud, evolving into one of the most persistent and underestimated attack vectors. And our report on Midnight Ransomware reminds us that even hardened cyber extortion can falter: when copy-paste criminals forget the math, defenders can seize the opportunity to turn the tables.&nbsp;Together, these stories capture the reality of consumers under siege: threats are faster, more deceptive, and closer to daily life than ever before, but also more fragile when exposed to the right defenses.&nbsp;<h3 class="text-align-justify">VibeScams - Phishing factories powered by AI&nbsp;</h3><h4 class="text-align-justify">A new kind of phishing&nbsp;</h4>We call them VibeScams because the trick isn’t in the code, it’s in the feeling. These sites pass the “vibe check”: the colors, the spacing, the logo placement, even the tiny footer links nobody reads but everybody recognizes. They feel right at first glance, and that’s enough to fool people into handing over money or credentials.&nbsp;What makes VibeScams different is that the criminals behind them often aren’t technical experts. Just like VibeCoding lets anyone create software without coding, these platforms let anyone create scams without phishing know-how or web-design skills. A few words typed into an AI-powered builder are enough to generate a polished, brand-like page that can be abused straight away.&nbsp;You open a text that says your DHL or FedEx parcel needs a small fee for delivery. You need your package, so you quickly click the link. The page you see passes a brand audit: the yellow (or purple, depending on brand), the spacing. Tomorrow it’s a Coinbase “wallet verification” or a Microsoft login. Everything looks great, right up until your money’s gone.&nbsp;Thanks to AI, the phishing supply chain has completely upleveled. AI web-builders have turned “make me a page that feels like X” into a one-line prompt. Some even spin up a site from a screenshot. No HTML, no design school, no expensive dev hours—just a credible, on-brand clone in minutes. That shift drops the barrier to entry for scammers and multiplies the risk for everyone else.&nbsp;

<h4 class="text-align-justify">Why this works&nbsp;</h4>Our researchers stress-tested this ourselves. Using free offerings, we asked a handful of popular website builders to help us recreate the vibe of TikTok, Microsoft, Instagram, Coinbase, and Binance. The results were alarmingly realistic: polished layouts, familiar components, auto-generated copy that felt “official enough,” and one-click publishing. In other words: plug-and-play phishing.&nbsp;And it’s not a fringe phenomenon. We’re seeing a surge of AI-built fakes across well-known platforms: think delivery brands, mobile carriers, crypto wallets, insurers, social media apps. Many are near-indistinguishable at a glance, especially on mobile where the URL bar is tiny and the design does most of the convincing. Since January 2025, we have blocked approximately 140,000 different AI-generated websites, roughly 580 new malicious sites every day on average. In the same period, we protected nearly 190,000 of our users, with the U.S., France, Brazil, and Germany among the most affected. That’s a lot of “almost-right” pages catching people on a busy Tuesday.&nbsp;

<h4 class="text-align-justify">Behind the curtain&nbsp;</h4>Why is this working so well on otherwise careful people? Because the old red flags (typos, clunky layouts, weird spacing) don’t show up when the page is composed by an AI design assistant. The scam succeeds on vibe: the color, the logo, the tone of the microcopy, the way the “Continue” button sits exactly where your thumb expects it. Localization is trivial now, too. If a campaign targets Spanish speakers in Madrid today and German speakers in Munich tomorrow, the builder simply re-spins the template with new text. And because set-up is cheap or free, criminals can A/B test headlines, icons, and prompts like growth teams do, then keep only what converts.&nbsp;

Under the hood, the workflow is painfully simple. Step one: prompt the builder to generate a page that looks and feels like a trusted brand or upload a screenshot for it to mimic. Step two: “wire up” the forms, either with built-in tools or by exporting the template and asking another AI to handle submission and exfiltration. Step three: publish, measure, iterate, repeat. When a host removes one site, a fresh copy appears somewhere else in minutes. It’s phishing as a service, and the inventory never runs out.&nbsp;To understand what criminals were actually using these AI-generated sites for, we went beyond blocking the URLs. Our team examined the detected domains and analyzed the structure and behavior of the pages. That included looking at the forms they contained, the data they attempted to capture, and the redirection flows that followed. In some cases, the purpose was obvious: credential fields cloned from bank or email logins. In others, links led to cryptocurrency “investment” portals, payment card skimming forms, or remote-support software downloads. And in the future, attackers could just as easily deploy fake crypto “verification” pages that drain seed phrases. By classifying each site this way, we built the threat type breakdown shown in the chart, with phishing dominating, crypto scams close behind, and a smaller slice made up of tech-support and other fraud attempts.&nbsp;

Real-world outcomes follow predictable patterns. Credential-harvesting logins feed account takeovers. Crypto-themed scams try to funnel victims into fake investments. Delivery-fee pages skim cards for small “tests” before bigger hits. Tech-support look-alikes push remote-control installs. The specifics differ, but the mechanics are the same: a believable façade buys a few seconds of trust, just long enough to steal something valuable.&nbsp;<h4 class="text-align-justify">Turning the tables&nbsp;</h4>Here’s the good news: this is not a losing game. On our side, we’re blocking the funnel. We detect and stop known-bad builder subdomains and typosquats before the page loads, so the “vibe” never gets a chance to trick you.&nbsp;&nbsp;Some builders are stepping up, too. When we flagged abusive sites, providers like Lovable, Elementor, Flazio, Softr, Webflow, and WebWave moved quickly to remove them. It shows that responsible reporting works, and that user vigilance plays a role as well. The faster suspicious sites are reported, the faster they’re taken down. Still, the ease of spinning up new clones means takedowns alone can’t win the race; prevention and protection remain critical.&nbsp;That’s why we also track bursts of brand impersonation across multiple builders and work directly with providers to limit abuse. And in our consumer products, features like Scam Protection and Scam Guardian help people sanity-check links and pages in the moment they need it most.&nbsp;What should readers do differently? Start by distrusting design. If a page “feels” right but the request is unusual—seed phrases, 2FA codes, urgent refunds—treat that mismatch as a siren. Don’t follow login links from texts or DMs; use your own bookmark or the official app. For deliveries, jump to the known URL yourself rather than tapping through. And keep unique passwords with MFA turned on, so one mistake doesn’t unlock everything.&nbsp;<h4 class="text-align-justify">The bottom line&nbsp;</h4>VibeScams don’t mean the web is broken. They mean phishing has matured. Speed, scale, and accessibility are now the attacker’s edge; precision, verification, and layered protection must be ours.&nbsp;&nbsp;Phishing no longer requires phishers, just a prompt. If design can be faked in seconds, then trust has to live somewhere harder to fake—like the URL you typed yourself, the security tools that block bad pages on the way in, and the habit of pausing when something feels a little too perfect.&nbsp;Want to dig deeper? Our full blog post on <a href="https://www.gendigital.com/blog/insights/research/vibe-scams" target="_blank" rel="noreferrer noopener">VibeScams</a> explores detailed case studies, examples of AI-built sites we uncovered, and how criminals are adapting their tactics.&nbsp;<h3 class="text-align-justify">SMS threats: the tiny texts criminals love&nbsp;</h3>A buzz at 8:12 a.m.&nbsp; The message lands while you’re making coffee:&nbsp; “Your account was accessed from a new device. If this wasn’t you, call us now: &lt;Phone Number&gt;”&nbsp;It even appears inside the same branded thread your bank uses. In under a minute you could be talking to a convincing “agent”, handing over one-time codes; because, who ignores a security warning?&nbsp;That’s the power of SMS as an attack vector: it’s cheap, instant and feels personal. And while headlines chase flashier threats, text-initiated fraud keeps quietly scaling. In 2024 alone, people reported <a href="https://www.ftc.gov/news-events/news/press-releases/2025/04/new-ftc-data-show-top-text-message-scams-2024-overall-losses-text-scams-hit-470-million" target="_blank" rel="noreferrer noopener">$470 million in losses</a> that began with a text, 5 times the amount reported in 2020. The U.S. regulator’s summary is blunt: texting is “cheap and easy,” and scammers know the ding is hard to ignore.&nbsp;&nbsp;Carriers and industry monitors don’t expect relief soon. Research with global operators finds over half anticipate more SMS fraud this year, not less, as criminals exploit pricing shifts, routing weaknesses and artificially-inflated traffic. Meanwhile, awareness lags. <a href="https://www.ofcom.org.uk/siteassets/resources/documents/research-and-data/telecoms-research/scams-research/experiences-of-suspicious-calls-texts-and-app-messages-research-2024.pdf?v=373453" target="_blank" rel="noreferrer noopener">In the UK</a>, just 15% of mobile users even know about the free 7726 number to report scam texts; only 6% have used it, meaning networks miss signals that would help them filter faster. And as law enforcement has warned, waves like toll/parking smishing can hop state-to-state in weeks, keeping victims and defenders off-balance.&nbsp;<h4 class="text-align-justify">This quarter’s SMS hall of shame&nbsp;</h4>This quarter we went through millions of malicious SMS hitting users around the globe. Below are the five most widespread campaigns we tracked. Each item refers to one concrete campaign, and the example shown comes from that campaign. The percentages are the share of all scam SMS attributed to that exact campaign in our telemetry during the period. This is not a ranking of scam types overall. Together, these five campaigns account for 26% of all malicious SMS seen this quarter:&nbsp;<ol><li data-list-item-id="e7acfb3896e8427c9fbde38c9cc45b496">Employment Scam (8% of all scam SMS)&nbsp;&nbsp;</li><li data-list-item-id="e31348b043602c4057e08189954bd876b">Fake Refund (7%)</li><li data-list-item-id="e8fda1dc91806f96ba98babdfe5ccc10f">Tax Refund / Fine (6%)</li><li data-list-item-id="ee1bc9064b1f2b102357763fa1c049510">Investment (3%)</li><li data-list-item-id="e5e3b5458317db28ec0742223a1ef5e5c">Delivery (3%)&nbsp;</li></ol>

<h4 class="text-align-justify">How the tiny text does outsized damage&nbsp;</h4>The trick isn’t high-end malware. It’s friction—or rather, the lack of it. SMS lives where real life does: delivery updates, two-factor codes, appointment reminders. Scammers hide in that noise and win the first five seconds: a short link, a short deadline, and a decision before coffee kicks in. Industry surveys suggest four in ten smartphone users encountered smishing attempts in 2023, a reminder that the top of the funnel is broad, even before under-reporting narrows official stats.&nbsp;Two dynamics keep SMS underrated and under-discussed. First, it’s cross-channel by design. Many campaigns quickly push you off SMS (onto a callback number or a messaging app) where pressure works better and defenses are weaker. Mobile operators/carriers can filter texts at the network level, and in some markets, regulators require them to do so; they can’t police your phone call in real time. Second, the signals are subtle. Phones can group messages by sender name, so a fake bank alert may land inside your real bank thread. Add a shortened URL and a convincing domain, and most of us are one tap from trouble.&nbsp;<h4 class="text-align-justify">The tricks behind the texts&nbsp;</h4><a href="https://us.norton.com/blog/emerging-threats/smishing" target="_blank" rel="noreferrer noopener">Smishing</a> doesn’t win because attackers out-engineer the phone. It wins because the channel feels routine and the disguises are simple but effective. Most texts arrive in the same inbox as your delivery updates and one-time codes; criminals hide in that noise and ask for something small before your brain has switched from “admin mode” to “security mode.” The playbook is a blend of human psychology (urgency, authority, convenience) and tiny technical tricks that make a dangerous message look ordinary for the three seconds it takes to tap.&nbsp;Under the hood there’s no magic, just throwaway domains, and tricks that defeat quick visual checks and basic filters. When a lure needs more time or pressure, the conversation jumps channels—to a phone call or a WhatsApp chat—where defenses are weaker and a calm “agent” can walk a victim through the rest. And if someone hesitates or realizes too late, a second wave appears offering “recovery services” that charge a fee to “get your money back.”&nbsp;Here are the mechanics doing most of the damage right now, and how they slip past both filters and busy humans:&nbsp;<ul><li data-list-item-id="ee43550981747fc9d4e9b42a09a58d485">URL masking: public shorteners (e.g., cutt.ly, tinyurl.com, rb.gy) and throwaway domains hide destinations long enough to win a tap.</li><li data-list-item-id="e54b9740582507d5512f801b4078d08fa">Brand-ish web addresses: subdomains that glance official at speed, like flhsmv.govturim[.]vip exploit our habit of only reading the start of a URL.</li><li data-list-item-id="e1e8f0554e6cbc656c7c56dcbab61f260">Username-in-URL phishing: https://www.fedex.com@… still misleads in SMS because the real hostname is everything after the @.</li><li data-list-item-id="eb4940436564e3927f17569e0e5202dcb">Unicode obfuscation: SMS supports UTF-16, so look-alike characters turn Amazon into Αmаzon; filters and humans both slip.</li><li data-list-item-id="ee6105c45f8c93df2ee73bd676cd848e7">Pivots to voice/messengers: moving victims to WhatsApp/Telegram or a phone call segments the attack across platforms: harder to detect, easier to pressure. Public warnings around toll/parking smishing illustrate how fast these waves evolve.</li><li data-list-item-id="e9a8b97965f6d1aaefda18bd69ee31418">The “rescue” after the scam: recovery-service pitches (“Scammed? We can help—chat here”) target people already hurt, extracting a second fee.&nbsp;</li></ul>For readers who want to see these categories in more detail, our blog post “SMS threats: the many faces of a tiny text” expands this list with screenshots, examples, and step-by-step advice.&nbsp;<h4 class="text-align-justify">When AI enters the picture&nbsp;</h4>Artificial intelligence is quietly reshaping this landscape. Where criminals once leaned on clumsy, typo-filled texts, they can now generate fluent, localized messages at scale, each one tailored to the language and phrasing of its target country. AI can also spin up endless variations, making filters that rely on spotting repeated patterns far less effective.&nbsp;And it’s not just text. Attackers are beginning to pair SMS with AI-generated voice calls or chatbot follow-ups on WhatsApp, creating a seamless multi-channel fraud that feels eerily professional. The result: scams that used to raise suspicion now read like the messages you really do get from banks, couriers, or tax offices. For defenders, this means the bar keeps rising; for consumers, it means skepticism has to become second nature.&nbsp;SMS may not trend like ransomware or zero-day headlines, but its quiet efficiency is exactly the point. It reaches everyone, blends with daily admin, and routes victims into higher-value fraud with almost no friction. Until awareness (and reporting) catches up, the smallest message on your phone will keep doing outsized damage—one buzz at a time.&nbsp;<h3 class="text-align-justify">Cracking Midnight: when copy-paste ransomware forgets the math&nbsp;</h3><a href="https://www.avast.com/c-what-is-ransomware" target="_blank" rel="noreferrer noopener">Ransomware</a> has long been treated as unbeatable: files are locked, the math is unbreakable, and victims are forced into a terrible choice: pay or lose their data. Midnight ransomware tells a different story.&nbsp;Built on Babuk’s leaked source code, Midnight is part of a new wave of copy-paste ransomware projects. But instead of improving on the original, its authors weakened it. In analyzing the code, our researchers uncovered a critical weakness in Midnight’s cryptography, the kind of mistake that is rarely seen in modern ransomware. By identifying and leveraging this flaw, the team was able to develop a free decryptor that gives victims a way out without paying.&nbsp;<h4 class="text-align-justify">Midnight in the wild&nbsp;</h4>At first glance, Midnight doesn’t look much different from other ransomware. It locks files, drops a ransom note called How To Restore Your Files.txt, and demands payment. In most cases, victims see their files renamed with the .Midnight or .endpoint extension, a tell-tale sign of the infection.&nbsp;

Earlier versions of Midnight mainly went after high-value data such as databases and backups, but more recent ones broadened the scope to nearly all common file types, leaving only program files untouched. To move quickly, it also uses a trick called intermittent encryption, touching just enough of a file to make it useless while speeding through the system.&nbsp;On the surface, all of this looks like business as usual for ransomware. But underneath, Midnight’s authors made critical mistakes in the encryption design, mistakes that turned into opportunities for defenders.&nbsp;<h4 class="text-align-justify">From Babuk to broken forks&nbsp;</h4>The 2021 Babuk leak was a turning point for the ransomware ecosystem. Suddenly, sophisticated source code was available to anyone who wanted to try their hand at cyber extortion. That leak spawned numerous spin-offs, some more successful than others. Midnight is one of these, and its story illustrates an important trend.&nbsp;Rather than giving rise to a new “super strain,” the Babuk leak produced a wave of rushed, amateurish forks. Midnight is a textbook case: criminals re-used the code, made “improvements” they didn’t fully understand, and ended up with a product that sabotaged itself.&nbsp;Our researchers uncovered weaknesses in its cryptographic design, rare flaws that opened the door to building a working decryptor. For defenders, even a single mistake of this kind is valuable; in Midnight’s case, the opportunity was even greater.&nbsp;<h4 class="text-align-justify">A free way out&nbsp;</h4>Armed with these insights, we developed a free Midnight Ransomware Decryptor. Victims can use it to recover files safely without paying ransom.&nbsp;Rather than duplicating technical detail here, we’ve published a full breakdown on our research blog, including indicators of compromise, screenshots, and step-by-step decryptor instructions. This report tells the bigger story.&nbsp;For defenders and researchers who want the technical details, our colleague Samuel Vojtáš has published an analysis of Midnight on the Gen blog. His article walks through the ransomware’s evolution from Babuk, highlights its quirks, and provides step-by-step instructions for using our free decryptor. You can read the deep dive here: <a href="https://www.gendigital.com/blog/insights/research/midnight-ransomware" target="_blank" rel="noreferrer noopener">Decrypted: Midnight Ransomwar</a>e&nbsp;<h4 class="text-align-justify">Why Midnight matters&nbsp;</h4>Midnight may not be the most widespread ransomware of 2025. But its lessons resonate far beyond its victim count:&nbsp;<ul><li data-list-item-id="ef872d2a26c053b8187346144d939a23c">Copy-paste criminals. Leaked source code is fueling countless ransomware spinoffs, but not all of them are stronger. Midnight proves that copy-paste shortcuts can weaken attackers.</li><li data-list-item-id="e6430be1e9ee1f864649e529f5fde79a9">Rare crypto flaws. Finding single exploitable vulnerabilities in ransomware encryption is uncommon, but Midnight proves that criminals don’t always get the math right.</li><li data-list-item-id="edc240bd0f64d4b1902b8b57af4bde758">Hope for victims. Midnight shows that ransomware isn’t always the end of the road. Free decryptors exist, and paying isn’t the only option.</li><li data-list-item-id="ee48e43821ce5d75497f203cb4cd04ac9">AI hype vs. reality. While headlines spotlight AI-assisted ransomware experiments, Midnight shows the other side of the ecosystem — rushed projects built on leaked code, riddled with rookie mistakes. The ransomware landscape is splitting: some groups experiment with AI, while others sabotage themselves. That fragmentation creates new openings for defenders.&nbsp;</li></ul><h4 class="text-align-justify">The bigger picture&nbsp;</h4>The ransomware ecosystem is fragmenting. Instead of a few large, disciplined groups dominating the field, we’re seeing a growing number of buggy forks, rushed experiments, and copycats built on leaked code. That’s good news for defenders: the more mistakes criminals make, the more opportunities we have to neutralize them.&nbsp;Midnight is a case in point, ransomware that tried to build on Babuk’s legacy, but ended up undermining itself. For victims, our decryptor means recovery without ransom. For the industry, it’s a reminder that ransomware isn’t always unbreakable. And for criminals, the message is clear: recycling someone else’s code won’t guarantee success.&nbsp;Branislav Kramár, Threat Analysis Engineer&nbsp; Daniel Beneš, Senior Threat Researcher&nbsp; Jan Rubín, Threat Research Team Lead&nbsp; Ladislav Zezula, Senior Malware Researcher&nbsp; Luis Corrons, Security Evangelist Samuel Vojtáš, Threat Analysis Engineer&nbsp; Tadeáš Zíka, Threat Analyst&nbsp;<h2 class="text-align-justify">In Closing&nbsp;</h2>This quarter confirmed the shift we have tracked all year: cybercrime targets people first. AI has made scams look right and feel right, from VibeScam lookalikes to SMS lures that hand victims to live “support.” Ransomware remains loud, yet the quiet wins come from shrinking the gap between first contact and first protection. Our focus stays on real-time defenses inside the places people already talk and shop, with clear help in the moment of doubt.&nbsp;With the holiday season nearing comes the peak shopping season. Expect scams tied to deliveries, order issues, too-good-to-be-true deals, fake support, and “in-platform” fraud across marketplaces and social. The playbook for readers is simple: slow one beat, check the sender and the URL, never share one-time codes, use 2FA or passkeys, and pay only inside trusted checkouts. We will meet criminals in the conversation with protections that spot the con and stop the loss. See you next quarter with the results.&nbsp;

<h2 id="download-the-q2/2025-threat-report-key-highlights">Download the <a href="https://www.gendigital.com/blog/sites/default/files/2025-11/Q32025%20Threat%20Report%20PDF%20Highlights.pdf" target="_blank" title="Q3/2025 Threat Report Key Highlights">Q3/2025 Threat Report Key Highlights</a></h2>Visit our <a href="https://www.gendigital.com/blog/insights/reports/threat-taxonomy" target="_blank" title="Glossary">Glossary and Taxonomy</a> for clear definitions and insights into how we classify today’s cyberthreats.

Tracking the surge of mobile scams, AI-driven attacks, and evolving data threats across Q3 2025.

Gen Q3/2025 Threat Report 

<h2>Foreword</h2>Welcome to our latest Gen Threat Report, this time focused on Q2/2025. April through June brought a complex mix of progress and peril across the cyber threat landscape. Some of the positive aspects included a slight decline in the overall threat risk ratio and several law enforcement operations aimed at disrupting cybercrime groups. At the same time, the threat landscape remained active, with a record volume data breaches, disruptive ransomware incidents and a steady stream of inventive scams. Navigating these signals requires careful interpretation, so let's explore the most significant developments together.One of the busy areas this quarter was the continued targeting of personal data. Breach events increased by nearly 21% quarter-over-quarter, and the number of exposed email addresses rose by over 15%. Also, credit alerts remained the most common identity-related notification in our systems. We also continued to see fallout from the X (Twitter) leak, which went public in early April, with compromised records resurfacing in various contexts. Q2 also brought headlines about the takedown of Lumma Stealer, one of the most notorious infostealers in recent years. While parts of its infrastructure were disrupted, the story didn’t end there. Based on our telemetry, Lumma remains alive and kicking,&nbsp;despite the efforts to dismantle this group. Distribution channels continued to operate, and data exfiltration persisted throughout the quarter. As we’ve seen before, bringing down one part of an ecosystem doesn’t always stop the threat entirely. You can read more about Lumma and the aftermath of the takedown in the featured story below. Still, the effort reflects growing coordination between law enforcement and the security community. Other notable actions this quarter included the indictment of Qakbot’s leader, charges against DanaBot operators and Europol’s Operation Endgame targeting ransomware infrastructure.On the financial-threats front, our research of an illegal pharmacy network&nbsp;revealed over 5,000 scam domains connected to a single cybercriminal group. The operation spans continents, hijacks legitimate websites and uses everything from fake blogs to chatbot-generated recommendations to lure victims. The goal is clear: harvest financial and personal data under the guise of discounted medicine. The full story is covered in our featured section on what we’ve dubbed “PharmaFraud”, which offers a closer look at how scalable and targeted this kind of fraud has become.&nbsp;Not all financial stories this quarter ended in loss. After tracking the FunkSec ransomware for several months, our team discovered a flaw in its encryption logic. This was another case of malware partially created using generative AI,&nbsp;and the first instance we’ve known for ransomware operators. According to the group itself, AI was used to assist with tooling, phishing templates and code snippets. Fortunately, it was still possible to identify a cryptographic weakness. Working quietly with law enforcement, we helped victims recover their data and later released a free decryption tool from the Avast brand. FunkSec has since gone quiet. While rare, this case shows that even AI-assisted threats can contain exploitable flaws when examined closely. You’ll find the full breakdown in the FunkSec featured story.Scams, as usual, remained among the most persistent threats, especially on mobile. Technical Support Scams&nbsp;(TSS) rose by nearly 65% globally, spreading increasingly through social media platforms. On Facebook, they accounted for 14% of the threats we blocked. Geographically, activity expanded beyond the usual hotspot of Japan, doubling in countries like Germany, Austria and France. Sextortion scams&nbsp;also surged, showing over a 100% increase in risk ratio, while financial scams affected users across major economies and platforms. Some impersonated legal services; others relied on urgency and fear. The tactics remained familiar, but the delivery kept evolving. Even malvertising found new ways to stay relevant. While overall volumes dipped slightly, malicious push notifications jumped by over 300%. These deceptive browser alerts, once accepted, gave attackers a way to keep targeting users long after the initial visit, often with scam content or fake system warnings designed to trigger panic clicks.In terms of malware threats, remote access threats&nbsp;saw a notable rise. The Wincir Remote Access Trojan (RAT) continued its resurgence, often delivered through so-called “Scam-Yourself” attacks, where users are tricked into launching the malware themselves. We also looked at how threat patterns differ between individuals and small businesses. On desktops, scams and malvertising led across both groups, though small businesses showed slightly lower risk exposure. The methods were familiar; the targets interchangeable. Finally, DealPly adware returned from near-obscurity in late Q2. Reactivated domains and Chrome extension infrastructure led to a fourfold increase in exposure between April and June. It was a timely reminder that even long-dormant threats can quickly regain traction.Overall, Q2/2025 reflected the complexity of today’s threat landscape. Some threats faded, others adapted, and a few returned in force. Scam and malvertising campaigns continued to lead in volume. Ransomware saw both setbacks and reversals, with at least one case offering real hope for victims. Personal data remained a high-value target. And enforcement efforts, while encouraging, didn’t always stop threats from resurfacing.&nbsp;Thank you for reading. We hope the report brings clarity to a quarter shaped by complexity and contradiction.Jakub Křoustek, Threat Research Director&nbsp;<h2>Threat landscape highlights: Q2/2025</h2>Although the most common types of threats tend to remain consistent over time, the threat landscape is in constant flux as malicious actors adapt their tactics to pursue harmful objectives. These changes are influenced by our evolving digital behavior – ranging from changing social media use and online shopping trends to increased remote learning and high-profile data breaches that impact our digital security. With the global risk ratio being 24%, almost one in four users encountered some kind of threat each month.In this section, we explore emerging threats, evolving techniques and notable shifts in global threat patterns that challenge what has traditionally been expected.

<h3 class="text-align-justify">Remote access exploited by threat actors</h3>Malicious remote access threats showed a significant increase during the first half of Q2/2025. The risk ratio of such threats increased by 62.13% quarter-over-quarter and affected many countries, including France, South Korea, and Brazil.The largest share of malicious remote access activity continues to come from Remote Access Trojans (RATs), led by Wincir, a threat that resurged in Q1/2025. We observed a significant wave of Wincir infections, with the highest risk ratios occurring in African countries and Asia. Wincir is frequently delivered via Scam-Yourself Attacks, and we have seen threat actors abuse the MEGA Cloud storage service to host the final payload.Mirai, the notorious IoT botnet which spreads by attacking vulnerable devices, also ramped up its activity this quarter, prominently targeting China, with notable increases in Hungary, Czechia and Spain.

However, remote access can be also exploited for distribution of malicious files or downloading payloads from file-sharing platforms and cloud services. We’ve spotted threat actors leveraging Microsoft OneDrive more frequently as a key component of their attack chains, exploiting synchronization processes to deliver malicious files.&nbsp;<h3 class="text-align-justify">Scams: Consistent tactics, new channels</h3>Scams are the most prevalent threat on mobile and the second most prevalent malware type overall. Even though the tactics used by scammers are repeated over and over – such as creating a sense of urgency, playing on emotions and vulnerabilities and making potential victims doubt themselves – the specific ways in which scammers achieve their goals evolve over time. Technical Support Scams (TSS)&nbsp;increased their risk in Q2/2025 by 64.69%, marked by systematically higher activity throughout the entire quarter. From a geographical perspective, the distribution of risk has shifted. For the first time in several quarters, Japan was overtaken by other countries in terms of risk ratio. Notably:<ul><li>Austria experienced a quarter-on-quarter increase of 83%.</li><li>Germany saw a dramatic spike of 178%.</li><li>France, while not in the top three, still showed a significant increase of 119%, making it a country to watch closely.</li></ul>A particularly noteworthy development this quarter was the emergence of Facebook as an infection vector, with 14% of all blocked threats on Facebook being Technical Support Scams. While the misuse of Facebook through paid advertisements, fake posts and fraudulent user accounts has long been associated with other scam types such as investment fraud and marketplace scams, its use in Technical Support Scams represents a new trend.The landing page to which users are redirected usually imitates the Facebook Messenger interface.

These pages are typically crafted to prompt user interaction, after which the attackers lock the victim’s browser, creating a sense of urgency and panic. This tactic is consistent with traditional Technical Support Scam behavior but now appears to be expanding into social media environments to increase reach and effectiveness.

As is typical for Technical Support Scam scenarios, a phone number to a fake help line is later presented to the victim, looking for a solution.Sextortion Scams are a serious concern, as they manipulate victims by exploiting fear, shame and blackmail. These threats usually spread via email and often come in waves. This quarter, Sextortion Scams showed a 101% increase in risk ratio, mainly due to two significant waves in April and June, with notably higher peaks. The tactics remained the same: simple emails threatening to expose the content gained by alleged hacking of a victim’s device (usually a video or photos of the victim in sensitive situations, which can be artificially created or don’t exist at all). Their repeated occurrence shows an undying motivation of the attackers combined with a non-zero success rate and ease of carrying out such attacks.

Financial Scams&nbsp;showed a significant 340% increase in risk ratio during Q2/2025. This affected major countries including the United States, France, the UK and Germany. The increased activity of Financial Scams affected both desktop and mobile devices, the latter caused by ads from Meta, especially on Instagram, which are primarily viewed by users on mobile devices. However, ads were shared across all social media platforms.

When it comes to Financial Scams, we have identified three ways in which data is typically obtained from users. In the first, an advertisement redirects to a landing page, which often supports the narrative presented in the advertisement. In another example, an advertisement is used for drawing attention to the risks of scams and at the same time offers help. In some cases, attackers use a Facebook form or a Messenger bot, both serving as a way for the scammers to contact their victims and lure them into their fraudulent schemes.

Alongside financial scams, Invoice Scams became also very active in the second half of Q2/2025, similarly to the previous quarter. This involved the use of fake invoices to impersonate legitimate companies to obtain money.

<h3 class="text-align-justify">Malvertising heavily uses malicious push notifications</h3>Even though malvertising as a potential infection chain was on a slight decline in Q2/2025, this was not the case for malicious Push Notifications employed by malvertising. While their activity was relatively stable in Q1/2025, it grew significantly in Q2/2025 with a 317% increase in risk ratio, spiking primarily at the beginning and end of the quarter.

Push Notifications can take various forms, including pages designed to mimic well-known video players. These prompts often feature multiple animations to entice users to click on them. In the case of the top-hitting sample below, the design mimics CAPTCHA.

The outcome is immediate: users are bombarded with numerous push notifications delivering varied content. These often include affiliate promotions for legitimate antivirus brands with warnings about malware, advertisements for dating sites or imitations of system messages.People are victimized by feeling an urgent need to click something that has popped up on their device without warning, resulting in malicious payloads being downloaded or sensitive information being shared.

<h3 class="text-align-justify">Identity and personal data protection trends</h3>Last quarter, we reported on the severity of data breaches as we entered 2025. This quarter was no different. Data breach events rose by nearly 21% in Q2/2025. Even though the overall number of breached records exposed in this way decreased, the number of breached emails increased by 16%.Among the notable breaches discussed this quarter was an X (formerly Twitter) data leak that likely occurred in Q1/2025 but became public in April 2025. The breach exposed over 200M records of X accounts alongside their correlated emails. This breached information was combined with previously leaked data from 2023. The second notable breach was an exposure of various personal records including employment, WeChat accounts, bank accounts and other personal data in China. Additionally, reports emerged about a massive database containing 16 billion passwords being hacked; however,&nbsp;<a href="https://www.gendigital.com/blog/insights/research/16-billion-passwords-leaked">further analysis</a> revealed that these credentials were largely aggregated from past breaches, many being outdated or duplicates.&nbsp;When it comes to identity protection, Gen saw Financial and Transaction Alerts increase by 22.84% and 7.45% quarter-over-quarter, respectively. However, compared to all identity-related alerts, Credit Alerts were still the most prevalent category, led by monthly credit score updates, instant credit inquiries and new account creations.Credit Alerts originate from multiple credit bureaus tracking changes in people’s credit profiles, such as new accounts and credit inquiries. Their primary goal is to notify an individual of potential fraud attempts, personal information changes or suspicious activity in real time. As this category represents a majority of identity alerts sent, we’ll analyze it in more detail.&nbsp;

The largest portion of these alerts come from Monthly Credit Score updates (65%), which provide routine insights into credit health, helping people track changes and detect unusual drops that may signal identity theft or unauthorized activity. Instant Credit Inquiry alerts (7%) notify individuals when a lender checks their credit, often a first sign of fraudulent applications. Similarly, New Account alerts (7%) flag the creation of new credit lines, which may indicate identity misuse if unrecognized. Credit Balance Change alerts (6%) and Credit Limit Change alerts (5%) help people monitor unexpected changes in credit utilization or available credit, both of which can affect credit scores and signal suspicious behavior.While not all Credit Alerts indicate fraud, these alerts are an important part of protecting yourself and your financial position.<h3 class="text-align-justify">Threats impacting small businesses</h3>While small businesses face distinct cybersecurity challenges, we see a great deal of overlap between what impacts small businesses and the issues individuals face. For both types of victims, social engineering remains king, but while malvertising remains the dominant threat for individuals in Q2/2025, scams top the list for small businesses. Small business threats are also focused more targeted data-stealing malware like infostealers and malicious droppers, followed by exploits and malicious remote access threats. This reflects attackers’ preference for traditional malware methods when targeting business entities.

While the risk ratio for scams on desktop is 10.96% when looking at a combination of both individual and small business users, for small businesses the risk was 5.68% in Q2/2025. The lower risk ratio of scams for businesses can be influenced by many factors, from businesses having their own security measures to people being more careful when it comes to their digital lives at work.<h3 class="text-align-justify">The return of DealPly: Adware’s unexpected revival</h3>Adware saw a decline during the first months of 2025, with strains that saw massive gains at the end of 2024 – such as BrowserKnocker, Popunder and DealPly – seeing sharp drops and BrowserKnocker and DealPly nearly disappearing from our telemetry. We attributed this to the shutting down of host domains, takedowns of hosted browser add-ons and decreased activity of the operators behind these adware threats.

But not one to be kept down, DealPly completely revived its presence in late May, with a more than quadruple increase in protected users. By all accounts, DealPly resurrected several previously used domains that helped propagate its browser add-on activity. Various Google Chrome extensions that were used in the past to harvest statistical and search data appear to be back online. Users worldwide were subjected to an increased barrage of adverts and obstructive redirects due to this resurgence.

On a country-by-country basis, we observe massive spikes in Brazil where DealPly multiplied its presence in terms of risk ratio by a factor of more than 25 in the space of a few days. The US and France saw a similar trend with respective fivefold and threefold increases in a short span of time. India experienced a more than 15 times the risk in a few days as well. In all the above-mentioned countries, DealPly kept the significantly increased impact through the end of the quarter. We estimate that this will continue into the next quarter as well, demonstrating that even though threats may seem extinct one day, they can completely revive the next – and both security companies and people need to ready for such changes.Patrik Holop,&nbsp;Principal Data Scientist Luis Corrons,&nbsp;Security Evangelist Branislav Kramár, Sr Threat Analysis Engineer Jakub Vávra, Sr Threat Analysis Engineer Ondřej Mokoš, Sr Principal Threat Analysis Engineer Alexej Savčin, Threat Analysis Engineering Manager<h2>Featured stories: Q2/2025 – Inside today’s cybercrime empires</h2>Cybercriminal groups today are smarter, faster and increasingly innovative. Their infrastructures rapidly evolve, their tactics grow more deceptive, and their operations span continents. In this section, we expose three distinct threats: MediPhantom's fake pharmaceutical empire, FunkSec's short-lived but destructive ransomware campaign and the relentless data-stealing business model of Lumma Stealer. Explore how these cyber actors operate, adapt and sometimes thrive and learn about the insights and actions essential to disrupting their dangerous endeavors.<h2>PharmaFraud: Exposing the hidden empire of illegal online pharmacies</h2>It's late, and you're urgently searching online for medication, perhaps a crucial antibiotic, an expensive weight-loss treatment or even something you’d rather not discuss openly. Among the search results, a polished website catches your eye: professional graphics, reassuring badges and low prices.&nbsp;It’s exactly what you need, exactly when you need it. It seems perfect, almost too good to be true.&nbsp;Because it is.Over 95% of online pharmacies <a href="https://pmc.ncbi.nlm.nih.gov/articles/PMC9413741/">operate illegally</a>, selling counterfeit, unapproved or prescription drugs without proper authorization. And, when factoring the online pharmacies that only advertise medications to take payment but never actually deliver, the number of fraudulent pharmacies online is likely even higher. These fake online pharmacies are what Gen refers to as PharmaFraud.Behind PharmaFraud’s slick websites lurks a sophisticated, coordinated cybercrime infrastructure, meticulously designed to defraud unsuspecting victims and put their health and safety at serious risk. An extensive investigation by Gen has uncovered the dark machinery powering thousands of fraudulent online pharmacies.<h3 class="text-align-justify">A single shadowy empire</h3>Our analysis connected thousands of seemingly independent pharmacy websites to a single, highly organized cybercriminal group we have named MediPhantom. This cyber gang orchestrates a vast, scalable infrastructure with remarkable precision. MediPhantom leverages advanced techniques such as hijacking legitimate medical websites, manipulating Google search rankings and exploiting public hosting platforms. Their strategy is disturbingly effective: victims are funneled seamlessly through spam emails, advertisements on adult websites, fake health blogs, misleading review platforms and even AI-powered chatbot recommendations.<h3 class="text-align-justify">Exploiting human vulnerability</h3>The cybercriminals target medications driven by desperation or stigma: erectile dysfunction treatments, essential antibiotics like Amoxicillin, trendy and costly weight-loss drugs and even antivirals falsely marketed during flu seasons and global health crises.&nbsp;Victims seeking these medications online unknowingly risk purchasing counterfeit or contaminated products, potentially leading to severe health consequences. Beyond the physical risks, they expose themselves to financial fraud and identity theft, as cybercriminals harvest personal data through malicious payment gateways fully under their control.<h3 class="text-align-justify">How the scam works</h3>We unraveled the cybercriminals' elaborate techniques, starting with a carefully executed reconnaissance phase. Criminals monitor public forums and social media to identify high-demand medications. They then weaponize this information, crafting fake pharmacy websites and registering deceptive domains.Victims are reached via two primary methods:<ul><li>Active methods: Spam campaigns are commonly used, where attackers send promotional emails that closely resemble legitimate pharmacy flyers, enticing victims to click on links that lead directly to fraudulent sites. Another tactic involves deceptive banner advertisements strategically placed on websites hosting adult or explicit content, occasionally appearing even on mainstream platforms like Facebook and YouTube.</li></ul>

Additionally, criminals utilize fake health blogs featuring AI-generated wellness articles. These blogs are multilingual and specifically optimized for search engine visibility, embedding deceptive banners within articles to redirect visitors subtly yet effectively to scam pharmacy websites. Furthermore, fraudulent review sites, such as PharmReviews[.]net, rank fake pharmacies highly and misleadingly, creating an illusion of trustworthiness through manipulated ratings and fabricated positive customer feedback.<ul><li>Passive methods: Criminals manipulate legitimate website rankings and inject malicious content into trusted sites, redirecting unsuspecting users directly into their scams.</li></ul>While active methods often involve legally questionable tactics like spam and fake reviews, passive methods typically require unauthorized access to compromised web servers, making them more technically sophisticated and complex to detect.Once the victim lands on a fraudulent pharmacy website, they proceed through a seemingly typical shopping workflow, ultimately leading to exploitation –usually stolen funds or credentials.The purchasing process mimics legitimate e-commerce platforms: the user adds items to a cart and proceeds to checkout. However, the payment gateway is typically hosted in a separate domain that the attackers fully control, so there is no secure or legitimate payment processor.To complete the purchase, the victim is prompted to enter private contact details and payment information, usually a credit card or cryptocurrency wallet which offers a 10% discount. Since the payment gateway is under the attacker’s control, all submitted data is directly transmitted to the threat actor.

<h3 class="text-align-justify">The invisible infrastructure</h3>Beneath these fraudulent storefronts lies a robust infrastructure, meticulously documented through our investigation:<ul><li>Over 5,000 domains were identified, continually rotating to evade detection.</li><li>Around 60 unique domains host fraudulent payment gateways, most of which reuse a common template, while a few use dynamic gateways that select from over 20 templates based on context.</li><li>Real human operators manage sophisticated live-chat systems to build trust.</li><li>Centralized phone systems operate like call centers to handle victim inquiries.</li></ul>During our research, we simulated the ordering process using test payment cards. Orders were typically confirmed, but when transactions failed, the sites used clever social engineering to push victims toward completing payment. In some cases, users were told, "If our system can't accept your card, you will receive the payment details to complete the payment. In this case, there will be no call confirmation, but make sure that all the information is correct." Other variations included prompts like, "Please make sure your card allows online transactions," or "If your order is not approved within 24 hours, your credit card might be blocked for internet transactions. Please get in touch with your bank and ask to remove the block." These messages are designed to blur the line between technical error and urgency, nudging victims to bypass their security instincts, and complete the transaction at any cost.Despite diverse branding, the infrastructure consistently traces back to MediPhantom, the single, highly organized threat actor orchestrating a vast network of fake pharmacy websites. Frequent changes observed over short timeframes (often within weeks) suggest high operational activity, likely aimed at evading detection or reflecting ongoing infrastructure restructuring.Our telemetry data reveals alarming global reach and scale. Fake pharmacy operations spike during peak periods, notably around holidays like Christmas, leveraging increased online activity. The cybercriminals operate multilingual platforms targeting regions such as Southeastern Europe (Greece, Croatia, Hungary), Central Europe (Germany, Switzerland, Austria), Western Europe (France, Spain) and extend their reach to the USA, Canada, Japan and Australia.<h3 class="text-align-justify">Beyond the scam: Real-world risks of fake medications</h3>The damage caused by PharmaFraud does not end with stolen money or compromised identities. It reaches deep into the lives and bodies of those who take the pills. Counterfeit medications sold by these fraudulent websites often bypass every safeguard built into legitimate pharmaceutical supply chains.Unlike regulated drugs, which undergo strict quality control and precise dosing, fake pills may contain no active ingredients at all or dangerously high amounts. Some are laced with toxic additives, including heavy metals or unknown chemicals. In the most tragic of cases, some medications can be laced with life-threatening substances. In one U.S. enforcement case in late 2024, a network of fake online pharmacies sold millions of fentanyl-laced painkillers, killing at least&nbsp;<a href="https://www.justice.gov/usao-sdny/pr/us-attorney-announces-charges-against-18-defendants-scheme-manufacture-and-distribute">nine confirmed victims</a>. The DEA’s 2023 data showed a record 80 million fake pills seized nationwide; evidence of how deeply the problem has penetrated.

Health risks include everything from allergic reactions to treatment failure. In lab testing, over a third of pills from rogue pharmacies had no active ingredient. Patients depending on these drugs may see their conditions worsen, believing they are being treated when they are not. In the worst cases, a single counterfeit tablet can be fatal.The global nature of this threat is equally alarming. In Europe, despite strong regulations and the EU’s pharmacy logo system, fake sites have surged, especially during drug shortages or health crises. During the COVID-19 pandemic, fake pharmacies in France pushed counterfeit chloroquine as a miracle cure. In Germany and Japan, fake or unauthorized sellers targeted consumers searching for restricted medications or lifestyle treatments like erectile dysfunction drugs and diet pills. Japan’s strict laws prohibit online prescription drug sales, yet customs officials there have intercepted&nbsp;<a href="https://www.jpma.or.jp/english/globalhealth/fake_measures/about_fake_measures.html">hundreds of thousands of counterfeit shipments</a> and shut down over 2,300 websites.Even packaging can mislead. Criminals mimic logos, pill shapes and labels. But there are clues: no lot of numbers, poor-quality printing, suspicious expiry dates or pills that look slightly off. Still, to the average consumer, a fake pill often looks indistinguishable from the real thing until it fails or causes harm.And the demand is high. In the U.S., high drug prices have pushed people to seek alternatives.&nbsp;<a href="https://www.aarp.org/money/scams-fraud/online-pharmacy/">Surveys show</a> that 1 in 9 adults, and 1 in 6 among those over 55, have purchased medication online. That is a massive target audience. And cybercriminals like MediPhantom know it.<h3 class="text-align-justify">Taking action and fighting back</h3>At Gen, we are proactively working to disrupt these PharmaFraud activities. Our dedicated cybersecurity team continuously monitors, identifies and blocks fraudulent domains and payment gateways. By leveraging advanced network analysis, we rapidly detect new malicious sites and quickly neutralize threats, significantly limiting their ability to exploit consumers.But the fight does not end there. We collaborate closely with international law enforcement agencies, sharing intelligence and supporting coordinated global takedown efforts. Together, through constant vigilance, sophisticated technological solutions and strengthened international cooperation, we are committed to dismantling this dangerous empire piece by piece, protecting consumers worldwide from online pharmaceutical fraud. Our goal is clear: to educate people about PharmaFraud and make MediPhantom’s infrastructure visible, vulnerable, and ultimately, dismantled.<h2>Beating FunkSec: When ransomware meets AI</h2>It started like any other ransomware story: encryption, extortion and chaos. But this time, the ending was different, and it’s not because the criminals suddenly grew a conscience.FunkSec ransomware emerged in late 2024, but its full operation unfolded in phases. The gang’s leak site listed its first victim as early as December 4 and suggested that their initial tactic was data exfiltration and extortion without encryption. The ransomware component came later. Based on available evidence, the ransomware development likely began in mid-December, with the first known sample dated December 31, 2024, just in time to ruin someone’s New Year’s Eve. And by January 1, a company working in the child protection sector had already been listed as a victim.FunkSec was written in Rust, a modern programming language gaining traction in both cybersecurity tools and advanced malware due to its speed and memory safety. Leveraging the orion-rs cryptographic library, FunkSec encrypted victims' files using ChaCha20 and dropped a ransom note named README-{random}.md in every folder, appending the extension “.funksec” to all encrypted data. It was designed to kill dozens of services and processes to maximize disruption, including browsers, media players, email clients and even Task Manager.

Interestingly, some samples attempted to load a desktop wallpaper image from imgur[.]com as part of the data-encryption process. While not critical to its function, it shows how threat actors are experimenting with small touches of psychological manipulation or branding, even in destructive tools.

While FunkSec wasn’t the most technically advanced ransomware, the damage was real. In just a few months, the gang targeted over 100 organizations&nbsp;worldwide, including companies in the U.S., Italy, Spain, Brazil among others. The ransom demand was modest: 0.1 Bitcoin per victim. But with 113 companies listed on their leak site, the potential haul amounted to more than $1.1 million at today’s rates. Not bad for a short-lived, bug-prone operation.And behind the scenes, something more alarming was taking shape: AI.The FunkSec operators admitted to using AI to assist in parts of their operations, including tooling, phishing templates, and code snippets. While they estimated that AI accounted for only about 20% of their workflow, it was enough to raise concerns. This may be one of the first publicly known cases of ransomware development partially assisted by generative AI.<h3 class="text-align-justify">Quiet victories and free help</h3>But here’s where the story takes a turn.A team of researchers at Gen quietly discovered a cryptographic flaw in FunkSec’s encryption logic. We won’t reveal the details, even now, to avoid giving future threat actors a blueprint for improvement. But the vulnerability was significant enough to allow us to do what we are committed to doing whenever possible: help victims recover their data without paying the ransom.Over the next few months, Gen collaborated discreetly with global law enforcement agencies, including ransomware investigators across the U.S. and Europe, providing support to help impacted victims regain access to their files through a free decryptor tool. The decryptor remained private throughout this phase to prevent detection or sabotage by the attackers.Now that FunkSec has gone quiet (the last known victim was attacked on March 15), the decryptor is being made publicly available, including through the&nbsp;<a href="https://www.nomoreransom.org/">NoMoreRansom</a> initiative. We’ve made our ransomware decryptor available for direct <a href="https://files.avast.com/files/decryptor/avast_decryptor_funksec64.exe" target="_blank">download here</a>.&nbsp;<h4 class="text-align-justify">Lessons from FunkSec</h4><ul><li>AI is entering the ransomware workflow. Even in limited form, generative AI is speeding up the development of cybercrime tools.</li><li>One crypto mistake can change everything. A flaw in the math helped dozens of victims avoid extortion and recover their data.</li><li>Law enforcement collaboration works. Coordinated, quiet support can stop ransomware without tipping off the enemy.</li><li>Ransomware doesn’t need to be perfect to be dangerous. Even experimental, buggy strains can hit real people and cause real harm.</li></ul>The Avast FunkSec Ransomware Decryptor is just the latest, most recent in a list of over 40 free ransomware decryptors released under the AVG and Avast brands over the past decade. Ransomware isn’t going away. But stories like this remind us: when researchers and law enforcement join forces, it’s the criminals who end up losing control.<h2>Lumma disrupted. But is the beast dead?</h2>Imagine taking down one of the world's largest infostealer infrastructures: servers shut, command centers offline and criminals scrambling.&nbsp;<a href="https://www.europol.europa.eu/media-press/newsroom/news/europol-and-microsoft-disrupt-world%E2%80%99s-largest-infostealer-lumma">Europol</a>, in collaboration with Microsoft, achieved precisely that in a spectacular operation targeting Lumma Stealer, the malware-as-a-service titan notorious for harvesting sensitive data worldwide.But here’s the question: Has the giant truly fallen or merely stumbled?<h3 class="text-align-justify">A long-standing threat</h3>Lumma Stealer has been a recurring subject in our threat reports over the years, known for its adaptability and widespread use in various campaigns. Its operators have employed sophisticated social engineering tactics, such as Fake CAPTCHA pages, to trick users into executing malicious scripts and giving the infostealer access to their devices. These deceptive methods have been documented in multiple analyses, highlighting the malware's evolution and the ingenuity of its distribution strategies.Gen Threat Labs has extensively researched how attackers use&nbsp;<a href="https://blog.avast.com/fakecaptcha-scams">Fake CAPTCHAs</a> to distribute malware, specifically mentioning Lumma Stealer as a commonly deployed threat in these attacks. Additionally, Lumma Stealer has been observed&nbsp;<a href="https://press.avast.com/deepfakes-ai-manipulated-audio-and-hijacked-social-media-surge-in-2024?utm_source=chatgpt.com">exploiting platforms like YouTube</a> to spread via cracked software propagated through Fake Tutorials.The success of all the techniques in Lumma Stealer’s toolbox resulted in a 1154% increase in activity during Q3/2024, indicating its aggressive proliferation and the effectiveness of its distribution tactics.<h3 class="text-align-justify">Distribution uninterrupted: Lumma’s silent persistence&nbsp;</h3>Gen telemetry from May, captured in the aftermath of Lumma Stealer’s takedown by Europol, reveals a troubling but not unexpected resilience. Instead of plunging dramatically, Lumma infection attempts continued steadily. Distribution channels, untouched by the operation, remain open and active, meaning Lumma is still knocking at users' doors. So how is it that Lumma was able to remain undisturbed after a successful governmental takedown?&nbsp;

The answer boils down to how Lumma operates. The Europol and Microsoft intervention primarily targeted the Command-and-Control (C2) servers and administration panels, effectively cutting off the stealer’s ability to relay stolen data. But the malware itself, persistently distributed through phishing emails, fake software updates and other&nbsp;<a href="https://www.gendigital.com/blog/insights/research/lumma-stealer-github">deceptive tactics</a>, still infects new victims' devices daily.In short, while the operation severed Lumma’s command structure, it failed to halt the distribution pipelines. Our internal data, highlighting a stable infection rate throughout May and the rest of Q2/2025, confirms this grim reality: Lumma’s reach remains alarmingly consistent.<h3 class="text-align-justify">Infrastructure resurrection: Lumma's swift recovery</h3>Even though Lumma Stealer continued to be widely distributed after the takedown, the critical question was whether attackers had managed to re-establish their exfiltration infrastructure or if they were simply relying on short-term capabilities of its distribution network. Did the disruption impact its exfiltration capabilities in the long run? Could the attackers recover, restore and deploy new infrastructure to receive logs?We’ve been closely monitoring Lumma’s use of dead drop resolvers,&nbsp;a technique that enables infected machines to dynamically retrieve updated command-and-control (C2) addresses. This mechanism allows threat actors to rotate infrastructure frequently without needing to redeploy the malware itself. In recent weeks, we’ve resolved multiple fresh C2 domains, clearly indicating an active and ongoing effort to maintain exfiltration capabilities.

In parallel, we uncovered a misconfigured administration panel tied to one of Lumma’s ongoing operations. It revealed thousands of logs, over 500 linked to cryptocurrency wallets, and a 3.5% “success rate” (wallets to total logs). Victims span over 100 countries, with Indonesia, the Philippines and Egypt topping the chart. We’ve observed the number of logs continuously increasing, clearly indicating that exfiltration is not just possible; it’s actively happening.

Together, these findings confirm that Lumma’s infrastructure wasn’t dismantled. It’s been resilient all along and barely missed a beat.<h3 class="text-align-justify">The reputational impact</h3>Despite the unsettling evidence of Lumma’s operational recovery, the takedown achieved a critical and perhaps more lasting impact: reputational damage.&nbsp;Lumma’s trustworthiness and reliability, central to its infamous Malware-as-a-Service (MaaS) operations, have dealt a massive reputational blow. Potential affiliate partners are now hesitant, wary of law enforcement scrutiny and the possibility of compromised infrastructures.History teaches us that in the dark corners of cybercrime, reputation often matters as much (if not more) as technological prowess. After all, cybercriminals thrive on trust among thieves. Once broken, regaining credibility can be even harder than rebuilding infrastructure.The partial disruption of Lumma Stealer is not an isolated victory. Recent months have witnessed several notable successes thanks to extensive international collaboration among law enforcement agencies and private sector entities. In the U.S., authorities indicted the leader behind the Qakbot botnet, notorious for facilitating major ransomware attacks. Separately, the DanaBot malware, responsible for infecting countless computers, saw its operators federally charged. Meanwhile, Europol’s Operation Endgame broke critical links in the ransomware kill chain by dismantling vital criminal networks at their very source.What these coordinated takedowns make evident is that cross-border cooperation, information sharing and joint operations between law enforcement and cybersecurity companies are increasingly effective. While no single action fully eradicates cyber threats, each disruption chips away at criminal capabilities, degrades operational trust, and collectively raises the cost for cybercriminals globally.<h3 class="text-align-justify">What happens next?</h3>As our investigation continues, we remain vigilant, closely monitoring Lumma’s evolving activity. For now, the beast appears wounded, not defeated. Its distribution network remains operational, infrastructure reconstruction efforts are ongoing, and yet the trust Lumma once commanded lies significantly damaged.Stay tuned as we keep our finger on the pulse of this evolving story, uncovering whether Lumma Stealer can rise again or if this is the beginning of its ultimate downfall.Jan Rubín, Threat Research Team Lead Ladislav Zezula, Malware Researcher Ľuboš Bever, Malware Researcher Luis Corrons,&nbsp;Security Evangelist Martin Chlumecký, Malware Researcher<h2 class="text-align-justify">In closing</h2>The digital underground is a constantly shifting landscape, marked by rapid adaptation and ruthless innovation. As threat actors become more sophisticated, understanding their operational nuances becomes critical. By analyzing cases like Lumma Stealer infostealer, FunkSec ransomware, and the MediPhantom fake pharmacy gang, we equip ourselves not only to defend against present threats but to anticipate and disrupt emerging ones. Our collective vigilance and adaptability remain our strongest assets in confronting the evolving world of cybercrime.&nbsp;

<h2>Download the <a href="https://cmsb.nortonlifelock.com/sites/default/files/2025-07/Q22025%20Gen%20Threat%20Report%20%20%28Booklets%29%20%284%29.pdf" target="_blank">Q2/2025 Threat Report Key Highlights</a></h2>Visit our <a href="https://www.gendigital.com/blog/insights/reports/threat-taxonomy" target="_blank" title="Glossary">Glossary and Taxonomy</a> for clear definitions and insights into how we classify today’s cyberthreats.

AI ransomware cracked without paying, fake pharmacy network unmasked and Lumma still alive after takedown

Gen Q2/2025 Threat Report

<h2>Foreword&nbsp;</h2>With this issue of the Gen Threat Report, we are introducing a more streamlined format, making it easier to digest and focusing more on key highlights, trends and emerging threats rather than attempting to catalog every detail. The Threat Landscape Highlights section will capture notable trends and evolving threat dynamics, and Featured Stories will now dive deeper into specific investigations.&nbsp;&nbsp;The threat landscape in Q1/2025 might look surprising to some. At first glance, the decline in the total number of blocked attacks compared to the previous quarter might seem like a welcome reduction in activity. However, this drop is not solely seasonal or due to reduced attacker activity. More importantly, this decrease highlights a deeper evolution in tactics: broad 'spray and pray' campaigns are giving way to more tailored, deceptive and persistent attacks. The threats that did emerge this quarter are more focused, strategic and reflect the growing sophistication of attackers.&nbsp;

Financial threats showed new levels of innovation. The CryptoCore group executed one of its most refined campaigns to date, blending deepfake videos of public figures, compromised YouTube accounts and professionally cloned websites. This most recent campaign resulted in an estimated $3.8 million in illicit profits over 2,200 transactions (although the real number is likely far higher). Mobile financial threats also escalated. The Crocodilus banking trojan, most active in Spain and Turkey, abused accessibility features to overlay fake login pages and steal crypto wallet credentials. Meanwhile, our LifeLock insights showed rising levels of credit and transaction alerts, indicating both increased monitoring activity and more frequent fraud attempts targeting users’ financial footprints.&nbsp;Data-stealing threats also continued to rise across multiple categories based on our telemetry. The number of data breach events — meaning instances where a company or platform was breached — increased by more than 36% quarter over quarter, while the total number of breached records — or personal data such as email, passwords, credit card numbers, etc. — surged by more than 186%. While large-scale service breaches made headlines, attackers were also using direct compromise of user data through infostealers such as Lumma Stealer (which has since been successfully taken down through a <a href="https://www.europol.europa.eu/media-press/newsroom/news/europol-and-microsoft-disrupt-world%E2%80%99s-largest-infostealer-lumma" target="_blank" rel="noreferrer noopener">collaboration between Europol and Microsoft</a>). Furthermore, phishing continued to play a growing role in data compromise — we documented how adversaries are abusing low-code form-building platforms to host phishing campaigns on legitimate infrastructure, making detection and takedown significantly harder. Lastly, ransomware remained a high-risk threat, building over the last three quarters. The majority of cases continued to be driven by the usual suspect, Magniber, but new strains, such as FunkSec, also emerged. FunkSec, in particular, had been allegedly partially generated using AI and large language models (LLMs).&nbsp;Scam threats were marked by significant diversification and reach. We protected more than 4 million people from Scam-Yourself Attacks, a category that now spans platforms and operating systems. FakeCaptcha, once confined to Windows, expanded to macOS and began distributing the infamous infostealer AMOS (Atomic Stealer) under the guise of phishing protection. Touché. Moreover, social media remained a key vector for scams, with compromised Facebook and YouTube accounts used for both distribution and monetization. Attackers combined AI-generated personas, hired influencers and platform-native ad systems to lend legitimacy to fraudulent campaigns. In parallel, Fake Update attacks, another type of Scam-Yourself Attack in which people are asked to update their device or programs but are instead guided to infect their devices, targeted European users causing an unprecedented growth of 17 times of the risk exposure compared to last quarter.&nbsp;We hope you find the Q1/2025 Gen Threat Report engaging and informative and the new format easy to digest. Thank you for reading. &nbsp;Jakub Křoustek, Threat Research Director&nbsp;&nbsp;

<h2>Threat Landscape Highlights</h2>While the list of the most prevalent threat type remains the same or nearly similar throughout the years, the threat landscape continuously evolves through the ways in which threat actors work to achieve their malicious ambitions. How the landscape shifts is inevitably affected by our digital activities, from the use of social media to online shopping and learning to recent events affecting the security of our digital lives, such as data breaches.&nbsp;&nbsp;In this section, we aim to provide insight into emerging threats, new techniques and trends and interesting changes in the otherwise expected behavior of the global threat landscape.&nbsp;

<h3>Global Risk Snapshot&nbsp;</h3>Global risk ratio: 24.53%&nbsp;Cyber risk remained high in Q1/2025, with a global average risk ratio of 24.53%, consistent with the heightened levels observed in late 2024. However, exposure remained highly uneven across regions.&nbsp;

The highest threat activity concentrated in parts of Asia and Eastern Europe. China topped the list with a risk ratio of 48.60%, followed by Georgia (44.51%) and Vietnam (39.06%). These figures reflect a mix of aggressive targeting, insufficient defensive infrastructure and high digital engagement.&nbsp;In contrast, major economies like Japan (16.12%), Germany (20.11%) and France (24.93%) reported significantly lower risk ratios, while Scandinavian countries like Finland (19.36%), Sweden (22.14%) and Norway (23.96%) continued to show resilience against attacks thanks to mature cybersecurity practices.&nbsp;South America remained a region of interest, with Brazil (20.14%) and Argentina (23.24%) experiencing spikes in mobile-specific threats. Meanwhile, countries with limited digital infrastructure — such as Haiti (18.44%) or the Democratic Republic of Congo (16.24%) — saw reduced exposure simply due to lower internet penetration.&nbsp;

<h3>Personal Data at Stake: Data Breaches &amp; Information Stealers&nbsp;</h3>Personal data is like digital gold to criminals, and risks to digital identities continue to increase. Based on our telemetry, data breach events - instances where a company or platform was breached - rose 36.12% quarter-over-quarter. Breached records increased by 186.26%, with breached user emails alone up 102.93%. More than 1.19 million records were reported with high or critical severity, meaning that the breached records also included plaintext passwords, potentially giving cybercriminals the figurative keys to over a million of people’s personal accounts.&nbsp;Large-scale data breaches are no longer rare. Notable digital-identity events in Q1/2025 included:&nbsp;<ul><li>USOSGM: Exposed full names and addresses of U.S. shoppers.</li><li>ALIEN TXTBASE: Huge collection of stolen user credentials published on Telegram channel—493 million unique website and email address pairs, affecting 284 million unique email addresses.&nbsp;</li></ul>One of the protective measures we provide for our users is alerting them when a significant breach happens and their personal data is exposed or possibly affected by a recent data leak. These alerts give our customers the opportunity to responsibly react and secure their personal data in advance of fraudulent activity by attackers. In Q1/2025, alerted users increased too with notable spikes in:&nbsp;<ul><li>Credit Alerts: +13.83%. These alerts are related to new accounts, credit inquiries, changes in credit profiles, etc., and they notify users of potential fraud attempts or suspicious activity in real time.</li><li>Criminal Record Alerts: +11.98%. These are related to users' identity appearing in legal or criminal records, including court cases, judgments, and sex offender notifications. These alerts inform users of potential misuse of their identity or unauthorized legal associations.</li><li>Transaction Alerts: +3.04%. Transaction alerts track financial transactions across users’ bank accounts, credit cards, and investment accounts. These notifications highlight unusual charges, threshold limits were exceeded, or payday loan applications.&nbsp;</li></ul>Data stealing efforts via information stealers also rose in Q1/2025, with a 8.24% increase in risk ratio, again driven by the <a href="https://www.gendigital.com/blog/insights/research/lumma-stealer-github" target="_blank" rel="noreferrer noopener">Lumma Stealer</a> which:&nbsp;<ul><li>saw a +59.4% market share increase, now at 19.51%</li><li>harvested credentials, crypto wallets, 2FA tokens</li><li>delivered via phishing, GitHub abuse, and Scam-Yourself attacks&nbsp;</li></ul>Other prominent infostealers by their malware share were:&nbsp;<ul><li>FormBook (12.47%)</li><li>AgentTesla (10.99%)</li><li>Ramnit, MassLogger, Fareit, SnakeKeylogger, Lokibot&nbsp;</li></ul>

The regions most impacted by information stealers were Turkey, Egypt, Indonesia and Argentina.&nbsp;<h3>&nbsp;Scams &amp; Social Media Exploits&nbsp;</h3>Scams continue to evolve as one of the most widespread and adaptable cyberthreats, exploiting both traditional and modern delivery channels. In Q1/2025, we observed scammers leveraging everything from <a href="https://www.avast.com/c-what-is-malvertising-how-to-stop-it" target="_blank" rel="noreferrer noopener">malvertising</a> (malicious advertising) to social media platforms and push notifications to reach potential victims. This broad attack surface was amplified by the wealth of user data available online, enabling highly targeted and convincing scams. Below, we highlighted some of the key trends and tactics shaping the scam landscape this quarter:&nbsp;<ul><li>Malicious push notifications delivering scams increased 10.26% in the risk ratio for Germany, followed by Norway (+24.85%) and Denmark (+22.42%).</li><li>Financial scams increased 500% in Lebanon, 223% in Moldova, 112% in Portugal and tens of percents also in Slovakia, Serbia, Estonia and Slovenia.&nbsp;</li></ul>Social media also remained a favored delivery mechanism for scams and other related threat types. In Q1/2025, 63% of social-media-related threats were observed on Facebook, followed by YouTube with 22% platform share. Platforms like Reddit and Instagram remained a relevant threat, while X (formerly Twitter) held steady at 7%. LinkedIn, a business and employment-oriented social network, observed a rising trend with 26.23% increase of its share.&nbsp;

The types of threats found on each social media site varied due to user demographics and usage patterns, with malvertising continuing to top the threat types on social media 30% of the total share, followed by phishing (21.72%). &nbsp;Q1 Scam Trends Revealed by Norton Genie&nbsp;Our Norton Genie scam detection tool shows the different type of scams reported by users:&nbsp;<ul><li>Generic scams: 51.4%</li><li>Phishing: 31.9% with a massive 4x increase quarter-over-quarter</li><li>Malvertising: 2.41%&nbsp;&nbsp;</li></ul>

<h3>Ransomware: A Changing Battlefield&nbsp;</h3>The ransomware threat level remains elevated since Q4/2024. In Q1/2025:&nbsp;<ul><li>Magniber dominated (67% of ransomware cases and over 100,000 protected users)</li><li>WannaCry and Enigma trailed far behind&nbsp;</li></ul>

While the notable players maintain the largest share of ransomware threats, there is a new player on the ransomware scene, called FunkSec. Some of their tools were most likely generated by an LLM agent, a sign that AI tools are lowering the barrier for creating ransomware. This also applies to the <a href="https://www.virustotal.com/gui/file/7e223a685d5324491bcacf3127869f9f3ec5d5100c5e7cb5af45a227e6ab4603" target="_blank" rel="noreferrer noopener">template source code</a>, where comments are written in perfect English (as opposed to very basic English in other mediums).&nbsp;Based on a report from <a href="https://www.chainalysis.com/blog/crypto-crime-ransomware-victim-extortion-2025/" target="_blank" rel="noreferrer noopener">Chainalysis</a>, the total volume of ransom payments decreased year-over-year (YoY) by approximately 35%. There are a few reasons why the payments declined —companies have adapted to this type of cyber-threat and are understanding the need for cybersecurity while more frequently declining to pay ransomware gangs while law-enforcement agencies have increased pressure on ransomware infrastructure and crypto-mixers. The total amount paid in 2024 was $813 million.&nbsp;<h3>Mobile Threats on the Rise&nbsp;</h3>Mobile threats surged in Q1/2025, with a 25% increase in protected users across adware and spyware categories. Adware, particularly strains like HiddenAds and MobiDash, dominated the mobile threat landscape, while older families like FakeAdBlockers faded from view. Brazil, India, Argentina, and Mexico saw some of the largest country-specific spikes, with Mexico notably experiencing a 42% jump in protected monthly users.&nbsp;

The evolving nature of mobile adware and spyware suggests these threats will continue to escalate in the coming quarters, particularly as attackers experiment with new delivery methods and leverage regional campaigns to maximize impact.&nbsp;

Spyware, though growing more modestly (+6% protected users), revealed worrying trends with new or resurging strains like SpySolr, Tambir and SpyLend, targeting victims in Turkey and India with increasingly aggressive data theft and blackmail tactics. Spain stood out with a 96% spike in spyware risk, while Turkey followed closely behind at +84%.&nbsp;Patrik Holop, Researcher&nbsp; Luis Corrons, Security Evangelist&nbsp; Ladislav Zezula, Malware Researcher&nbsp; Jakub Vávra, Threat Operations Analyst&nbsp; Jan Rubín, Malware Researcher&nbsp; Alexej Savčin, Threat Analysis Engineering Manager&nbsp; Lukáš Zobal, Research Engineering Manager&nbsp;

<h2>Featured Stories: Deception, Innovation and Exploited Trust&nbsp;</h2>The first quarter of 2025 demonstrated that cybercriminals are not merely refining their methods; they’re rewriting the playbook entirely. Our Featured Stories expose how threat actors employed groundbreaking technologies, hijacked trusted platforms and used highly personalized deception to trap victims more effectively than ever.&nbsp;CryptoCore’s manipulation of deepfake technology around President Donald Trump’s 2025 inauguration illustrates how major media events can become powerful tools for financial fraud on a global scale.&nbsp;&nbsp;In parallel, cybercriminals exploit legitimate online website builders, rapidly deploying convincing phishing pages designed to bypass traditional security measures and deceive users into handing over their most sensitive data.&nbsp;We also explore the sophistication of Scam-Yourself Attacks, a disturbing trend where victims are deceived into willingly infecting their own devices. Attackers increasingly use realistic AI-generated personas, cleverly compromised social platforms and sophisticated cross-platform techniques to evade detection and persuade users to lower their defenses voluntarily.&nbsp;Together, these featured stories paint a clear picture of a threat landscape driven by innovation, deception and an alarming exploitation of trust.&nbsp;<h3>Hijacked Inauguration: How CryptoCore Used Deepfakes to Scam Millions&nbsp;</h3>CryptoCore, the sophisticated cybercriminal group that exploits the popularity of cryptocurrencies, has perfected the art of deception. By combining deepfake technology, hijacked YouTube accounts and professionally designed websites, they transform media events into launchpads for sophisticated scam operations targeting cryptocurrency users. Their approach exploits trust, manipulates public attention and turns fabricated reality into a convincing trap. We broke down their methods further in our article about <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/" target="_blank" rel="noreferrer noopener">CryptoCore</a>.&nbsp;In Q1/2025, CryptoCore found the perfect stage. As the 2025 inauguration of U.S. President Donald Trump captured global headlines, the group launched one of its most aggressive deepfake campaigns yet, targeting cryptocurrency enthusiasts caught in the media frenzy.&nbsp;Our telemetry shows that during this period, CryptoCore’s activity surged to over four times the typical baseline, reflecting the scale of the operation.&nbsp;&nbsp;

CryptoCore significantly increased its activity on YouTube during the inauguration, hijacking more accounts and rebranding them to look like official accounts linked to Donald Trump. Deepfake technology was at the heart of the operation, creating realistic, fabricated videos featuring both Donald Trump and Elon Musk promoting fraudulent giveaway events.&nbsp;

The scam narrative remained consistent: leveraging the inauguration’s media spotlight to push cryptocurrency investment schemes, promising participants the chance to double their profits. The videos were carefully crafted, often reusing authentic footage with manipulated lip-syncing and embedded QR codes that redirected viewers to sophisticated fake websites. These sites were highly professional in appearance, featuring interactive elements and images of Trump and Musk to enhance their credibility.&nbsp;

In addition to the inauguration event, Donald Trump's meme coin, $TRUMP, officially launched on January 18, 2025, just before Donald Trump's second inauguration. The coin quickly gained public attention, fueled by media coverage and the political spotlight.&nbsp;&nbsp;Seizing the opportunity, CryptoCore created a wave of scam promotional content featuring deepfakes of Trump and other high-profile figures. The scam once again promised exclusive benefits and double profit, this time tied to investments in the $TRUMP coin.&nbsp;&nbsp;Beyond the inauguration, CryptoCore maintained a stable trend of distributing fake videos exploiting the likenesses of other cryptocurrency personalities such as Vitalik Buterin, Michael Saylor and Brad Garlinghouse. These deepfakes were spread across hijacked platforms, extending the reach of their scams far beyond the political event.&nbsp;&nbsp;CryptoCore’s operations in Q1/2025 resulted in estimated profits of $3.8M across 2,200 transactions, based on analysis of cryptocurrency wallets identified on fraudulent sites. As this estimate only includes tracked wallets and visible activity, the actual profit is likely much higher.&nbsp;CryptoCore’s latest campaigns show how quickly attackers adapt, combining deepfake technology, hijacked trusted platforms, and media-driven moments to lure unsuspecting victims. Today’s scams no longer rely on crude deception: they look polished, professional and dangerously convincing. It is crucial to stay vigilant and verify the authenticity of any cryptocurrency-related content, especially that tied to high-profile events or personalities, to avoid deception.&nbsp;<h3>The Hidden Threat of Phishing Attacks Through Online Forms&nbsp;</h3>Cybercriminals have always been on the lookout for simple, effective and low-cost ways to run phishing campaigns. While some invest in elaborate infrastructure—offering realistic phishing pages as part of paid “phishing-as-a-service” kits—others opt for a cheaper, faster approach: abusing legitimate website builders. These low-effort alternatives abuse legitimate tools with drag-and-drop interfaces, enabling anyone to create a website without needing coding skills. This approach allows for a quick, although limited, way to create phishing pages on legitimate hosting domains. Such pages have a higher chance of bypassing standard email filters, which is a significant threat to ordinary users. Therefore, phishing links are predominantly sent via email. The main tactic is to create a sense of urgency about a blocked account or service limitation requiring immediate action. Another type of email is informational, requesting the review of a document accessible online, but only after logging in.&nbsp;Even though many of these websites can be spotted with a bit of scrutiny, they remain consistently present in the wild, and in some regions, increasingly so. They primarily mimic the login screens of major companies providing telecommunications, email and streaming services. Financial institutions and forms requiring payment information, social security numbers and other sensitive data are also common targets. Additionally, the phishing pages appear in various languages across all continents.&nbsp;Attackers often abuse popular website builders, e.g., Weebly or Wix, hosted on trusted domains and infrastructure. These tools are frequently free, making their misuse very simple and anonymous. Phishing pages typically have a legitimate second-level domain, which does not raise suspicion with spam filters or antivirus software. Additionally, attackers can choose arbitrary third-level domains, often using their names to evoke familiarity with the phished brand. A popular tactic is also typo squatting in the subdomain name, such as:&nbsp;<ul><li>updatefacebookmeta[.]weebly[.]com</li><li>microsoftdocumentfile[.]weebly[.]com</li><li>outlookauthenticationmicrosoft[.]weebly[.]com</li><li>myfmsbank[.]weebly[.]com</li><li>onlinedesk[.]wix.com&nbsp;</li></ul>Beyond website builders, attackers increasingly abuse dynamic DNS (DDNS) services and subdomain providers like DuckDNS to host phishing sites. These services allow the creation of custom subdomains that mimic well-known brands, further enhancing the deception. By leveraging such flexible infrastructure, attackers can quickly scale campaigns without requiring extensive technical knowledge, expanding their reach and impact.&nbsp;Some login pages are sophisticated and require greater attention to detect, especially if the legitimate login form is simple to copy. On the other and, there are also many obviously fraudulent pages where, e.g., the entered password is not masked, the footer displays the logo of the abused platform or the header contains links leading to unrelated sites. In any case, the login page sitting on the website builder domain is a red flag indicating that something is wrong.&nbsp;The figure below illustrates an example of an obvious phishing page. Notice the suspicious menu items, including irrelevant options unrelated to the site's purpose. The page layout is also inconsistent and unprofessional, with mismatched fonts and awkward formatting. One of the most obvious red flags, though, is that passwords are displayed in plain text rather than masked—an immediate giveaway that the site is not legitimate.&nbsp;

Phishing attacks of this type are steadily increasing worldwide, with distinct spikes in specific regions.&nbsp;

In the U.S., a significant campaign targeted AT&amp;T and Xfinity customers in early 2025. Conversely, in Australia, we have observed a steadily increasing trend since February, relentlessly targeting Telstra email users.&nbsp;

These regional waves reflect how attackers can easily localize their campaigns using publicly available tools, targeting specific providers, languages and users with minimal effort and maximum reach.&nbsp;The technique remains widely used for a reason: it’s fast, cheap and often effective. Even when phishing pages are poorly made, their trusted hosting domains give them an edge, making them harder to filter and easier to overlook.&nbsp;Notably, Q1/2025 telemetry shows a rising number of phishing campaigns hosted on DDNS services and subdomain providers, adding to the already widespread abuse of site builders. While the overall phishing threat landscape remained relatively stable this quarter, these shifts in hosting methods point to an evolving playbook that emphasizes speed, flexibility and low operational costs.&nbsp;

<h3>The Evolution of Scam-Yourself Attacks: Smarter, Sneakier and Cross-Platform &nbsp;</h3>The most dangerous attacks aren’t always the ones that sneak in unnoticed — they are often the ones that make you open the door yourself.&nbsp;&nbsp;<a href="https://us.norton.com/blog/emerging-threats/threat-report-q3-2024" target="_blank" rel="noreferrer noopener">Scam-Yourself Attacks</a> rely on well-crafted social engineering tactics, designed to trick users into infecting their own devices. The malicious steps don’t hide in the background — they’re laid out in front of the user, disguised as helpful instructions. It’s <a href="https://us.norton.com/blog/emerging-threats/malware" target="_blank" rel="noreferrer noopener">malware</a> you install yourself — and attackers are getting better at convincing you to do it.&nbsp;&nbsp;

In Q1/2025 alone, we protected more than 4 million people from Scam-Yourself Attacks like ClickFix and FakeCaptcha, some of the most widespread and persistent threats across the globe. While the overall “Fake” category, which includes Scam-Yourself Attacks, saw a slight decrease in global risk ratio by 8.96% this quarter, its impact remains massive, with persistent activity observed worldwide.&nbsp;&nbsp;

<h4>AI Personas, Fake Finance Tools and the YouTube Trap&nbsp;</h4>One of the most striking evolutions we observed this quarter is how attackers use AI-generated personas, deepfake influencers and hired actors to deliver Scam-Yourself campaigns, primarily through compromised YouTube accounts.&nbsp;&nbsp;Meet Thomas Harris, also known as Thomas Roberts or Oscar Davies, among other names. He is very active on YouTube, providing advice on how to easily make money using otherwise paid extensions for TradingView, like ChatGPT AI Charts (no matter if such an extension actually exists or not). Typically present as an unlisted video on a compromised YouTube account, "Thomas” verbally and visually explains how to proceed with the installation, effectively performing a Scam-Yourself Attack. The most shocking part is Thomas isn’t real at all but is instead a rising star of an influencer who is completely deepfaked.&nbsp;

Usually, the video is unlisted and is not visible on the compromised YouTube channel where it is hosted, and it cannot be searched for on YouTube. In order for the user to reach the video, the attackers frequently use YouTube’s advertising system, recommending the scam videos when it recognizes the user is interested in the related topic.&nbsp;The attackers also use a lot of tricks to make the compromised accounts look as convincing as possible. To impersonate the original vendor, the attackers made some typical changes:&nbsp;<ul><li>Renaming the channel (arbitrary, perfectly mimicking the original channel)</li><li>Renaming the @handle (must be unique, typo-squatting is typically used)</li><li>Deleting all of the content of the previous owner</li><li>Filling the channel with linked videos leading to the official channel the attackers are impersonating&nbsp;</li></ul>Let us explain the last step more using the example below.&nbsp;&nbsp;Linked videos are a feature of YouTube where the user can link videos from different channels and present them on their own channel. In the screenshot below, we can see a compromised YouTube channel. Because the videos in this case point to the official TradingView channel, they look very convincing and legitimate – that’s because they are legitimate — even though they don’t belong to this channel at all. The user would need to click on the individual videos and observe that they are actually hosted on a different channel to recognize they’re on not on the page of the company, account or vendor that they think they’re on.&nbsp;

For more details about this campaign, <a href="https://www.gendigital.com/blog/insights/research/ai-generated-personas-deepfake-tactics-scam-yourself-attacks" target="_blank" rel="noreferrer noopener">read our blogpost</a>.&nbsp;<a href="https://x.com/GenThreatLabs/status/1894763068313178208" target="_blank" rel="noreferrer noopener">Trading Bot Scam</a> is yet another type of AI impersonation campaign we observed during Q1/2025 (and beyond). In the 500+ videos so far, we observed more than 15 different personas, and we are still counting. Either completely AI-generated, deepfaked, or performed by hired actors, all these personas carry out the Trading Bot Scam.&nbsp;

All of the personas shown above advise users on how to get rich, quickly and easily, by exploiting price differences in cryptocurrency on blockchains. To do so, users are instructed to copy and paste a smart contract code into an online Integrated Development Environment (IDE platform) for the cryptocurrency contract. When the user adds money to the contract, their money is sent to the attacker’s wallet instead. This method takes Scam-Yourself Attacks to the next level. Instead of simply tricking users into pasting malicious commands into their computers, it uses legitimate websites or tools to trick them into setting up a malicious smart contract on the blockchain.&nbsp;&nbsp;The attacker usually hosts their own fake coding platform on a website with a slightly misspelled name. This way, they avoid the warnings and pop-up messages that real platforms show to protect users from copying dangerous code.&nbsp;

By self-hosting the IDE, the attackers are changing its implementation in such a way that these warnings are suppressed, making it a tradeoff between user noticing the typo-squatted domain and the warning dialogue.&nbsp;<h4>FakeCaptcha Gets Smarter (and More Cross-Platform)&nbsp;</h4>ClickFix and FakeCaptcha continue to evolve. One new tactic involves <a href="https://x.com/GenThreatLabs/status/1883930160392778027" target="_blank" rel="noreferrer noopener">interactive image-based</a> CAPTCHAs mimicking the classical “select all the traffic lights” puzzle. However, after selecting the image (quite frankly, any image for that matter), the user is once again redirected to the common set of malicious steps which result in infecting the user’s device.&nbsp;Another FakeCaptcha campaign <a href="https://x.com/GenThreatLabs/status/1888144081869590600" target="_blank" rel="noreferrer noopener">focused on countries in Asia</a>, uses typo-squatted URLs trying to impersonate well-known brands like Pepsi, McDonald's and Coca-Cola. In campaigns like this, we can observe usage of a variety of loaders — programs designed to secretly install malware on a victim’s device, including the well-known Emmenhtal loader. In some cases, the loader is cleverly hidden inside a polyglot MP3 file, which can be played as normal audio but also contains malicious JavaScript. This hidden code is then run by a tool called mshta.exe to install Lumma Stealer malware.&nbsp;

In FakeCaptcha attacks, attackers hide malicious code by adding comments that make the command look harmless. This way, the user only sees the supposed verification message and the malicious command is hidden just before the comment, as can be seen below:&nbsp;

In Q1/2025, we saw an <a href="https://x.com/GenThreatLabs/status/1899855568451367330" target="_blank" rel="noreferrer noopener">improvement of this technique</a>. The attackers started to use Unicode characters in these comments in an attempt to avoid detection. Nothing really changed for the user, but under the hood, the byte representation varies significantly.&nbsp;

FakeCaptcha also <a href="https://x.com/GenThreatLabs/status/1902342309175279748" target="_blank" rel="noreferrer noopener">exploits the userinfo part of URLs</a> (credentials before the ‘@’ symbol) in mshta.exe requests. This is done to obfuscate the URL, so it seems like a common google.com domain (see below), but in fact, the request is made to the attacker’s hosted website.&nbsp;

Additionally, FakeCaptcha is not just a Windows thing anymore. In early Q1/2025, this attack was <a href="https://x.com/g0njxa/status/1884166667498054004" target="_blank" rel="noreferrer noopener">observed on macOS</a>. With a promise of protection against phishing attacks, by following the steps, the campaign was distributing AMOS, an information stealer also known as Atomic Stealer.&nbsp;

In parallel, we also observed a considerable rise in Fake Update campaigns, where attackers trick victims into installing supposed browser updates (such as for Chrome or Opera) that actually deliver malware. These fake updates, designed to closely mimic legitimate prompts, caused a massive +1711% spike in global risk ratios during Q1. While situational, such campaigns can surge dramatically in short bursts before settling back into quieter periods. Notably, this particular wave hit countries like Belgium, Poland, Italy, New Zealand, Switzerland, Spain, the Netherlands, Germany and the United Kingdom especially hard.&nbsp;Scam-Yourself Attacks also allow previously dead malware strains to shine again. During Q1/2025, we observed a resurrection of Wincir RAT/dropper, also known as Legion Loader, which rose to popularity in 2022 before quickly beginning its steady decline.&nbsp;&nbsp;The attack starts with an unofficial third-party website for downloading software. This website is, however, hosted by the attacker and instead of a direct download, instructions on how to proceed are displayed to the user.&nbsp;

Note that the instructions aren’t infecting the victims’ devices directly. Instead, the installer is simply downloaded and conveniently displayed to the user in a traditional Explorer window. After the user double-clicks on it, or presses enter, they execute Wincir manually on their own.&nbsp;

Looking ahead, we anticipate Scam-Yourself Attacks will continue evolving in sophistication and scope. The blending of AI-generated personas, cross-platform malware delivery (including macOS), and advanced social engineering techniques suggests that these attacks will remain one of the most adaptive and challenging threat categories in the quarters to come. Regional surges, like those seen in the Fake Update campaigns, are likely to reappear as attackers test new angles and exploit localized opportunities.&nbsp;Martin Chlumecký, Malware Researcher&nbsp; Jan Rubín, Malware Researcher&nbsp; Luis Corrons, Security Evangelist&nbsp;<h2>In Closing&nbsp;</h2>The Gen Q1/2025 Threat Report revealed an evolving threat landscape where cybercriminals are becoming increasingly sophisticated, leveraging advanced technologies like AI, deepfakes, and cross-platform scams to exploit trust and target their victims. These issues aren’t just technological; they’re deeply personal, affecting real people and real lives.&nbsp;Key insights included a 186% surge in breached records, a growth in Fake Update Scams of 17 times the previous quarter’s levels, and the rise of Scam-Yourself Attacks, which deceived millions of users into compromising their own systems. We saw new players on the ransomware scene, developing attacks created by AI that target businesses’ bottom lines. Financial threats, like CryptoCore’s deepfake-powered cryptocurrency scams, reaped millions in profits, while mobile threats took a deeply personal turn, targeting users’ sensitive data through spyware and banking Trojans.&nbsp;While the overall volume of cyberattacks has not significantly increased, this signals a shift from broad, indiscriminate strategies to more targeted, innovative, and persistent tactics.&nbsp;&nbsp;Despite these challenges, there’s hope. Awareness, proactive measures, and robust cybersecurity practices are critical in countering these threats. Together, we can build a digital future that’s smarter, safer, and more resilient.&nbsp;Stay protected. Stay alert. Stay ahead. &nbsp;

Download the full <a href="https://www.gendigital.com/blog/sites/default/files/2025-05/Gen%20Threat%20Report%20Whitepaper%20final.pdf" target="_blank" title="Q1/2025 Whitepaper">Q1-2024 Threat Report Whitepaper</a> here.&nbsp;Visit our <a href="https://www.gendigital.com/blog/insights/reports/threat-taxonomy" target="_blank" title="Glossary">Glossary and Taxonomy</a> for clear definitions and insights into how we classify today’s cyberthreats.

Gen Protects Millions of People as Breached Personal Information, Phishing Reports, Fake Browser Update Scams and Scam-Yourself Attacks Are on the Rise 

Gen Q1/2025 threat report 

Understanding cyberthreats can be complex, especially as tactics evolve and terminology expands. This blog is designed to make things easier. Here, you’ll find clear definitions and classifications of key threat types featured in our quarterly <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q1-2025" target="_blank" rel="noreferrer noopener">Gen Threat Reports</a>. We keep it simple, sharp and rooted in real-world things that researchers across the Gen family of brands continue to discover in the wild.&nbsp;&nbsp;As threat insights evolve quarter over quarter, this resource will grow alongside them, helping journalists, analysts and curious minds stay informed while navigating the ever-changing threat landscape. Think of it as your fast, reliable reference to stay ahead of what’s out there.&nbsp;<ul><li>Adware (malware-based threat)&nbsp;Adware threats refer to applications that display intrusive out-of-context adverts to users to generate fraudulent advertising revenue. In other words, it’s sneaky software that shows annoying pop-up ads to make money, often without you realizing where they’re coming from or why. These apps often mimic popular apps like games or camera filters and include stealthy features to avoid detection or removal.&nbsp;</li><li>Alert (threat indicator and metric)&nbsp;An alert refers to any and every notification sent to a user’s app, within a given period, to warn you about possible threats to your identity, money or personal information. &nbsp;</li><li>Bankers (malware-based threat)&nbsp;Bankers are a sophisticated type of malware (and a subset of infostealers), designed to steal banking credentials, crypto wallets and payment information. Generally distributed through phishing messages or fake websites, Bankers can take over a victim's device by abusing the accessibility service. Once installed and enabled, they often monitor 2FA SMS messages and may display fake bank overlays to steal login information.  &nbsp;</li><li>Blocked Attack (threat indicator and metric)&nbsp;A blocked attack means we stopped a specific threat from reaching a specific user during a certain period of time.&nbsp;</li><li>Breach Event (data compromise threat)&nbsp;A breach event is a security incident where unauthorized individuals gain access to personal or identity-related data. For example, the event of identity theft.&nbsp;</li><li>Breached Record (data compromise threat)&nbsp;A breached record is an individual instance of leaked data from a breach, such as an email, a password, your SSN, credit card number or IP address.&nbsp;</li><li>Data-Stealing Threats (data compromise threat)&nbsp;These threats focus on stealing valuable data from a device, including login credentials, cryptocurrencies, browser cookies, passwords and private documents.&nbsp;</li><li>Dating Scams (scam-based threat)&nbsp;Also known as romance scams or online dating scams, these scams involve scammers forming fake romantic relationships online to gain trust and extract money or enough personal data to commit identity theft.&nbsp;</li><li>Digital Fingerprint&nbsp;When you visit websites, small bits of data about your device, browser, and online behavior are collected to identify you. Over time, this data forms a unique “digital fingerprint” that can track your activity across the web. Unlike cookies, it can’t easily be cleared or disabled. Companies use it to personalize ads and content, but it also exposes details about your habits, interests, and identity. This makes it a growing privacy concern and a target for misuse.&nbsp;</li><li>E-Shop ScamThis is a type of scam where attackers create fake online e-shops to trick you into making a purchase, but either the goods ordered are not delivered or they turn out to be counterfeit.&nbsp;</li><li>Fake Tutorial (type of Scam-Yourself Attack)This is misleading content that tries to present itself as a legitimate tutorial, usually to encourage you to download malware or click a malicious link.&nbsp;</li><li>Financial Scam&nbsp;This is a type of fraud where the attacker tricks you into giving them money or sensitive financial information (e.g., fake investment opportunities).&nbsp;</li><li>Gambling Scam (malware type)This is a type of scam where attackers trick you into placing bets on their fake gambling platforms but refuse to pay out legitimate winnings.</li><li>Identity Alert Ratio (metric)Identity alert ratio represents the proportion of active users in a given period who received at least one identity-related alert during that period.</li><li>Infostealers&nbsp;This is malicious software that steals passwords, banking credentials, crypto wallet keys, and other sensitive information from your computer.&nbsp;</li><li>Invoice Scam (malware type)This is a type of scam where attackers use fake invoices to impersonate legitimate companies to obtain money from the victims.&nbsp;</li><li>Know-Your-Customer (KYC)A set of identity verification and ongoing monitoring processes used by financial institutions and regulated businesses to confirm who a customer is, understand their activity, and assess risk in order to prevent fraud, money laundering, and other financial crime.</li><li>Malicious Browser Push Notifications (scam-based threat)&nbsp;Attackers exploit browser notification features by tricking users into enabling them, then sending harmful or misleading messages.&nbsp;</li><li>Malvertising&nbsp;Short for malicious advertising is when hackers hide harmful software or links inside online ads—even on trusted websites. These ads might look normal, but clicking them (or sometimes just loading the page) can infect your device or steal your info. An example: You visit a news site and see a banner ad that looks like a software update or prize offer. If you click it, it might secretly install a virus or take you to a fake website that steals your passwords. You didn’t have to visit a sketchy site; the bad ad came to you.&nbsp;</li><li>Phishing (scam-based threat)&nbsp;A type of online scam where fraudsters attempt to trick victims into providing sensitive data by impersonating trustworthy sources via emails, texts or fake websites. The fraudulent message usually contains a link to a fake website that looks like the real one, where the victim is asked to enter their sensitive information.  &nbsp;</li><li>Ransomware (malware-based threat)&nbsp;Ransomware is any type of extorting malware. The most common subtype is one that encrypts files (documents, photos, videos, databases on a victim’s PC) and demands payment (“ransom”) to decrypt them. Those files become unusable without decrypting them first. To decrypt the files, attackers demand money, “ransom”, hence the term ransomware. &nbsp;</li><li>Remote Access Trojans (malware-based threat)&nbsp;RATs are typically spread through social engineering techniques, such as phishing emails or infected file downloads. Once installed, RATs grant the attacker complete access to the victim's device, enabling activities like surveillance, data theft or spying via webcams.&nbsp;</li><li>Risk Ratio (threat indicator and metric)&nbsp;This metric denotes the severity of threats in a given country and is calculated as:&nbsp; Number of attacked users / Number of active users (monthly average). Unless stated otherwise, risk ratios are only reported for countries with 10,000+ users per month.&nbsp;</li><li>Scam-Yourself Attack (misleading)&nbsp;This attack is a social engineering tactic where victims are tricked into unintentionally compromising their own security—often by entering real credentials or verification codes into a fake but convincing interface. For example, they might send you to a fake login page that looks real, and when you enter your code or password, they use it right away to get into your account.&nbsp;</li><li>Scams&nbsp;A broad category of threats aimed at tricking victims into giving away personal information or money. We track diverse types of scams, including but not restricted to: Malicious browser push notifications, dating scams, tech support scams phishing. &nbsp;</li><li>Sextortion ScamThis is a type of extortion scam where the victim is threatened with sexually explicit material alleged to involve them. Attackers often claim to have obtained this material through hacking or surveillance.</li><li>SpamUnsolicited messages typically sent in bulk, often for marketing or promotional purposes. These messages may not be directly harmful, but are unwanted, generally considered a nuisance and can clutter the recipient's inbox.</li><li>Spyware (malware-based threat)&nbsp;Spyware is sneaky software that secretly watches what you do and steals personal info like your messages, photos, location, or passwords. It often spreads through fake ads, scam messages or tampered apps. Some advanced versions, used by governments, can even break into devices using hidden security flaws.&nbsp;</li><li>Tech Support Scams (scam-based threat)&nbsp;These scams involve fraudsters pretending to be legitimate tech support agents to gain remote access or steal personal and financial data. These scams rely on confidence tricks to gain victims' trust and often involve convincing them to pay for unnecessary services or purchase expensive gift cards. It's important for internet users to be vigilant and to verify the credentials of anyone claiming to offer technical support services. &nbsp;</li><li>Web skimming (malware type)This threat injects malicious code into web payment pages to steal bank card details or make unauthorized payments.</li></ul>

A no-jargon guide to cyberthreats 

Gen threat glossary & taxonomy 

<h2>Foreword&nbsp;</h2>The year is over, and we can confidently conclude that 2024 was record-breaking. In Q4 alone, we successfully blocked 2.55 billion threats — equivalent to 321 attacks every second and a 9% increase compared to 2023. Social engineering threats, particularly scams, dominated the landscape, making up 86% of all attacks.&nbsp;

Some of you might recall what we <a href="https://decoded.avast.io/threatresearch/avast-q321-threat-report/" target="_blank" rel="noreferrer noopener">mentioned back in 2021</a>, when we launched this series: the threat landscape is highly dynamic and constantly evolving. At that time, we were witnessing one of the major shifts – the move beyond <a href="https://www.avast.com/c-malware">malware</a> and attacks on devices (e.g., exploits, droppers, banking trojans) to more human-centric attacks. While malware threats remain as we enter 2025 and continue to require robust defenses, today’s scam-related threats are far more dangerous, both technically and psychologically.&nbsp;As we step into the new year, we see new threats on the horizon. Rapid advancements in AI and large language models (LLMs), such as <a href="https://openai.com/index/introducing-operator/" target="_blank" rel="noreferrer noopener">OpenAI’s Operator</a>, capable of automating our daily online tasks (e.g., paying invoices, placing online orders), are being eyed by attackers as the next frontier. Imagine the risks when malicious actors attack or manipulate these AI agents. It’s a shift that would redefine the threat landscape yet again.&nbsp;But before we look forward, let’s review the key developments in the final quarter of 2024. Our featured story, The Dark Side of Social Media, delves into how cybercriminals target billions of users across social platforms. Social media threats have evolved beyond traditional malware, with scams such as malvertising, fake e-shops, and phishing becoming prevalent. Facebook emerges as the dominant source of these attacks, followed by YouTube. We also showcase how each platform faces different types of threats, influenced by their unique purposes and user bases, with cybercriminals tailoring their tactics accordingly.&nbsp;The social media threat landscape is closely linked to campaigns targeting personal data, which grew in complexity and scale in the last quarter. Campaigns like ClickFix and FakeCaptcha – what we call “Scam-Yourself Attacks” - continued to psychologically manipulate users. We safeguarded over 4.2 million unique users from FakeCaptcha scams alone, a staggering 130% increase compared to the previous quarter. To help protect people from this growing threat, we introduced a <a href="https://www.gendigital.com/blog/news/family-of-brands/clipboard-protection" target="_blank" rel="noreferrer noopener">Clipboard Protection feature</a> that blocks clipboard-based threats before execution. The attackers linked to these scams deployed the NetSupport remote access trojan (RAT) with iterative improvements to its script, reportedly developed using AI tools like ChatGPT, highlighting the dual role of AI in cybersecurity.&nbsp;While scams dominated the quarter, <a href="https://www.avast.com/c-what-is-ransomware">ransomware</a> threats continued to escalate, with attacks surging by 50% in Q4/2024 building on a staggering 100% increase in Q3/2024. Magniber emerged as the most prevalent ransomware family, accounting for 62% of all detected cases. We observed notable increases in regions such as Mexico (+230%), Japan (+180%), and parts of Europe (e.g., Austria and France, both +100%). Furthermore, Advanced Persistent Threats (APTs) also remained a critical concern, as groups like Lazarus Group employed zero-day exploits and sophisticated social engineering tactics to steal sensitive information from high-value targets.&nbsp;Financial threats demonstrated both persistence and innovation in the fourth quarter, with mobile banking trojans like DroidBot and ToxicPanda targeting EU users across advanced techniques such as NFC relay attacks and the disabling of system monitoring. The BankBot banker also saw a 236% increase in protected users compared to Q3/2024. In India, attackers used WhatsApp to distribute trojans disguised as utility payment apps. Unfortunately, they left the database unsecured, allowing access to thousands of stolen victim credentials. <a href="https://www.avg.com/en/signal/what-is-spyware">Spyware</a> threats also surged, with SpyLoans campaigns causing spikes in several regions, despite law enforcement crackdowns. Furthermore, Crypto scams evolved further, with campaigns like CryptoCore leveraging high-profile events and deepfake technology to defraud victims of millions. The CryptoCore attackers targeted individuals through fake investment schemes tied to newsworthy subjects including the U.S. presidential election and Elon Musk announcements. These deepfakes and manipulated narratives enabled attackers to gain victims’ trust and convince them to transfer funds. This marked the attackers' largest campaign to date, stealing over $7 million in Q4/2024 alone.&nbsp;Scams remained widespread, demonstrating remarkable adaptability. Fake e-shops, for instance, were particularly active during Black Friday and Christmas, using poisoned search results, social media ads, and phishing emails to deceive shoppers. Beyond financial losses, these scams often led to compromised personal data, resulting in identity theft and financial fraud or long-term credit damage. Dating scams also gained momentum, particularly in Nordic countries, preying on individuals’ emotions and trust. Meanwhile, technical support scams surged in localized areas, such as Switzerland and Japan, with attackers adjusting their methods to align with local preferences and contexts. Malvertising continued to serve as a major vector for scams and malware, comprising 41% of all blocked attacks this quarter, the largest share of any single threat type.&nbsp;As we enter 2025, these findings highlight three critical areas that are evolving within the threat landscape: APTs and ransomware, scams and fraud, and attacks on AI systems and AI-driven attacks. Threat actors are constantly refining their tactics to exploit vulnerabilities, both human and technological, across each of these areas.&nbsp;Wishing you an enjoyable read and a safe year ahead in 2025, with security both online and off.&nbsp;Jakub Křoustek, Malware Research Director&nbsp;<h2 class="text-align-justify">Methodology&nbsp;</h2>This report is structured into three main sections: Desktop-related threats, where we detail our intelligence on attacks targeting the Windows, Linux and Mac operating systems, specifically emphasizing web-related threats; and Mobile-related threats, where we describe the attacks focusing on Android and iOS operating systems.&nbsp;We use the term “risk ratio” in this report to denote the severity of specific threats. It is calculated as a monthly average of the formula: “Number of attacked users / Number of active users in a given country.” Unless stated otherwise, risk ratios are only reported for countries with more than 10,000 active users per month.&nbsp;A blocked attack is defined as a unique combination of a protected user and a blocked threat identifier within a specified time frame.&nbsp;Our quarterly threat reports provide insights about the threat landscape as observed from the Gen family of Cyber Safety brands. We continuously improve our threat telemetry and anticipate further refinements in future reports.&nbsp;<h2 class="text-align-justify">Scams, Threats and Cybercrime&nbsp;</h2><h3 class="text-align-justify">A closer look at how cybercriminals target billions of people through social media platforms&nbsp;</h3>The world is evolving. Today’s threats have moved beyond malware, with new forms of scams arising daily, plaguing our digital world and aiming to defraud unsuspecting victims. The days of <a href="https://us.norton.com/blog/malware/what-is-a-trojan">trojans</a> and worms being the biggest security concerns for people online are gone. Make no mistake, these threats still exist and we need to remain protected against them, but today’s threats are far more dangerous, both technically and psychologically.&nbsp;&nbsp;Adding to this complexity is the rise of Artificial Intelligence (AI), which has recently become a game-changer for cybercriminals. AI-powered tools allow scammers to create highly convincing and adaptive attacks, from <a href="https://www.avast.com/c-deepfake">deepfake videos</a> and voice synthesis to personalized phishing messages crafted to deceive even the most cautious people. This technological edge makes today’s scams much more effective and harder to detect than ever before.&nbsp;One of the most dangerous playgrounds for today’s cybercriminals is social media. It encompasses a wide range of platforms, including traditional social media, video-sharing platforms and messaging apps. These platforms serve different purposes, from connecting friends to sharing content, and their demographics vary significantly.&nbsp;From a security perspective, it’s not just the platforms’ user content and functionality that make them unique, it’s also the nature of the attacks they attract. Each platform’s distinct features and audience shape the strategies cybercriminals use to exploit them. From phishing links on messaging apps to fake profiles on traditional social networks, the variety of scams reflects the diversity of the platforms themselves. In this article, we’ll take a look at these threats, specifically pertaining to Facebook, YouTube, Instagram, TikTok, X, LinkedIn and Messenger platforms.&nbsp;<h3 class="text-align-justify">The Latest in Social Scamming&nbsp;</h3>Scammers have found fertile ground in social media, exploiting their massive user bases and diverse functionalities to target unsuspecting individuals. One prominent example is the "<a href="https://www.gendigital.com/blog/insights/research/tiktok-elonmusk-scam" target="_blank" rel="noreferrer noopener">TikTok Elon Musk Scam</a>", where fraudsters impersonated the tech billionaire to promote fake cryptocurrency giveaways, enticing people to send funds with the promise of doubling their returns. Particularly, the sophistication of the impersonation made it effective, preying on Musk’s real-world influence and TikTok’s younger, tech-curious demographic. Meanwhile, fraudulent job offers have surged under the guise of "<a href="https://www.gendigital.com/blog/insights/research/part-time-job-scams" target="_blank" rel="noreferrer noopener">Part-Time Job Scams</a>", luring individuals with promises of easy income, but ultimately compromising personal information or demanding upfront payments.&nbsp;&nbsp;Another case, the "<a href="https://www.gendigital.com/blog/insights/research/how-a-skype-notification-turned-into-a-costly-lesson" target="_blank" rel="noreferrer noopener">Skype Notification Scam</a>", demonstrates how even old-fashioned messaging apps can lead people into costly traps, showcasing the many ways cybercriminals manipulate trust and digital habits. Additionally, phishing attacks often use social media to harvest account credentials, <a href="https://x.com/GenThreatLabs/status/1854565018177597786" target="_blank" rel="noreferrer noopener">spreading malicious campaigns</a> within the same ecosystem they exploit.&nbsp;However, beyond the specific stories and articles discussing the general risks and threats in social media,&nbsp;many questions remain unanswered. What are the chances of encountering an attack on social media? Which platforms are the most "dangerous"? What are the actual types of threats we can find there? Our researchers set out to answer these questions.&nbsp;<h3 class="text-align-justify">Threats Across Social Media&nbsp;</h3>When analyzing threats detected across social media platforms, Facebook emerges as the dominant source of detected threats, accounting for an alarming 56.19% of the total. YouTube follows with 25.92%, while platforms like X, Reddit, and Instagram contribute 6.91%, 4.65%, and 3.79%, respectively. The remaining threats are scattered across other platforms. This distribution highlights the disproportionate risk posed by some platforms due to their user base size, engagement patterns, and platform-specific characteristics.&nbsp;&nbsp;Interestingly, we have blocked six times more threats on Telegram than on WhatsApp, despite WhatsApp having a significantly larger user base. This aligns with previous observations, where scammers often redirect victims to continue conversations on Telegram, leveraging its unique features to further their schemes. The chart below provides a visualization of these figures, highlighting how cybercriminals capitalize on the distinct dynamics of each platform to target users effectively.&nbsp;

What are the threats that are targeting people on social media? There is a wide range, including:&nbsp;<ol><li data-list-item-id="e31126818e11f4585e82366f99c04454c">Malvertising (26.95%): Cybercriminals spread malware or redirects users to malicious websites through deceptive online advertising. These ads often distribute harmful content disguised as legitimate advertisements.&nbsp;</li><li data-list-item-id="eddb4370042e394a7ca45aa952e549c49">E-shop Scam (23.47%): Attackers create fake online shops (e-shops) to trick users into making purchases. Victims either receive counterfeit goods or nothing at all, losing money and potentially exposing personal data.&nbsp;</li><li data-list-item-id="e96fda58c10b594ed6498a6f57a864d7f">Phishing (18.07%): Scammers use deceptive messages, emails or websites to steal sensitive information such as credit card numbers, banking credentials or passwords. These campaigns often mimic legitimate communications.&nbsp;</li><li data-list-item-id="ebad5340ec63ff73035397e6442d9b8f0">Financial Scam (10.68%): Attackers trick people into giving money or sensitive financial information. Common examples include fake investment opportunities and fraudulent loan offers.&nbsp;</li><li data-list-item-id="e169afb1b4f16f0dce541e2baa85adf8e">Generic Scam (10.24%): This broad category includes scams where attackers aim to deceive victims into sharing personal information or money, without fitting into the more specific categories above.&nbsp;</li><li data-list-item-id="e1d30bd592f8ec3bb1958364e1e2a4164">Tech Scam (5.43%): Scammers impersonate legitimate technical support providers to gain access to victims' computers and data. These scams typically start with fake error messages or unsolicited calls offering help.&nbsp;</li><li data-list-item-id="e870a929dd5e196c363b0a15a8c03ae97">Dating Scam (2.93%): Cybercriminals establish fake romantic relationships to trick victims into sending money or sharing personal information, typically on dating platforms or social media using fake profiles.&nbsp;</li><li data-list-item-id="eb68415b3b462379c8544aa5d013bdf13">Others (2.24%): A collection of less common, but still significant, threat types that exploit social media in various ways.&nbsp;</li></ol>

These figures show the diverse strategies used by cybercriminals to exploit users on social media. <a href="https://us.norton.com/blog/malware/malvertising">Malvertising</a> remains the dominant threat at 26.95%, targeting large user bases with scalable attack methods within advertising ecosystems. E-shop scams, accounting for 23.47% of threats, reflect how attackers exploit shopping-centric platforms like Facebook and Instagram to take advantage of users’ trust and urgency during transactions. Phishing, at 18.07%, continues to deceive unsuspecting users into revealing sensitive information through deceptive links and messages. Financial scams (10.68%) and generic scams (10.24%) demonstrate the diversity of tactics cybercriminals employ to target victims.&nbsp;&nbsp;The last quarter of 2024 saw a spike in online shopping activity, and cybercriminals were quick to take advantage of the increased traffic. Platforms like Facebook and Instagram, which promote shopping through integrated features, saw a notable rise in e-shop scams during this period. The urgency of holiday deals and the allure of discounts create the perfect conditions for scammers to thrive.&nbsp;Each platform is unique, with different types of users and content shared, reflected in the threats that are prevalent in each one. Let’s take a closer look at the five social media with more threats detected.&nbsp;Facebook&nbsp;The high prevalence of e-shop <a href="https://lifelock.norton.com/learn/fraud/facebook-scams">scams on Facebook</a>, accounting for 26% of all threats, contrasts sharply with their lower representation on other platforms. This is largely due to Facebook’s Marketplace and its community-based interactions, which scammers exploit through fake listings and impersonated sellers. Unlike YouTube's ad-centric threats, Facebook's focus on local commerce and its older demographics makes it an ideal ground for e-shop scams, particularly targeting less tech-savvy users.&nbsp;YouTube&nbsp;Malvertising dominates YouTube, accounting for 54% of the platform’s threats. This is driven by YouTube’s platform’s ad-based revenue model, which scammers exploit to deliver malicious ads to a vast, engaged audience. Unlike Instagram’s visually curated content, YouTube’s reliance on long video engagement provides more opportunities for malicious ads to appear, making it a prime target for malvertising campaigns.&nbsp;X (formerly Twitter)&nbsp;The overwhelming prevalence of generic scams on X, making up 62% of blocked attacks, reflects the platform's open nature and lack of stringent verification. Unlike Reddit’s community-focused structure, X’s fast-paced environment and trending hashtags provide scammers with the opportunity to inject fraudulent content, such as cryptocurrency giveaways and donation scams, into high-visibility discussions.&nbsp;

Reddit&nbsp;Malvertising (66%) and phishing (29%) are the dominant threats on Reddit. Unlike Instagram’s shopping-centric scams, Reddit’s reliance on user-generated content creates opportunities for malicious actors to embed harmful links in posts and comments. The decentralized nature of Reddit communities amplifies these threats, as scammers target niche audiences with tailored phishing schemes.&nbsp;Instagram&nbsp;E-shop scams dominate Instagram, accounting for 42% of threats on the platform. Unlike YouTube’s ad-driven ecosystem, Instagram’s visual-first design and integrated shopping features make it a prime target for scammers. The ability to create polished, fake product galleries and targeted ads enables fraudulent e-commerce to thrive on the platform, particularly during seasonal shopping periods like Q4.&nbsp;<h3 class="text-align-justify">Conclusion&nbsp;</h3>Social media platforms have evolved into bustling hubs for interaction, commerce and entertainment. However, their growth has also created fertile ground for cybercriminals. The interplay platform-specific features and seasonal trends, such as Black Friday and Christmas shopping frenzies, highlights the adaptability of modern scams.&nbsp;Looking ahead, the evolving nature of cybercrime on social media calls for innovative and adaptive approaches to security. As platforms integrate more features and users continue to share more of their lives online, finding the right balance between functionality and safety will be crucial. Only through collaboration between platforms, users and security experts can the growing tide of digital threats be effectively countered.&nbsp;Luis Corrons, Security Evangelist&nbsp; Patrik Holop, Researcher<h2 class="text-align-justify">Desktop-Related Threats&nbsp;</h2><h3 class="text-align-justify">Advanced Persistent Threats (APTs): From Fake Interviews to Zero-Day Exploits&nbsp;</h3>An Advanced Persistent Threat (APT) is a type of cyberattack that is conducted by highly skilled and determined hackers who have the resources and expertise to penetrate a target's network and maintain a long-term presence undetected.&nbsp;This quarter, the Lazarus Group, a North Korean advanced persistent threat (APT) actor, continued their stream of attacks by integrating both established and novel malware into its infection chains. In Q4/2024, the group continued to target individuals using compromised archive files masquerading as skill assessment tests for IT professionals, spread by Lazarus through LinkedIn messages. Additionally, Lazarus continues to abuse GitHub repositories to deliver JavaScript-based infostealers and leverage zero-day vulnerabilities to deploy the next stage of the attack chain. One notable example involved a fake job offer shared via a LinkedIn message, which directed recipients to a malicious website “willointerview[.]com”. This campaign targeted young IT and cybersecurity professionals who were looking for work.&nbsp;&nbsp;

The infection sequence employed by Lazarus is intricate, utilizing multiple malware components to establish a foothold within targeted systems. Through our research, combined with insights from Kaspersky, we have identified a new downloader and loader named CookiePlus, which is capable of downloading malicious shellcodes and DLLs. We have also observed Lazarus reusing a loader from a previous campaign, referred to as RollMid.&nbsp;In another recent campaign, Lazarus targeted cryptocurrency investors by creating a fake multiplayer online battle arena game called detankzone (hosted at "detankzone[.]com"), which it claimed to incorporate both decentralized finance and non-fungible token features.&nbsp; The website of the detankzone game, appearing as a legitimate game, contained hidden scripts that exploited a zero-day vulnerability in Google Chrome (CVE-2024-4947), enabling remote code execution upon visiting the site. After the remote code execution, Lazarus used another exploit to bypass V8 sandboxing.&nbsp;

This campaign highlights the Lazarus Group's consistent use of advanced tactics, such as zero-day exploits and deceptive lures, to infiltrate systems and steal sensitive information. Their operations remain focused on targeting IT professionals and individuals employed by organizations of strategic interest to the attackers.&nbsp;Luigino Camastra, Malware Researcher&nbsp;<h2>Data-Stealing Threats: Scam-Yourself Attacks Continue to Enable Data Theft&nbsp;</h2>Data-Stealing Threats are dedicated to stealing anything of value from the victim’s device. Typically, they focus on stored credentials, cryptocurrencies, browser sessions/cookies, browser passwords and private documents.&nbsp;The fourth quarter of 2024 saw a number of good-news headlines in the world of cyber gang takedowns. One of the biggest stories was <a href="https://www.operation-magnus.com/" target="_blank" rel="noreferrer noopener">Operation Magnus</a>, a joint effort by the Dutch National Police, the FBI and other partners, resulting in the take down of RedLine and META information stealers.&nbsp;While the protectors saw success in taking down malicious actors, new data theft threats emerged. <a href="https://www.gendigital.com/blog/insights/research/glove-stealer" target="_blank" rel="noreferrer noopener">Glove Stealer</a> is a newly discovered information stealer written in .NET. In addition to stealing browser data (cookies, autofill information, etc.), it also heavily focuses on cryptocurrency wallets, 2FA authenticators, password managers, email clients, and other sensitive data. This stealer also follows the trend of bypassing App-Bound Encryption, introduced in Google Chrome, using the IElevator service bypass. Note that we described many existing bypasses for the App-Bound Encryption in the previous <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q3-2024" target="_blank" rel="noreferrer noopener">Q3/2024 report</a>.&nbsp;Furthermore, we continued to see many FakeCaptcha campaigns, distributing mostly information stealers and RATs. During Q4/2024, attackers introduced multiple <a href="https://x.com/GenThreatLabs/status/1854127111285375392" target="_blank" rel="noreferrer noopener">new adaptations</a> of well-known CAPTCHA designs, including CloudFlare.&nbsp;

Because of the high prevalence of ClickFix and FakeCaptcha campaigns (we will break down the statistics separately below), Gen introduced a brand-new <a href="https://www.gendigital.com/blog/news/family-of-brands/clipboard-protection" target="_blank" rel="noreferrer noopener">Clipboard Protection feature</a>, available in products across the Norton, Avast and AVG brands. This additional defense layer in our protection stack allows us to better address clipboard threats, including Scam-Yourself Attacks. Ultimately, this protection allows us to eradicate the threat before it even has the chance of being downloaded to the users’ systems.&nbsp;By analyzing content being copied from websites via FakeCaptcha scams, we <a href="https://www.gendigital.com/blog/insights/research/cybercriminals-leveraging-chatgpt-to-create-malicious-payloads" target="_blank" rel="noreferrer noopener">uncovered an attack chain</a> used for deploying the remote access trojan (RAT) NetSupport. This chain was orchestrated by a script iteratively developed by the attacker using ChatGPT. Findings like these not only highlight a growing trend of enabling low-skill actors to achieve high-impact outcomes, but they also prove that inventions like Clipboard Protection are key in helping make the world a safer place.&nbsp;ClearFake, one of the many notoriously known Fake Update actors, continued to <a href="https://x.com/GenThreatLabs/status/1849110244221243643" target="_blank" rel="noreferrer noopener">use ClickFix to deliver malware</a>. With the assistance of the EtherHiding technique for delivery, we observed the DarkGate information stealer with vast RAT capabilities being distributed.&nbsp;

Finally, in Q4/2024 we observed a 17% increase in the activity of AtomicStealer, also known as AMOS, one of the most advanced information stealers targeting macOS. This sophisticated malware is designed to steal a variety of personal information, enabling <a href="https://lifelock.norton.com/how-it-works/what-is-identity-theft">identity theft</a>, monetization of stolen data, and facilitating more targeted attacks. A rising trend for threats on this platform is the usage of PyInstallers. These provide a way of executing Python scripts even on devices with no Python installed, effectively simplifying the malware distribution.&nbsp;<h3 class="text-align-justify">Statistics&nbsp;</h3>We happily reported a significant 60% decrease in detections of Lumma Stealer in Q4/2024. This was a welcomed break following the previous quarter where Lumma Stealer spiked dramatically and increased its malware share by massive 1154% with data-stealing malware increasing in risk ratio by 32% in general. Additionally, after the aforementioned Operation Magnus, RedLine and META stealers ceased to operate. Even though it might seem like data theft is cooling in terms of the sheer numbers, we need to have a closer look at the threat landscape to understand the changes better.&nbsp;According to our data and estimations, the decrease of Lumma Stealer and thus information stealer activity overall is due to the protection against typical distribution methods for information stealers, including FakeCaptcha. This is further supported by introducing Clipboard Protection feature to our products. This naturally influences our statistics because we completely eliminate the delivery method at its very origin and thus sooner than the final payload would be delivered to infect the victims’ systems.&nbsp;As described in the previous quarter’s featured story, Scam-Yourself Attacks, such as ClickFix and FakeCaptcha, have taken off, launching massive campaigns all around the world. This trend continued in Q4/2024, where we protected more than 4.2M unique users against FakeCaptcha attacks. The risk ratio of encountering FakeCaptcha scams increased by +130% compared to the previous quarter.&nbsp;

The highest risk ratio of stumbling upon FakeCaptcha was in the Balkan states, including:&nbsp;<ul><li data-list-item-id="ee8ea2af425dc969e6ad57600c6c9259e">Montenegro (9.76%)&nbsp;</li><li data-list-item-id="e073a2a102ad07392e5b8346739be7dd2">Serbia (8.94%)&nbsp;</li><li data-list-item-id="e3d965a45ff11b93666acbc026f085683">North Macedonia (8.92%)&nbsp;</li><li data-list-item-id="ebb4d8bd936acac6eca1d461834049503">Kosovo (8.51%)&nbsp;</li></ul>Other countries with a high-risk ratio were:&nbsp;<ul><li data-list-item-id="ed7d34dc6cdfcb1ec8ac48266ef4412ec">Egypt (8.31%)&nbsp;</li><li data-list-item-id="ef95c775b47ca25285a2d2f976dfb5019">The Philippines (5.14%)&nbsp;</li><li data-list-item-id="e4c06c7f78104d6807a579035867bee4c">Argentina (2.91%)&nbsp;</li><li data-list-item-id="ec23afbdc7f6598cc926bbc4074a0b55b">Spain (2.17%)&nbsp;</li><li data-list-item-id="e733895e4271561057b66fca0be45555e">Italy (2.66%)&nbsp;</li><li data-list-item-id="e8a9f30048bd1d1b6160e48cd15354760">India (1.69%)&nbsp;</li><li data-list-item-id="e2a730fea4fd7f37569db2f0166844d88">Brazil (1.13%)&nbsp;</li><li data-list-item-id="ea93537f47ebed0d510980ad5b10b8737">France (1.15%)&nbsp;</li></ul>Compared to the previous quarter, the overall risk ratio for information stealers decreased by 32% in Q4/2024.&nbsp;

Conversely, the risk ratio in Indonesia experienced a slight increase of 1.53%, while in Turkey, the risk ratio increased by 10%.&nbsp;

After losing 60% of its malware share, Lumma Stealer is, according to our data, in the second place in terms of information stealer share behind AgentTesla. However, AgentTesla also lost some presence, decreasing its malware share by 9%.&nbsp; Because of this shift in proportion, every other information stealer increased its malware share in Q4/2024. One of them stands out, however, as MassLogger increased its malware share by massive 437%, ranking amongst the top 10 stealers now.&nbsp;The most common information stealers with their malware shares in Q4/2024 were:&nbsp;<ul><li data-list-item-id="e9036f6974855490f21b73e707360cde7">AgentTesla (16%)&nbsp;</li><li data-list-item-id="ef8d6cab6fcacca735420291345d55700">Lumma (12%)&nbsp;</li><li data-list-item-id="e705383a6e3337870fa9f8c2f06e11941">FormBook (12%)&nbsp;</li><li data-list-item-id="e8f9ce1c56e2743f5d67d8dece83e9a3e">Ramnit (11%)&nbsp;</li><li data-list-item-id="e6b1f551f866e7e7a0def83ca95e6c543">Fareit (7%)&nbsp;</li><li data-list-item-id="eccfa020dff7fdfad6da4859f3a09c215">SnakeKeylogger (5%)&nbsp;</li><li data-list-item-id="e81948226ff969a4fab4a91b45be2e8c9">MassLogger (4%)&nbsp;</li><li data-list-item-id="eb1b1b784d3816d4d17112fc05e22fcc5">Vidar (3%)&nbsp;</li><li data-list-item-id="e4222124656116c55b5e53e123944cb8e">Lokibot (2%)&nbsp;</li><li data-list-item-id="e2561587784086dcbe1ee0159db6bfaa6">ViperSoftX (2%)&nbsp;</li></ul><h2 class="text-align-justify">Ransomware: Third Consecutive Quarter of Growth&nbsp;</h2>Ransomware is any type of extorting malware. The most common subtype is the one that encrypts documents, photos, videos, databases, and other files on the victim’s PC. Those files become unusable without decrypting them first. To decrypt the files, attackers demand money, “ransom”, hence the term ransomware.&nbsp;LockBit, one of the biggest players in the ransomware scene, went through some interesting changes in the latter half of 2024, with a significant decrease in the number of (published) attacks over the last 6 months:&nbsp;

Furthermore, the U.S. Department of Justice <a href="https://www.justice.gov/usao-nj/pr/us-charges-dual-russian-and-israeli-national-developer-lockbit-ransomware-group" target="_blank" rel="noreferrer noopener">announced</a> that they officially charged Rostislav Panev, a LockBit malware developer who was arrested in Israel and is currently awaiting extradition to the USA.&nbsp;&nbsp;

Panev was a key part of the LockBit gang, contributing to their path of destruction which has included attacking children’s hospitals amongst other organizations across industries. It seems, though, that the rest of LockBit has moved on from Panev after announcing that an updated version – LockBit 4.0 - is expected to launch in February.&nbsp;

<h3>Trigona Reemerges with Deceptive Strategy&nbsp;&nbsp;</h3>Trigona ransomware resurfaced in the summer of 2024, but this time with a change in tactics designed to hide its identity. Earlier attacks referenced their own leak site, but recent ransom notes avoid mentioning it altogether. Instead, they point to leak sites belonging to other ransomware groups such as KillSec, Hunters, and DragonForce. However, our analysis has not found any evidence of Trigona victims appearing on these other leak sites, making it unlikely that these groups are actually collaborating. The ransomware group also uses a slightly modified cryptor, which led to it being misclassified as part of a different malware family. Analysis of configuration data inside the binary files confirmed that it is the same Trigona ransomware with some adjustments. This new approach has been observed since June 2024, with additional samples appearing throughout the remainder of the year.&nbsp;

<h3 class="text-align-justify">Statistics&nbsp;</h3>For the third consecutive quarter, ransomware has continued its alarming upward trend, with a notable 50% increase in Q4/2024. This follows a staggering 100% rise in Q3/2024 and a 24% jump in Q2/2024. The sustained growth in ransomware activity highlights an ongoing, escalating threat to both individuals and organizations globally.&nbsp;According to our telemetry, Magniber is still the most prevalent ransomware (62% of malware share). Its high counts come from the <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q3-2024" target="_blank" rel="noreferrer noopener">previous quarter</a>:&nbsp;

Countries with the highest increases in risk ratio are in South America, including:&nbsp;<ul><li data-list-item-id="eccded537cd85a1578393a7876874dce4">Colombia (+400%)&nbsp;</li><li data-list-item-id="e4d33b3109b627b8ab5d6a3bfb2309d11">Uruguay (+400%)&nbsp;</li><li data-list-item-id="e0f682a6d6254d02e5755d6f8766eda36">Brazil (+370%)&nbsp;</li><li data-list-item-id="e4618706afd3adc6f188d6091d7028133">Argentina (+300%)&nbsp;</li><li data-list-item-id="eacbff3679734906857954e97d449563a">Venezuela (+290%)&nbsp;</li><li data-list-item-id="ed4633475e09b0fa012a61daec2017776">Peru (+270%)&nbsp;</li></ul>Risk ratios also increased in Mexico (+230%), Japan (+180%), Austria (+100%), France (+100%), and Canada (+100%).&nbsp;Absolute risk ratios per country are depicted in the following map:&nbsp;

Ladislav Zezula, Malware Researcher&nbsp; Samuel Vojtáš, Malware Researcher&nbsp; Jakub Křoustek, Malware Research Director&nbsp;<h2>Remote Access Trojans (RATs): Remcos Slowing Down&nbsp;</h2>A Remote Access Trojan (RAT) is a type of malicious software that allows unauthorized individuals to gain remote control over a victim's computer or device. RATs are typically spread through social engineering techniques, such as phishing emails or infected file downloads. Once installed, RATs grant the attacker complete access to the victim's device, enabling them to execute various malicious activities, such as spying, data theft, remote surveillance and even taking control of the victim's webcam and microphone.&nbsp;After a substantial increase in Q3/2024, the activity level of RATs remained consistent throughout Q4/2024. Interestingly compared to what we have seen in previous years, this year there was seemingly no decrease in RAT prevalence towards the end of the year.&nbsp;

Countries with the largest increases in risk ratio were:&nbsp;<ul><li data-list-item-id="e04472feff67e1684041d5dfa46b86fa0">Algeria +37% (mostly driven by HWorm and njRAT)&nbsp;</li><li data-list-item-id="e2a24abc65a3b09a9b63793418997b834">Belgium +33% (AsyncRat, Remcos)&nbsp;</li><li data-list-item-id="e3f41d53276039dceee02d2cce4c2c5b3">Netherlands +29% (Remcos, QuasarRAT)&nbsp;</li></ul>Largest decreases in risk ratio:&nbsp;<ul><li data-list-item-id="e99ac92e86998c20161cab8e6b8fc8a02">Czechia -35%&nbsp;</li><li data-list-item-id="e13fb64f35289e4f1aacc864c62c73e8f">Hungary -31%&nbsp;</li><li data-list-item-id="e3fe2f93937ed97bd87454edc0fdaab72">Romania -25%&nbsp;</li></ul>The list of safest countries includes France, Sweden and Japan. France and Sweden kept their place among the top 3 countries least impacted by RATs from Q3/2024.&nbsp;

QuasarRAT saw its malware share surge by over 70%, with Turkey, Bulgaria, and Egypt being the most affected countries. Other strains, such as NanoCore and DarkComet, also experienced significant gains, each rising by approximately 30%.&nbsp;We have seen Remcos decrease in activity mostly in Europe, the United States and Canada losing some of its malware share to other strains in Q4/2024. However, Remcos remains the top strain globally in terms of overall share. Additionally, Remcos has been recently updated to version 6.0 - new features are aimed at operators, mostly simplifying the organization of remote (infected) computers. The update also contains some minor bug fixes. From a defender's perspective, the changes are not significant.&nbsp;In the Q3/2024 report, we observed that the online shop which previously sold the XWorm RAT had gone inactive. As far as we can tell, it has not been replaced with another one. We also have not seen a more recent version of XWorm following 5.6 which launched in September 2024 and was the last to be advertised on the now defunct site. However, XWorm is not slowing down as its activity remains at approximately the same level as in the previous quarter.&nbsp;Lesser known RATs are also making their mark, with the FBI issuing a warning regardingHiatusRAT at the end of 2024. Threat actors have been scanning web cameras and DVRs for vulnerabilities using HiatusRAT. Targeted vulnerabilities include CVE-2017-7921, CVE-2018-9995, CVE-2020-25078, CVE-2021-33044 and CVE-2021-36260. While HiatusRAT is not a new threat, being first discovered in early 2023, this warning serves as a reminder of the importance of regularly updating all connected devices, especially those often overlooked like web cameras and DVRs.&nbsp;

Ondřej Mokoš, Malware Researcher<h2>Vulnerabilities and Exploits: Chained Exploits and Sandbox Escapes &nbsp;</h2>Exploits take advantage of flaws in legitimate software to perform actions that should not be allowed. They are typically categorized into remote code execution (RCE) exploits, which allow attackers to infect another machine, and local privilege escalation (LPE) exploits, which allow attackers to take more control of a partially infected machine.&nbsp;In Q4, two significant local privilege escalation vulnerabilities in Windows were discovered to be actively exploited in the wild. These vulnerabilities underscore the need for robust sandboxing mechanisms. Additionally, recent findings have linked some of these exploits to advanced threat actors, further emphasizing the sophistication of modern cyberattacks.&nbsp;The first vulnerability, CVE-2024-49138, was found in the Windows Common Log File System Driver (CLFS.sys) and reported by CrowdStrike. This vulnerability allowed attackers to escalate their privileges, potentially compromising system security. While CrowdStrike did not provide specific details about the nature of the vulnerability or the identity of the actors exploiting it, the fact that it targeted a core Windows driver underscores its severity.&nbsp;&nbsp;Google reported the second vulnerability, identified as CVE-2024-49039, which involved an escape from the Windows AppContainer sandbox. This security feature in Windows is designed to provide a sandboxed environment for applications, running them with minimal privileges to isolate them from critical system components and each other, thereby reducing the risk of malware or malicious behavior affecting the broader system. However, this vulnerability allowed a low-privileged user to execute code at a medium integrity level, effectively bypassing AppContainer's protections. The discovery of this vulnerability underscores the ongoing challenges in maintaining robust application isolation.&nbsp;ESET later discovered that CVE-2024-49039 was being exploited in the wild. Attackers were observed chaining this vulnerability with a remote code execution flaw in Firefox, identified as CVE-2024-9680. According to ESET’s analysis, the attackers leveraged CVE-2024-49039 to escape the sandbox from the untrusted process level of Firefox’s content process to a medium integrity level. This chain of exploits demonstrates the sophistication of modern attacks, where multiple vulnerabilities are combined to achieve a specific goal.&nbsp;The technical details of CVE-2024-49039 reveal that the vulnerability relied on calling functions from an undocumented Remote Procedure Call (RPC) endpoint. This endpoint allowed the creation of a scheduled task, a function that should not have been callable from the untrusted process level. By exploiting this flaw, attackers were able to create a scheduled task that executed arbitrary applications at a medium integrity level. This action enabled them to elevate their privileges on the system and break out of the sandbox, effectively bypassing the intended security boundaries of the AppContainer.&nbsp;Adding to this complexity, ESET researchers uncovered a previously unknown vulnerability in Mozilla products that was being exploited in the wild by the Russia-aligned group RomCom. This marks at least the second time that RomCom has been caught exploiting a significant zero-day vulnerability in the wild. Earlier in June 2023, RomCom was linked to the exploitation of CVE-2023-36884 through Microsoft Word. The group’s involvement in exploiting CVE-2024-49039 highlights their capability to adapt and weaponize zero-day vulnerabilities for targeted attacks.&nbsp;The exploitation of these vulnerabilities underscores the importance of continuous monitoring and improvement in security mechanisms. The chaining of CVE-2024-49039 with CVE-2024-9680, along with RomCom’s exploitation of Mozilla products, illustrates how advanced threat actors can combine weaknesses in different components to achieve their objectives. Addressing such threats requires a multi-faceted approach, including rigorous patching practices, comprehensive vulnerability assessments, and robust application isolation mechanisms.&nbsp;In Q4/2024, we continued evaluating the main exploitation and post-exploitation frameworks targeting our users. While our telemetry indicated that the use of frameworks was on a downward trend for this quarter, Cobalt Strike was again the most prevalent strain, occupying 31% of the hits in this category.&nbsp;

To confirm whether the downward trend that marked this quarter is temporary or significative in time, we will continue to evaluate and monitor the evolution of the exploitation and post-exploitation frameworks in Q1/2025.&nbsp;&nbsp;Luigino Camastra, Malware Researcher&nbsp; David Álvarez, Malware Analyst&nbsp; Michal Salát, Threat Intelligence Director&nbsp;<h2 class="text-align-justify">Web Threats&nbsp;</h2>Web threats remain a key focus for our analysts, encompassing numerous sub-categories of scams. Despite attackers continuously introducing modified variations of old scams, the overall downward trend towards the end of the year persisted. The last quarter of the year saw an even further decline, with a 13% drop compared to Q3/2024. This decline was observed in most countries, although there are some exceptions, which we will cover later in the text.&nbsp;<h2 class="text-align-justify">Scams: A Worldwide Challenge&nbsp;</h2>A scam is a type of threat that aims to trick people into giving an attacker their personal information or money. We track diverse types of scams which are listed below.&nbsp;Despite a downward trend, we observe that certain detections have increased compared to the previous quarter. These detections primarily highlight the main reason for the success of today's scam threats: malvertising.&nbsp;For our regular readers, the concept of malvertising is well-known. However, it’s worth reiterating that the key factor in malvertising is its ability to target specific audiences. When advertisements are presented on social networks, for example, this targeting can be particularly effective because these platforms have access to more accurate and comprehensive user data. Additionally, many users perceive these platforms as safe, which can result in reduced awareness of potential threats. For example, our data indicates that some blocked scams originate from users who have been redirected from Meta's social networks.&nbsp;

In the below screenshot, you can see a notorious landing page. This illustration nicely shows the type of page to which users are redirected by some ads, sometimes resembling a tabloid article. This particular example is a financial scam. The right side of the screenshot shows another way such scams are spread: through push notifications, an increasing threat which we’ve highlighted in numerous reports and blogs. The screenshot also shows that this is a financial scam.&nbsp;

If we take a closer look at the chart below, Q4/2024 was the most active quarter for financial scams in 2024.&nbsp;

Financial scams come in many different packages; this constantly recycled social engineering attack can be presented to people, for example, with a narrative of weight loss advice or as medical scams – the ways in which scammers entice their victims is almost endless.&nbsp;If you look at the global heat map, you’ll see there is almost no place in the world that is not impacted by scams as 2024 comes to an end.&nbsp;&nbsp;

When examining the areas with highest chance of encountering a scam, Slovakia stands out with a risk ratio of 21.30%, although it experienced a slight decrease of 2% compared to the previous quarter. Vietnam follows closely with a risk ratio of 20.69%, showing a significant increase of 6%. Meanwhile, Czechia has a risk ratio of 19.87%, also seeing a 2% decrease from the previous quarter.&nbsp;Beyond the list of countries with the highest risk, several other countries experienced significant quarter-over-quarter changes. South Korea saw the most substantial increase, with a 20% increase to a final risk ratio of 7.51%. Australia also experienced a notable rise, with a risk ratio of 15.24%, increasing by 6%. The United Kingdom saw a significant increase, with a risk ratio of 14.26%, up by 3%.&nbsp;<h3 class="text-align-justify">CryptoCore Exploits U.S. Election and Elon Musk's Statements – $7M Stolen&nbsp;</h3>A crypto scam is a cyber threat designed to trick individuals into surrendering their cryptocurrency. These scams exploit the anonymity and irreversibility of blockchain transactions, often targeting those with a limited understanding of how cryptocurrency works.&nbsp;The <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/" target="_blank" rel="noreferrer noopener">CryptoCore scam group</a> continued its operations in Q4/2024 with the same modus operandi of abusing high-profile events in the media, luring victims with promises of easy profits using deepfake videos. These attackers also leverage statements and actions by Elon Musk to make their scams appear more legitimate. In Q4/2024, their primary focus, as expected, was the U.S. presidential elections, further amplified by the involvement of Elon Musk.&nbsp;

The CryptoCore activity around the presidential election increased throughout October. The highest threat peak was on November 9, 2024, when Donald Trump won the presidential election in Arizona, completing a clean sweep of all seven battleground states and locking in a decisive electoral college victory over the Democratic Vice President Kamala Harris.&nbsp;If we compare the activities of CryptoCore across 2024, the presidential campaign was the most dangerous since we began <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/" target="_blank" rel="noreferrer noopener">tracking the group</a>. The presidential campaign was even more significant than the highly destructive campaigns abusing the topics of the total solar eclipse and SpaceX flight.&nbsp;

The United States remains the country most affected by CryptoCore Scams, followed by the United Kingdom and Germany.&nbsp;&nbsp;

The deepfake videos used as CryptoCore lures used messages emphasizing Donald Trump as a visionary leader who understands innovation and the future of finance, particularly cryptocurrency. They claimed that Trump supports a platform for doubling cryptocurrency investments, presenting it as part of his vision for empowering individuals and revolutionizing financial systems. These scams touted Trump as an advocate for blockchain technology, cryptocurrency adoption, and deregulation to legitimize the fraudulent scheme.&nbsp;&nbsp;

Victims are targeted through hijacked YouTube accounts, which prioritize attackers' videos in search results using specific keywords. These videos typically contain a QR code, which redirects the victim to a well-designed fraudulent website featuring motifs of Elon Musk and Donald Trump.&nbsp;

As CryptoCore's activities escalated dramatically throughout the quarter, and our telemetry captured 3,500 cryptocurrency transactions linked to 500 crypto wallets with a total value of an estimated $7,000,000 in October through December alone. While this figure is a rough estimate, the actual amount could be higher, given the complexity of tracking illicit crypto wallets and abused platforms. Additionally, the sharp rise in the value of most cryptocurrencies used by CryptoCore has significantly increased the group's overall profit in this quarter.&nbsp;

An interesting event exploited by the attackers in Q4/2024 was Elon Musk's promise of a $1 million giveaway per day during the presidential election. Musk's himself added credibility to the CryptoCore scam, because if a real Musk is handing out <a href="https://www.vox.com/politics/378912/musk-trump-voting-contest-million-dollars-swing-state-lottery-pennsylvania" target="_blank" rel="noreferrer noopener">$1 million checks daily</a>, why couldn’t his "official event" be giving away hundreds of thousands in cryptocurrency? The attackers quickly seized the opportunity, creating a fake video based on the official giveaway event. This demonstrates how adept the attackers are at abusing media events to mislead people.&nbsp;We will repeat ourselves again: Always verify the legitimacy of such claims through official channels and avoid making any financial transactions without confirming the offer's authenticity.&nbsp;If it sounds too good to be true, it probably is.&nbsp;<h3 class="text-align-justify">Dating Scams: Love's Illusion&nbsp;</h3>Dating scams, also known as romance scams or online dating scams, involve fraudsters deceiving individuals into fake romantic relationships. Scammers adopt fake online identities to gain the victim's trust, with the ultimate goal of obtaining money or enough personal information to commit identity theft.&nbsp;When examining the risk ratios for dating scams, several countries have shown significant quarter-over-quarter changes. Iceland experienced the largest increase, with a risk ratio of 5.37%, up by 51%. This substantial rise indicates a growing concern for dating scams in the region.&nbsp;

Hungary and Czechia both saw notable increases of 7%, with risk ratios of 4.42% and 3.98%, respectively. Belgium also experienced a significant rise, with a risk ratio of 3.67%, up by 5%.&nbsp;&nbsp;In contrast, Germany and Norway had minimal changes in their risk ratios, with Germany remaining stable at 4.28% and Norway seeing a slight increase to 4.26%.&nbsp;

Overall, these statistics underscore the varying impact of dating scams across different regions.&nbsp;

<h3 class="text-align-justify">Tech Support Scams: Deceptive Assistance&nbsp;</h3>Tech support scam threats involve fraudsters posing as legitimate technical support representatives who attempt to gain remote access to victims' devices or obtain sensitive personal information, such as credit card or banking details. These scams rely on confidence tricks to gain victims' trust and often involve convincing them to pay for unnecessary services or purchase expensive gift cards. It's important for internet users to be vigilant and to verify the credentials of anyone claiming to offer technical support services.&nbsp;Japan remains a top target for tech support scams, with a risk ratio of 1.51%, up 14% from the previous quarter.&nbsp;

However, the most significant surge in tech support scams this quarter has been observed in Switzerland, where the risk ratio skyrocketed by 114% to 1.05%. This dramatic increase highlights a new hotspot for these scams.&nbsp;Austria also experienced a substantial rise, with a risk ratio of 1.06%, up by 68%. Similarly, Hong Kong saw a 43% increase, bringing its risk ratio to 0.96%, and Canada recorded a 35% rise, reaching a risk ratio of 0.80%.&nbsp;France continues to be a notable target, with a risk ratio of 1.07%, reflecting a 22% increase from the previous quarter.&nbsp;&nbsp;

Overall, while Japan remains a consistent hotspot, the significant increases in Switzerland, Austria, Hong Kong, Canada, and France indicate a broader and more dynamic threat landscape for tech support scams.&nbsp;

<h3>Email Threats: Unwrapping Christmas Email Scams&nbsp;</h3>The Email threats section tends to cover a wide range of scams targeting almost anyone with an email address. These scams take various forms, including fake invoices designed to mimic legitimate brands and trick recipients into making payments to the attackers. Extortion emails attempt to coerce victims into sending cryptocurrency by falsely claiming to have recorded compromising webcam footage. Lottery scams lure users to websites that offer deals too good to be true, while classic phishing emails falsely inform recipients that their password has expired in an attempt to steal credentials. This section will explore the common email scams that can land in your inbox and the tactics used by cybercriminals to exploit unsuspecting users.&nbsp;Christmas is always a fruitful period, not only for retailers but also for malicious actors. Regarding <a href="https://us.norton.com/blog/online-scams/phishing-email-examples">email scams</a>, the threat intensity remains relatively constant throughout the last quarter of 2024, maintaining a steady threat level. The only notable spike occurs in the weeks preceding Christmas, followed by a slight uptrend toward the end of the year. Attackers take advantage of this period to amplify their efforts, primarily because the end of the year is stressful for many people. As a result, individuals often let their guard down when checking their mailboxes, making them more susceptible to scams. This targeted approach likely makes attackers’ efforts more effective.&nbsp;&nbsp;

As shown on the below map, the red glow is most significant in North America, indicating that the United States and Canada are most affected by email scams. These countries also experienced a notable quarterly increase of 13%. Australia follows this trend closely, with a 10% quarterly rise. The Benelux countries also reported substantial numbers, reflecting high risk ratios. Furthermore, South Africa, France, and the United Kingdom have been significantly impacted.&nbsp;

Apple is one of the most targeted brands by email scams, notably iCloud. The reason for this is simple: scammers aim to exploit services that the majority of users rely on. By using notable cloud providers like Microsoft 365 or Google Drive, they increase their chances of success. The example shown below claims that users will lose their cherished data, incorporating a few prominent red flags. Below are three obvious key red flags in the email:&nbsp;<ol><li data-list-item-id="e157ae5c3e23b65c8dcd1f89b741d9328">Suspicious Email Address - The sender's email address (no-reply@781[.]qebsjbg...) does not match Apple's official domain (e.g., @apple.com or @icloud.com). A legitimate company like Apple always uses its verified domain.&nbsp;</li><li data-list-item-id="ebdfec9b62e1b23f02609258cf177a459">Urgent and Threating language - The subject line and content use panic-inducing phrases like "LAST ALERT: ALL YOUR PHOTOS WILL BE DELETED!" and "Your photos and videos will be deleted!!". Scammers often use fear to pressure victims into acting quickly without verifying details.&nbsp;</li><li data-list-item-id="e7c7e66a55a433e1cdba30f22b2cee308">Poor Grammar - The phrase "Failed to attempt payment" is grammatically incorrect. Professional emails from Apple or any major company are carefully crafted and free of errors. Additionally, the design feels inconsistent, with mismatched fonts, overly bright colors (e.g., "FULL" in red), and unpolished presentation.&nbsp;</li></ol>

Furthermore, the email code reveals additional issues that are not immediately apparent.&nbsp;<ol start="4"><li data-list-item-id="e986b98e843a8720ead0168f64f014827">DKIM Signature Failure - The DKIM signature in the email headers shows an error: dkim=permerror (no key for signature) and the domain 602.qunipameoxsp.us is not a verified or trusted sender. This suggests the email's integrity cannot be verified, which is a common sign of phishing emails.&nbsp;</li><li data-list-item-id="e80c0aef64b6d627ab03401437915fd74">Malformed Links - The hyperlink in the code (&lt;a href="https://storage[.]googleapis[.]com/loblaman996655/lobla.html#..."&gt;) redirects to a Google storage link instead of an Apple domain. Legitimate companies do not host critical account-related actions on third-party services like Google Storage.&nbsp;</li><li data-list-item-id="e4fc9e319355b8d78831df8002483348d">Excessive Inline Styling and Obfuscation - The email contains overly complex and excessive inline CSS, such as numerous gradient styles and unnecessary hover effects (e.g., .divv:hover, .ligne:hover). These are often used by scammers to disguise malicious content and create a more "professional" appearance.&nbsp;</li></ol>This quarter, we conducted a deeper analysis of the scams our customers receive in their email inboxes. From a collection of malicious emails that we analyzed, we assessed the type of scams using the AI scam type classifiers based on the email displayed to the customer.&nbsp;&nbsp;Interestingly, the most prevalent type of scam was the e-shop scam, where the attackers try to lure people to fake shopping websites. These sites either take payments and never deliver the goods or collect data from users to sell or exploit in other ways. E-shop scams accounted for 51% of all scam emails in Q4/2024.&nbsp;

The second most prevalent category was gambling scams, where attackers trick people into placing bets on fake gambling platforms but refuse to pay out winnings. The third most prevalent category was investment scams, where attackers advertise fake investments promising high returns or guaranteed profits in stocks, forex, property, cryptocurrencies and other assets. Finally, the fourth category was political scams, where attackers take advantage of campaigns and elec21tions to scam people, for example by convincing them to contribute to fake campaigns.&nbsp;&nbsp;&nbsp;The statistics above represent the view for the whole quarter, however, towards the end of 2024, investment scams were on the rise and, in the last days of the year, there 15-25% of the daily analyzed samples were classified as investment scams.&nbsp;&nbsp;

A good example of an investment scam is displayed below. The scam in this case is luring people to click on the link to reveal the name of the cryptocurrency that is going to increase 150 times in the future. This is a common tactic used in scam emails, as the user can be redirected directly to a malicious website or asked to register and transfer funds that would never be retrieved.&nbsp;&nbsp;

<h3>Hidden Dangers of Fake E-Shops: Financial and Health Risks&nbsp;</h3>Fake shop scams involve fraudsters creating imitation online stores that appear legitimate and trustworthy. These fake shops often mimic well-known brands or use professional-looking websites to deceive customers. Victims are lured into making purchases, believing they are buying genuine products. However, the goods never arrive after payment or are of inferior quality.&nbsp;Fake e-shops, also known as scam shopping websites, pose significant consumer risks. A particularly alarming risk is to victim´s financial and physical health. Fake e-shops selling medications, supplements, or other health-related products may distribute unregulated or counterfeit drugs, which can be extremely dangerous. Additionally, falling victim to these scams often leads to financial losses and identity theft.&nbsp;The largest category of fake e-shops consists of stores selling clothing and pharmaceuticals. In terms of medications, the most requested products are drugs for male erectile dysfunction, which require a prescription. Using these medications without consulting a doctor can lead to serious health complications. Moreover, the origin of these drugs is uncertain, and they may be faked substitutes with dangerous side effects.&nbsp;The detected e-shops have been flagged as malicious due to several warning signs, such as the absence of a cookies consent popup, offering huge discounts, lack of clear contact information, and offering suspicious payment methods.&nbsp;&nbsp;

The payment gateways of fake e-shops are typically hosted on separate domains with valid certificates signed by untrustworthy certification authorities. Therefore, it isn't easy to immediately recognize that sensitive data is in danger since the certificate is valid from a technical perspective. However, this ensures the victim's data is securely delivered directly to the attackers. Additionally, the attackers often enhance the legitimacy of secure data transfer by using logos of reputable security companies.&nbsp;

Victims typically end up on fraudulent websites by searching for specific medications, often prescription drugs, and encountering fake sites offering enticingly low prices among the search results. Another standard method to distribute fake e-shops is through advertisements on Facebook, YouTube, and Instagram, amongst other platforms. Finally, the third most frequent method is through unsolicited emails and spam.&nbsp;In Q4/2024, we observed an increase in the activity of fake e-shops, which is an expected phenomenon during the holiday season as people are looking for attractive discounts and offers. The correlation between high-profile sales events, such as Black Friday and Christmas shopping, and the increase in scam incidents underscores the danger of online fraud during peak shopping seasons.&nbsp;

The dangers of fake e-shops go beyond financial loss. These sites can compromise personal data, leading to identity theft, unauthorized transactions, and long-term damage to credit scores. Recognizing the signs of a fake e-shop and understanding the risks involved are crucial for safe online shopping.&nbsp;<h3 class="text-align-justify">Phishing: A Year in Review&nbsp;</h3>Phishing is a type of online scam where fraudsters attempt to obtain sensitive information including passwords or credit card details by posing as a trustworthy entity in an electronic communication, such as an email, text message, or instant message. The fraudulent message usually contains a link to a fake website that looks like the real one, where the victim is asked to enter their sensitive information.&nbsp;In Q4/2024, we protected 14% more users against <a href="https://www.avg.com/en/signal/what-is-phishing">phishing</a> than in the previous quarter. Our data shows a diverse range of phishing activities, with some abused brands experiencing substantial increases in phishing attempts.&nbsp;

Let’s start with phishing attempts targeting Amazon. We saw a dramatic increase, with a malware share of 2.42%, up by 509% from the previous quarter. This surge highlights the growing exploitation of Amazon's brand to lure unsuspecting users. Some of this increase could also be related to attackers trying to take advantage of discount shoppers, which tends to be higher towards the end of the year.&nbsp;Despite a slight decrease of 1% in phishing activity for the brand, Microsoft remains a common target, with a malware share of 0.99%. This indicates a persistent threat level for users of Microsoft services.&nbsp;Phishing attempts targeting Facebook increased by 36%, resulting in a malware share of 0.68%.&nbsp;Financial institutions continue to be prime targets, with phishing attempts particularly for Chase increasing by 295%, leading to a malware share of 0.52%.&nbsp;&nbsp;The most notable increase in brands imitated for phishing purposes was observed with Wix, which saw an astounding 2840% rise in phishing activity, resulting in a malware share of 0.39%. This spike indicates a new focus on exploiting website-building platforms. We observed similar behavior last year with Weebly, but this time, Wix is the primary target.&nbsp;

Phishing attempts on Netflix also saw a substantial increase, with a 375% rise, leading to a malware share of 0.12%.&nbsp;&nbsp;Alexej Savčin, Malware Analyst&nbsp; Branislav Bošanský, Scientist&nbsp; Martin Chlumecký, Malware Research&nbsp;&nbsp; Matěj Krčma, Malware Analyst&nbsp; Nikola Groverová, Data Scientist&nbsp;<h2 class="text-align-justify">Mobile-Related Threats&nbsp;</h2>Mobile threats continues their evolution in Q4/2024 with several new strains and updates to existing ones. MobiDash adware made a resurgence fueled by a new Facebook campaign, distributing the ad-ridden threat to users worldwide by hiding in when installed and displaying out-of-context ads.&nbsp;New bankers join the fray, with DroidBot utilizing its RAT capabilities to go after banking details and cryptowallets, targeting several EU countries. The newcomer ToxicPanda also made its mark, disguised as Visa, dating apps and Chrome. With its ability to disable system monitoring used by banking apps, it can act on behalf of the user to initiate payments. Lastly, the NGate banker mentioned in the previous report was spotted in new countries, utilizing the same NFC relay technique to siphon money away from users.&nbsp;In the Spyware sphere, we saw a new strain sneak onto the Amazon app store, a rather novel distribution method. With its ability to record the screen and spy on victim’s SMS messages, it posed a threat until its prompt removal by Amazon. SpyLoans continue to be a persistent threat to users worldwide, harvesting private and personal information that is later used to extort victims. Several law enforcement agencies have made inroads in tackling this nefarious threat.&nbsp;<h3 class="text-align-justify">Web Threat Data within the Mobile Landscape&nbsp;</h3>Most blocked attacks on mobile devices in Q4/2024 were web-based, mirroring the previous quarter. Consumers are much more likely to encounter phishing websites, scams, malvertising and other web threats on their mobile devices than ever before. These threats can come in a variety of formats such as private messages, SMS and emails but also redirects on less reputable sites, unwanted pop ups and through other avenues.&nbsp;In contrast to these types of mobile scams, traditional on-device malware requires a more complex infection vector where the consumer must also install the malware. For proper functionality of most mobile malware, permissions need to be granted by the consumer first, which again lowers the chances of malicious activity being triggered.&nbsp;Hence, blocking web-threat based attacks is beneficial for the security of mobile devices, as malware actors often use them as an entry point to get the payload onto the mobile device of their victims.&nbsp;

The Dark Side of Social Media, CryptoCore Deepfakes Stole $7 Million, and More than 4 Million Users Protected from Scam-Yourself-Attacks 

Gen Q4/2024 Threat Report 

<h2 class="text-align-justify">Foreword&nbsp;</h2>The Gen Q3/2024 Threat Report is here, offering an in-depth look at the forces reshaping the threat landscape. Scams continued to dominate, while other serious threats—including malvertising, ransomware, droppers, and data-stealing malware—surged ahead. Many of these threats remain closely linked to scams, underscoring the relentless evolution of cybercriminal tactics.&nbsp;

One of the most alarming trends is the rise of “Scam-Yourself Attacks”—an advanced <a href="https://us.norton.com/blog/emerging-threats/what-is-social-engineering">social engineering</a> tactic that tricks users into compromising their own systems. This quarter alone, we protected over 2 million users from a variant called FakeCaptcha, which mimics CAPTCHA prompts to deliver malware. With a staggering 614% increase of these Scam-Yourself attacks quarter-over-quarter; social engineering, psychological manipulation tactics, continues to be one of the most dangerous tools in the cybercriminal arsenal.&nbsp;In addition, <a href="https://www.avast.com/c-what-is-ransomware">ransomware</a> threats escalated following a 24% increase in Q2/2024, with a further 100% rise in the risk ratio and number of protected users this quarter. This surge was primarily driven by the AliGater campaign, which delivered the Magniber ransomware. Remote Access Trojans (RATs) also saw a 26% increase, largely due to the spread of XWorm. Our researchers once again uncovered and disclosed a zero-day vulnerability, in the AFD.sys Windows driver, which was exploited in the wild by the Lazarus APT group and specifically targeted a nuclear power plant.&nbsp;Also, among the most significant changes this quarter, information stealer activity rose by 39% quarter over quarter, fueled by the rise of Lumma Stealer. This malware-as-a-service has rapidly gained prominence, fueled by the ultimate objective of data theft, employing various delivery methods like fake YouTube tutorials and abused GitHub repositories. Its ability to bypass protections has made it one of the most formidable threats this quarter.&nbsp;In other social engineering news, malvertising, one of the most persistent types of social engineering, grew this quarter by 18%. Crypto scams, particularly those orchestrated by groups like CryptoCore, have spiked, using deepfake technology to exploit media events and lure victims into fraudulent cryptocurrency schemes. Additionally, malicious browser push notifications surged by 166% in some regions such as Italy.&nbsp;Data stealing <a href="https://www.avg.com/en/signal/what-is-malware">malware</a> also increased on mobile devices in Q3/2024. Financial data theft by banking malware saw a 60% surge, with attacks like Rocinante targeting users in Brazil, while new threats like TrickMo and Octo2 emerged in Europe. <a href="https://us.norton.com/blog/malware/spyware">Spyware</a> also rose sharply, with a 166% spike driven by NGate, an advanced spyware targeting NFC data for ATM withdrawals. A common denominator for the main mobile threats seen this quarter is their delivery via malicious SMS messages. As part of our mobile section, we will also showcase the most prevalent scam types identified through our Norton Genie visibility in 2024 so far.&nbsp;As we look back on the quarter, it’s evident that the cybersecurity landscape is evolving rapidly, with new and sophisticated threats emerging across the board. From the growing impact of social engineering scams to the resurgence of malware, the challenges we face continue to escalate. We encourage you to explore the full scope of insights provided in this report to gain a clearer understanding of these threats and their implications.Jakub Křoustek, Malware Research Director<h2 class="text-align-justify">Methodology&nbsp;</h2>This report is structured into three main sections: Desktop-related threats, where we describe our intelligence around attacks targeting the Windows, Linux and Mac operating systems, with a specific emphasis on web-related threats and Mobile-related threats, where we describe the attacks focusing on Android and iOS operating systems.&nbsp;We use the term “risk ratio” in this report to denote the severity of specific threats. It is calculated as a monthly average of “Number of attacked users / Number of active users in a given country.” Unless stated otherwise, calculated risks are only available for countries with more than 10,000 active users per month.&nbsp;A blocked attack is defined as a unique combination of the protected user and a blocked threat identifier within the specified time frame.&nbsp;Our quarterly threat reports inform about the threat landscape situation as seen from the Gen family of Cyber Safety brands. We continuously enhance our threat telemetry and anticipate further refinements in our future reports.&nbsp;<h2 class="text-align-justify">Featured Story: "Scam-Yourself Attacks” Peak, Tricking Users Into Compromising Their Own Devices&nbsp;</h2>Picture this: You're at your desk, staring at a frustrating error message or a stalled software installation. In a hurry to find a solution, you turn to the Internet. There it is: a YouTube tutorial or an easy step-by-step guide, seemingly offering the perfect fix. With a few clicks, you're on your way to solving the problem. But instead of a solution, what you’ve really done is opened the door to a hidden threat, following a path laid out by cybercriminals.&nbsp;These types of attacks—what Gen has termed “Scam-Yourself Attacks”—are evolving faster than ever, and they’re proving highly effective. In fact, this quarter alone, we’ve seen a staggering 614% increase in these attacks. The term encompasses a variety of threats, from Fake Tutorials to ClickFix scams, FakeCaptcha tricks, and Fake Updates. Together, they form a broader web of deception that’s catching millions of users off guard.&nbsp;<h3 class="text-align-justify">A New Age of Cyber Trickery: Guiding Victims to Perform Their Own Attacks&nbsp;</h3>The landscape of cyberattacks has shifted. Gone are the days when malware simply hid in a suspicious email attachment or shady download. Now, attackers are using your curiosity, and your urgency to fix an issue, against you. They’ve weaponized what seem like harmless instructions to lure you in, and by the time you realize what’s happening, it’s already too late. Whether it’s through seemingly helpful tutorials or fake update prompts, cybercriminals are making you their accomplice.&nbsp;Let’s take a closer look at the different tactics that fall under the umbrella of “Scam-Yourself Attacks”, illustrating how they all work together to deceive.&nbsp;<h4>Fake Tutorials: The Trap Disguised as Help&nbsp;</h4>Imagine a cracked software installer you found online. Along with the software, there's a README file guiding you through the installation. It looks innocent enough, but buried in those instructions is a deadly line: "Disable your antivirus for this software to work properly". What you think is a helpful guide is, in fact, a direct invitation for malware to slip through your defenses.&nbsp;<ul><li data-list-item-id="e843e9372584b29ba71590cea71e7dce3">Cracked Software and README Files: These often come with hidden dangers. Cybercriminals cleverly disguise malicious steps within seemingly helpful guides. You follow the instructions, thinking it’s necessary for the installation, only to find you’ve opened the door for malware.&nbsp;</li></ul>

<ul><li data-list-item-id="ebaf4d85a64a5ec0ec18d224939b02810">YouTube Tutorials: Another trick in the cybercriminals' playbook involves video tutorials. The video walks you through the process of installing software, but when you click the link in the comments to download it, you’re downloading malware instead. What started as a guide to help you ends with your device compromised. The worst part? You’re the one who clicked, copied, and executed the threat.&nbsp;</li></ul>&nbsp;

But there’s good news: whether you downloaded it from an unofficial website, YouTube, or even GitHub, security vendors like us don’t care where it came from. If it’s malicious, we detect it.&nbsp;<h4>ClickFix: The Illusion of Control&nbsp;</h4>Now imagine you’re trying to fix a problem on your computer—an annoying Windows error code, perhaps. You find what appears to be a genuine solution online. It asks you to copy a script to your clipboard, paste it into the command prompt, and hit Enter. You follow along, thinking you’re resolving the issue, but, in reality, you’ve just run a piece of malware that opens the floodgates to attackers.&nbsp;This is ClickFix, a specific form of so-called Fake Tutorial campaigns where users are misled into performing steps that ultimately compromise their own devices.&nbsp;

The illusion here is control—cybercriminals know you’ll follow the steps because they seem like a straightforward fix. &nbsp;<h4>FakeCaptcha: When Familiarity Breeds Danger&nbsp;</h4>Think about how often you’ve encountered CAPTCHA’s, the little “I’m not a robot” checkboxes. We’ve become so used to them that we rarely question their legitimacy. Cybercriminals know this, and they’re taking advantage. They’ve created <a href="https://www.gendigital.com/blog/news/innovation/global-surge-in-fake-captcha-attacks" target="_blank" rel="noreferrer noopener">FakeCaptcha</a>—a variant of ClickFix—designed to resemble a real CAPTCHA, tricking you into following steps that lead straight to infection.&nbsp;<ul><li data-list-item-id="edb37a9b9a9201f233181e9c5f0ef5838">How It Works: You land on a compromised website or a malicious page, and a CAPTCHA pops up. After clicking “I am not a robot” a script is quietly copied to your clipboard, and you’re prompted to run it. Following these instructions results in malware silently taking over your system.&nbsp;</li></ul>

It’s a perfect example of how attackers exploit familiarity. The CAPTCHA looks real, but the consequences are all too dangerous. What’s happening behind the scenes is that the script acts as a dropper—downloading further malware onto your system, often the infamous <a href="https://www.gendigital.com/blog/news/innovation/lumma-stealer-github" target="_blank" rel="noreferrer noopener">Lumma Stealer</a>, one of the most advanced information stealers out there today. In Q3/2024, we observed a surge in Lumma Stealer campaigns, which are discussed in more detail in the Information Stealers section of this report.&nbsp;<h4 class="text-align-justify">ClearFake and Fake Updates: Changing Strategies&nbsp;</h4>ClearFake is a threat actor primarily known for using the Fake Update tactic, where users are tricked into downloading malware disguised as a browser update. This quarter we saw something interesting – ClearFake adapted. They started using the ClickFix tactic in certain campaigns, showing that threat actors are willing to shift strategies when one method proves more effective than another.&nbsp;Typically, ClearFake presents users with what looks like a legitimate browser update page. Once users download the "update," they end up with malware instead. But, this quarter, they also employed ClickFix, guiding users to copy and paste scripts, much like other Fake Tutorials.&nbsp;The Fake Update screens can take many, and often truly legitimate-looking, forms. As an example, in <a href="https://x.com/GenThreatLabs/status/1840762181668741130" target="_blank" rel="noreferrer noopener">this campaign</a> we spotted WarmCookie backdoor being distributed, allowing the adversaries to execute a variety of commands on the victim’s PC.&nbsp;

In a new twist, ClearFake’s latest adaptation combines elements of both Fake Updates and ClickFix. Users encounter a familiar update prompt, suggesting a necessary browser update. However, instead of a one-click download, users are instructed to follow steps: copying a malicious script to their clipboard and pasting it into a PowerShell prompt, effectively giving the script administrator privileges. This approach requires users to feel fully involved in the update process, making them unknowingly complicit in infecting their own devices. It’s a deceptive blend of familiarity and manipulation, designed to take advantage of users’ reliance on routine updates.&nbsp;

<h4>How Big Is This Problem?&nbsp;</h4>In Q3/2024, we protected over 2.1 million users from FakeCaptcha attacks alone. Think about that—millions of people almost fell for it. This is just one piece of a much larger puzzle. The risk ratio for the entire “Scam-Yourself Attacks” category surged by over 614%, demonstrating just how widespread and global these attacks have become. Countries like Italy, Argentina, the Philippines, France, Spain, and Indonesia are among those facing the highest risk ratios for these attacks.&nbsp;

<h4>Conclusion: The Hidden Dangers of "Scam-Yourself Attacks"&nbsp;</h4>In a world where we rely on quick fixes and familiar online prompts, Scam-Yourself Attacks have become a cybercriminal’s dream. Users are unknowingly following instructions that do the attackers’ bidding for them, whether through fake CAPTCHAs, misleading YouTube tutorials, or cleverly disguised README files. &nbsp;What’s more troubling is how effortlessly these scams blend into our daily digital lives. We’ve grown so used to CAPTCHAs and quick-fix guides that we often forget to stop and question them. Also, almost every application needs to be up-to date and if it isn’t, users commonly see screens and dialogues prompting the (mandatory) update. In the hands of cybercriminals, our trust in these familiar formats becomes their most powerful weapon.&nbsp;As these campaigns evolve, one constant remains: they thrive on user deception and manipulation. The question isn’t whether these fake tutorials will persist, but how we will recognize and navigate them before it’s too late.&nbsp;&nbsp;Jan Rubín, Malware Researcher Luis Corrons, Security Evangelist<h2 class="text-align-justify">Desktop-Related Threats&nbsp;</h2><h3 class="text-align-justify">Advanced Persistent Threats (APTs): Evolution of FudModule&nbsp;</h3>An Advanced Persistent Threat (APT) is a type of cyberattack that is conducted by highly skilled and determined hackers who have the resources and expertise to penetrate a target's network and maintain a long-term presence undetected.&nbsp;Over the past quarter, the Lazarus group has once again demonstrated its expertise in stealth and innovation, proving its status as one of the most dangerous cybercriminal organizations. Among the various APTs we’ve been tracking, Lazarus has leveraged sophisticated tools like the FudModule rootkit and has also been using zero-day vulnerabilities to evade detection while orchestrating their cyberattacks.&nbsp;In early June, we identified that Lazarus was exploiting a new zero-day vulnerability in the Winsock driver (CVE-2024-38193). This vulnerability allowed attackers to achieve local privilege escalation (LPE), granting them the ability to deploy the FudModule v3.0 rootkit on targeted systems.&nbsp;On August 19, 2024, <a href="https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/" target="_blank" rel="noreferrer noopener">Microsoft identified</a> two additional zero-day vulnerabilities that are actively being exploited in the wild. The first of these vulnerabilities is a remote code execution (RCE) flaw in Chromium, designated as CVE-2024-7971. This RCE exploit allows attackers to execute code within the sandboxed Chromium renderer process.&nbsp;Once the exploit is triggered, it deploys shellcode that contains a Windows sandbox escape exploit (CVE-2024-38106). This sequence of events ultimately leads to the download and loading of the FudModule rootkit directly into memory.&nbsp;The sandbox escape exploit specifically targets a vulnerability in the Windows kernel. By leveraging this weakness, the Lazarus Group can successfully load the FudModule rootkit into memory, thereby enhancing their capabilities in executing further attacks.&nbsp;The FudModule rootkit itself has undergone significant evolution in its latest version. In addition to its standard arsenal of tools for evading detection and disabling security measures, <a href="https://www.gendigital.com/blog/news/innovation/lazarus-fudmodule-v3" target="_blank" rel="noreferrer noopener">FudModule v3.0</a> now includes new capabilities designed to complicate incident response efforts. One of the most notable features is its ability to disable crash dumps, which are often critical for post-incident analysis. By blocking this functionality, FudModule makes it difficult for security teams to trace the root cause of an infection or reconstruct the sequence of events leading up to an attack.&nbsp;Moreover, FudModule v3.0 is more closely integrated with the payloads it seeks to protect. It injects its payload into a process secured by the Protected Process Light (PPL) framework, a feature typically used to safeguard critical system processes. This integration makes it more difficult for security solutions to detect and remove the malicious payload, as it benefits from the same protections afforded to legitimate system processes.&nbsp;Given these extensive changes, we have classified this version as FudModule v3.0, reflecting the significant advancements it embodies. It has evolved from being a standalone rootkit designed to disable security defenses into a more versatile tool that also actively protects the malicious payload from detection and removal.&nbsp;Several other advanced persistent threat (APT) groups remain highly active across Southeast Asia. One notable actor, MustangPanda, is conducting extensive operations in Myanmar, deploying various backdoors to infiltrate victims’ systems. These attacks are primarily aimed at document theft, with the stolen data being exfiltrated to MustangPanda’s command-and-control (C2) servers. Myanmar continues to be one of the most targeted nations in the region, but we’ve also observed significant APT-related activity across India, the Philippines, Hong Kong, Vietnam, and Cambodia.&nbsp;In addition, several government websites in various Asian countries have been compromised and infected with a JavaScript (JS) backdoor. This backdoor is capable of gathering information from victims and executing encrypted JS modules sent from its C2 server. The malware attempts to exploit a vulnerability in WPS Office, similar to one previously detailed in an ESET report, to achieve remote code execution on targeted machines.&nbsp;We have reported multiple vulnerabilities to Kingsoft, the developer of WPS Office, to address these vulnerabilities.&nbsp;Luigino Camastra, Malware Researcher Igor Morgenstern, Malware Researcher<h3>Bots: Distributed Mess of IoT</h3>Bots are threats mainly interested in securing long-term access to devices with the aim of utilizing their resources, be it remote control, spam distribution, or denial-of-service (DoS) attacks. &nbsp;While this quarter was significantly less rich in terms of law enforcement agency activities compared to the last quarter, it wasn’t eventless. The FBI attempted to take down the Raptor Train botnet that was using SOHO routers, IP cameras, NAS storages and other similar devices as proxies for further attacks. According to their <a href="https://www.justice.gov/opa/pr/court-authorized-operation-disrupts-worldwide-botnet-used-peoples-republic-china-state" target="_blank" rel="noreferrer noopener">report</a>, this botnet was maintained by People’s Republic of China state-sponsored hackers working for the Integrity Technology Group company. The FBI dispatched a command that used the malware's native functionality to disable the malware. This was also noticed by the threat actor who unsuccessfully tried to interfere with these remediation efforts by launching a DDoS on the operational infrastructure.&nbsp;We will use DDoS as a segue to another new botnet that was discovered in September and has been dubbed Gorilla Botnet. Unsurprisingly, the Gorilla Botnet also consists of breached vulnerable IoT devices and is based on a modifier Mirai source code. Coincidentally, Cloudflare reported that it was hit by a world record 3.8 Tbps DDoS attack during September. As if that wasn’t enough for September, a new vulnerability in a common Linux software (Common UNIX Printing System – CUPS) with a huge amplification factor of 600 was discovered.&nbsp;But it’s not all bad news in the world of Bots: the NoName057 group that is behind the DDosia project is still in stagnation. This quarter they came out of hiding to target European banks but, thankfully, the targeted banks were successful in mitigating these attacks. The group presumably tried to improve their success rate by targeting websites of small and usually regional institutions (e.g. regional road maintenance companies). While these attacks were often successful, their impact has been very limited due to the website’s relative irrelevance. The only significant deviation followed the Ukrainian incursion into the Kursk Oblast, when DDosia switched targeting to Ukrainian targets for a few days before returning to their usual operation. We have also noticed that NoName057 is more frequently cooperating with other groups such as CyberArmyofRussia, HackNeT, CyberDragon, and KaliHunt/Russia to coordinate their DDoS attacks.&nbsp;Another prolific botnet, Twizt, &nbsp;underwent frequent updates during September in comparison to the previous month. No significant changes were observed in these updates neither in design nor modulus used to decrypt messages.&nbsp;

<h3 class="text-align-justify">Information Stealers: Lumma is Everywhere&nbsp;</h3>Information stealers are dedicated to stealing anything of value from the victim’s device. Typically, they focus on stored credentials, cryptocurrencies, browser sessions/cookies, browser passwords and private documents.&nbsp;When it comes to information stealers, this quarter was wild. In particular, we observed Lumma Stealer, one of today’s most advanced stealers, being spread globally – and fast. New GitHub campaign? Lumma. Fake tutorial YouTube videos? Lumma. Requests on Steam accounts usernames? Lumma. The numbers are staggering: Lumma increased its information stealers malware share by a massive 1154% this quarter. Let’s dive into some of the campaigns in more detail to explain why this isn’t a typo but rather the effect of broad and varied campaigning.&nbsp;&nbsp;Everything started with a <a href="https://www.gendigital.com/blog/news/innovation/global-surge-in-fake-captcha-attacks" target="_blank" rel="noreferrer noopener">surge of FakeCaptcha</a> campaigns, which we also described in our Featured Story in this quarterly issue. These campaigns, usually <a href="https://x.com/GenThreatLabs/status/1827007175627010077" target="_blank" rel="noreferrer noopener">carried over by malvertising</a>, executed more than 2.1 million attacks on our customers &nbsp;in &nbsp;Q3/2024 alone. According to our observations, in most of the cases, these campaigns were spreading Lumma Stealer. The copied PowerShell script to clipboard, which is supposed to be executed in the Run prompt (Win+R), is usually either downloading Lumma Stealer directly in a form of an archive or uses a variety of different intermediary loaders to do the job. Most of the time, we observed HijackLoader (/IDAT Loader) being used to load Lumma.&nbsp;We’ve seen FakeCaptcha being utilized by many different actors with many of those changing the CAPTCHA appearance just a little, as could be observed during the <a href="https://www.gendigital.com/blog/news/innovation/aligater" target="_blank" rel="noreferrer noopener">AliGater malvertising</a> campaigns. These campaigns were spreading Lumma Stealer Magniber ransomware. An interested reader can find more information about this threat in the Vulnerabilities and Exploits section of this issue.&nbsp;We also observed quite a few GitHub campaigns, both in the form of polluting repositories with pull requests containing links to malware (= Lumma, again) and <a href="https://www.gendigital.com/blog/news/innovation/lumma-stealer-github" target="_blank" rel="noreferrer noopener">directly in the comments</a>. Thankfully, these dangerous comments are frequently written in poor English, alerting some to the potential risk. This red flag, however, might become less common in the near future with better availability and common adaptation of generative AI.&nbsp;

Finally, Lumma Stealer has launched another interesting approach, rotating C&amp;C addresses in the form of <a href="https://x.com/GenThreatLabs/status/1826232224179687468" target="_blank" rel="noreferrer noopener">account usernames on Steam</a>. These usernames are usually encrypted by a simple Caesar substitution cipher. In an example below, the C&amp;C addresses can be decrypted by applying ROT-15. Leveraging online platforms like this has underlying positive aspects for the attackers,&nbsp; allowing them to rotate the C&amp;C just by changing the username to reflect the new address.&nbsp;

<h4 class="text-align-justify">App-Bound Encryption Bypass&nbsp;</h4>Since the adaptation of <a href="https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html" target="_blank" rel="noreferrer noopener">App-Bound encryption</a>, which we discussed in the Q2/2024 report, malware developers behind various information stealers were quite busy with figuring out bypasses of this enabled-by-default hardened protection of browser cookies in Google Chrome.&nbsp;We observed many discussions, particularly on Telegram, about approaches to bypass the protection, along with some authors bragging that they already achieved the bypass.&nbsp;

Lumma Stealer is not alone in this, however; we’ve observed similar reports throughout the past quarter from PovertyStealer, Vidar, StealC, WhiteSnake and Meduza, to name a few.&nbsp;There were many different discussions by threat actors regarding how to perform the actual bypass, showcasing the urgency with which information stealer developers were trying to address this protection. For example, developers behind Vidar were considering using a <a href="https://x.com/g0njxa/status/1833894122710515954" target="_blank" rel="noreferrer noopener">TPM module for encryption</a>.&nbsp;Even though the specific bypasses might vary and are still in the testing and development phases, one method stands out and, as usual, it feels like the simplest method wins it all.&nbsp;As recently reported by <a href="https://spycloud.com/blog/infostealers-bypass-new-chrome-security-feature/" target="_blank" rel="noreferrer noopener">SpyCloud Labs in a blogpost</a>, malware can use specific parameters while starting a new instance of Chrome as described <a href="https://mango.pdf.zone/stealing-chrome-cookies-without-a-password" target="_blank" rel="noreferrer noopener">in the original Mango PDF Zone publication</a>. More specifically, malware can use “--remote-debugging-port=” parameter to listen for a debugger connection. After that, the malware can attach to Chrome via a URL dedicated for DevTools (remote debugger), create a WebSocket and send a message to retrieve the cookies. This can be combined with other common means of hiding such newly created windows, for example by using a “--window-position=” parameter to set the window position outside of the victim’s screen which also avoids the use of standard WinAPI functions.&nbsp;We can (unfortunately) confirm from our research that malware truly doesn’t need any special permissions or user interaction whatsoever. We have found traces of previous misuses, indicating that this approach might <a href="https://issues.chromium.org/issues/40050335" target="_blank" rel="noreferrer noopener">not be fully patched yet</a>.&nbsp;Another recent method, <a href="https://x.com/xaitax/status/1850500705074700298" target="_blank" rel="noreferrer noopener">reported by Alexander Hagenah</a>, for bypassing the App-Bound Encryption uses Chrome’s internal COM-based IElevator service. This bypass requires admin privileges to copy the executable into %PROGRAMFILES%\Google\Chrome\Application folder. This is required since Chrome’s App-Bound encryption is also performing path validation.&nbsp;Cases like this demonstrate that information stealers, especially the ones offered as Malware-as-a-Service, put everything on the line to keep their mass-theft campaigns going, and we can only expect this endless cat-and-mouse game to continue.&nbsp;<h4 class="text-align-justify">Statistics&nbsp;</h4>The risk ratio of getting an Information stealer increased by 39% in Q3/2024, due in large part to the vast campaigns distributed by Lumma Stealer. These campaigns also shifted the whole information stealers market quite a bit, putting Lumma Stealer on a pedestal.&nbsp;

We also observed risk ratio increase in almost all regions with a greater userbase:&nbsp;<ul><li data-list-item-id="eb21195281e85f80226c492f7e7d1adf8">France: 135%&nbsp;</li><li data-list-item-id="e4cb09abec3a6df4b5cba39d166fc5bf6">Japan: 128%&nbsp;</li><li data-list-item-id="e66bb0794b472a0e9366a696106019da1">Slovakia: 127%&nbsp;</li><li data-list-item-id="ea0c85f30204d22ee8d2fca96a34fb0fa">Canada: 48%&nbsp;</li><li data-list-item-id="e7db6476a5a5045611ee0633f723c5466">Spain: 34%&nbsp;</li><li data-list-item-id="ed37a444f22579fae7e3e8fc68307c49a">Brazil: 27%&nbsp;</li><li data-list-item-id="ec847260927132146f716644fc7cbe9a6">United States: 22%&nbsp;</li><li data-list-item-id="e203073b9c691355cf82d7ca89e0b48be">Czech Republic: 9%&nbsp;</li></ul>

Lumma Stealer now has the largest malware share with 30.95%, a 1154% increase over the previous quarter. Many of the other information stealers had an expected comparative decrease in their malware share (the shift caused by Lumma Stealer), though not all of them. SnakeKeylogger also increased its malware share, with a significant 461% increase.&nbsp;Compared to the previous quarter, in Q3/2024 AgentTesla decreased in malware share by 49%, Ramnit by 30%, and Fareit by 24%. FormBook, however, stayed the same, without any shifts in its malware share.&nbsp;Note that these shifts, especially the decreases, don’t indicate there would be less of such infections across our userbase. This only means that comparatively to each other the malware families are less common, and it doesn’t necessarily reflect they are less prevalent themselves.&nbsp;The most common information stealers with their malware shares in Q3/2024 were:&nbsp;<ul><li data-list-item-id="edc396cf3248146f06d25c112526a36f7">Lumma Stealer (30.95%)&nbsp;</li><li data-list-item-id="ea3b457895225c3caadf0427f52e62976">AgentTesla (17.23%)&nbsp;</li><li data-list-item-id="ed4825660085d9c3cf0fa91427698a412">FormBook (8.97%)&nbsp;</li><li data-list-item-id="e1d02e277b5df883b54b411ed5782abf2">Ramnit (8.39%)&nbsp;</li><li data-list-item-id="e07127427d2e81527644c52eb047054d1">Fareit (5.36%)&nbsp;</li><li data-list-item-id="e6ae5dd39989ca2b5e3fa2ddd8ac46ce5">SnakeKeylogger (3.95%)&nbsp;</li><li data-list-item-id="ee48db7e304536184677159bb92480419">RedLine (3.38%)&nbsp;</li><li data-list-item-id="eb798792557768e53a5beb7b756aea560">Lokibot (2.06%)&nbsp;</li><li data-list-item-id="e0b0c2bdbb5444ea4d38ef99e83800248">Vidar (1.58%)&nbsp;</li><li data-list-item-id="e36863c14836d36c7c9d99b95908fa267">ViperSoftX (1.43%)&nbsp;</li><li data-list-item-id="ecd8c094447ca75a435cf7e44d928680e">StealC (1.17%)&nbsp;Jan Rubín, Malware Researcher</li></ul><h3>Ransomware: The Rise and Decline of Magniber&nbsp;</h3>Ransomware is any type of extorting malware. The most common subtype is the one that encrypts documents, photos, videos, databases, and other files on the victim’s PC. Those files become unusable without decrypting them first. To decrypt the files, attackers demand money, “ransom”, hence the term ransomware.&nbsp;Ransomware is a business that certainly does not go away. According to a <a href="https://www.chainalysis.com/blog/2024-crypto-crime-mid-year-update-part-1/" target="_blank" rel="noreferrer noopener">report</a> published by Chainalysis, the amount of $459,800,000 paid by ransomware victims in the first half of 2024 will set a new yearly record, should the payments continue at the same speed for the rest of the year.&nbsp;Magniber Surge&nbsp;Because most of the big ransomware groups focus on attacking corporations, trends in the consumer segment do not change much on a quarterly basis. However, the trend changed in Q2/2024 when <a href="https://www.gendigital.com/blog/news/innovation/q2-2024-threat-report" target="_blank" rel="noreferrer noopener">we noted</a> a 24% increase of ransomware threats, a trend that is continuing in Q3/2024. Further, in August there was a surprising anomaly detected by our sensors: a rapid increase in blocked URLs related to ransomware:&nbsp;

Reports

Gen Q4/2025 Threat Report

SMS threats: the many faces of a tiny text

Gen Q3/2025 Threat Report

Gen Q2/2025 Threat Report

Gen Q1/2025 threat report

Gen threat glossary & taxonomy

Gen Q4/2024 Threat Report

Gen Q3/2024 Threat Report

Gen Q2/2024 Threat Report

Avast Q1/2024 threat report

Avast Q4/2023 threat report

Avast Q3/2023 threat report