WhatsApp has begun rolling out a new optional “Scam Alert” feature, which uses a local machine learning model to warn users when scammers are targeting them. Scam Alert is now available as part of a limited beta rollout while the company tests this new warning system with researchers in its Bug Bounty community. “Today, we’re
WhatsApp rolls out new feature that flags potential scam messages Read More »
Affiliate links on Android Authority may earn us a commission. Learn more. We all have our favorite Chrome extensions that make daily web browsing effortless, whether it’s a quick screen snip tool, a right-click unlocker, or a simple tab manager. But what happens when one of those trusty add-ons quietly turns against you? Over the
PSA: Don’t trust that Chrome update popup — it could be malware Read More »
Security researchers have disclosed new “Plug and Pwn” attacks that abuse the Windows Plug and Play feature to trigger Windows into installing vulnerable or insecure vendor software and gain SYSTEM privileges. The research, presented at DEF CON 34 by security researchers Alejandro Hernando and Borja Martínez, exploits how Windows automatically identifies new connected hardware, locates
Plug and Pwn attack uses fake USB devices for Windows SYSTEM access Read More »
More than 737 browser extensions published on the Chrome Web Store impersonated well-known VPN and proxy services while routing users’ traffic through SOCKS5 proxies operated by a single provider. Some of the extensions impersonated dozens of established brands, including Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare’s 1.1.1.1 public domain name system (DNS) resolver. Researchers at
Hundreds of fake Chrome VPN extensions route traffic through a proxy Read More »
Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe’s Commerce and Magento e-commerce platforms have been detected, potentially allowing attackers to hijack customer accounts. The flaw is described as an incorrect authorization vulnerability that could be leveraged to “gain elevated access to sensitive resources” without authentication and is one of the seven issues that Adobe
Hackers exploit critical Adobe Commerce flaw to hijack customer accounts Read More »
A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal card data and send it to attackers in real time. In an incident investigated by the cybersecurity company Group-IB, a fraudster impersonated a bank employee and called the victim under the pretense of a problem
Android malware combo takes out loans and relays victims’ credit cards Read More »
An ongoing data theft campaign uses custom tools to steal data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow customer portals. The data-theft campaign, dubbed City-Forum by SaaS security firm Reco, has been traced to a single server that has targeted multiple organizations worldwide. These organizations include telecommunications companies, banks and financial services
“City-Forum” data-theft attacks target Salesforce, ServiceNow portals Read More »
A proof-of-concept (PoC) exploit for a critical Microsoft SharePoint vulnerability, published by cybersecurity company Rapid7 on Tuesday, is already being used in attacks. Tracked as CVE-2026-55040, this authentication bypass security flaw in the JWT token validation pipeline can be exploited by attackers without privileges to perform operations as a SharePoint site user or administrator. Microsoft
Hackers leverage new Microsoft SharePoint exploit in attacks Read More »
It might feel like an eternity that we’ve been living in this AI era, but really we’re only at its advent. As such, many of the risks associated with it have until now been merely hypothetical. However, we’re now seeing research filter out from security and software research teams that show some genuinely concerning behaviour,
Signal has introduced Automatic Key Verification, a new security feature that gives users a new way to ensure their encrypted chats haven’t been intercepted. The new feature is part of a “key transparency” system that uses Cloudflare and Trail of Bits as trusted third-party independent auditors to verify the integrity of Signal conversations. “It works
Signal adds new security feature to thwart man-in-the-middle attacks Read More »
