You can watch this article as a video on The Privacy Lab's YouTube channel.

Five billion dollars. That's how much Google agreed to pay after being caught tracking millions of users who thought they were browsing privately with Incognito mode. During the lawsuit, quotes from Google’s own employees emerged, calling Incognito "effectively a lie" and a "confusing mess."

Even Google's Chief Marketing Officer warned the CEO that they had to use "fuzzy, hedging language" because, in her own words, "it's not truly private."

I think Incognito mode is one of the most successful illusions in tech history. So, I'm going to strip it back to look at what Google Chrome actually does to protect your data, what Incognito mode completely fails to do, and the steps you can take to stay genuinely safe online.

Credit where it's due

It's important to be fair to Google here, even though it might feel a bit wrong: Chrome is actually a fairly secure web browser when it comes to keeping you safe from hackers and malware.

Importantly, it makes sure you use HTTPS, which encrypts the data that passes between your device and the websites you visit. This means that even if you connect to a dodgy Wi-Fi hotspot and someone is monitoring the connection, they can't steal your passwords or read your traffic. Plus, it warns you if you click on unencrypted HTTP links. Because Chrome and most other modern browsers do this, the classic "man in the middle" attack is very rare nowadays.

Chrome also features Secure DNS, as well as tab sandboxing. The latter isolates every browser tab so a malicious site can't jump to another and steal data. But the problem isn't Chrome's security. The problem is what happens when you click on Incognito.

What Incognito mode is good for

Incognito mode is not built for network stealth – it just keeps your browser tidy. When you open an Incognito tab, your browser stops recording some data. It doesn't save your activity in history, doesn't save auto-fills, and blocks third-party cookies

For example, if you're shopping for a birthday present or visiting… certain sites you'd rather not have saved in your history, Incognito mode works perfectly. It stops someone else who uses the same device from seeing what sites you've visited. However, this is exactly where its power ends.

Where Incognito fails

Everything falls apart the moment your data leaves your device – Incognito mode does nothing to hide your identity from the outside world. Your internet provider can still log the domain names you connect to, and if you're browsing on a work or school network, they can see every single site you visit.

Most worryingly, the websites you visit can still track you. They can record your real IP address, and if they use something like Google Analytics, they can instantly tie your "private" session to your existing digital profile.

In fact, following that massive lawsuit I mentioned earlier, Google had to change the official warning page in Chrome to explicitly admit this. It now reads: "This won't change how data is collected by websites you visit and the services they use, including Google."

Essentially, they had to confess on-screen that the data collection doesn't stop.

Is Incognito mode still worth using?

Whether you should use Incognito boils down to what you expect from it. If you care about what other people using your device can see, it's perfect. It's also great for logging into different email accounts, getting around article limits on news sites, or stopping your YouTube algorithm from being ruined because you wanted to watch one weird video.

However, Incognito does not give you any kind of meaningful digital privacy. For any entity that has control over your connection – notably your ISP, school, or workplace – there's no difference at all between using Incognito and rawdogging it with a logged-in Chrome tab.

It's the same story for the sites you visit. Your IP and any device identifiers are still available to see, so it's very easy to link this activity with anything else you've done online. At the end of the day, Incognito only hides your tracks from the person sitting next to you – not the rest of the world.

For genuine privacy, I recommend using tools that actually secure your connection. Use one of the best VPNs to hide your activity from your ISP and change your IP address, and consider switching to a browser like Brave or Firefox that blocks tracking by default. Ad and tracker blockers are also good – there are plenty available for free – and finally, keep everything updated, including Chrome. New releases address the most recent issues, so it's good to stay on top of this.

In short, it's certainly not in Google's best interest to provide you with a tool that strips away the possibility of data collection. There are still eyes behind the famous fedora and sunglasses – and they're always watching.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

If you're still recycling the same three passwords across half the web, then this is your cue to stop. A good password manager creates strong, unique logins for every account you have, remembers the lot and fills them in for you. And right now one of the best password managers we've tested is half price!

For a limited time, Keeper is taking 50% off its Personal and Family Plans for your first year; that's some of the biggest discounts we've seen from Keeper!

Why pick Keeper?

Keeper Security is a Password manager with award-winning security and over 10 years of experience. It's fast, full-featured, and offers easy-to-use desktop and mobile apps.

Keeper Security has been in the game longer than most; having been founded back in 2009, they now protect millions of people worldwide and is built on zero-knowledge architecture, which means no one other than you ever sees your passwords or encrypted data, not even Keeper, and in the very worst case scenario, your data is still encrypted and scrambled.

In our Keeper password manager review, we found it to be dependable, affordable and very secure and it's a regular fixture in our best password manager guides

That's why 50% off family and personal plans is such a bargain! The family plan, for example, covers five users, each with a completely private vault and 10GB of secure storage, split across a household; it's mere pennies per month per person!

Not sure yet? Keeper offers a 30-day free trial with no card details required, so you can test all the features before buying.

More from Tom's Guide

• The best password managers in 2026
• Keeper Security Promo Codes
• People are the password problem: How you're creating your biggest security risks

Tom’s Guide may earn a commission when you buy through the links in this article.

You can watch this article as a video on The Privacy Lab's YouTube channel.

In October 2020, Google launched a virtual private network. Of course, this seemed out of character – one of the most data-hungry companies in the world whipping up a product to help people protect that exact commodity. But, on paper, Google VPN looked pretty good. It had a huge server network and because it came bundled with premium Google Drive plans, for many it was effectively "free." There were murmurings that it could even dethrone the big names that populate our guide to the best VPNs overall.

However, in April 2024, it was announced that the VPN was destined for the Google graveyard. By June, it was dead and buried.

As ZDNet reported, Google stated: "We're refocusing our efforts to support more in-demand features with Google One. To keep our subscription service fresh, we're discontinuing the VPN feature." In short, Google's reasoning was that people simply weren't using it.

But that was just a cover story.

A clash of philosophies

To understand Google VPN's issues, you have to look at the business model first. Effectively, Google is a data and advertising company. It makes money by tracking your searches, mapping your locations, and ultimately building a very specific profile around you to sell targeted ads.

However, VPNs are designed to stop exactly that. By encrypting your data, VPNs allow you to hide what you're doing from your internet provider, government, and any hackers on dodgy networks. By changing your IP address, they make it harder to build a profile from your activity. Naturally, people were skeptical of Google developing such a product.

To build trust, Google published white papers, open-sourced the apps, and even commissioned independent audits. For example, in its official technical white paper, Google laid out how hard it worked to protect your data, writing:

"By employing a cryptographic blind signing step between user authentication and connecting to the VPN, we give users a stronger guarantee that their network activity can't be tied back to their identity."

Cybersecurity firm NCC Group agreed, writing in its public report that it found the system to have "a robust implementation and a strong technical security posture."

The truth is that Google's VPN was very secure. But even with these stamps of approval, most of us struggled to look past the irony of asking an advertising giant to secure your web traffic. The audience looking for privacy didn't trust Google, and the audience that trusted Google didn't care about privacy.

A VPN limited by design

Perhaps more people trusted Google than I'm giving them credit for. But those that did use Google VPN found it was no match for established names like NordVPN, Proton VPN, or Mullvad. It couldn't compete because it only did half the job.

Most people want their VPN to change their virtual location. That might be to access regional sites like BBC iPlayer and watch more shows on Netflix, or maybe to avoid content restrictions in countries like Russia and China. Either way, it's a core feature of any good VPN.

However, even on its paid plan, Google VPN did not let you choose a country to connect to. Instead, when it was first launched, it only allocated you an IP address in your "broad" location. In reality, that often meant connecting to a server several states away. This ended up messing with things like weather reports and proved very annoying – especially for people who didn't really understand how VPNs work.

In 2023, Google addressed this by allowing you to use a "local" IP address nearer your real location, but there was still no true location choice. This decision was an absolute dealbreaker for millions of potential customers.

What's more, the app was seriously underpowered. It lacked things like protocol switching, dedicated IPs, port forwarding, obfuscation, or split tunneling. Plus, if you didn't have a Pixel phone, Google VPN didn’t even have a kill switch to block internet traffic if it crashed.

In short, it was half-baked. Anyone actively looking to buy a VPN realised pretty quickly that there were so many better options out there.

The fragmented ecosystem

You might have noticed that there are more than a few similarities between Google's VPN and another well-known privacy tool from a Big Tech company: Apple Private Relay. Really, they are – or were – exactly the same thing: a limited VPN bundled with cloud storage.

But there are a few key reasons why Google VPN failed spectacularly, and why Private Relay is still going strong. Buckle up – Google made all of this quite confusing.

There were in fact three different versions of Google VPN: Google One VPN (RIP), Google Fi Wireless VPN, and VPN by Google. The latter two still exist, both now called VPN by Google, but in reality they're two different bits of software. Notably, though, the now-dead Google One VPN was the only one available for anyone to buy. The others require Google hardware to use them.

Coverage at the time shows the disconnect. Initially, Google stated that it was shuttering the VPN because "people weren't using it." However, it was also announced that the VPN would live on in the form of the Pixel VPN. And that's not to mention Google Fi.

Confusing, right? Well, it doesn't stop there. If we consider each product separately, they all appear to have different purposes and different goals – and none seem properly integrated. Let's quickly have a look at these:

• Google One VPN: This is the one that died, the one I covered the most here at Tom's Guide, and probably the most-used version at the time. It was used as an incentive to convince users to buy more cloud storage, and the only version available without the purchase of a Google hardware product.
• Google Fi Wireless VPN: This VPN's purpose was to convince customers to switch their phone lines over to Google's cellular network, and was available with a Google Fi subscription.
• Pixel VPN: The Pixel VPN's goal was to increase physical phone sales. Essentially, Google wanted to offer perks to compete with the iPhone. This version was only available with the purchase of a Pixel 7 or newer phone.

Although there's no definitive proof, it appears that each team responsible for these three products was totally separate from the other. The three VPNs may even have run on completely different infrastructures.

Here's a clue that points that way: Google claims it shut down Google One VPN due to low usage – but this was arguably the most-used version of the three. If all three VPNs shared the same servers, why kill the most popular one for being underused, while Fi and Pixel carried on unaffected? It suggests, at the very least, that Google One VPN was built and run with little coordination with Google's other VPN ventures.

Even if we avoid conjecture entirely, the fact remains that in early 2024 you could own a Pixel phone, run it on Google Fi, and pay for a Google One cloud storage – meaning you'd have three different Google-branded VPNs competing for control over the exact same traffic.

Suffice to say, it seems Google wasn't quite as organised as you might expect one of the richest companies in the world to be.

The pivot to AI

Running a VPN is expensive. Thousands of servers in dozens of countries, tip-top security, and routing huge amounts of data takes a lot of cash.

For a company like NordVPN or ExpressVPN, these costs are justified because it's their entire business. For Google, it was a expense that wasn’t generating any revenue. No one was subscribing to Google One just for the VPN – it was just a "perk" that came with their cloud storage, which they probably didn't use.

Then, in early 2024, Google changed tack. AI was here. Google's CEO, Sundar Pichai, celebrated a massive milestone on X, but his words betrayed the future of Google:

The writing was on the wall. The future of Google's subscription business didn't include tools like a VPN. It was going to be driven by artificial intelligence – and there was no reason to maintain an unpopular product that didn't line the coffers.

Bottom line

Ultimately, the collapse of Google VPN proves that privacy can't be treated as an afterthought. A successful VPN needs more than solid engineering – it demands an overall philosophy that isn’t compromised by a business model based around advertising and data collection. Google didn't fail because it lacked the technology. It failed because it lacked the trust.

Then, when the AI boom hit, the VPN was first on the chopping block. Google could no longer justify maintaining an expensive and underused infrastructure that actively protected your data – the commodity most valued by the tech giant. By killing the VPN, it cleared the path for Gemini and showed us exactly where Big Tech’s priorities lie.

But, for us, this was a win. Consumers sent a message that they refused to compromise on trust just for the convenience of a cheap bundle. You voted with your wallets, and Google had to listen.

We have contacted Google for comment. We await their reply.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Even with one of the best MacBooks, you can never be too careful when downloading new apps. Case in point: a new malicious Mac app is posing as a legitimate Apple tool to steal passwords, keychain data and more from vulnerable systems.

As reported by BleepingComputer, the app in question serves as a means to infect vulnerable Apple computers with a new Mac info-stealer. While security researchers at Jamf first observed it back in May when it was still in development, this malware is now being actively used by cybercriminals in their attacks.

Dubbed CrashStealer, what makes this Mac malware strain so dangerous is the way in which it perfectly mimics Apple’s own macOS crash reports. Although something might seem off to more discerning users, others could easily fall for this attack given how much care and attention has gone into impersonating this legitimate tool.

Here’s everything you need to know about this new Mac malware and how you can keep your own MacBook and all the sensitive data it contains safe from hackers.

Impersonating a legitimate Apple utility

In their report, Jamf’s security researchers explain how the malware hides in plain sight by posing as a meeting platform called Werkbit. While they don’t go into details about the malware’s initial distribution method, a malicious app like this could be distributed via fake ads or on a developer-focused site like GitHub.

After downloading the app, it’s mounted on your desktop just like with any new software you download for your Mac. Surprisingly, though, the hackers behind this campaign are using a signed and Apple-notarized installer to distribute their fake app. Not only does this add a sense of legitimacy to the app but it also allows it to bypass Apple’s built-in Gatekeeper security feature without any warnings whatsoever.

When launched for the first time, the app displays a fake macOS password prompt that looks strikingly similar to what you’d see when downloading new software manually as opposed to through the Mac App Store. Once a victim puts in the password for their Mac, the hackers then have everything they need to unlock their Apple Keychain which acts as macOS’ encrypted password vault and contains all sorts of sensitive info like saved credentials in Safari, app passwords, Wi-Fi passwords and more.

The CrashStealer malware isn’t just limited to stealing from your Keychain though. It can also steal browser credentials and cookies from Chrome and other Chromium-based browsers as well as Firefox. Likewise, it can steal data from 80 different crypto wallet extensions and 14 of the best password managers including 1Password, LastPass, Dashlane and more.

To get all of this stolen data off your Mac, the malware encrypts it before packaging it into hidden ZIP archives and uploading it to a hacker-controlled C&C server.

By using a signed and notarized dropper and a re-signed payload, CrashStealer is a sophisticated Mac malware that’s especially good at avoiding detection.

How to stay safe from Mac malware

If you’re worried about CrashStealer and other Mac malware, the first thing you should do is to avoid sideloading apps, or in this case, installing new apps from anywhere besides the Mac App Store.

Just like on one of the best Android smartphones, when you download new apps from websites instead of an official app store, you’re putting your devices and the data they contain at risk. Apps submitted to the Mac App Store go through rigorous security checks while those you download from a random website don’t.

Normally when you download an unverified app from the web, macOS’s built-in Gatekeeper security feature will block it or warn you before you install it. In this case, though, that doesn’t happen since the installer used in this campaign is signed and appears to be legitimate. Well, at least in Gatekeeper’s eyes.

While Gatekeeper can keep you safe from most threats, there are ones like this that manage to bypass its defenses. For this reason, you might want to consider using one of the best Mac antivirus software solutions alongside Apple’s built-in ones. That way, if something slips past Apple, your third-party antivirus software will be able to stop the threat before it can do serious damage.

Since CrashStealer is still a relatively new Mac malware, this likely won’t be the last time we see it. This is why you always need to be extra careful when downloading and installing new software onto your Apple computer.

More from Tom’s Guide

• New PamStealer Mac malware poses as a clipboard manager to steal login info
• Apple’s ‘Hide My Email’ reportedly exposing real email addresses
• GTA 6 warning: Pre-order scams are stealing users' info and spreading malware

The official Grand Theft Auto 6 launch isn't for several months, but pre-orders have been in full swing since the end of June. You may want to be careful if you try to order the game, though.

Security researchers from Kaspersky recently released a warning via email to Tom's Guide that cybercriminals are using the hype around GTA 6 to deploy a "wide range of fraud schemes." The most common scheme appears to be fake pre-order websites or false video tutorials on how to get the game.

"Highly anticipated game releases have long presented significant opportunities for cybercriminals, and we are already detecting related fraudulent activity," Olga Altukhova, a Senior Web Content Analyst at Kaspersky, said in the report. "These schemes are carefully timed to capitalize on heightened consumer excitement: attackers understand that periods of intense anticipation can lower users’ guard and create a false sense of urgency."

The fake sites utilize graphics and copy that mimic Rockstar's branding, including real trailers and promotional artwork. They offer gamers the ability to pre-order the game for the PS5 or Xbox.

Unfortunately, when users enter their personal details and payment information, it sets them up to potentially have their bank accounts drained and sensitive data compromised.

According to Kaspersky, the false pages have been found in multiple languages, which indicates that scammers are targeting unsuspecting people across the globe.

Other frauds to avoid

Fake websites aren't the only scam. At least one website was offering what it claimed to be a beta version of the game as a download framing it as a leak.

The false beta was promoted on social media and streaming platforms where scammers showed gamers how to "safely" download the game. Downloading and opening the file enabled malware to be installed on your system which could lead to compromised data and unauthorized access.

Finally, cryptocurrency owners are also being targeted via suspicious websites promoting tokens using GTA 6 branding.

How to safely pre-order and avoid scammers

As always, when it comes to software, whether games or programs, we always recommend you purchase or download from official sources.

GTA 6 is only launching on PS5 and Xbox Series S and X this November. If you're interested, purchase the game through the storefronts on your console of choice. Or you can go to the official Rockstar GTA 6 site and pre-order there.

Kaspersky recommends using a prepaid card when purchasing games to avoid exposing your credit card or bank account information. It's an extra step but good practice for keeping your financial information safe.

Even beyond of GTA 6, you should always double-check the URL formats of websites you're visiting, especially ones you're not familiar with. Also check the spelling of names and organizations where typos can reveal falsehoods.

Online scams often end up with nasty malware infections, so you want to keep your devices protected as well. Make sure that you're using the best antivirus software on your Windows PC, the best Mac antivirus software on your Apple computer, and one of the best Android antivirus apps on your Android smartphone

For even greater protection and help recovering any funds lost to scams, you may also want to consider signing up for one of the best identity theft protection services.

Finally, consider enabling multi-factor authentication and monitoring accounts regularly, which can help warn you about unauthorized access.

More from Tom's Guide

• 3 cloud gaming services I recommend if gaming platforms are too expensive
• Assassin’s Creed Black Flag Resynced is a remake done right — and the best pirate game I’ve ever played
• I grinded enough Microsoft reward points to get GTA 6 for free — here's how you can do it too

Security researchers who focus on Apple devices have discovered a new macOS malware that appears to be surprisingly clever while it harvests data and login credentials.

According to the IT firm Jamf (via ArsTechnica), the new malware, dubbed PamStealer, can get on your Mac in two stages. First, it disguises itself as Maccy, a clipboard manager.

Apparently, PamStealer is compiled as AppleScript written in Rust that uses the Pluggable Authentication Modules interface that is built into macOS to target the device's login password, which is then sent to an attacker-controlled server.

What makes PamStealer unique is that it combines AppleScript and disk images to stealthily enter your computer. When you click the AppleScript, it opens the macOS Script Editor where the malware is buried in the file.

"Rather than relying on shell commands such as curl or zsh, the AppleScript executes a self-contained JavaScript for Automation (JXA) downloader that retrieves and stages the payload using native Objective-C APIs," the Jamf team wrote. "Combined with a Rust-based second stage and a password capture workflow that validates credentials locally through PAM, the result is a quieter execution chain than we typically observe in commodity macOS stealers."

How PamStealer works

When someone installs the false Maccy and opens the disk image, they're prompted to enter Command-R immediately. Doing so executes the malicious code inside AppleScript. This allows it to bypass com.apple.quarantine, a normal macOS feature that offers warnings and restrictions when you're opening executable files from the internet.

The second stage is a Mach-O file specifically written for Macs running Apple M-series CPUs. Rust is apparently an uncommon code for macOS infostealers. This bundles SQLite and calls it read interface, meaning it opens and reads databases files directly.

PamStealer will pop up a native password prompt that is meant to resemble a system authorization request. It reads, "“Maccy wants to make changes. Enter your password to allow this.”

Once a password is entered, it's validated through the PAM API, meaning its harder for malware defenders to detect. Additionally, it can either give a malicious actor full disk access or inject code designed to access Ethereum accounts.

“Together, these behaviors illustrate how commodity macOS stealers continue to evolve, adopting quieter execution chains and native implementations that reduce traditional detection opportunities while remaining compatible with standard macOS features,” Jamf said.

How to stay safe from PamStealer

First and foremost, Maccy is a real, legitimate app that is quite popular. If you are interested in checking the app, the only real website is maccy.app.

Jamf found the fake Maccy was being hosted at maccyapp.com, a site you should not visit.

Secondly, it's a good reminder to double and triple-check website URLs. Specifically for macOS apps, you can also see if the app in question is available in the Apple App Store. Maccy, for instance, is in the App Store.

Apple is still a pretty closed garden so if you're looking for something and want to be sure it's real, I would recommend starting there before venturing into the hinterlands of the internet.

Beyond that, your Mac does come with built-in security software in the form of XProtect. But if you need some extra protection, it might be worth investing in one of the best Mac antivirus software solutions to run alongside it.

More from Tom's Guide

• Apple’s ‘Hide My Email’ reportedly exposing real email addresses
• What is Q-Day?
• 'Amazon put identity theft victims through a Kafkaesque ordeal': FTC issues $2.5 million fine over denying requests

Back when it was first revealed alongside iCloud Plus, Apple’s Hide My Email always seemed like magic as anyone could use it to avoid handing out their ‘real’ email address. However, a newly disclosed vulnerability just revealed that this privacy feature isn’t so private after all, leaving a way for attackers to completely uncover your actual email address.

For those unfamiliar, Hide My Email is one of the built-in perks that comes with a paid iCloud account. Once enabled, it masks your primary email address and replaces it with a randomly generated one that ends in @icloud.com. From there, Apple makes it easy to view any emails sent to that random address as they’re automatically forwarded to your main email address.

Think of Hide My Email as a fast-tracked way to get a burner email address from one of the biggest names in tech. And the best part, you don’t need one of the best iPhones to use this feature since even Android and Windows users can sign up for iCloud Plus.

From signing up for newsletters to free trials, Hide My Email can be an incredibly useful feature, especially for those times when you don’t want to use your work or personal email to avoid ending up with loads of spam in your inbox.

Personally, I always thought it seemed too good to be true and according to a new report from 404 Media, that just might be the case. Here’s everything you need to know about this new Hide My Email vulnerability along with some alternatives you might want to try out in the meantime until Apple finally rolls out a real patch for this major flaw.

Not your standard disclosure

Normally with high-profile vulnerabilities, security researchers discover them and then inform the company in question about their findings. Once this is done, they usually give companies a 90-day window to verify the bug, patch it, and test that their fix actually works. Sometimes though, companies might ask for an extension if they’re dealing with a difficult-to-patch, high-severity vulnerability.

According to 404 Media’s reporting, security researcher Tyler Murphy went above and beyond when reporting the Hide My Email vulnerability to Apple back in June of last year. Instead of 90 days, he reported the issue and showed how to replicate it to Apple over a year ago. After waiting all that time, Murphy has finally come out and disclosed the vulnerability to 404 Media.

It’s worth noting though that neither Murphy nor 404 Media have revealed the exact details of this major vulnerability. Apparently though, it’s still exploitable as the news outlet independently verified the flaw this week, uncovering their own reporter's real address using a hidden email alias.

After reporting the issue to Apple, the company told Murphy that it was looking into the vulnerability. From there, Cupertino said that it was fixed back in March of this year. However, during his follow-up investigation, Murphy discovered that it was still exploitable. He then contacted Apple about the vulnerability again, and Apple effectively begged him not to go public, stating they would "appreciate" him keeping quiet until an actual fix rolls out.

As it stands now, Hide My Email can reveal your real email address since a patch that actually fixes this bug hasn’t been released yet.

Hide My Email alternatives you can try right now

Given this is a major vulnerability that completely undermines Apple’s privacy-first focus, I guarantee that if the company wasn’t actively working on a fix, it absolutely is now. However, since your real email address could have been exposed as a result of this bug, you might be considering other alternatives.

Another reason you might want to ditch Hide My Email is due to an upcoming change Apple recently announced in a blog post. Instead of just providing you with a random email address ending in @icloud.com, going forward, all of your new burner email addresses will end with the dedicated @private.icloud.com subdomain. This might seem like a small change, but it’s actually quite a significant one. By switching to a unified, obvious subdomain, the very websites on which you previously used Hide My Email could soon start blocking your burner addresses automatically because they are so easy to identify. If you want to get ahead of that change, here are some alternatives worth considering.

Proton is well-known for its privacy-first tools, and just like Apple, it also has an email forwarding service called SimpleLogin. It’s considered one of the best alternatives to Hide My Email overall, and along with dedicated iOS and Android apps, it also works seamlessly in any web browser. Another cool feature is that you can instantly toggle your email aliases off with a single tap.

Another alternative worth considering is DuckDuckGo’s Email Protection. The privacy-focused search engine’s email alias service is both completely free and very lightweight. It’s built into both its browser extensions and mobile apps and generates a @duck.com email alias. Besides hiding your real email address, this alternative also strips out hidden ad trackers before forwarding replies from your email alias right to your real inbox.

Finally, there’s Mozilla’s Firefox Relay. It provides you with email aliases via a simple browser extension and has a user-friendly dashboard that lets you manage, mask, and delete your email aliases very easily.

Apple’s Hide My Email made email aliases mainstream and has been a godsend for many iCloud users. However, given this recent vulnerability and its potential fallout, no one would blame you for giving a similar service a try.

More from Tom's Guide

• 'Google is force-feeding AI with no way to opt ': DuckDuckGo CEO says installs are surging after Google I/O
• What are anti-censorship features and how is Proton VPN leading the way?
• We asked cybersecurity experts to build a privacy toolbox for $10 per month – here's what they came up with, and more

The Federal Trade Commission is fining Amazon $2.25 million over allegations that the retail giant regularly denied records requests from identity theft victims. The U.S. agency accused Amazon of violating the Fair Credit Reporting Act.

Per an FTC press release, a complaint was filed by the Department of Justice as a referral from the FTC. It alleged that Amazon failed to comply with Section 609(e) of the FCRA, which requires companies to provide victims of identity theft with records about transactions made in their name within 30 days of a consumer's request.

FTC accusations against Amazon

Amazon apparently did not have a written policy for responding to 609(e) requests until last year.

“Amazon often put identity theft victims through a Kafkaesque ordeal by demanding they identify the thief who stole their information before Amazon would release the records the law entitles them to—records that could help victims protect themselves and recover from the fraudulent conduct,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection said in the release.

The complaint claims that customers who reached out to Amazon were often told that the requested records could not be provided for "security" or "privacy" reasons. In one provided example, a consumer tried to get business records related to unauthorized charges from a fraudulent account. However, Amazon reportedly refused for security reasons unless the consumer "guessed the name on the [fraudulent] account," which they were unable to do.

Penalties and resolution

Alongside the $2.25 million civial penalty, the DOJ's proposed order requires Amazon to provide records lawfully requested by identity theft victims and law enforcement agencies. It also requires the company to provide notice to customers about how they can request FCRA records.

Additionally, Amazon is required to contact any customers who requested records since April 2024.

An Amazon spokesperson told Tom's Guide that it has implemented process improvements and resolved the matter with the FTC.

“We are committed to providing customers with their detailed account information when they need it most. We've resolved this matter with the FTC and have implemented process improvements for customers who believe they may be victims of identity theft. Customers who need assistance requesting their records can visit our Help Page to learn more."

How to contact Amazon for Identity Theft records

Amazon has a portal for Identity theft called "Report Suspicious Activity." There you can report unrecognized orders, chargers to your payment methods that aren't from your Amazon account and other unauthorized activity.

You can request records relating to fraudulent transactions via the Request Your Data portal. If that's not enough you can also send an email or physical mail:

By Email: fcra-requests@amazon.com

By Mail: Amazon Legal Department
Attn: FCRA Records Requests
P.O. Box 80161Seattle, WA 98108-9990

You will need to provide a copy of a government ID, a copy of a police report concerning identity theft, or a government-issued Identity Theft Report, found at IdentityTheft.gov. You'll also need relevant details about the fraudulent transaction and contact information so Amazon can reach out.

Amazon says that it will fulfill your requests within 30 days unless more information is needed.

More from Tom's Guide

• Amazon kills Fire Stick sideloading — apparently, malware and piracy are to blame
• Amazon has a hidden button that connects you with a real customer service agent — here's where to find it
• Still shopping blind on Amazon? This ChatGPT trick helps me avoid bad buys — and it works every time

Antivirus software is imperative if you want to avoid the latest threats, from info-stealing malware or ransomware that locks up your computer unless you pay a fine. It works in the background, combating these risks and allowing you to go about your day as you normally would.

Some computers have built-in antivirus software, for example, Window's Microsoft Defender. While this is great for baseline protection, if you want something more comprehensive with more customization, that's where the best antivirus software comes in.

To help you find the best antivirus software for your devices, we spent weeks installing, testing, and uninstalling all of the programs below while taking a close look at their features, extras, and design. We even reached out to customer support to see how easily each company was able to solve common and not so common problems.

Based on our extensive testing, research and the results from third-party labs, Norton 360 Deluxe is our pick for the best antivirus software overall. It’s easy to use and provides effective malware protection without significantly impacting your computer’s performance. You also get plenty of extra features you’ll actually use.

However, there are plenty of other great antivirus providers too, and in this guide we'll take your through all the options. Whether you’re looking to secure a single device or ensure your entire household is protected from the latest threats, this is the best antivirus software you can get right now.

The quick list

The best antivirus software you can buy today

The best antivirus software overall

Norton 360 is an antivirus that perfectly strikes the balance between usability and strong protection, with feature-packed plans that cover just about every cyber threat you could want to protect yourself from.

Norton 360 offers varying levels of protection, depending on which plan you go for. Its standard plan is its cheapest. It costs $42 for the first year and renews at $94, coming in a little cheaper than Bitdefender Total Security, which starts at $109. For this price, you can protect one device against malware, viruses, ransomware, and hackers. You also get Deepfake Protection, 10GB of cloud backup, Dark Web Monitoring, and a VPN.

Its most expensive tier, Norton 360 with LifeLock Select Plus, starts at $99 for the first year and renews at $189. For this price, you can protect up to 10 macOS, Windows, iOS, and Android devices, as well as getting access to features including Scam Protection Pro, 250GB cloud storage, Parental Control, Credit Monitoring Coverage, and up to $25,000 in stolen funds reimbursement, amongst some other extras. This includes SafeCam, which protects your webcam and microphone, and its backup tool Time Machine.

In independent testing, Norton 360 performed incredibly well. AV Test’s February 2026 report certified Norton 360 as a “Top Product” with a 6/6 score across Protection, Performance and Usability — the same score as both Bitdefender and McAfee.

Additionally, AV Comparatives’ April 2026 test, Norton 360 scored 90/100 in AVC, 94.7/100 in Procyon, and 5.3 in Impact. The lower the Impact score, the better, and Norton 360 outperformed Bitdefender, which scored a 9.6/10 in Impact. It was outperformed, however, by McAfee, which achieved a 3.3/10 in Impact.

Finally, in its UK April 2026 report, SE Labs awarded Norton 360’s macOS version an AAA rating with 100% protection accuracy, which is the highest possible rating.

On top of this, its low system impact means that you can run its scans in the background without disrupting your computer's performance, even if you're doing something that requires a lot of system load, like gaming. During testing, where I played Cyberpunk 2077 (Ultra graphics) with Norton 360 running in the background, system impact was minimal. Frames per second (fps) only dipped from 118 to 105 while doing a Full Scan of almost 900,000 files.

When it comes to its downsides, Norton 360 does have a couple. Some of its protection features (like SafeCam) are Windows-exclusive, while others are paywalled.

Additionally, in testing, I found Norton 360's Ask Genie AI assistant was a lot slower and more inconsistent than the AI assistants offered by competitors such as Avast One and Malwarebytes.

Still, regardless of these (relatively minor) shortcomings, Norton 360 is still one of the most dependable and feature-rich antivirus software suites on the market.

• Read our full Norton 360 review

The best antivirus software for features

Bitdefender is a great option if you want feature-heavy antimalware software, thanks to its range of plans for you to choose from.

Unlike Norton 360, however, it does not offer discounts for the first year of use. Its cheapest Consumer plan, Bitdefender Total Security, starts at $109; Bitdefender Premium Security costs $129; Bitdefender Ultimate Security retails for $159; and Bitdefender Ultimate Security Plus costs $189.

These plans all offer different levels of protection, with Total Security having the least security features, and Ultimate Security Plus having the most. Still, Total Security offers protection against malware, ransomware, and network threats, Advanced Threat Defense, which monitors active apps, Cryptomining Protection that fights against apps that you have no knowledge of, Anti-Phishing, Anti-Fraud, Antispam, and more.

For this review, I tested the Bitdefender Ultimate Security plan, which includes all this as well as email protection, Scam Protection Pro that fights sophisticated scams, Digital Identity Protection, as well as a VPN.

Bitdefender's independent testing scores were decent. It achieved 6/6 scores across Protection, Performance, and Usability in AV Test’s February 2026 report, the same as McAfee and Norton.

With this being said, its AV Comparatives’ April 2026 test results were not as good. This test uses benchmarking tools to assess system impact. It scored 85/100 in AVC, 95.4/100 in Procyon, and 9.6/10 in Impact. McAfee performed better with a 90 and 96.7 score respectively.

This was the only test Bitdefender slightly underperformed in, however. SE Labs (U.K.) gave Bitdefender an AAA (highest possible rating with a 100% protection accuracy.

Its protection doesn't hamper your computer's performance, either. I performed a full scan (of over 2.3 million files) while also running Cyberpunk 2077, and it only dipped from 100 fps to 97 fps.

If I could change a couple of things about it, it would be this: adding a Quick Scan option, and allowing its app window to be resizable on Windows. In the grand scheme of things, though, these are relatively minor complaints.

Overall, Bitdefender is a great bit of kit to have in your arsenal for giving you peace of mind against ever-evolving AI and malware threats.

• Read our full Bitdefender Total Security review

The best antivirus software for families

McAfee+ Ultimate is a welcome security package if you have many devices to protect, a big household, and a lot of family members. It does everything you’d want to protect your PC, Mac, or smartphone, and the package doesn’t limit how many devices you can use with your account.

In addition to an extremely powerful antivirus solution, you get features that help protect you (and your family) during your online activities as well. Among the many included features that come with McAfee+ Ultimate is a VPN (with no restrictions to a set file transfer limit), full access to a password manager, identity monitoring, a social media monitoring tool, a text scam detector, and more.

During testing, there were no performance problems during scanning. A full scan of 926K files took 35 minutes, which is the same time as Norton 360 Deluxe, although slightly slower than Bitdefender Total Security. McAfee+ Ultimate also offers options for a quick scan and a five-minute scan if you want to speed things up a little.

Some of the features offered, however, are available in Windows as free tools, like a file shredder and a clean up tool that removes temporary files.

McAfee+ Ultimate's pricing starts out pretty reasonable, usually around $49.99. However, you should keep in mind that after the first year, this price jumps up quite significantly to $149.99. So, if you don’t need many devices covered, it may not be worth the fee.

McAfee+ Ultimate offers an unlimited VPN, which is handy for those who want a VPN along with their antivirus. During testing, we found the unlimited VPN easy to configure and use. Additionally, its features, like the password manager, were easy to install and worked as expected.

McAfee+ Ultimate's antivirus protection scores in independent tests are outstanding overall, achieving a protection rate of 99.5% in AV-Comparatives' tests published in December 2025. Its false positives score was excellent too, on par with Bitdefender Total Security, and better than Norton 360 Deluxe, Malwarebytes Plus, and Avast Premium Security.

The main drawback here is the higher price point, although if you’re covering multiple devices, then you may find it worth it. Still, if you're after a budget antivirus, consider Malwarebytes Plus.

• Read our full McAfee+ Premium review

The best antivirus software for banking

Avast One offers not only excellent antimalware and antivirus protection, but also protection against AI-generated scams, deepfakes, suspicious texts and links, and more.

The biggest plus about Avast One is that it offers a completely free tier, which is great if you want to protect yourself without breaking the bank. This blocks viruses and malware and offers protection against ransomware, as well as allowing you access to Avast’s AI-powered assistant for catching scams.

On top of this, you also get a 60-day trial of SecureLine VPN. Extra features, like Scam Guardian Pro, AntiTrack, and firewall, can be activated from within the app. These are all paid add-ons, but the good news is that you can pick and choose which ones you need, instead of paying for an all-in-one package, such as the tiers offered by Bitdefender and Norton 360.

During testing, I used Avast Premium Security, which includes Wi-Fi protection, WebGuard, which uses AI to block scam websites, and Mail Shield, which monitors your email address for threats.

Avast was rated as a top product by AV Test’s February 2026 report, achieving a 6/6 score across Protection, Performance and Usability. In AV Comparatives’ April 2026 test report, Avast ranked 6th on the list, just under Norton 360, with a 90/100 AVC score, 94.5/100 Procyon score, and a 5.5 Impact score. Finally, it achieved the highest rating possible of AAAwith a 100% total accuracy percentage in SE Labs (U.K.) April 2026 report.

Unlike some competitors (like Bitdefender), Avast One offers a few different types of scans: Smart (quick), Full, Targeted (custom), and Boot-Time. I ran a Full Scan, which took 6 minutes and 12 seconds, which is a lot quicker thanBitdefender's full scan, which took 26 minutes and 23 seconds. However, Avast One doesn’t tell you how many files it has scanned, unlike Bitdefender.

I tested the impact of these scans by running Cyberpunk 2077 while running them and measuring the slowdown. During a Full Scan, Cyberpunk 2077 dropped from 99 fps to 96 fps, meaning the impact was barely noticeable at all.

However, if you're looking for antivirus protection for your family, you may be a bit disappointed to learn that Avast One does not feature built-in parental controls, unlike Bitdefender. Additionally, it can only protect up to 10 devices, meaning if you have more devices than this, it may not be suitable.

Still, if you want antivirus software that offers swift and diverse system scanning as well as modern AI threat analysis, Avast One is a great choice.

• Read our full Avast One review

The best budget antivirus software

Malwarebytes is user-friendly, excellent value for money and includes some great tools like an AI-driven Scam Guard and Digital Footprint Scanner to keep you safe from cyber threats.

As with the other antivirus software providers on this list, Malwarebytes has a range of different plans that cover various needs and requirements. It has three consumer plans, with its Standard plan available for $44 / £29 per year. This plan offers basic protection against malware, viruses, and more on one device only.

The next step up is the Plus plan, which costs $79 / £49 annually. It includes everything offered by Standard, plus a high-speed VPN and anonymous browsing.

Malwarebytes’ most expensive plan is called Ultimate in the U.S. ($279 per year) and Total in the U.K. (£129 per year). Regardless of what they are called, Ultimate and Total feature Advanced Social Media Monitoring as well as $1 million in identity insurance. While these are great features, this plan is pricier than both Bitdefender and Norton 360, although there are also various Family plans starting from $149 / £109 per year.

You don't have to fully commit off the bat, though. Malwarebytes offers a 60-day money-back guarantee — just like Norton 360.

One thing I did find slightly disappointing about these plans was that none of them offer cloud backup and storage or parental controls. If these are features you desperately want, you'd be better off checking out Bitdefender, Avast One, or Norton 360.

In independent testing, Malwarebytes performed decently. In AV Comparatives’ April 2026 test report Malwarebytes scored 75/100 in AVC, 97.4/100 in Procyon, and 17.6 in Impact. The Impact score is a little worrying, however, as it means that (on paper at least) Malwarebytes has a negative impact on your system resources. Bitdefender (9.6), Avast (5.5) and Norton 360 (5.3) all performed better than Malwarebytes in this area.

In SE Labs (U.K.) April 2026 report, Malwarebytes Premium was awarded an AAA rating with 97% protection accuracy. While this bad at all, it should be noted that Bitdefender, Norton 360 and Avast One are all rated 100% for their protection accuracy.

Malwarebytes offers three scan levels —Threat Scan (quick), Deep Scan (full), and Custom Scan (targeted). The quick scan option is nice to see, and gives it an edge over the likes of Bitdefender, which don't offer these options. In testing, its Threat Scan was completed within 22 seconds, having scanned over 176,000 files without detecting any anomalies or threats. Its Deep Scan took 14 minutes and two seconds to finish, and scanned a total of 427,157 files — a little less than Bitdefender, which scanned over two million files in 26 minutes.

To test its impact on system performance, I ran Cyberpunk 2077 while these scans ran in the background. Cyberpunk 2077’s frame rate dipped a fair bit, from 87 to 75. While this isn't the worst impact on performance, especially as I didn’t notice any stuttering or lag while playing the games, with Bitdefender I achieved 97fps in Cyberpunk 2077 with the software performing a Full Scan.

Overall, Malwarebytes is user-friendly and offers a great range of features to keep you and your devices safe and malware-free. However, it is lacking in a couple of key areas, and its system impact does leave a little to be desired.

• Read our full Malwarebytes Plus review

Also tested

We test a lot of apps when searching for the best antivirus software, but only a handful can reach the top spots. If you're after more options, here are some other great antivirus packages that didn't quite make the mark.

How we test the best antivirus software

We test each antivirus program and evaluate its interface, performance, protection, extra features and — above all — overall value.

After timing and rating the installation process’s ease, we looked at whether the interface was simple and straightforward, convoluted and difficult to grasp — or something in between.

Next, we went through all the major and many minor features that each suite provides, including VPN access, file shredding and backup software, if included.

As far as performance goes, we measured how much the system slowed down while the program was scanning for malware using a Lenovo ThinkPad T470 with a 2.5GHz Core i5-7200U processor, 8GB of RAM and 256GB of solid-state storage containing 43.3GB of files.

To gauge each program’s impact on system performance, we used our custom Excel test which measures how long a PC takes to match 20,000 names and addresses on a spreadsheet. The longer the task takes versus a baseline reading, the more the system performance is impacted.

For malware detection performance, we referred to results from tests conducted by three independent labs: AV-TEST in Germany, AV-Comparatives in Austria and SE Labs in England.

Each lab periodically subjects major antivirus programs to stress tests that include thousands of pieces of malware as well as hundreds of “zero-day” samples that the software has to learn to recognize.

We paid particular attention to false positive readings of safe software deemed dangerous by the program under review as an indication of the precision of the program’s scanning technology.

How to choose the best antivirus software for you

When choosing an antivirus software, the top priority among all other decisions should be how well it performs to keep your system safe from malware and viruses.

To help you determine which of the many options out there will be the best at protecting your devices, we use results from tests conducted by three different independent labs to help us determine which antivirus program excels at finding and eliminating malware threats.

We also perform our own tests to see how much each program slows down your system, and how many resources it will consume to run both while scanning and while running in the background.

You’ll also want to read reviews online to see what other users have to say about their experiences with using the software, how it performed, what the interface was like, and how responsive the customer service was.

Next, consider the needs of your household and what devices you want to protect. How many family members do you have in the home? How many devices does each person need coverage for? What platforms do each of those devices use, and are the features they'll need available on these platforms?

Make a list of what devices and operating systems you need coverage for, as not all antivirus programs will cover all of them, and some will offer bundles for multiple family members or devices.

Narrow down the features you would like to see included in your antivirus program – because most antivirus programs offer so many features, it’s easiest to start out by making a list of what features are most important to your needs.

Do you also need parental controls? Is a VPN important to you? Would you like a password manager or file shredder? What about a hardened browser, a firewall, or webcam protection? Think about what you’d like most as additional security features and list them out, and see what the top antivirus programs offer.

Lastly, consider how much you want to spend — some antivirus programs will offer bundles for their suites, or tiers, that will package deals that include numbers of licenses or devices protected for a single purchase. You should also check a company’s website for any trial offers, as many will give you 30 days to try out their program for free before purchasing. Just make sure to cancel before the trialis over, or risk paying for software you don't want.

Free vs paid antivirus software

With so many antivirus programs to choose from, there’s absolutely no reason for your PC or smartphone to go unprotected — especially when there are free programs available to choose from as well. So, why would you bother paying for something that you didn’t have to?

Well, there are lot of reasons to choose one antivirus program over another but if you’re looking specifically at just free versus paid antivirus programs there are a few reasons to choose one over the other.

Free antivirus software will always provide users with basic protections against the most common malware threats, and will block dangerous files and applications. It should also warn you about suspicious websites, offer a cleanup option for infected files or apps and recognize when unknown devices are using your network.

However, a paid option is going to go a step beyond and offer more comprehensive security features — more advanced protections against unknown or upcoming threats, a more thorough feature set including VPNs, password managers, a file shredder that will fully remove deleted files and may cover more devices including tablets and smartphones.

Paid antivirus software also generally includes customer support via phone, chat or instant messaging and email whereas free versions will not. Plus, they add functions like an ability to customize your antivirus service, a feature to block suspicious sites, and a backup service to save data or back up devices.

It might also include features like webcam protection, remote control prevention to keep others from controlling your system, and the ability to run apps or software in a “sandbox” setting.

Paid antivirus software also generally includes customer support via phone, chat or instant messaging and email whereas free versions will not. If just the basics will do, a free version will be enough but if you’re looking for something more then it’s worth looking at some paid options.

Antivirus FAQ

Even though you should always download new apps from official sources like the Google Play Store, some Android users still end up getting tricked into downloading them from websites which can be extremely dangerous. Case in point, a new Android banking trojan is currently making the rounds online that’s distributed via fake apps from malicious websites.

As reported by BleepingComputer, once installed on vulnerable Android phones, the banking trojan in question is capable of targeting over 200 banking and financial apps to drain accounts and steal crypto. Unsurprisingly, it does so by impersonating Google Chrome and TikTok as both apps are extremely popular.

The trojan installs the new Rokarolla malware which also steals lock screen credentials, your contacts, SMS data and even uses keyloggers to record everything you type into your phone.

Here’s everything you need to know about this new Android banking trojan and how you can keep your bank account safe from the cybercriminals using it in their attacks.

Masquerading as Google Play Protect

Although you should never sideload Android apps unless you absolutely have to, many people still do despite the risk. The hackers behind this campaign use fake websites to trick unsuspecting users into installing Chrome or TikTok unofficially instead of downloading these apps directly from the Google Play Store like they should.

According to a new report from the cybersecurity firm Zimperium, after downloading either app though, the hackers use an interesting trick to give potential victims the illusion of safety. For those unfamiliar, Google’s built-in security app Google Play Protect checks any new software you download for viruses. However, in this case, a fake Play Protect pop-up appears before the Rockarolla malware is actually downloaded. Given the fact that the pop-up perfectly impersonates a Play Protect warning, most users wouldn’t think twice before proceeding with this secondary download.

At this point, the damage is done and the Rockarolla malware gets to work. In total, it’s able to spoof 217 different banking and financial apps to steal your credentials. It does so by using overlays that mimic each individual app. While to the end user it appears as if they’re just logging into their online bank account, they’re actually handing over their username and password to hackers.

Another interesting trick up Rockarolla’s sleeve is that it can steal SMS notifications from your online bank as well as intercept any calls trying to warn you that something is amiss. This way, you won’t get a fraud alert and the hackers can proceed to empty your accounts one by one.

While Google continues to improve Android’s security, if you don’t download apps the right way, you too could easily end up falling victim to this and other malware.

How to stay safe from Android banking trojans

I can’t stress this enough, unless you really know what you’re doing, you should avoid sideloading apps. Sure, malicious apps do manage to sneak past Google’s defenses from time to time but for the most part, if you download new apps from the Play Store, you should be safe. The same goes for other official Android app stores like the Samsung Galaxy Store too.

From there, you want to make sure that Google Play Protect is installed and enabled on your smartphone. It’s enabled by default on all of the best Android phones but it’s always a good idea to check to make sure. For extra protection though, you can also use one of the best Android antivirus apps alongside it. You have to pay for many of them but they typically add other useful features like a VPN or password manager to help keep you safe online.

Despite constant warnings, people keep installing apps from websites instead of official stores. As long as this keeps happening, hackers are going to use it to their advantage. However, if you install new apps the way you’re supposed to, you can avoid falling victim to Rockrolla and other banking trojans like it.

More from Tom's Guide

• Popular Steam wallpaper app hijacked to spread dangerous malware — how to stay safe
• Update your Nvidia GPU drivers now to protect your PC from 9 "high-severity" vulnerabilities — here's what's at risk
• I just got hit by the Ultrahuman data breach — here's what hackers stole from my account

If accidentally downloading malicious apps and getting your computer infected with viruses wasn’t enough, these days, you can’t even trust your own eyes and ears thanks to deepfakes.

Just a few years ago, you only had to look out for phishing emails, fake websites and dodgy attachments from unknown senders. Now though, thanks to AI, you can just as easily be fooled by a very convincing fake image or video.

Fortunately, in the same way that cybercriminals are now using AI in their attacks, so too are cybersecurity firms. While Norton and the rest of the companies behind the best antivirus software use cloud-based AI to better analyze and detect new threats, this isn’t your only option when it comes to staying safe online.

You can also do so yourself locally but you will need a computer with its own neural processing unit or NPU. Thankfully, the best AI laptops with chips from Intel, AMD, Qualcomm and even Apple have you covered. However, when I bought my trusty ThinkPad a few years ago, this wasn’t an option yet.

After trying out Norton’s Deepfake Protection for myself though, I’ve become an NPU believer. While laptop makers tried to sell us on AI-powered features like portrait lighting, auto-framing and live captions, as it turns out, set–and-forget online security was what finally convinced me in the end.

No more second guessing

In the past, you always had to be careful when checking your inbox or navigating to unfamiliar sites. With the rise of deepfakes though, online scams can appear where you’d least expect them like on a job interview or even a video call with a loved one.

For instance, let’s say you’re looking for a new remote job and make it to the interview stage. You hop on Zoom, Google Meet or Microsoft Teams and expect the other attendees to be actual people, right? Well with deepfake videos becoming more advanced every day, they might not be.

Alternatively, maybe an urgent video or audio clip arrives in your messages from a loved one who’s in trouble. The message may look and sound just like them but the whole thing could actually be fake and an attempt to con you out of your hard-earned cash.

AI-powered scams are here to stay but if you use Norton’s Deepfake Protection, they’ll get flagged before they can do any real damage just like how its antivirus detects and prevents you from interacting with malware. From giveaway scams to crypto fraud, this feature runs locally on your device to analyze and detect synthetic voices so you don’t have to keep guessing whether or not something is real.

While I know most of us believe we’re tech-savvy enough to spot these kinds of things, that isn’t always the case. And all it takes is one slip up to end up in a very bad situation. Likewise, for those of us with older parents or relatives, we can rest easy knowing we won’t get a frantic phone call in the middle of the day as they’ll be protected.

Just like with deepfakes themselves, I had to experience this new feature for myself, so I installed Norton 360 on my laptop, toggled Deepfake Protection on and took it for a spin.

Deepfake protection (at a cost)

With Norton 360 installed on my laptop, I headed to the Scam Protection tab where in addition to Deepfake Protection, you can also enable Safe Web to keep you protected from risky websites and other online scams as well as Safe SMS which uses AI to flag scam text messages.

In Deepfake Protection’s settings, you can toggle on an auto-scan feature and another one that notifies you when AI-generated voices are being used on a site you’re visiting or in a video you’re watching. It’s all fairly simple and there aren’t too many settings to configure which makes it easy to set up regardless of how skilled you are on a computer.

In my case though, there was just one catch. Since I don’t have an AI laptop, Norton’s Deepfake Protection does require more system resources. Thankfully, my ThinkPad was powerful enough that I could just enable it right from within Norton 360. However, if you’re using an older laptop with fewer than six CPU cores and less than 8GB of RAM, you will need to manually install it but Norton walks you through the process in this support article.

While Deepfake Protection works automatically in the background, you can also manually enable it too. On the right side, there’s a Start button and clicking on it analyzes the audio or video playing in any app. This could be particularly useful if you’re on a video call in an app as opposed to through your browser.

Although I like the simplicity of Norton’s Deepfake Protection, I was a bit let down that I couldn’t manually select files for local analysis. I get that the feature runs in the background but it would be nice to be able to drag and drop pictures or videos saved on your computer — perhaps from a messaging service like WhatsApp — to have them analyzed just to be sure.

Finally sold on an NPU

During my testing, I didn’t see much of a performance hit on my ThinkPad. However, that doesn’t mean that over time, running Norton’s Deepfake Protection on a non-AI laptop won’t affect your workflow. If you’re trying to do something intensive like render video, you’re going to need all of your laptop’s processing power and something like this running in the background could slow things down.

While you can run Norton’s Deepfake Protection on older laptops, this feature and the added peace of mind it brings is what finally convinced me that paying a bit more for a computer with an NPU in its processor is absolutely worth it.

When AI laptops first hit store shelves, they were a harder sell as the features offered at the time just weren’t useful enough to justify the higher prices of these new devices. Now though, you can put that extra bit of silicon to much better use by having it proactively keep you safe from deepfakes and other online scams in the background.

Years ago when I first started covering antivirus software, its performance impact was a critical factor that couldn’t be overlooked. While this is still true today and we continue to see how running scans can affect performance, NPUs have changed things significantly. I never thought deepfakes would sell me on NPUs, here we are.

As for Norton’s Deepfake Protection, I expect it will only get better over time just as the effectiveness of its antivirus has. Sure, cybersecurity will always be a game of cat and mouse but with an NPU inside your laptop, at least you can fight that fight locally instead of over the cloud.

More from Tom's Guide

• I tried 3 AI-powered scam detectors to help keep me safe online — and there's a clear winner
• Popular Steam wallpaper app hijacked to spread dangerous malware — how to stay safe
• I found a phishing email in my inbox and a malicious app in my news feed — here’s how I knew they were scams

Hackers are once again targeting gamers on Steam, but this time, instead of using malware-filled games to do so, they’ve switched to hiding malicious code in desktop wallpapers.

As reported by BleepingComputer, these infected wallpapers can prove quite dangerous for unsuspecting gamers as they can provide an easy way to install a backdoor on one of the best gaming PCs or even to hijack their Steam accounts.

Any image you download online could contain malware. However, the hackers behind this campaign are leveraging an incredibly popular Steam app to do so instead. With 20 to 50 million installs according to SteamSpy, Wallpaper Engine is one of the most downloaded apps on the platform.

What makes Wallpaper Engine so popular, though, is that users can download hundreds of thousands of desktop wallpapers made by other users through Valve’s community hub, Steam Workshop. By abusing this feature, the hackers are easily able to disseminate their infected wallpapers.

Here’s everything you need to know about the latest malware threat on Steam and how you can keep your account — and your gaming PC — safe from hackers.

Malicious application wallpapers

For those unfamiliar, in addition to static wallpapers, Wallpaper Engine also supports four dynamic wallpaper types that can render videos, interactive scenes, webpages with audio and video, and applications. That last one is incredibly important in this campaign.

Unlike a JPEG or PNG file, Wallpaper Engine’s application wallpapers are full-on Windows executables that run like any other program on your PC. According to researchers at the cybersecurity firm Kaspersky, not only do they pose a built-in security risk, but they’re also currently being used by hackers to deliver malware to unsuspecting Steam users.

In a blog post, Kaspersky’s researchers explained how they discovered dozens of malicious application wallpapers on Steam Workshop, many of which had been downloaded thousands or even tens of thousands of times. By analyzing the application wallpapers in question, the researchers found that the malware is either bundled directly into their installation packages or hidden inside password-protected archives that users are then tricked into opening. Unfortunately, the damage is done immediately after one of these compromised wallpapers is installed.

After a user installs one such asset posing as a game called NTRaholic, the wallpaper launches as expected. However, in the process, a backdoor file belonging to the DarkKomet malware is also installed in the background. In order to search for and steal Steam credentials, a custom version of a system library called ‘AggregatorHost.dll’ is installed as well.

In addition to DarkKomet, Kaspersky’s researchers also found other malware families installed in these malicious wallpapers, like the Lumma and Vidar infostealers. They were even used to spread ransomware, too.

How to stay safe from malware

Fortunately, after Kaspersky alerted Valve about this campaign, all of the infected wallpapers in question were removed from the Steam Workshop. Still, this is an excellent reminder to always be careful when downloading files online, even if they come from a trusted platform.

In order to stay safe from any malware contained within desktop wallpapers, game mods, or games themselves, you definitely want to make sure your gaming PC is protected with the best antivirus software. If you want to be extra careful, you might also consider investing in one of the best identity theft protection services. That way, if your credentials are compromised as a result of what you download online, you have a safety net to help monitor your data and recover financial losses from fraud.

When in doubt, stick to trusted creators when downloading new wallpapers and be extra cautious before running any executable on your gaming PC. This likely won’t be the last time hackers target Steam in their attacks, but Valve has an excellent track record of quickly responding to and dealing with malicious activity on its platform.

More from Tom's Guide

• I just got hit by the Ultrahuman data breach — here's what hackers stole from my account
• Update your Nvidia GPU drivers now to protect your PC from 9 "high-severity" vulnerabilities — here's what's at risk
• I just tried Asus’ upgraded Xbox Ally X20 for ROG’s 20th anniversary — and it isn’t just another special edition handheld

Google Chrome's next update could be the final nail in the coffin for some of the best ad blockers like uBlock Origin. As per a Cybernews report, Chrome is set to finally drop support for Manifest V2 extensions, which would mean the end of support for Chrome's ad blockers.

Google began the shift over to Manifest V3 last year, but the report notes the next iterations of the browser — either version 150 or 151 — will remove the older framework completely.

“MV2 extensions are no longer allowed in any supported version of Chrome, and we are removing support for them and the associated functionality," Google engineer Devlin Cronin wrote in a Chromium commit confirming the change.

"We won't be able to provide/maintain this functionality indefinitely due to the complexity and tech debt, as well as the security risks it entails."

Shifting Chrome fully to Manifest V3 won't stop new ad blockers from being developed (in fact, some services like AdGuard, AdBlock, and Ghostery have been updated for V3), but it does impose restrictions. Manifest V3 will cap the number of filtering rules an extension can apply, which could theoretically foil ad blockers' attempts to respond to the latest ad-deployment technology.

Of course, there are some benefits to this new system. Many Chrome extensions that seem legitimate are actually loaded with malicious code. Chrome's new, more rigid Manifest V3 system will be better equipped to put a stop to that.

What does this mean for those that want to block ads?

The simplest answer for those who want to continue blocking ads after the latest version of Chrome rolls out is to switch browsers. This change will likely affect other Chromium-based browsers like Opera, Edge, and Samsung Browser, albeit not for a while yet.

However, Mozilla's Firefox browser doesn't use Chromium and has no current plans to remove the MV2 framework extension, so switching over could be a viable option if people want to continue running uBlock Origin. Similarly, the privacy-focused Brave browser could be another way to keep your favorite extensions running.

Finally, if you're determined not to see ads, you could investigate signing up for a desktop app that will block ads for you — rather than relying on a browser extension. This may be more costly, but it will also likely be more effective at catching those adverts that interrupt your browsing.

More from Tom's Guide

• A VPN will be an essential part of my summer vacation packing — here's why
• 3 hidden ChatGPT settings most people never turn on — and why you should
• Verizon MVNOs: A complete listing, plus the best option for your money

Like many people, I've started using ChatGPT for shopping. I'm already using the chatbot throughout the day, and when it started recommending products and retailers, it felt like an easy way to save time. Instead of opening a dozen browser tabs, I could compare products, find alternatives and track down the best deals in a single conversation.

At first, it worked surprisingly well. Then I got scammed.

[UPDATE]

The following is a response from OpenAI:
"We're aware of a small number of potentially deceptive sites that have appeared in shopping-related results in ChatGPT. We've taken action on the ones we've identified and are continuing to improve our safeguards to make them less likely to appear in the first place."

I thought I was buying from a real store

What I thought was the official website of a popular swimsuit company turned out to be a fake store. The site looked legitimate and the branding matched, even the product photos looked authentic. I had no idea scams like this existed so I placed an order for a swimsuit and a pair of shorts and waited for them to arrive. But, when they never came, I contacted the real company and I learned they had never received my order.

That's when I realized that just because ChatGPT recommends a retailer doesn't mean that retailer is legitimate.

To be clear, this is largely a web problem rather than an AI problem. ChatGPT is pulling information from the internet, and scammers have become remarkably good at creating websites designed to look trustworthy. Some fake stores copy branding, product photos, customer service information and even entire website layouts from legitimate businesses. In fact, I've previously covered how easy it has become to clone a website using AI tools and a simple prompt.

That experience changed the way I shop online. Now, whenever ChatGPT, Gemini or another AI assistant recommends a retailer I've never used before, I spend a few extra minutes verifying it's real before I buy anything.

Here are the seven warning signs I look for now.

1. The URL doesn't match the brand

This is always the first thing I check. Scam websites often use addresses that look almost right but contain extra words, numbers or unusual domain endings.

For example, a legitimate retailer might use 'brandname.com" while a fake version might use "brandname-sale.com" or "brandname-outlet.shop" or "official-brandname.store." At a quick glance they can look convincing, especially when you're focused on finding a product.

Before entering payment information, I always double-check that the website address matches the retailer's official domain.

2. The discounts seem too good to be true

A sale alone isn't suspicious, but a 90% discount on nearly every item usually is something to question. In my case, the price was 50% off, which seemed particularly good, but not suspicious. But scammers know that urgency and excitement can override common sense. If every product appears heavily discounted and inventory seems unlimited, that's a major red flag.

Whenever I see prices that seem dramatically lower than every other retailer, I compare them with a few trusted stores before moving forward.

3. The site's contact information is vague or missing

This wasn't a red flag until I went back to the website to look for a contact number to find my order. There wasn't any "Contact Us" section. Legitimate retailers generally want customers to contact them, which is why most established stores provide some combination of customer service phone numbers, email addresses, physical business addresses, return policies and support portals.

If a website offers little more than a generic contact form, I become cautious immediately. A missing customer service presence doesn't automatically mean a site is fake, but it's enough to make me investigate further.

4. The writing feels strange

Ironically, in the age of AI, bad writing is still one of the easiest warning signs to spot. Many scam websites contain awkward grammar, random capitalization, poorly written policies and generic product descriptions. Yet, some are incredibly good, so good that they might have even been copied directly from the real company's site.

Take a few minutes to poke around the site and make sure things seem legit. After I was scammed, I looked around the site and everything appeared well written and professional, so you may just need to trust your gut or call the real company directly.

5. The reviews only exist on the website itself

A page filled with glowing five-star reviews doesn't tell me much anymore. Instead, I search independently. I look for mentions on forums, Reddit, Trustpilot, Google Reviews and other third-party sources.

If a retailer has supposedly been operating for years but has almost no presence outside its own website, that's something I pay attention to.

6. The checkout process feels rushed

Most websites have a checkout that asks you to confirm your order. But many scam stores try to create artificial urgency and leave out steps for confirmation once they have your credit card locked in.

The site or checkout might have messages such as: "Only 1 left!" "Sale ends in 10 minutes!""23 people are viewing this item right now!"

I've been to plenty of legitament websites that do that, but fake sites do these types of pessure tactics to push shoppers into making quick decisions. Now, if I feel rushed, I slow down. Scammers benefit when buyers don't stop to think.

7. AI is the only place I found the store

This may be the biggest lesson I learned. If ChatGPT, Gemini or another AI assistant recommends a retailer I've never heard of, I don't assume the recommendation has verified the company's legitimacy. In my case, the store was legitamate but the swimming suit was not available anywhere else.

If the website or stock seems strange, leave the AI chat and do a few independent checks. If you can't find the retailer through a normal Google search or no other website mentions it and its reputation can't be verified outside of the AI reccomendation, it's a giant red flag.

My takeaway

Getting scammed made me feel a variety of emotions. Besides being out of $150 and a swimming suit, I learned a tough lesson: don't treat AI recommendation as endorsements.

AI can be an excellent shopping assistant, but the same web that helps AI find useful information also contains misleading information, fake stores and sophisticated scams. Today, whenever an AI tool points me toward a retailer I've never used before, I take an extra minute to verify what I'm looking at.

That small pause may be the difference between finding a great deal and becoming someone else's cautionary tale.

More from Tom's Guide

• Google just supercharged NotebookLM — these are the 3 new features I'm testing first
• Apple Intelligence just got its biggest upgrade yet — here are all the new features announced at WWDC 2026
• Apple finally fixed Siri — here's all the features for the new Siri AI announced at WWDC

I'm sorry to report that I'm one of the victims in the Ultrahuman data breach, which includes wellness data. Yesterday, certain Ultrahuman users got an email from Mohit Kumar, the company's founder and CEO, alerting them of a “security incident” that occurred on 27 March 2026.

Kumar said: “The most important facts first: no passwords, card details, or payment data were involved, and we have found no evidence of misuse.” As a health and fitness editor, I'm constantly testing the latest wearables, and it turns out I've been compromised and, according to Ultrahuman, my data is now at risk.

The company, best known for its smart rings, reportedly has up to 700,000 users globally. The breach targeted an internal analytics system, rather than Ultrahuman’s core user database, so it’s thought that only around 1,000 users are affected. Let’s look at what’s been taken and the steps Ultrahuman has taken to reassure users like me.

What have the hackers stolen?

According to the email that landed in my inbox last night, the “affected dataset” contained just one single piece of personal information: my email address. In the grand scheme of things, that's not too bad.

A statement on the Ultrahuman website confirms that for other users, this won’t be the only data accessed by hackers.

“The information visible to the unauthorised individual varied by account. The dataset that was accessed contained, depending on the user, contact and account details, order and transaction history, and for a smaller group of users, some fitness related data associated with their product usage and purchases.”

Kumar goes on to write: “No passwords, payment or credit card information, account details, transaction history or wellness data were accessible or affected by this incident. Your Ultrahuman Ring continues to operate normally and to record accurate wellness information.”

What has Ultrahuman advised?

The email goes on to advise me to “be alert to phishing attempts. If you receive any unexpected email, SMS, or telephone call referencing Ultrahuman, your orders, or your personal data, please treat it with caution, particularly where it conveys urgency or requests that you click a link.”

In a week that’s seen Oura launch the Oura Ring 5, and reports building about a new Samsung Galaxy Ring, what this data breach will do to Ultrahuman’s reputation remains to be seen.

I reached out to Ultrahuman, and they responded with the following statement:

"On March 27 2026, the wellness data of 0.1% of users was accessed via unauthorized access to an internal tool. No passwords or payment data were accessed, and the Ultrahuman Ring and production system weren’t compromised.

"We’ve taken our time to properly comply with the process of informing regulators and auditing the full scope of what was and wasn't affected. We wanted to inform users precisely what data was involved rather than guessing, and have taken steps to ensure this never happens again."

Have you had your personal details stolen through a data breach? Let me know what happened in the comments below.

More from Tom's Guide

• I've been using the Fitbit Air for over a week, and my favorite feature has completely changed the way I wake up
• The Fitbit Air is basically just a screen-less Fitbit Inspire 3 — and that’s a very good thing
• Forget the Whoop 5.0 — The new Fitbit Air is a screen-less, subscription-free fitness tracker for the masses

Antivirus software is imperative if you want to avoid the latest threats, from info-stealing malware or ransomware that locks up your computer unless you pay a fine. It works in the background, combating these risks and allowing you to go about your day as you normally would.

Some computers have built-in antivirus software, for example, Window's Microsoft Defender. While this is great for baseline protection, if you want something more comprehensive with more customization, that's where the best antivirus software comes in.

To help you find the best antivirus software for your devices, we spent weeks installing, testing, and uninstalling all of the programs below while taking a close look at their features, extras, and design. We even reached out to customer support to see how easily each company was able to solve common and not so common problems.

Based on our extensive testing, research and the results from third-party labs, Norton 360 Deluxe is our pick for the best antivirus software overall. It’s easy to use and provides effective malware protection without significantly impacting your computer’s performance. You also get plenty of extra features you’ll actually use.

However, there are plenty of other great antivirus providers too, and in this guide we'll take your through all the options. Whether you’re looking to secure a single device or ensure your entire household is protected from the latest threats, this is the best antivirus software you can get right now.

The best antivirus software you can buy today

The best antivirus software overall

Norton 360 Deluxe offers solid, real-time malware protection with plenty of scan options and little impact to performance. It also has more features than you can shake a stick at.

Norton's familiar interface highlights important and common functions, making them easy to find and easy to drill down to find more advanced features.

From a webcam blocker and warning for suspicious websites, to intrusion detection against botnets, brute force attacks, and file and print sharing vulnerabilities, this package has all the features you need to protect yourself while you're online. You'll also get a firewall, password manager, VPN, parental controls, and ransomware rollback.

These features do all come at a price, however, and that is literally a higher price. At $119.99 per year — after the first year, as Norton does offer some introductory prices that can lower this price for your first annual subscription — Norton 360 is one of the more expensive pieces of antivirus software on this list. It also only offers coverage for up to five devices. However, if these features are what you're after, then you might find it worth it. If you're just looking for an antivirus on the cheap, you might be better off going for Malwarebytes Plus.

Additionally, during our testing, we found that the features were a bit of a mixed bag, performance-wise. Some of them were mainly just alert-based rather than solution-focused, and therefore not as useful as they could be. For example, if you use its dark web scanner to see if your sensitive information has been leaked on there, you can’t automatically fix any issues unless you purchase the Privacy Monitor Assistant add-on for $109.99 a year (you could still fix it manually yourself for free, though).

As well as this, Norton 360 does not include a file shredder or file encryption. If these are absolute musts, then you might want to go for McAfee+ Premium.

When it comes to scanning options, Norton 360 Deluxe includes a quick scan, a full scan, or a pre-boot deep scan, all of which ran very fast and none of which impacted overall performance.

Norton 360 Deluxe’s antivirus protection scoring is overall fairly excellent in independent lab testing where they’ve consistently ranked in the top tiers. For example, in AV-Comparatives' December 2025 tests, Norton 360 Deluxe achieved a protection rate score of 100%. It did have a slightly higher false positive rate than that of Bitdefender Total Security and McAfee+ Ultimate, however, its score was the same as Avast Premium Security.

• Read our full Norton 360 Deluxe review

The best antivirus software for features

If you're looking for a straightforward antivirus, look no further than Bitdefender Total Security. It provides great value in terms of protection and extra features, has little discernible impact on performance, and has a straightforward interface that helps you find what you need without any fuss.

It's a little cheaper than Norton 360, with the first year running at $59.99, although the subscription fees rising to $109.99 afterwards. This price includes excellent, real-time antivirus protection as well as features like a free VPN (although it is limited to 200 MB of data per day), a firewall, an anti-spam feature, a secure browser, phishing, and webcam protections.

During testing, we found the included features were all useful, particularly the webcam and microphone privacy feature that blocks unauthorized access, the optimization app that helps speed up your PC by removing unnecessary files, the data protection utility that securely deletes files, and the Safepay browser that protects financial transactions.

Bitdefender Total Security has a range of scans available, including quick or full system scans, as well as custom scans for single files or folders. It's exceptional at isolating files, protecting you from ransomware, and blocking infections before they occur. In our testing, the quick scans took only a few minutes while a full scan of 1.5M files took 30 minutes, making it faster than Norton 360 Deluxe.

During independent testing, Bitdefender Total Security performed exceptionally well, achieving an antivirus protection rate of 99.1% in AV-Comparatives' tests published in December 2025. While this is slightly lower than both McAfee+ Ultimate and Norton 360 Deluxe, it is by between 0.5-0.9%. Additionally, its false positive rate was lower than that of Malwarebytes Plus, Norton 360 Deluxe, and Avast Premium Security.

The software has built-in features that will learn your computer’s file structure, which should improve scan times as well. The Advanced Threat Detection feature is a more proactive scanning feature that monitors for suspicious activity in real-time in order to be able to intercept threats before infections occur. Plus, there’s a Ransomware Remediation feature that blocks intrusive software from infecting sensitive files.

During our testing, we found the interface clear and efficient to use — it even has a customizable dashboard where your most-used utilities can be added (and ones you don’t use, removed). It also includes a VPN map, so you can see where you're virtually connected to.

One of the downsides is the fact that the VPN is limited to just 200 MB per day. With a limit like this, you're unlikely to be able to do any high-bandwidth activities while connected, like streaming movies or TV, or gaming. If you want an antivirus with an unlimited VPN, consider McAfee+ Premium.

Additionally, the password manager included with your subscription is a 30-day free trial version, which is not particularly useful. If you want to continue using the password manager after these 30 days, you'll need to pay $19.99 for an annual subscription. Not the highest price, but not nothing either.

• Read our full Bitdefender Total Security review

The best antivirus software for families

McAfee+ Ultimate is a welcome security package if you have many devices to protect, a big household, and a lot of family members. It does everything you’d want to protect your PC, Mac, or smartphone, and the package doesn’t limit how many devices you can use with your account.

In addition to an extremely powerful antivirus solution, you get features that help protect you (and your family) during your online activities as well. Among the many included features that come with McAfee+ Ultimate is a VPN (with no restrictions to a set file transfer limit), full access to a password manager, identity monitoring, a social media monitoring tool, a text scam detector, and more.

During testing, there were no performance problems during scanning. A full scan of 926K files took 35 minutes, which is the same time as Norton 360 Deluxe, although slightly slower than Bitdefender Total Security. McAfee+ Ultimate also offers options for a quick scan and a five-minute scan if you want to speed things up a little.

Some of the features offered, however, are available in Windows as free tools, like a file shredder and a clean up tool that removes temporary files.

McAfee+ Ultimate's pricing starts out pretty reasonable, usually around $49.99. However, you should keep in mind that after the first year, this price jumps up quite significantly to $149.99. So, if you don’t need many devices covered, it may not be worth the fee.

McAfee+ Ultimate offers an unlimited VPN, which is handy for those who want a VPN along with their antivirus. During testing, we found the unlimited VPN easy to configure and use. Additionally, its features, like the password manager, were easy to install and worked as expected.

McAfee+ Ultimate's antivirus protection scores in independent tests are outstanding overall, achieving a protection rate of 99.5% in AV-Comparatives' tests published in December 2025. Its false positives score was excellent too, on par with Bitdefender Total Security, and better than Norton 360 Deluxe, Malwarebytes Plus, and Avast Premium Security.

The main drawback here is the higher price point, although if you’re covering multiple devices, then you may find it worth it. Still, if you're after a budget antivirus, consider Malwarebytes Plus.

• Read our full McAfee+ Premium review

The best antivirus software for banking

A highly capable antivirus package that focuses on the most serious security threats, Avast Premium Security has a straightforward design intended for those who just want to run antivirus software.

It’s a lower priced security package that doesn’t throw in a lot of bloatware, which means it doesn’t come bundled with a lengthy list of features, but does include some security add-on’s that are helpful specifically for banking safely.

At $79.99 a year, Avast Premium Security is one of the cheapest antivirus options on this list. However, this also means it lacks some of the features available with other antivirus programs. Most notably, it doesn’t come with a VPN or a password manager. If you want these features, consider checking out McAfee+ Ultimate or Malwarebytes Plus.

However, it does include features such as a webcam blocker, a data shield for sensitive documents, a data shredder, an Email Guardian tool, as well as protection against DNS hijacking and remote desktop exploits.

It also includes a banking mode which allows you to conduct financial transactions in a browser that runs on top of Windows for added protection. This is great for added peace of mind during the sensitive transactions. You can also scan your computer for sensitive information, such as a PDF that contains a Social Security number, and block access to those documents. This adds an extra layer of protection to your personal information.

Though it lacks some of the polish of its sister software, Norton 360 Deluxe, Avast Premium Security still has speedy and capable performance during scans. Speaking of scans, it offers a quick scan, a targeted scan which allows you to select specific folders, or a boot sector scan which runs before Windows loads.

In testing, a quick scan took only three minutes, and a full boot sector scan took twelve. This is a lot speedier than the other products on this list, although it didn’t find as many files as competing products.

With this being said, Avast Premium Security achieved the same antivirus protection rate as Norton 360 Deluxe in AV-Comparatives' testing published in December 2025, a score of 100%. It also achieved the same false positives rate, which was decent but still higher than that of Bitdefender Total Security and Mc Afee+ Ultimate.

• Read our full Avast Premium review

The best budget antivirus software

Malwarebytes Plus is for those who are looking for basic protection without a lot of fuss. Though it does include some essential security features, for example, an unlimited VPN, it is a full-featured security suite like Norton 360 Deluxe. Instead, it is a good quality, low-cost tool that has a straightforward interface and a simple goal to protect your system from malicious threats and malware.

Intended as more of a basic antivirus scanner, Malwarebytes Plus' annual cost is only $59.99 a year for three devices, making it the cheapest antivirus on this list. For that, you get options for a quick scan that can be scheduled to run regularly, a manual scan, or a custom scan to select specific folders.

It does still have some features, namely a Browser Guard extension for web browsers that scans for web-based threats in order to block them in real time. It also has some advanced features, for example, an anti-heap spraying feature, and another feature that fights against exploits related to ASLR.

With this being said, there is no boot sector scan option or full scan (if you want these options, consider Avast Premium Security), but the quick scan only took 26 seconds during testing. While Malwarebytes Plus performed fairly well in AV Comparatives' independent tests published in December 2025, achieving an antivirus protection rate of 98.1%, this score is lower than that of the other providers on this list. It also had a much higher number of false positives as compared to every other antivirus on this list, meaning it may incorrectly flag threats, making it less reliable than the other providers on this list, too.

We found that in many ways, the biggest advantage is that there aren’t many features to configure in the software here. For example, it does have an unlimited VPN, though you cannot select a server location. Additionally, Malwarebytes Plus does block ransomware attacks, but does not encrypt or backup files.

Overall, this isn’t an advanced product, although it excels if you need a quick scan to see if a computer or phone is infected.

• Read our full Malwarebytes Plus review

Also tested

We test a lot of apps when searching for the best antivirus software, but only a handful can reach the top spots. If you're after more options, here are some other great antivirus packages that didn't quite make the mark.

How we test the best antivirus software

We test each antivirus program and evaluate its interface, performance, protection, extra features and — above all — overall value.

After timing and rating the installation process’s ease, we looked at whether the interface was simple and straightforward, convoluted and difficult to grasp — or something in between.

Next, we went through all the major and many minor features that each suite provides, including VPN access, file shredding and backup software, if included.

As far as performance goes, we measured how much the system slowed down while the program was scanning for malware using a Lenovo ThinkPad T470 with a 2.5GHz Core i5-7200U processor, 8GB of RAM and 256GB of solid-state storage containing 43.3GB of files.

To gauge each program’s impact on system performance, we used our custom Excel test which measures how long a PC takes to match 20,000 names and addresses on a spreadsheet. The longer the task takes versus a baseline reading, the more the system performance is impacted.

For malware detection performance, we referred to results from tests conducted by three independent labs: AV-TEST in Germany, AV-Comparatives in Austria and SE Labs in England.

Each lab periodically subjects major antivirus programs to stress tests that include thousands of pieces of malware as well as hundreds of “zero-day” samples that the software has to learn to recognize.

We paid particular attention to false positive readings of safe software deemed dangerous by the program under review as an indication of the precision of the program’s scanning technology.

How to choose the best antivirus software for you

When choosing an antivirus software, the top priority among all other decisions should be how well it performs to keep your system safe from malware and viruses.

To help you determine which of the many options out there will be the best at protecting your devices, we use results from tests conducted by three different independent labs to help us determine which antivirus program excels at finding and eliminating malware threats.

We also perform our own tests to see how much each program slows down your system, and how many resources it will consume to run both while scanning and while running in the background.

You’ll also want to read reviews online to see what other users have to say about their experiences with using the software, how it performed, what the interface was like, and how responsive the customer service was.

Next, consider the needs of your household and what devices you want to protect. How many family members do you have in the home? How many devices does each person need coverage for? What platforms do each of those devices use, and are the features they'll need available on these platforms?

Make a list of what devices and operating systems you need coverage for, as not all antivirus programs will cover all of them, and some will offer bundles for multiple family members or devices.

Narrow down the features you would like to see included in your antivirus program – because most antivirus programs offer so many features, it’s easiest to start out by making a list of what features are most important to your needs.

Do you also need parental controls? Is a VPN important to you? Would you like a password manager or file shredder? What about a hardened browser, a firewall, or webcam protection? Think about what you’d like most as additional security features and list them out, and see what the top antivirus programs offer.

Lastly, consider how much you want to spend — some antivirus programs will offer bundles for their suites, or tiers, that will package deals that include numbers of licenses or devices protected for a single purchase. You should also check a company’s website for any trial offers, as many will give you 30 days to try out their program for free before purchasing. Just make sure to cancel before the trialis over, or risk paying for software you don't want.

Free vs paid antivirus software

With so many antivirus programs to choose from, there’s absolutely no reason for your PC or smartphone to go unprotected — especially when there are free programs available to choose from as well. So, why would you bother paying for something that you didn’t have to?

Well, there are lot of reasons to choose one antivirus program over another but if you’re looking specifically at just free versus paid antivirus programs there are a few reasons to choose one over the other.

Free antivirus software will always provide users with basic protections against the most common malware threats, and will block dangerous files and applications. It should also warn you about suspicious websites, offer a cleanup option for infected files or apps and recognize when unknown devices are using your network.

However, a paid option is going to go a step beyond and offer more comprehensive security features — more advanced protections against unknown or upcoming threats, a more thorough feature set including VPNs, password managers, a file shredder that will fully remove deleted files and may cover more devices including tablets and smartphones.

Paid antivirus software also generally includes customer support via phone, chat or instant messaging and email whereas free versions will not. Plus, they add functions like an ability to customize your antivirus service, a feature to block suspicious sites, and a backup service to save data or back up devices.

It might also include features like webcam protection, remote control prevention to keep others from controlling your system, and the ability to run apps or software in a “sandbox” setting.

Paid antivirus software also generally includes customer support via phone, chat or instant messaging and email whereas free versions will not. If just the basics will do, a free version will be enough but if you’re looking for something more then it’s worth looking at some paid options.

Antivirus FAQ

There are a number of things that can put your sensitive data at risk, from major security breaches to losing your wallet or having an invoice sent to the wrong address. No matter what it is, it only takes one mistake for your data to get into the wrong hands.

You may not even noticed that your identity has been stolen until your banking acocunts have been accessed and drained. To stay one step ahead of scammers, you need to make sure you’ve established the proactive protection that one of the best identity theft services can provide.

We put the top identity theft protection services to the test using our own personal data to prove they actually work. We tested them for dozens of hours, testing out all their different features — from contacting support and navigating the interface, to triggering alerts and trying out features to see which ones work best for which circumstances.

Whether you need the comprehensive coverage provided by LifeLock or a more budget-friendly solution like IDShield, we have recommendations to keep you and your whole family's data safe.

The quick list

The best identity theft protection software you can buy today

Best identity theft protection overall

Lifelock is one of the oldest identity theft protection providers, and it offers some of the most comprehensive coverage around. During testing, we were impressed by its features: you get everything from credit monitoring and alerts to dark web monitoring, scam protection, and a large amount of insurance. The service also offers traditional antivirus features like a VPN, malware scanning, and a password manager courtesy of an add-on with the Norton 360 security suite.

LifeLock offers $1 million each to cover lawyers, consultants, accountants, and experts in order to help you forensically examine and recover from an identity theft, credit card theft, or money stolen, and personal expenses such as lost work or the cost of getting new documentation like a passport or driver's license.

The service provides necessary features, including dark web scanning, credit score access with the Vantage 3.0 rating system, title change check, and sex offender alerts. It also has more extensive features that help protect users — like the Social Media Monitoring, which looks out for account takeovers and cyberbullying, a Privacy Monitor scan that monitors your information against data broker sites, and a Computer Tune Up utility.

All these features are nicely organized in an interface that makes them easy to find, with major services highlighted. We found it easy to navigate through, adjust settings, or find controls. While testing the service, most of the notifications he received were regarding bank transactions, though LifeLock will also send alerts over data breaches, sex offenders in the neighborhood, or if a utility is opened in your name (among other issues).

Given that it can be paired with Norton 360 antivirus protection, LifeLock is clearly a product intended for those who want all the features – and who aren’t afraid to pay for it. It provides comprehensive identity theft protection with an amazing array of features, including an antivirus add-on that is known to be feature-rich, and includes utility add-on’s for those who want even more.

• Read our full LifeLock review

Best identity theft protection on a budget

The least expensive identity protection service on our list doesn’t lack in features or protection. Aura offers three tiers: for individuals, couples, or families, and all three tiers include monitoring and scores from all three credit bureaus and a Vantage 3.0 rating.

Aura will monitor both bank and investment accounts using Plaid, and send alerts if it finds any duplicate charges, transactions that go over your preset limit, bankruptcy proceedings in your name, sex offenders in your neighborhood, and more.

Despite its low monthly rate, it also offers a 24/7 White Glove treatment which provides a single case manager to handle an identity theft case from start to finish. That means if you have an issue, you only have to deal with one person to get back any new identity documents or resolve any issues. The plans cover between $1 and $5 million of identity insurance to protect against credit card fraud or someone draining your bank account.

When we tested Aura, we found its interface particularly easy to navigate and we appreciated that it didn’t leave out features. It includes a credit lock button (for Experian), dark web monitoring, malware scanning, a password manager, VPN, sex offender and cyber bullying alerts, a Safe Gaming app which keeps an eye on in-game commenting, and a 24/7 customer support number, among others.

• Read our full Aura review

Best identity theft protection for families

McAfee has paired its antivirus software with TransUnion’s identity services to create McAfee+ Ultimate, a comprehensive package for the age of cyber theft. We found McAfee+ Ultimate to be a well-integrated solution with a common look and feel for generally easy use and navigation.

It simplifies combining identity protection with security software and includes antivirus protection for an unlimited number of devices, as well as up to $2 million in identity theft insurance and an extra $25K in ransomware funds. There is also daily access to credit changes from all three major credit bureaus with scores, monitoring, and freezes.

McAfee+ Ultimate’s dashboard has boxes with numbers that clearly indicate any items that may be found in data breaches, as well as other metrics like how many devices are covered and more. It’s built around TransUnion offerings, so it includes features such as a TransUnion credit lock, however the Ultimate tier includes Equifax and Experian credit reporting as well.

Like the other services on this list, it provides a VantageScore 3.0, but it also gives an explanation of the items that affect that score as well as credit improvement advice. McAfee will provide access to lawyers, accountants, and detectives to investigate and remediate an identity theft, and provisions for lost wages and travel if needed. Plus, it includes a Personal Data Cleanup tool that can scrub your information from data broker sites.

During testing, we found the Online Account Cleanup particularly useful; the feature finds all the accounts associated with your email address. Likewise, he was impressed by the Protection Score that gives an overall safety rating and tells you which features of the program you have enabled.

On the antivirus side, McAfee+ Ultimate’s program provides multiple scanning options to check for malware, and doesn’t slow down a system even when the VPN is enabled. Its integrated Scam Detector can warn you about any text, image, video, or email scams that are geared toward you. Because of the unlimited devices covered and the features that can easily improve your online safety, McAfee+ Ultimate is a good pick for every member of the family.

• Read our full McAfee + Ultimate review

Best identity theft protection for security

Another service that uses TransUnion credit monitoring, reports, and identity insurance, Bitdefender pairs it with its own malware protection in order to cover all the most important parts of a busy online life. Bitdefender Ultimate Security Plus provides up to $2 million of identity insurance and credit freeze, through TransUnion, as well as malware scanning, a password manager, and a VPN.

Bitdefender’s base subscription includes credit reports and monitoring from TransUnion, but the extended account has reports and monitoring from Equifax and Experian as well. Credit reports are available on a quarterly basis, but there is daily access to a Vantage 3.0 score.

The service can track up to 10 bank and investment accounts, and keeps track of key personal accounts like passports, drivers licenses, and credit cards. It will send alerts about suspicious activity like address changes and payday loans.

While testing Bitdefender Ultimate Security Plus, we liked the BreachIQ feature that told him if his data was being exposed and also provided him with an identity Safety Score. It showed data leaks with related dates and a rating; the service then gave actions to mitigate exposure.

Plus, the credit simulator lets users play out different scenarios for how to best pay off debt. On the antivirus side, another helpful inclusion was the Scam Alert, an AI-powered utility that analyzes texts, images, and audio to determine if they’re fraudulent. Bitdefender Ultimate Security Plus’ focus on online security makes it ideal for those who want to include identity theft services with their antivirus protection.

• Read our full Bitdefender Ultimate Security Plus review

Best identity theft protection for privacy

IDShield will not only provide the basic needs for identity theft protection, like monitoring credit, limiting rogue transactions and keeping an eye on investments, but it also offers many useful tools to protect your privacy online.

IDShield provides access to a Reputation Manager which can scan your social media accounts for any inappropriate content you may want to clean up. It also has a Privacy Check feature that works with data broker sites to find any instances of your information that may have leaked, and then removes them.

IDShield has four tiers of plans to cover either individuals or families with up to $3 million in identity theft insurance to cover stolen funds. During testing, it did a good job of delivering and monitoring Experian scores, though it doesn’t have access to full credit reports or show scores from the other agencies it does monitor suspicious activities from them and provide a Vantage 3.0 score.

It will also provide lawyers, accountants and investigators to assist with restoration, and includes antivirus software from Trend Micro for malware protection. It can also watch for your information on the dark web and at payday loan establishments, and keep an eye on medical records. IDShield will send you alerts about any bank and investor accounts, for social media monitoring and sex offenders in your neighborhood.

• Read our full IDShield review

Also tested

Not every identity theft protection service can be the best. The ones we've included above are the ones that really stand out for their features and value, but we test plenty more. Here are the services that didn't quite make the list but are still worth your money if you're after more options.

How we test and rate the best identity theft protection services

Our testing and analysis of the best identity theft protection services focuses on how well each one monitors credit information, financial activity and personal information. We also rate each service for how frequently it provides credit reports and credit scores (not including free annual credit reports).

We give extra weight to the services that offer tools to help improve your credit score, and penalize services that do not give you credit reports from all three credit bureaus. We also rate each service for the number of credit cards, debit cards and bank accounts they’ll monitor and paid close attention to whether or not a service provides email or SMS notifications for large changes to account balances or large expenses on a credit card.

We penalized services that didn’t allow us to add any personal information beyond our Social Security number, such as driver’s license number, phone number or multiple email addresses; this is all information that can be used to steal your identity and that is commonly taken in a data breach. We also gave extra points to services that detected any compromised personal information.

We spent months trying out all the services on this list with actual personal information. During this testing period, our reviewer used his own credit cards and bank accounts to sign up for each service then used his accounts as usual to look for signs of identity theft. He also opted into all email, SMS or phone alerts and regularly checked credit reports to monitor for changes.

Additionally, he tried out all the available features of each service to see which ones proved useful, helpful or clunky, poked through the user interface on both desktop and mobile to see how user friendly it was, and contacted customer support to see if they were responsive.

How to choose the best identity protection service for you

Many of the services we've reviewed in this guide work in similar ways — they monitor the three major credit bureaus for your information, and will send you an alert if something worrying pops up. All of them monitor the dark web, and some will additionally search data broker sites for any mentions of your personal information, for example, your name, Social Security number, credit card, and/or bank account numbers.

Each of the services on this list will send you alerts should anything come up, usually via text or email. Additionally, they are all accessible via desktop or mobile apps on Android or iOS.

If the worst comes to the worst, and your identity is in fact stolen while you're paying for one of these services, each of the services we've reviewed here will cover up to $1 million or more to restore your reputation and credit. This can sometimes include reimbursement for stolen funds and lost wages.

So, we've covered what's the same, but what's different?

The main differences between the services are how frequently you'll receive credit reports and scores from them, as well as the specific bureaus you'll receive these credit scores from. Additionally, not all the services monitor your bank, credit card, and investment accounts, and not all of them will offer home title change alerts either.

Others offer more online safety tools, for example, features regarding cyberbullying, sex offender alerts, and parental controls, like game modes. Others will also bump up their security by offering two-factor login authentication — a real bonus considering 2FA is a recommended step in protecting your accounts against hackers and account break-ins.

FAQs

Norton 360 is one of the best antivirus software suites you can buy today, and it’s worth (nearly) every cent. Boasting a plethora of protection and security tools, Norton 360 protects you and your devices from AI scams, ransomware, and even deepfakes. What makes Norton 360 a sublime choice is the 24/7 customer support, user-friendly interface, and 60-day money-back guarantee. Low system impact is a boon too.

But the software isn’t perfect, as some features, like SafeCam, are restricted to Windows only. Norton 360’s AI assistant which checks links for malware is a little slow as well, especially when compared to the ones offered by its competitors.

For the complete breakdown, read my full Norton 360 review.

Norton 360 review: Specs

Norton 360 review: Costs & what’s covered

Norton 360 offers different plans offering varying levels of protection, depending on whether you’re a consumer or the owner of a small business. If you’re buying a subscription for yourself and/or your family, Norton 360’s cheapest plan, fittingly named Standard, costs $42 for the first year and renews at $94. This is a little cheaper than Bitdefender Total Security which starts at $109.

Naturally, prices jump up the more advanced the plan is. Norton 360 Deluxe for consumers starts at $52 for the first year and renews at $124, and Norton 360 with LifeLock Select Plus starts at $99 for the first year and renews at $189. Norton 360’s most expensive plan costs the same as Bitdefender Ultimate Security Plus — one of the biggest differences, though, is that Norton 360 offers a lower price point for the first 12 months.

If you own a small business, there are two plans to choose from for up to 10 employees: Norton Small Business starts at $59 for the first year and renews at $119 (for three employees), and Norton Small Business Premium starts at $199 for the first year and renews at $299 (for five employees).

It’s important to note that Norton 360 offers different plans for American and non-American customers. For instance, Norton 360 with LifeLock requires a valid Social Security Number so it can’t work in the U.K. or elsewhere outside of the States. Due to this limitation, I tested the Advanced plan, which is the highest tier available outside of the U.S.

Before you commit to a plan, it’s worth reading the fine print and going through all its features. Happily, Norton 360 offers a 60-day money-back guarantee for its consumer and business customers alike. Even better, Norton 360 says that if your device catches a virus its software can’t detect, you’ll get your money back (terms and conditions apply, naturally).

Norton 360 review: Protection

As I mentioned before, Norton 360 offers varying levels of protection depending on the plan you choose. Norton 360 Standard, the cheapest plan for consumers, protects one device against malware, viruses, ransomware and hackers, and offers Deepfake Protection, 10GB of cloud backup, Dark Web Monitoring, and a VPN.

The most advanced plan for consumers, LifeLock Select Plus, protects up to 10 macOS, Windows, iOS and Android devices from all the aforementioned, while including Scam Protection Pro, 250GB cloud storage, Parental Control, Credit Monitoring Coverage, and up to $25,000 in stolen funds reimbursement, amongst some other extras.

As with other antivirus software we test, I referred and compared testing results from three independent labs who test antivirus software twice a year (for the most part). The first thing I looked at was AV Test’s February 2026 report which certifies Norton 360 as a “Top Product” with a 6/6 score across Protection, Performance and Usability. Bitdefender and McAfee also received the same scores.

In AV Comparatives’ April 2026 test, Norton 360 performed better than Bitdefender. This test uses benchmarking tools to assess system impact. Norton 360 scored 90/100 in AVC, 94.7/100 in Procyon, and 5.3 in Impact. The lower the Impact score, the better, and Norton 360 outperformed Bitdefender which scored a 9.6/10 in Impact. McAfee, on the other hand, achieved a 3.3/10 in Impact, making it better than both its competitors.

As for the SE Labs (U.K.) April 2026 report, Norton 360’s macOS version was awarded an AAA rating with 100% protection accuracy, which is the highest possible rating.

Norton 360 review: Performance

Once you’ve bought your subscription, it’s time to download and install Norton 360 on your computer or smartphone. On Windows and macOS, you’ll need to log into My Norton with the registered email address and find the Download button on the dashboard. If you can’t see it, you may need to enter your 25-character unique license key and the Download button should then show up. It took under five minutes to get Norton 360 up and running on our testing rig on which I ran the majority of the tests.

On iOS and Android smartphones, you’ll need to download Norton 360 from the respective app store and sign in with your registered email address. The app should then automatically pull your subscription details. It takes mere seconds — the process couldn’t be smoother.

The first thing I did to test the antivirus software was to run a system scan — most users will be doing the same, I’m certain. There are a few types of scans available. You’ve got your classic Quick and Full scans, and in addition to those, you get access to Targeted (custom) and even a Startup scan which, as the name suggests, scans your files when you boot up the computer. Startup scan is something I haven’t seen other antivirus software suites offer, including Bitdefender and Malwarebytes.

To start with, I ran a Quick Scan which took three minutes and 33 seconds to complete, and it scanned 96,054 files without detecting any threats. The Full Scan took a bit longer, as expected, and it took just over five minutes to scan 896,544 files. Again, no anomalies were detected. Norton 360 didn’t scan as many files as Bitdefender, which scanned over two million files in 26 minutes.

The Quick and Full scans were conducted without any other heavy-duty apps running in the background. To see if Norton 360 has an impact on system performance, I ran in-game benchmark tests on two games: Cyberpunk 2077 and Forza Horizon 5. With Norton 360 running in the background, Cyberpunk 2077 (Ultra graphics) achieved 118fps which dipped to 107fps with the Quick Scan running, and 105fps with the Full Scan running.

Similarly, with Forza Horizon 5 running on High graphics, the game achieved 125fps with Norton 360 running in the background. With the software performing a Quick and Full Scan, the frame rate dropped to 123fps in both instances. This goes to show that Norton 360 doesn’t have a detrimental effect on your system’s performance, and that you can continue gaming as usual even with the software running in the background.

After finishing the in-game benchmark tests, I ran a few tests at speedtest.net to see how Norton 360 impacts internet speeds. As you can see from the table above, upload speeds dropped a fair bit with the Quick and Full Scans running — though the latter’s were faster than the former’s (surprisingly).

Norton 360 review: Features

In addition to system scanning, Norton 360 packs other goodies too, all of which ensure your device and online identity remain protected from threats. I tested the Advanced plan which comes with extras like Deepfake Protection, Parental Controls, Dark Web Monitoring, and Social Media Monitoring which notifies you of suspicious activity, like changes to your account settings and risky links.

I put a few of those through their paces, starting with Ask Genie, which is Norton 360’s built-in AI assistant. It helps you assess links and images to determine whether they’re safe to open or believe. I’ve seen AI assistants in Malwarebytes and Avast One too, so I was looking forward to testing Norton 360’s.

Unfortunately, I found Ask Genie to be quite slow to respond. I started off by asking it to check if a YouTube link was safe to click on. I got texts back that it was working on the thumbnail, content and more and to come back in a few minutes. Ask Genie never completed the task and said to try again later — which was disappointing.

I then asked it to check whether a security alert from Microsoft was legitimate (I knew it was). It asked me a number of questions to figure out what exactly I wanted to know. I was surprised by this, as I didn’t have to do so with Malwarebytes and Avast One. Both those suites’ AI assistants were quick to answer. Similarly, I had to tell it thrice what to do with a TikTok link I shared to check its legitimacy. I felt frustrated by Norton 360’s AI assistant, truth be told.

On to the good things now. Norton 360 comes with a Secure VPN, depending on the plan you purchase but it’s included in the Advanced tier I tried. You don’t need to download a separate app for the VPN, which is great, and it lets you connect to 2,000 servers across 65 counties — a little less than Bitdefender where you can connect to one of 4,000 servers globally, but still good.

Norton 360’s Advanced plan features a handy File Cleanup tool too, which detects unneeded files on your machine, and determines whether they’re safe to delete. This is good for those who have many, many files on their computer, as it gives you an at-a-glance view of files eating into your storage and hampering system performance. You can then go through the files and choose which ones you want to get rid of.

Though Norton 360 offers robust protection thanks to features like Credit Alerts and Dark Web Monitoring, I’m surprised one of its features is paywalled. When I opened Norton 360, it told me my computer was at risk and that “6,553 issues” were slowing down my PC. When I clicked on it to fix the issues, I was told to purchase Norton Utilities Ultimate. It isn’t expensive, with the add-on costing £29 for the first year, but still disappointing that you have to buy it separately.

Also worth noting: some features are available to Windows users only. SafeCam, which protects your webcam and microphone, and Cloud Backup aren’t compatible with non-Windows machines, including MacBooks. This isn’t a massive drawback, per se, as macOS features reliable built-in privacy tools to protect your webcam, and Time Machine is a powerful backup tool, too.

And to top it all off, Norton 360’s Advanced plan includes advanced security measures like AI agent protection. If you use, say, Claude Code, Cursor or OpenClaw, you can integrate Norton 360 into it to keep your AI tools secure while they work.

Norton 360 review: Interface

I’m yet to test an antivirus software that doesn’t sport a clean, accessible interface, and Norton 360 is no different. My Norton, the online dashboard, serves as the central hub for managing your subscription and activating it on different devices. There are no intrusive pop-ups or ads, so it’s a joy to navigate the dashboard.

The software itself is extremely user-friendly, and everything is well-signposted for new (and returning) users to understand. It’s important to note that you can’t make the window full-size — but this is a common occurrence with antivirus software suites. I’ve seen it with Avast One and Bitdefender, and the only software suite that doesn’t follow this convention is Malwarebytes.

Norton 360’s mobile app is just as intuitive to use. It’s available on both iOS and Android. I tested it on my Google Pixel 10 Pro XL, and found the activation process super quick — all I needed to do was login with my registered email address. I found the mobile dashboard easy to understand, and I also liked that I didn’t need to download a separate app for the Secure VPN.

Norton 360 review: Support

Regardless of how smoothly an app runs, you may run into some issues that can’t be solved by a simple Google search. Norton 360 offers extensive support for consumers and businesses alike. The support center features detailed help pages and troubleshooting guides, and there’s an active community of other users who discuss issues and solutions on Norton 360’s official forums.

If the guides fail to enlighten you, Norton 360 happily offers 24/7 email, chat and text support — just like Bitdefender, Avast One and McAfee. To get started, you must type in your registered email address, after which you’ll be asked to select the topic you need help with. Norton 360 will then suggest contact methods, but if you don’t want to speak to a human being over the phone, you can ask to be connected to the live chat.

The AI-powered chatbot is useful and quick to answer your questions. I asked it for help with two separate things and it quickly presented the solution to me. I then asked to speak with a human being and it took just under five minutes for the chatbot to connect me with another person.

Norton 360 review: Verdict

Norton 360 delivers a comprehensive security suite that strikes a balance between strong protection and ease of use. Its top-tier plans pack in nearly every feature you could want: malware and ransomware defense, Dark Web Monitoring, Parental Controls, Secure VPN, and more. Its low system impact is a standout advantage, as the software can run without seriously disrupting gaming or day-to-day performance.

However, there are a few niggles standing in the way of Norton 360 achieving the perfect score. Some features remain limited to Windows machines, including SafeCam, and Norton’s Ask Genie AI assistant feels slow and inconsistent compared to offerings from Avast One and Malwarebytes.

But even with these shortcomings, Norton 360 remains one of the most feature-rich and dependable antivirus software suites today — and it offers bang for your buck.

In April, Charter Communications suffered a data breach via the hacking group ShinyHunters. The company recently confirmed that the breach occurred, but has been insistent that no sensitive information was taken.

Charter is a large broadband provider that includes the Spectrum brand, which serves millions of customers across the entire United States.

The company confirmed the breach to Tom's Guide and said it launched protocols and alerted authorities about the incident. Charter said that no sensitive personal or business information was stolen.

"We are aware of the situation, following our security protocols and are working with appropriate authorities," a Charter spokesperson said. "No sensitive personal information (PI) or customer proprietary network information (CPNI) data was exfiltrated by the threat actor as a result of recent activity."

Contradictory statements

Charter's statement on the matter does seem to contradict statements from the ShinyHunters hacking group. The group claims that it stole 40 million records containing the personal information of home and business customers.

The group reportedly told BleepingComputer that it breached Charter on April 1 through a voice phishing attack that was used to compromise an employee account.

ShinyHunters claims the data includes customer names, email addresses, phone numbers, plan information and some CPNI data. The group also said it had some support ticket data.

ShinyHunters is on a tear

The threat actor ShinyHunters has been active since 2019, but in 2026 alone, we've tracked at least three separate data breaches claimed by the group. And there have been others targeting business users and not consumers, like Salesforce, that we haven't covered.

The first one we covered was a Panera breach in February that exposed information for more than 5 million customers. The identity protection company Aura suffered a nearly 1 million-person data breach in March that exposed customer information.

And just last month, the security company ADT was hit by a breach that affected 5.5 million customers, who saw stolen information leaked online.

How to stay safe after a data breach

It's not clear how much sensitive customer data was actually stolen. With that in mind, these tips are meant to help you protect yourself if sensitive information is taken.

Usually, a company sends out data breach notification letters to affected individuals. In the meantime, though, consider signing up for one of the best identity theft protection services, as they can help you recover your identity if it's stolen and any funds lost to scams, too.

Keep a close eye on your mailbox for any data breach letters. If Charter doesn't pay a ransom, keep an eye on your inbox for an entirely separate reason. Hackers could use any stolen information to try to launch targeted phishing attacks against you.

These phishing emails could contain malicious links or malware. So keep your PC protected with the best antivirus software and your Apple computer updated with the best Mac antivirus software.

ShinyHunters seems like it will continue hacking major companies, so more data breaches are likely in the future. Every company should be taking the threat posed by this group seriously.

More from Tom's Guide

• Avast One review: Robust protection at a reasonable price… but with some compromises
• Update your Nvidia GPU drivers now to protect your PC from 9 "high-severity" vulnerabilities — here's what's at risk
• 2.8 million hit in frightening scareware attack that holds your browser hostage — how to stay safe

Having one of the best antivirus software installed on your devices can protect you from AI-generated scams and viruses. If you’re looking for an all-in-one solution, Avast One is a great choice. It offers robust protection against deepfakes, sophisticated malware, and more. It comes with a built-in AI assistant which can analyze texts, links and images for anything suspicious. With low impact on system resources and an accessible interface, Avast One nearly does it all.

I say “nearly” because, unfortunately, the software has a couple of flaws. A maximum of just 10 devices are protected, and there’s no cloud backup.

Should you still buy this antivirus software suite? Read my full Avast One review to find out.

Avast One review: Specs

Avast One review: Costs & what’s covered

Avast One was relaunched in 2026 and since then, the software can be downloaded for free and paid add-ons can be added from within the software, depending on your needs. Instead of paying for a bundle of features you may never use, you have the option to build the protection with the features you actually need.

The free version of Avast One, without any add-ons, blocks viruses and malware, protection against ransomware, and you even get access to Avast’s AI-powered assistant for catching scams. You also get a 60-day trial of SecureLine VPN. Extra features, like Scam Guardian Pro, AntiTrack, and firewall, can be activated from within the app. These are paid products, but the good news is that you can pick and choose which ones you need, instead of paying for an all-in-one package, such as the tiers offered by Bitdefender and Norton 360.

Avast One is a consumer-focused antivirus software suite, so it doesn’t offer any business-oriented plans. For those, you may want to consider Bitdefender, Norton 360 or even Malwarebytes.

Before committing to any purchases, make sure you read the fine print. Luckily, if you aren’t happy with your purchase, Avast One offers a 30-day money-back guarantee — just like Bitdefender, although Norton 360 offers a longer 60-day guarantee.

Avast One review: Protection

Like I said, you can add extra protection features from within the free Avast One software. I was provided with a review code for Premium Security which already had things like Wi-Fi protection, WebGuard which uses AI to block scam websites, and Mail Shield which monitors your email address for threats. I’ll discuss these in detail shortly.

When we review antivirus software, we refer and compare testing results from three independent labs who test antivirus software twice a year on average. I looked at AV Test’s February 2026 report which rates the old version of Avast as a “Top Product” with a 6/6 score across Protection, Performance and Usability, just like Bitdefender and Norton 360.

After that, I read AV Comparatives’ April 2026 test report which uses benchmarking tools to assess system impact. Avast ranked 6th on the list, just under Norton 360, with a 90/100 AVC score, 94.5/100 Procyon score, and a 5.5 Impact score. The lower the impact score, the better, and Avast was just 0.2 off Norton 360.

Last but not least, the SE Labs (U.K.) April 2026 report gave Avast a AAA rating (highest possible) with a 100% total accuracy percentage. All of this proves that Avast is a comprehensive, well-rounded antivirus software boasting excellent performance — on paper, at least, and we’ll get into how it performs in real-world use next.

Avast One review: Performance

Once you’ve bought your Avast One plan, or are opting for the free version first, you’ll need to download and install it on your Windows or macOS machine, or your Android or iOS smartphone. Doing so is straightforward. You need to download the software from the Avast One homepage, or if you already have the free version, you can input your license key via the menu within the already-downloaded app. I installed the software on our testing rig, on which I ran the majority of the testing.

Activating your subscription on your smartphone is just as easy. Download the app from either the iOS or Android store and enter your registered email address when prompted. I did so on my Google Pixel 10 Pro XL and I was up and running in under a minute. The smartphone app offers many of the same features as the PC software.

The first thing I did after installing the software was run a computer scan. Avast One offers a few different types of scans: Smart (quick), Full, Targeted (custom), and Boot-Time. I ran a Full Scan which took 6 minutes and 12 seconds, which is a lot quicker than the time Bitdefender took (26 minutes 23 seconds). Avast One doesn’t tell you how many files it has scanned either, unlike Bitdefender. The Full Scan flagged a few system errors which it then helped me resolve.

Avast One upstages Bitdefender as the latter doesn’t offer any other scan options. The former’s Smart Scan is a handy option when you want a quick check after having downloaded a new file, for instance. I’m sure users will find Targeted and Boot-Time Scans useful too.

To put the software through its paces, I ran Cyberpunk 2077 and Forza Horizon 5 to see how the games’ performance was impacted, and you can see the results in the table below.

With Avast One running in the background (and no other apps open except for the game), Cyberpunk 2077 achieved 99fps while Forza Horizon 5 achieved 125fps. With the Smart Scan running, Cyberpunk 2077 achieved 96fps and Forza Horizon 5 topped at 124fps. Full Scan results were nearly identical too. The loss of a couple of frames is barely noticeable in real-world use, and it goes to show that the antivirus software won’t impact your work or gaming experience.

I also ran a few internet speed tests at speedtest.net to analyze how Avast One impacted upload and download speeds, and you can see the results in the table below.

With the Smart and Full Scans running, the internet download and upload speeds were impacted negatively. Antivirus software suites can sometimes act as a detriment in this area as they monitor incoming and outgoing data in real-time, and that could be one of the reasons why. Surprisingly, this wasn’t the case with Bitdefender, and I even got the fastest upload speeds with the software running in the background.

Avast One review: Features

Avast One offers plenty of extras in addition to system scanning and basic protection, like Web and Email Shield, a VPN, dedicated browser, AI Agent Protection, Deepfake Protection, and more. There's also AntiTrack which stops advertisers and other websites from tacking you; BreachGuard Premium which monitors the dark web for your personal data and even sends opt-out requests to data brokers; CleanUp Premium for removing junk files; and Driver Updates to keep device driver up-to-date.

I tested a few of the extras, starting with Avast Assistant, an AI-powered cybersecurity tool which analyzes suspicious messages, images and links. In an age where AI scams are becoming more commonplace (and more sophisticated), having a feature such as this is very useful.

To test Avast Assistant, I copied and pasted an email from Microsoft pertaining to login information. Avast Assistant then asked me a couple of questions, which I answered, and it told me the text looked safe — and I already knew it was safe because the email was a direct result of me logging into a new device.

I then tried Network Inspector which scans home/work and public networks for vulnerabilities. As someone who tends to work on trains and in cafés over public Wi-Fi, I find this tool very useful, as it can protect me from threats I may not have been aware of otherwise. I scanned my workplace’s network and in just five minutes, Avast One told me the network was secure.

You also get access to an Uninstall Simulator which shows you how the system will be impacted without actually uninstalling the app. It temporarily hides the app so you can see if your system runs smoothly without it. This is a great tool for testing disruptions, system errors and breaks in dependencies.

Last but certainly not least, I tested the Avast One SecureLine VPN. The VPN enables you to choose from roughly 700 servers spread across 35 or so countries — that’s a lot less than Bitdefender’s VPN which offers access to 4,000 servers in more than 50 countries. Regardless, it’s easy to connect to an encrypted server in another country. SecureLine VPN features built-in DNS leak protection, and there are plenty of custom settings available to suit your needs.

The only noteworthy drawback in terms of features is that Avast One doesn’t offer Cloud Backup, and it doesn’t feature parental controls either. You’ll need to speak with an expert when you visit the official website if you want parental controls.

Avast One review: Interface

Similar to Bitdefender, Avast One doesn’t feature any intrusive or unnecessary pop-ups, and using it is a delight. The interface is clean and user-friendly, and everything is well-signposted. When you go through the different protection options for the first time, you’re given quick explanations of what each does.

But also like Bitdefender, you can’t make the Avast One window full-size, so it occupies only a small portion of your entire screen. This isn’t a major flaw, but it would have been nice to be able to see all the features and settings. As the window is quite small, you need to scroll quite a bit to go through all of them.

As I mentioned earlier, Avast One is available on Android and iOS, and the Android app that I tested sports a user-friendly design too. The dashboard gives you quick access to all the settings, and just like the desktop app, everything is easily understandable. The app doesn’t take up much space either as it requires approximately 150MB to install.

Avast One review: Support

Similar to Norton 360 and Bitdefender, Avast One offers 24/7 customer support over online chat, text or phone, so if you run into any issues, you can speak to a human to get to the bottom of it. Avast’s support page has comprehensive troubleshooting guides which should be your first port of call. If you can’t find a solution, you can get in touch with the support team via the Contact Us button.

Once you’ve clicked on it, you’ll be asked to answer a few questions pertaining to your issue. When the system has evaluated your problem, it suggests either calling the support team or chatting with an engineer. What I find odd, though, is that you can’t simply choose to initiate web chat — you can only do so when the system determines it. Bitdefender and Norton let you use the online chat function as and when you please.

After answering the questions, I was able to chat with the virtual assistant. It was able to answer my query quickly and correctly when I asked it how to access the VPN. You can also speak to a human by asking the virtual assistant to connect you with one.

Avast One review: Verdict

Avast One delivers strong security and robust protection against the most sophisticated of scams, including being able to identify deepfakes and AI-generated images. Backed by excellent lab scores, it provides top-tier malware defense with negligible impact on system resources. Its standout feature is the AI-powered Avast Assistant which flags text and link scams. Navigating the software is seamless on desktop and mobile, too.

However, Avast One doesn’t feature built-in parental controls, something its competitor, Bitdefender, bundles into its most expensive subscription. Also, the software can protect up to 10 devices only

If you prioritize swift and diverse system scanning, a clean interface and modern AI threat analysis, Avast One is a highly capable software suite.

Looking for the best antivirus software to protect your online identity and offline machines? Malwarebytes is an excellent choice, and it blends robust, smart features with a user-friendly design to deliver a comprehensive package. With its recent software refresh, Malwarebytes offers an expansive suite of features, including an AI-powered Scam Guard, Digital Footprint Scanner, and more.

The premium protection comes at a premium price, though, especially for businesses. Malwarebytes may have a detrimental impact on your system resources too, as I experienced in my testing. But if those are compromises you’re willing to make, I doubt you’d be dissatisfied with the software.

For the complete breakdown, read my full Malwarebytes review.

Malwarebytes review: Specs

Malwarebytes review: Costs & what’s covered

Just like every other antivirus software provider out there, Malwarebytes offers different plans for consumers and businesses, depending on the user’s needs and requirements. We’ll start with Malwarebytes’ consumer plans, and there are three available. The Standard plan is available for $44 / £29 and offers basic protection against malware, viruses and more on one device only.

The Plus plan is a step-up from Standard and costs $79 / £49 annually. It includes everything offered by Standard, plus a high speed VPN and anonymous browsing. Malwarebytes’ most expensive plan for consumers goes by different names in the U.S. and the U.K. In the States, it’s called Ultimate ($279) and across the pond, it’s called Total (£129). Ultimate and Total feature Advanced Social Media Monitoring as well as $1 million in identity insurance. It’s important to note that Malwarebytes’ top-tier consumer plan is pricier than Bitdefender and Norton 360. There are also various Family plans starting from $149 / £109 per year.

Now, on to the business plans. There are three tiers available. For Sole Proprietors, the plan covering three devices starts at $119 / £99. The Boutique Business plan for 10 devices costs $399 / £306, while the top-tier Small Office plan for 20 devices costs $799 / £612. That’s a lot of dough, especially when Bitdefender’s GravityZone Business Security Plan costs just $444.

As always, I’d recommend reading the fine print and seeing what each plan entails before buying it. But in case you aren’t happy with your purchase, Malwarebytes offers a 60-day money-back guarantee — just like Norton 360.

Malwarebytes review: Protection

The level of protection you get against online and offline threats will depend on the Malwarebytes plan you buy. The Standard consumer plan, for instance, offers protection from viruses, Trojans and spyware, as well as personalized security assessments and advice. The Total (or Ultimate) plan that I tested offers a lot more, including an unlimited VPN, Identity Theft Protection and insurance, Scam Guard (also included in all plans), Digital Footprint Scanner, and Personal Data Remover. I’ll discuss these in detail shortly.

What’s surprising is that none of Malwarebytes plans offer cloud backup and storage or parental controls. The likes of Bitdefender, Avast One and Norton 360 offer these to a degree, making any of these a better choice if these are features you value.

Before diving into Malwarebytes’ performance, let’s take a look at how three independent labs who test antivirus software twice a year (for the most part) rate it, starting with AV Test. Unfortunately, the last time AV Test tested Malwarebytes was back in October 2023, before the software was refreshed and updated, so take this with a grain of salt. The lab rated Malwarebytes as a “Certified” product, with 5.5/6 score across Protection and Performance, and 6/6 in Usability. Bitdefender and Norton 360 received 100% scores across all criteria, though.

AV Comparatives’ April 2026 test report rated Malwarebytes 12th out of the 19 antivirus software suites they tested. AV Comparatives assess system impact, and Malwarebytes scored 75/100 in AVC, 97.4/100 in Procyon, and 17.6 in Impact. That Impact rating is a lot, and it basically alludes to the software having a negative impact on your system’s resources — on paper, at least. Bitdefender (9.6), Avast (5.5) and Norton 360 (5.3) all outrank Malwarebytes here — and it was proven in my testing too, which I’ll discuss soon.

In SE Labs (U.K.) April 2026 report, Malwarebytes Premium was awarded an AAA rating with 97% protection accuracy. While this isn’t poor, Bitdefender, Norton 360 and Avast One are all rated 100% for their protection accuracy.

Malwarebytes review: Performance

After buying your subscription, it’s time to install the Malwarebytes software on your Windows, macOS, Android or iOS device. There are two ways of installing it if you’re on a desktop. You can either register your unique license key in the already-installed free version, or you can redeem the key via the dedicated webpage. Downloading and installing the software on our testing rig took me about five minutes.

On Android and iOS smartphones, you’ll need to download the app from the respective app store — as I did on my Google Pixel 10 Pro XL — and enter your license key or registered email address when prompted. Of course, this will work only if you’ve bought a multi-device plan.

Naturally, the first thing I did after installing Malwarebytes on our testing rig was run a system scan, and there are three available: Threat Scan (quick), Deep Scan (full), and Custom Scan (targeted). The Custom Scan is especially handy if you want something between the speedy and detailed scans. I ran a Threat Scan first, as that’s the default option, and the scan was completed within 22 seconds, having scanned over 176,000 files without detecting any anomalies or threats. It’s nice to see Malwarebytes offer a quick scan option, unlike Bitdefender.

Via the Advanced Settings menu under Scanner, you can access the other scan modes, so I ran a Deep Scan which took 14 minutes and two seconds to finish. It scanned a total of 427,157 files — a little less than Bitdefender which scanned over two million files in 26 minutes. Again, no threats were detected, as I expected as our testing rig is a very clean system.

The first Threat Scan was done with no other heavy-duty apps running in the background, so to assess Malwarebytes’ impact on system performance, I booted up Cyberpunk 2077 and Forza Horizon 5, and ran in-game benchmark tests. As you can see from the table above, Cyberpunk 2077’s frame rate dipped a fair bit, from 87 to 75, and Forza Horizon 5’s from 110 to 99. This isn’t bad per se, and I didn’t notice any stuttering or lag while playing the games, but it’s important to note that with Bitdefender, I achieved 97fps in Cyberpunk 2077 and 123fps in Forza Horizon 5 with the software performing a Full Scan.

After finishing the in-game benchmarks, I ran a few tests at speedtest.net to see how Malwarebytes impacted upload and download speeds. You can see the results in the table above. Upload speeds took quite a hit with the Deep Scan running, something I didn’t experience with Bitdefender and Avast One.

My testing goes to show that Malwarebytes has a negative impact on system resources and performance, and aligns with the aforementioned AV Comparatives’ April 2026 test report.

Malwarebytes review: Features

Alongside in-depth and quick scanning, Malwarebytes includes a bunch of extras to protect you against online and offline threats. I tested a few of the goodies included in the Malwarebytes Total plan, starting with Digital Footprint. Digital Footprint basically lets you know of any security breaches, including leaked or stolen passwords. All you need to do is enter your email address and Malwarebytes will search the internet for any anomalies.

I first entered my team’s joint mailing address and Malwarebytes noted that the data from this email address was not exposed — which makes sense, as you can’t individually log into it. So to put the feature through its paces, I used my personal email address, and Malwarebytes found a few concerning breaches. Websites that I haven’t used in years still had my data, and were even involved in breaches.

Happily, Malwarebytes gives you a quick rundown of when the breach occurred to give you an idea of how long your data has been exposed. You can then fix the issues as needed.

Many antivirus software companies are pushing scam protection these days, which makes sense as AI-generated scams are more common than ever, and they can be quite hard to detect by humans. Malwarebytes’ Scam Guard is an integrated AI assistant, and within this tab, you can drop a link and image and ask the software to check if it’s legitimate.

I attached a screenshot of an email I received from Microsoft pertaining to a login on a new device. Scam Guard analyzed it and told me it was safe, and even advised me of next steps. I followed that up with asking Scam Guard to check if a TikTok URL was safe to click on, and it informed me that it was legitimate too, citing the legitimacy of the URL and TikTok’s position in the market.

I also tried the File Shredder tool which enables you to permanently delete files to varying degrees, including overwriting data several times using complex patterns so there’s no trace left of it. I did this with a throwaway screenshot that Malwarebytes promptly got rid of. It’s like using a physical paper shredder… but digital.

Finally, I tested the Malwarebytes VPN which is included in the Total plan. The unlimited VPN allows you to choose from over 150 servers in 60 different locations — a little less than Bitdefender where you can connect to one of 4,000 servers in 50 countries, but still good. The VPN takes around a minute or so to connect and once it’s done, Malwarebytes works to stop sophisticated cyberthreats while still providing fast internet speeds.

Malwarebytes also offers Identity Theft Protection and once you’ve signed up for it by entering your details, it monitors the dark web and alerts you if your data is being illegally traded or sold. It can track and report changes in your credit activity and score too. All in all, Malwarebytes offers a complete protection package — the top-tier Total plan does, at least.

Malwarebytes review: Interface

I really like Malwarebytes’ interface and design. The online dashboard, known as Secure Hub, where you can change account settings is accessible, clean and doesn’t feature intrusive pop-ups — and the same goes for the downloaded software too. Everything is easy to understand, thanks to plenty of signposting. I also like that the software gives you a protection score, depending on the measures you’ve taken and settings you’ve activated to protect yourself.

Another thing I appreciate about Malwarebytes’ software is that the desktop window can be maximized and made full-size to take up the entire screen, unlike Bitdefender and Avast One. This helps you see all the features at a glance and saves some time as you don’t have to keep scrolling to find what you’re looking for.

Malwarebytes’ app on iOS and Android is just as user-friendly if not more, and it also gives you a protection score — mine was 20 before I enabled the various features, like Firewall. The app doesn’t eat into your storage either as the download requires just 60MB of free space.

Malwarebytes review: Support

Since Malwarebytes was redesigned, the software now offers 24/7 customer support via email and online chat, so if you’re ever in a pickle, help is available. This is a similar level of support to what’s offered by Bitdefender, Avast One and Norton 360. Getting help is super easy too. There are plenty of troubleshooting guides available, and they should be your first port of call. Malwarebytes Labs is an extremely active blog too, where the team posts news and updates.

If all else fails and you need to speak with a human, you can first speak with the AI chatbot which can answer simple questions. I asked it how to register my license key and it promptly gave me a solution.

I then asked to speak to a human and it asked me to either sign in or continue as guest, so I chose the latter and I was asked to enter some information and a short description of the issue. It then created a ticket and told me a human agent would get back to me via email, and it took a human two hours to reply to my email.

Easy to do, but it’s worth noting that Malwarebytes doesn’t offer telephone support, unlike Bitdefender and Avast One. As someone who doesn’t like speaking on the phone, I don’t mind it, but it may be an issue for those who need urgent help.

Malwarebytes review: Verdict

Malwarebytes is one of the most intuitive and user-friendly antivirus software suites you can buy today. Packed with robust modern features, like AI-powered Scam Guard and Digital Footprint Scanner, it effectively protects you from online and offline threats. 24/7 web and email support, the unlimited VPN, and an accessible mobile app make this a compelling package.

However, Malwarebytes falls slightly short of perfection when compared to heavyweights like Bitdefender. It has a noticeable impact on system resources, including frame-rate drops in demanding games. Its top-tier business plan carries a premium price tag too, which means its competitors offer better value for money.

But at the end of the day, this is a highly capable and accessible shield against sophisticated, modern threats. Backed by a 60-day money-back guarantee if you aren’t satisfied, Malwarebytes is still an excellent choice for those who value identity protection — as long as you have the hardware to cushion its performance footprint.

With the rise of AI scams and sophisticated malware threats that we may not always see, it’s more crucial than ever to have one of the best antivirus software installed on your devices — and luckily, there are plenty of options to choose from. However, if you use multiple devices or run a business, there’s one antivirus software that’s better than the rest, and that’s Bitdefender.

Bitdefender offers many different tiers for consumers, families and businesses, and having tested the Ultimate Security plan, I wonder how I’ve gone so long without it. Bitdefender offers extensive protection thanks to anti-theft and anti-scam features. It sports a clean interface that makes the numerous settings easy to understand, whether you’re on mobile or desktop. The VPN and comprehensive Identity Protection are cherries on top of the cake.

For the complete breakdown, read my full Bitdefender review.

Bitdefender review: Specs

Bitdefender review: Costs & what’s covered

Bitdefender is one of the most prominent names in the world of antivirus software. The brand offers multiple tiers of protection — depending on whether you’re buying it for personal use, for your small business, or at an enterprise level. For the regular Joe and their family, the cheapest Consumer plan, Bitdefender Total Security, starts at $109; Bitdefender Premium Security costs $129; Bitdefender Ultimate Security retails for $159; and Bitdefender Ultimate Security Plus costs $189.

If you own a small business, you can get the Bitdefender Ultimate Small Business Security Plan starting at $189 for three members. For 25 members, this jumps up to $799. For medium-sized businesses, the GravityZone Small Business Security plan for five devices costs $169 for a year, with the most expensive GravityZone Business Security Plan costing $444. The price will naturally vary depending on the number of devices and the years you buy the subscription for.

Depending on the plan you buy, each tier carries different levels of protection and additional services. It’s worth looking into what each individual plan covers before committing to one — but each tier also offers trial periods as well as 30-day money-back guarantees. I won’t bore you with all the details but I’ll share an example with you. I tested the Bitdefender Ultimate Security Family plan which, alongside basic protection, offers email protection, Scam Protection Pro that fights sophisticated scams, Digital Identity Protection, as well as a VPN.

Bitdefender’s cheapest Consumer plan is a little pricier than Norton 360’s, which starts at $94 for a year. Both brands’ most expensive Consumer tier, though, costs the same. Bitdefender offers better value for money when compared to McAfee, though, as the latter’s cheapest plan starts at $119 and goes all the way up to $119. As you’ll soon see throughout this review, Bitdefender doesn’t give you much to complain about, and you’re getting bang for your buck.

Bitdefender review: Protection

Bitdefender offers varying levels of protection depending on the plan you buy. The most basic tier for consumers, Total Security, offers protection against malware, ransomware and network threats, Advanced Threat Defense which monitors active apps, Cryptomining Protection that fights against apps that you have no knowledge of, Anti-Phishing, Anti-Fraud, Antispam, and lots more. These features are also included in the Ultimate Security plan with some other extras.

For antivirus reviews, we refer and compare testing results from three independent labs who test antivirus software twice a year (for the most part). I looked at AV Test’s February 2026 report for this review. Their results certify Bitdefender Total Security as a “Top Product” with a 6/6 scores across Protection, Performance and Usability. McAfee and Norton also received the same scores.

Bitdefender didn’t perform as well in AV Comparatives’ April 2026 test which uses benchmarking tools to assess system impact. It scored 85/100 in AVC, 95.4/100 in Procyon, and 9.6/10 in Impact. McAfee performed better with a 90 and 96.7 score respectively. Bitdefender did better than Norton’s 94.7 Procyon score, but lagged behind Norton’s 90 AV-C score. Don’t let this put you off, though, as Bitdefender is still an excellent antivirus. And if numbers matter a lot to you, SE Labs (U.K.) gave Bitdefender an AAA (highest possible rating with a 100% protection accuracy.

Bitdefender review: Performance

The first thing you’ll naturally be doing after you’ve signed up for a subscription is downloading and installing Bitdefender — and doing so is extremely easy. You’ll need to login to the Bitdefender Dashboard, where you originally bought the plan, and activate it. You’ll then be able to download the software onto your machine. It took me mere seconds to download the app and get it up and running on our testing rig — on which I ran the majority of the testing.

Also depending on the plan you purchase, you’ll be able to install the app following the same procedure on different devices. For instance, I was provided a code for the Ultimate plan, as I mentioned earlier, so I could download it onto my Google Pixel 10 Pro XL. Once I’d activated the subscription on our testing PC, all I needed to do was login using my registered email on my phone, and I was in. It took mere seconds to get up and running.

Now for the big question: how does the antivirus software perform in regard to scanning? Bitdefender offers a full system scan which, as the name suggests, scans every single file on your machine — even the ones you might not be aware of. Surprisingly, there’s no option for a Quick Scan, as offered by the likes of Norton and McAfee.

It’s easy to start the Full Scan as the button to do so is within the app’s dashboard. I ran a Full Scan of our testing rig and it took 26 minutes and 23 seconds to complete, and it scanned a total of 2,319,256 files (I didn’t even realize there were that many to scan!). As I expected, the scan didn’t flag any viruses or issues.

This was done with no other heavy-duty apps running (I used the first scan’s results as the baseline), but to put the software through its paces, I ran Cyberpunk 2077 and Forza Horizon 5 to see how the games’ performance was impacted.

After running the numerous in-game benchmark tests, I’ve noted the results in the table above. With Bitdefender simply running in the background, Forza Horizon 5 achieved 125fps while Cyberpunk 2077 achieved 100fps. I then started a Full Scan which resulted in Forza Horizon 5 achieving 123fps and Cyberpunk 2077 achieving 97fps. This goes to show that the antivirus software doesn’t hamper your gaming PC’s performance. The loss of two or three frames per second is hardly noticeable.

I also ran a few internet speed tests at speedtest.net to see how Bitdefender impacted upload and download speeds. The first test I ran was without Bitdefender installed; the second with it installed; and third while running a Full Scan.

As you can see in the table above, even with the Full Scan running, the internet download and upload speeds remained pretty much the same — and I even got the fastest upload speeds with Bitdefender running in the background, surprisingly.

Bitdefender review: Features

Aside from scanning and other basic protection features, Bitdefender offers plenty of goodies, especially if you get one of the higher tiers. Like I mentioned earlier, the Bitdefender Ultimate Security plan comes with the likes of Web Scam Protection, Anti-Phishing and Anti-Fraud countermeasures, and more, so I put a few of these through their paces, starting with the Vulnerability Scan.

The Vulnerability Scan gives you an overview of any critical updates and settings you can change to better protect your device. Much quicker than the Full Scan, this is a good way to see all updates available at a glance.

There’s also Scam Protection Pro, which many antivirus companies seem to be pushing right now, and for good reason too. With the rise of AI, it’s easier than ever to fall for a scam, no matter how alert we think we are. Scam Protection Pro reads your emails and text messages (if you’re logged into Bitdefender on your smartphone), and verifies any links it finds. It’s very useful, and one feature I’m sure consumers and businesspeople would appreciate.

As you do with many other antivirus software suites, you get access to Bitdefencer VPN too. The VPN allows you to choose from over 4,000 servers in more than 50 different countries. The Ultimate plan includes unlimited VPN traffic, so Bitdefender encrypts all internet traffic, your bank information, passwords, downloads, and everything in between. Having used ExpressVPN in the past, I personally prefer Bitdefender VPN’s interface and clean look. This, combined with the SafePay browser, means you can browse the internet with confidence.

Bitdefender also offers identity theft protection through continuous dark web and surface monitoring, digital footprint visualization, identity protection score, real-time breach notifications, and even security advice from Bitdefender experts. Consumers on the Ultimate plan get this feature bundled in, but if you’re on a lower tier, you’ll need to buy it separately, starting at $129 / £79 annually.

Bitdefender review: Interface

What I really like about Bitdefender is that there are no intrusive or unnecessary pop-ups and ads. The interface is extremely clean, intuitive and user-friendly. Performance-wise, I didn’t notice the software have any detrimental impact on our testing PC either, as all other programs ran smoothly without any lag, even when the software was running in the background.

But the one thing I don’t like is that you can’t make the Bitdefender window full-size, so it occupies only a small portion of your entire screen. This isn’t a massive drawback, but it would have been nice to be able see all the features and settings at a glance rather than having to scroll through them.

The Bitdefender software is also compatible with iOS and Android, and as I alluded to earlier, I tested it on my Google Pixel 10 Pro XL. Similar to the desktop version, Bitdefender Mobile Security on Android is just as user-friendly, with the dashboard giving you quick access to all the settings, such as Scam Protection Pro and System Scan. Unfortunately, you need to download a dedicated app to access the VPN on mobile devices. Luckily, neither app eats up your storage as they’re both under 100MB.

Bitdefender review: Support

While Bitdefender is a sheer delight to use, you may run into some issues — that’s bound to happen with any hardware or software you’re using. If you’re in a pickle, Bitdefender offers extensive customer support — for both consumers and businesses alike.

On the consumer side of things, you get access to a number of troubleshooting guides, but if those fail, you can contact Bitdefender support either via email, 24/7 chat, or over the phone. You must answer three questions pertaining to your issue, after which the website will suggest a few troubleshooting guides, or give you the option to contact support.

When I did this, I had to speak with the Bitdefender Helper AI about my problem, and it was quick to answer a simple question: “How do I activate my subscription?” I found the advice straightforward and helpful. I then asked to speak to a human and after explaining my issue briefly, it connected me to a human being, who was prompt and very helpful. All tiers get a similar level of support, which is fantastic.

For businesses, there’s a dedicated B2B help center offering specialized help. What I love about the support center is that it offers 24/7 support, and a specialized team is available around the clock. This is similar to what Norton and McAfee offer. It’s important to note, though, that local language support is available during working hours only, for all three brands.

Bitdefender review: Verdict

Bitdefender stands out as a premier choice for individuals, families and businesses seeking robust digital security. Having tested the Ultimate Security plan, I can confidently say that it’s a comprehensive security suite. Its protection capabilities are stellar as they protect you against malware, identity theft and scams, which is more important than ever in the age of AI.

What truly impressed me in my testing was Bitdefender’s low system impact as even with full system scans running, it didn’t deter internet speeds or tank the frame rate in intensive games. The interface, on both desktop and mobile, is clean and simply a joy to use. Features like Scam Protection Pro and unlimited VPN on higher tiers add to its value, and make the top-tier subscription worth the investment.

Of course, few things in life are perfect and Bitdefender isn’t one of them, as there’s no Quick Scan option, and the non-resizable app window on Windows can be a little annoying. But these are soft cons, and something you should be able to overlook given the trade-off. If you prioritize peace of mind against evolving AI and malware threats, Bitdefender is, in a word, exceptional.

If your Windows or Linux computer uses one of best graphics cards made by Nvidia, you're going to want to make sure you're using the latest drivers. This week, the company issued a security alert and driver updates to combat a variety of vulnerabilities.

The alert highlights 15 issues, nine of which Nvidia has marked as "high-vulnerability." The high-risk flaws run the gamut of what bad actors can do to your PC. That includes letting hackers get access to your PC kernel, inject malicious code, steal crucial data, or gain administrative access. All the stuff you don't want happening.

For both Windows and Linux, you can download the driver update directly from Nvidia. On Windows, you'll want to make sure you upgrade to driver version 569.49.

On Linux, you want to make sure you update to version 590.48.01. The new versions were released about a week ago, so most people who have automatic updates turned on should have the update. But check your driver version just in case.

According to the alert, all Nvidia drivers before version 596.36 — version 482.53 for GTX 10-series and below — are potentially at risk from these vulnerabilities.

Keep your PC safe from malware

This is a general reminder to ensure all your drivers are up to date. Most driver releases patch security flaws like the ones outlined by Nvidia.

To be fair, some driver updates can cause issues, but later this year, Microsoft will automatically roll back bad Windows drivers to the most recent stable version. Still, keeping your drivers up to date is good practice.

If you're on PC, Microsoft releases new security updates every second Tuesday of each month.

Additionally, you'll want to ensure that Windows Defender is enabled. It largely does a great job of catching threats before they do damage.

For extra protection, you should consider the best antivirus software. Paid antivirus solutions usually update regularly, plus you often get access to VPNs, a password manager and other security goodies.

New vulnerabilities crop up all the time, but if you practice good cyber hygiene you devices and data should stay safe.

More from Tom's Guide

• Nvidia is teaming up with Span to install mini AI data centers right on the side of your house, turning residential neighborhoods into a distributed supercomputing network that actually pays homeowners for their unused electricity
• I test gaming laptops all year — here are the only 8 I recommend in 2026
• Nvidia RTX 5070 laptop GPU gets 12GB VRAM — here’s why it's a game-changer

Imagine this: one minute you’re checking your email, and the next, your browser is completely locked. If that wasn’t worrying enough, whenever you click your mouse, a warning sound plays and your current IP address is shown prominently on your screen. No, this isn’t a ransomware attack where you’re locked out of your files by hackers. Instead, it’s a new scareware attack currently making the rounds online where scammers try to trick you into picking up your phone and calling them.

As reported by Cybernews, 2.8 million people have been targeted by this attack since the beginning of this year. Dubbed CypherLoc by security researchers at Barracuda, it uses a combination of phishing, malicious code and social engineering to get potential victims on the phone. From there, the scammers on the other end can get all sorts of personal and financial information out of them or even launch follow-up attacks.

Here’s everything you need to know about this new scareware attack, along with some tips and tricks to help you avoid falling for this scam and others like it in the first place.

Socially engineered panic

Just like with many other attacks, this one begins with a phishing email in your inbox. According to a blog post from Barracuda, there’s either a malicious link in the body of the email or one included in an attachment.

While you should never click on links in emails from unknown senders, those who do in this case are taken to a webpage that appears harmless at first glance. However, it gradually transitions into a scareware page once triggered to do so.

Within the page, there’s a hidden, encrypted payload that executes the scareware. Before it can be decrypted and launched, though, the site checks to see if it is being run in a testing environment (usually by security researchers), and if so, a blank screen appears instead. This helps CypherLoc avoid detection.

On an ordinary user’s computer, though, the page will transform into a scareware interface that locks their browser, shows alarming-looking security messages and urges them to contact tech support immediately to fix the issue.

Although the tactics used in this campaign are similar to a ClickFix attack, the scammers behind it have a few more tricks up their sleeves to coerce potential victims into calling them. In addition to fake login forms to appear more legitimate, the most surprising one is that this fake page plays a warning sound whenever a user clicks, switches to full screen or tries to reload. Then, to make things personal, CypherLoc retrieves and then displays a victim’s public IP address on its scareware page.

Between showing a user’s IP address and random alarm sounds playing from their browser, this will usually be enough to convince potential victims to call the phone number that appears on screen. If they do so, they’re met with scammers posing as Microsoft tech support, which is likely enough to convince many people to hand over sensitive details they would have ordinarily kept private.

How to stay safe from scareware

Scareware is often a last resort to trick unsuspecting users into doing something they normally wouldn’t. However, by practicing good cyber hygiene from the start, you’re much less likely to actually end up on one of these fake but equally terrifying pages.

So how do you avoid falling victim to CypherLoc? Well, you need to be extra careful when checking your inbox, social media and even your text messages. Given that almost anyone can contact you these days, you want to be on the lookout for messages from unknown senders and this is especially true with ones that invoke a sense of urgency to get you to click or call. You also always want to avoid clicking on links or downloading attachments from unknown senders.

Carefully checking your inbox while keeping a level head about you will only take you so far and of course, we all slip up at times and make mistakes. That’s why it’s important to protect your computer from malware and other viruses by installing the best antivirus software. If you want to take your protection to the next level, though, you may also want to consider investing in one of the best identity theft protection services, as they can help you recover your identity and any funds lost to scams. Many identity theft services also include an antivirus, so while you’re paying slightly more for one of them, you often get multiple layers of protection in a single subscription.

Given that security tools have become so advanced recently, scammers and other cybercriminals now need to be a lot more creative in their attacks. CypherLoc is a great example of this, and another reason why you need to stay on your toes whenever you’re checking your email and other messages.

Although we don’t know who the scammers behind CypherLoc are targeting specifically, I’ll update this story when and if we find out more.

More from Tom’s Guide

• Microsoft's urgent Window 11 patch fixes 30 'critical' bugs — update your PC now
• That peace sign you do in your selfies could let AI steal your fingerprints for scammers — here’s how
• I put Apple’s new macOS ClickFix warnings to the test and they actually worked — now I want them on Windows too

A newly discovered zero-day vulnerability in Microsoft Exchange Server has experts sounding the alarm. On Thursday, Microsoft announced mitigations for a high-security Exchange Server vulnerability that's being actively exploited by hackers. All an attacker needs to do is send a specially crafted email that, when opened through Outlook Web Access, can execute arbitrary code within the user's browser.

Microsoft's called this security flaw (tracked as CVE-2026-42897) a spoofing vulnerability affecting fully updated versions of Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE).

"An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context," the Exchange Team said.

Although security patches are not yet available, Microsoft said the Exchange Emergency Mitigation Service (EEMS) can provide automatic mitigation for Exchange Server 2016, 2019, and SE on-premises servers.

"Using EM Service is the best way for your organization to mitigate this vulnerability right away. If you have EM Service currently disabled, we recommend you enable it right away. Please note that EM Service will not be able to check for new mitigations if your server is running Exchange Server version older than March 2023," per the Exchange Team.

To check the status of the Exchange Emergency Mitigation Service, organizations should follow Microsoft's instructions on running the Exchange Health Checker script.

May has been one hell of a month for Microsoft's security team. In the last week alone, Microsoft's fixed over 130 vulnerabilities as part of its Patch Tuesday cycle, many of which are driven by a new AI-powered bug-hunting system codenamed MDASH (Multi-model Agentic Scanning Harness).

More from Tom's Guide

• I tried this expert-approved '15-minute Friday reset' decluttering hack — here’s what happened
• Is your personal information public? The simple step to securing your privacy online
• Microsoft's urgent Window 11 patch fixes 30 'critical' bugs — update your PC now

Now is the perfect time to update your laptop or desktop PC as Microsoft has released its May Patch Tuesday updates which contain fixes for 30 flaws rated as important or critical severity.

In total, the latest security patch applies fixes to 138 bugs including many that made network privileges vulnerable. Fortunately, none of the bugs are listed as publicly known or under active attack.

The patch was released at the same time as one from Google that addressed 127 security flaws in Chromium, which undergirds the Microsoft Edge browser.

Many of the flaws appear to be related to Azure and more business-focused Microsoft products. However, one of the more severe bugs impacts Windows DNS via a heap-based buffer overflow flaw that would let a malicious actor execute code over a network.

"An attacker could exploit this vulnerability by sending a specially crafted DNS response to a vulnerable Windows system, causing the DNS Client to incorrectly process the response and corrupt memory," Microsoft said in its patch notes. "In certain configurations, this could allow the attacker to run code remotely on the affected system without authentication."

Hundreds of flaws fixed this year

Since January, when the first patch Tuesday of 2026 fixed 114 flaws, Microsoft has apparently fixed more than 500 CVE bugs already this year.

According to Hacker News, this can be attributed to a greater focus by Microsoft on vulnerability discovery, some of which is heavily assisted by AI-based flagging. Microsoft claimed as much in a recent Microsoft Security Response Center report released this week.

"Microsoft engineers and the wider security community alike are increasingly using AI to examine software more carefully and more often than was practical even a few years ago," Tom Gallagher said in the report.

How to stay safe with Patch Tuesday

First and foremost, update your Windows laptop or desktop with the latest system update or patches. You also want to make sure that Windows Defender is enabled so that it can scan your system for dangerous malware.

Of course, we always recommend using one of the best antivirus software packages for extra protection.

In the MSRC report, Gallagher recommends practicing good cyber hygiene, which we wholeheartedly agree with. This includes enabling multi-factor authentication, creating strong passwords, and using one of the best password managers

As always, and in general, don't click links or attachments from unknown senders, as they could contain malware or send you to phishing sites designed to steal your personal information.

By practicing good cyber hygiene and regularly updating your computer, you should be safe from most attacks.

More from Tom's Guide

• Is your personal information public? The simple step to securing your privacy online
• Android alert: 7 million users downloaded ‘stalking’ apps that were actually scams
• What is AgeGO, and is it safe to use?

You might be surprised how much of your personal information is already on public search sites.

Addresses, phone numbers, even relatives' names are all fair game. Data broker websites pull from public records like court filings, voter registrations, and social media, then compile everything into searchable profiles anyone can find.

It's worth knowing this exists, since the information can be misused for unwanted marketing or phishing attempts. Fortunately, most sites have an opt-out process. The catch is that it has to be done individually for each one, so here's how to get started.

More from Tom's Guide

• Your personal information is everywhere online — 5 ways to start removing it from the internet
• Apple buried an extreme security mode on iPhone — and it blocks government-level hacking
• Stop Chrome from tracking you — change these 5 settings right now

Normally, when it comes to scams, there is clearly a bad party and it's usually the grifter. However, a new scam uncovered by security researchers at ESET lands squarely in the everyone is probably wrong zone.

The scam involves a series of 28 apps dubbed "CallPhantom" by ESET that racked up more than 7.3 million downloads on the Google Play Store. The various apps promised to give users access to call histories, SMS records and even WhatsApp call logs for any phone number.

To gain access to this creepy information, users had to pay a subscription fee. Unfortunately for them, but perhaps fortunately for the people whose phone numbers they entered, these CallPhantom apps only sent back fake data.

The ESET researchers found that the apps used different methods to fake the "information." The apps would generate random phone numbers and match them with fixed names, call times and durations.

Some of the apps demanded users' email addresses where the fake call history would supposedly be sent. However, no "data" would be sent until after payment.

Surprisingly, none of the apps requested intrusive permissions on the scammed individual's phone.

Payments to the apps were split up as well. Some relied on the Google Play Store's official billing system, which is required for apps that offer in-app purchases. Some utilized third-party payments or had payment card checkout forms that side-stepped Google's policies though.

ESET says that it submitted its report about the CallPhantom apps to Google in December 2025, and all of the apps in question have since been removed. Browsing the Play Store today, we were unable to find any evidence of these apps.

How to stay safe from malicious apps

Look, obviously, no one deserves to be scammed. That said, when you go looking for sketchy apps that promise to enable behavior next door to stalking, you are more likely to find programs built to grift.

So... don't do that.

Per ESET, the apps in the research were mainly targeted at people in India and the Asia-Pacific regions.

Still, if you've been scammed, there is recourse for refunds in the Play Store app. Google lays out the process on its Cancel, pause, change subscription page.

Beyond that, for any app be sure to check the reviews beyond the glowing 5 Stars at the top of the page.

Only download apps from reputable publishers, always apply security updates and avoid downloading any non-essential apps. Be sure to reject and disable accessibility permissions too. Of course, enable Google Play Protect as well as this built-in security tool scans all of your existing apps and any new ones you download for malware and other threats.

CallPhantom doesn't appear to have introduced malware or viruses, but you should still protect your smartphone with one of the best Android antivirus apps.

Apps can do real damage, especially those with malicious intentions. It's why we recommend limiting the number of apps you have installed overall. And perhaps, don't try to find out who other people are calling using a shady app making dubious promises.

More from Tom's Guide

• 'Not happening! Y'all are wild': Google shoots down rumors Android will copy the iPhone's Liquid Glass design
• How to turn on Android’s anti-theft protection features and secure your phone
• I tried Android 17 and these are the 5 new changes worth paying attention to

While gardening isn’t all about productivity, it’s particularly satisfying when a single plant grows an abundance of vegetables throughout the season. If you’re looking to get more from your garden without spending a fortune, May is one of the best times to start planting.

Warmer soil, longer days, and more reliable weather create ideal conditions for fast growth, which usually goes hand in hand with quicker harvests and better overall yields. For the price of a few seeds, you can end up eating delicious home-grown produce throughout the summer.

Tips when growing high-yield vegetables

Choosing the right plants is also critical. Focusing on high-yield vegetables is a simple way to make your garden work harder for you, without sacrificing flavor in the final harvest. Some crops produce continuously, while others mature quickly for repeat sowings.

Vertical growers are also a great way to get surprisingly large harvests from just a small footprint. With the right mix, you can keep your kitchen stocked for weeks — or even months — from a relatively small space, at a relatively low price.

Focus on keeping plants well-watered, harvesting often, and sowing regularly, and you’ll be rewarded with a steady, budget-friendly supply of fresh produce throughout the season.

Whether you’re planting in beds, raised planters, or containers, these 7 vegetables are all excellent choices to sow or plant in May if you want a productive, budget-friendly garden.

1. Zucchini

Zucchini is a prolific summer vegetable that can produce an impressive number of fruits from just one plant. Planting in May gives it the warmth it needs to establish quickly and grow vigorously. Once it starts cropping, it often keeps going for weeks, with new fruits forming rapidly

To plant
Sow seeds about 1 inch deep in fertile, well-draining soil in full sun. Allow 2–3 feet between plants to accommodate their size. Water consistently and harvest fruits while they’re still small to maintain quality and encourage further production. Keeping the plant well-fed will help sustain its heavy output.

Best for USDA zones: 4–11

2. Green beans

Green beans are reliable, fast-growing plants that offer a steady stream of harvestable pods. Climbing varieties, in particular, can make excellent use of vertical space, giving you more yield per square foot and freeing up space for other crops. Sowing in May means seeds go into warm soil, which helps them germinate quickly and grow without setbacks.

To plant
Sow seeds around 1 inch deep in a sunny spot, spacing them 2–4 inches apart. Provide structures for climbing types early on, to ensure they can grow upright with sufficient support. Water during dry spells, especially once flowers appear, to ensure healthy production. Regular picking keeps plants productive and can also prevent pods from becoming tough, so they’re tastier to eat.

Best for USDA zones: 5–10

3. Lettuce

Lettuce is a quick-turnaround crop that can be harvested repeatedly over a short period. Simply sow seeds consistently through the summer to ensure a regular supply of leafy greens. Starting in May ensures the early plants have sufficiently warm conditions to speed up germination and leaf production, especially for loose-leaf varieties.

To plant
Sow seeds thinly and cover lightly with soil. For continuous harvests, sow every couple of weeks. Keep soil evenly moist and harvest outer leaves regularly. Choosing heat-tolerant varieties can help extend the growing window as temperatures rise.

Best for USDA zones: 3–9

4. Radishes

Radishes are one of the fastest crops you can grow, making them ideal for maximizing output in a short time. With May’s warmer soil, they germinate in just a few days and mature quickly, allowing for multiple sowings in succession. This rapid cycle makes them perfect for filling empty spaces between slower crops, and their high water content makes them a refreshing choice during hot weather.

To plant
Sow seeds in shallow drills and cover lightly. Thin seedlings early to give roots room to develop. Water consistently to maintain good texture and flavor, then harvest promptly once ready. Resow frequently for a continuous supply, or whenever you have extra space in the garden.

Best for USDA zones: 2–10

5. Tomatoes (from transplants)

Tomatoes are a long-season crop that reward patience with heavy yields over time. By May, conditions are usually warm enough to transplant young tomato plants outdoors, allowing them to establish strong roots and begin steady growth. With proper care, a single plant can produce dozens of fruits across the season. If you didn’t start seeds earlier in the year, don’t worry; you can buy young tomato plants that are ready to be planted outdoors.

To plant
Place tomato plants in a sunny, sheltered position in nutrient-rich soil. Bury stems slightly deeper to encourage root development and provide sturdy support. Water consistently and feed regularly to promote greater harvests. Pruning side shoots on certain varieties can also help channel energy into fruit production.

Best for USDA zones: 4–11

6. Cucumbers

Cucumbers are vigorous growers that can produce large quantities of fruit over a relatively short period. Sowing in May gives them the warmth they need to grow rapidly and start producing earlier in the season. This is also a small footprint warrior, so be sure to train them to grow vertically, as it not only saves space but also improves airflow and makes harvesting easier.

To plant
Sow seeds about 1 inch deep in full sun and well-draining soil. Space plants well and provide a trellis or support for upward growth. Keep soil consistently moist, as cucumbers are sensitive to drying out. Harvest regularly to keep plants producing and prevent fruits from becoming oversized and flavorless.

Best for USDA zones: 4–11

7. Swiss chard

Swiss chard is a hardy leafy vegetable that offers repeated harvests over a long season. Once established, it continues to produce new leaves even after regular picking, making it one of the most dependable crops for consistent yields. It also tolerates a range of conditions, including partial shade, so it’s a great all-rounder no matter where you live.

To plant
Sow seeds about ½ inch deep in rows, spacing plants 6–12 inches apart. Water regularly to encourage steady growth. Harvest outer leaves first, allowing the center to continue producing. Its colorful stems also make it an attractive addition to both vegetable beds and ornamental borders.

Best for USDA zones: 3–10

Gardening essentials we love

More from Tom's Guide

• Why are my tomato plant leaves turning yellow? 5 steps to save your harvest
• Stop spending a fortune on expensive lawn treatments: These 7 genius budget-friendly hacks will give you a stunning green yard using simple tricks like recycling kitchen coffee grounds and a 5-minute fix for bare patches
• Watch the magic unfold: How adding 1 kitchen waste product to hydrangeas will guarantee deep blue blooms

A growing number of Claude users are reporting unauthorized purchases tied to their Claude accounts, with patterns surfacing across Reddit and security reports.

According to findings highlighted by Frontiers in Computer Science and reported in The Guardian, modern phishing attacks are increasingly powered by automated, AI-assisted tactics, making account takeovers faster and harder to detect than ever.

This isn't a breach of Claude, it's actually something faster and much sneakier.

How the scam actually works

This attack doesn’t rely on breaking into Anthropic’s systems. Instead, it exploits how accounts, saved payments and gift subscriptions are currently handled. Scammers are gaining access using leaked passwords from past breaches or stolen browser sessions. In some cases, this happens through phishing emails or malware that captures login data without the user even realizing it.

But, this is where things gets sneaky, bad actors are using a "gift" loophole. Once inside, attackers don’t change your password or email, because that would raise alarms for you. Instead, they go straight to billing and send multiple gift subscriptions to external email addresses they control.

Since gifting often has fewer verification steps than account changes, it’s the fastest path to cash. From there, digital gift codes get delivered immediately, which means scammers can resell them on third-party marketplaces, often for crypto, before you even notice the charges.

Why this is happening now

This type of fraud isn’t unique to AI. We've seen prompt injection scams and similar hacks before, but now AI platforms are becoming a new target because of how quickly they’ve scaled.

Here’s where the gap is showing up:

• Limited payment verification: Some users report no secondary authentication (like a bank text code) for gift purchases.
• Trusted device loophole: If a hacker hijacks an existing session, activity can look “normal” to the system. Remember, no password or user name is changed in the sneaky process.
• Faster attack automation: AI-powered phishing and credential attacks are getting more efficient and harder to spot, especially if a user doesn't login to their account every day.

In short, even though the tools are getting smarter, protections and security are still catching up. Just last week, even the most dangerous AI in the world, got into the wrong hands.

How to protect your account right now

If you use Claude (or any AI tool with saved payments), you'll want to do these three steps to stay safe:

• Remove saved payment methods. Go to Settings > Billing and delete stored cards or payment options. Only add them when you’re actively making a purchase.
• Log out of all devices. I'm guilty of always staying signed in, but by logging out, it forces a reset of active sessions, including any that may have been hijacked. If a scammer is already inside your account, this can cut them off instantly.
• Watch for “gift” confirmations. Check your email for messages like “Your gift has been delivered.” If you didn’t send it, contact your bank immediately, request a refund, then secure your account.

The bottom line

This isn't a flaw with Claude, but it is a preview of what happens when fast-growing AI tools don't have enough protections in place. AI tools are rapidly improving, but the real risk is how quickly (and quietly) scammers can take control of your account.

To keep yourself safe, assume your saved payment methods are a liability, and consider removing them until Anthropic puts a 2FA system in place for gift subscriptions.

More from Tom’s Guide

• Check your storage: Chrome may be downloading a 4GB AI model — here’s what we know
• I asked ChatGPT to build a James Clear ‘Atomic’ routine for my home office — here are the 3 changes that actually stuck
• I tested GPT-5.5 Instant — and it finally stopped overexplaining everything

Microsoft Edge apparently saves your passwords in its memory as cleartext according to a Norwegian cybersecurity researcher. This matters because it means a malicious actor could see all of your passwords if they gain access to your PC.

Update: Microsoft provided Tom's Guide with a statement, read on for the company's response.

The researcher, Tom Jøran Sønstebyseter Rønning (spotted by our friends at PC Gamer), posted a thread on X explaining how the browser decrypts "every credential at startup" and then keeps them in process memory. It even happens for sites that you don't visit that session.

"Edge is the only Chromium‑based browser I’ve tested that behaves this way," Rønning said.

To be clear, this isn't available for anyone to just stumble across. You need some know-how and administrative access to the terminal server, already a huge breach. Once that is done, a bad actor "can access the memory of all logged‑on user processes."

A person could have administrative access on one account and then use that access to compromise passwords for other logged-in users too.

Yes, someone with admin rights can wreak havoc on any computer they have access to, but you typically need passwords to access password managers or two-factor authentication. Cleartext means that passwords are more visible and in a shared environment, that would be a treasure trove for a bad actor.

"Access to browser data as described in the reported scenario would require the device to already be compromised," a Microsoft spokesperson said in a statement.

"By design"

Rønning posted that he disclosed this flaw to Microsoft and was told that the behavior is "by design." And it appears to be known.

In a related thread, X user LopezLucio666 responded that they reported the flaw in September of 2025. According to a screencap they posted, the Microsoft Security Response Center (MSRC) deemed the flaw "not a vulnerability and no security boundary being crossed."

The message says that the ability to read Edge memory requires privileges "the same or greater."

Microsoft has a password manager security FAQ that does sort of address the issue. "Even if an attacker has admin rights or offline access and can get to the locally stored data, the system is designed to prevent the attacker from getting the plaintext passwords of a user who isn't logged in."

This doesn't do anything for users who are logged in, though.

Microsoft told Tom's Guide that design choices regarding this involve "balancing performance, usability and security, and we continue to review it against evolving threats."

The company added that the browser's access to password data in memory allows you to sign in quickly and securely, an "expected feature of the application."

Per Rønning and others' research, the system may not be doing enough to prevent attackers from being able to access the cleartext passwords.

In the meantime, we recommend using one of the best password managers instead of storing them in Edge or any other browser for that matter.

Microsoft statement

More from Tom's Guide

• Microsoft is hiding Windows 11's 'eyes' — here's how to find Copilot Vision (and fully delete it)
• Microsoft reportedly redesigning Start Menu in Windows 11 after actually listening to user complaints
• Microsoft quietly hiked prices on all its Surface laptops — it's now cheaper to buy a MacBook Air

Governments across the U.S. and around the world are looking for new ways to keep minors away from inappropriate content online. While age verification is becoming a common hurdle, Utah’s SB 73 — set to go into effect later this week — goes a step further by indirectly targeting the best VPN services.

As reported by our friends at Tom’s Hardware, the state’s Online Age Verification Amendments will begin enforcement on May 6. While the bill includes a new 2% tax on adult content revenue beginning in October, the most immediate impact for users involves the aggressive new regulations on VPN access.

Once the law goes into effect, anyone physically located in Utah will be considered to be accessing a website from within the state, regardless of whether they’re using a VPN, proxy server or other means to hide their geographic location. To complicate things further, Utah will also be the first state to hold companies liable if visitors to their websites are using a VPN to bypass age verification.

The new law doesn’t just discourage VPN use; it also prohibits companies that host “a substantial portion of material harmful to minors” from explaining or even encouraging Utah residents to use one to bypass age verification checks. So, for instance, an adult website won’t be able to put out a post on social media explaining how those concerned about their privacy can use a VPN to access its site anonymously.

While not an outright VPN ban, SB 73 effectively discourages VPN use across the board by limiting what websites can say about them. It creates a "guilty until proven innocent" environment for platforms: if a site can’t tell if a user is actually in Utah, its obligation to police VPNs remains murky. However, if a site allows a Utah minor through because they were using a VPN, that site is now on the hook for a lawsuit.

Age verification outlook

Whether you like it or not, age verification across the web is coming. Enough U.S. states and countries have gotten on board that it’s no longer a question of if, but when, age verification will go into effect.

For most people, this will likely involve uploading a government ID or answering a few questions before they can access a particular site. Just like how CAPTCHA protects sites from bot traffic, age verification is designed to protect minors from accessing inappropriate content online.

There’s just one really big problem, though: VPNs. While a VPN can be a legitimate tool to protect your anonymity and privacy online, they also allow you to sidestep geo-blocking, like what Utah is trying to do here. Likewise, many people depend on VPN services to securely access company files and data over an encrypted connection.

Even if Utah or any other government wanted to block VPNs outright, doing so would be incredibly difficult. VPN providers constantly add new IP addresses and, as the Electronic Frontier Foundation points out, there’s no comprehensive blocklist. Furthermore, "residential proxies" — which make a user's traffic look like it's coming from a standard home ISP — are nearly impossible for websites to filter out.

Utah is looking at an endless game of whack-a-mole if it tries to block VPNs outright. This is why the state is shifting to a "liability trap," holding websites legally responsible when users mask their location. To avoid this risk, many sites may simply choose to block all known VPN traffic or force every visitor, regardless of where they are, to upload an ID.

We’ll see how SB 73 works in practice once it goes into effect on May 6, but for now, let’s hope other states don’t follow in Utah’s footsteps. The goal of protecting minors comes from a good place, but the rest of us are going to be caught up in the fallout.

More from Tom’s Guide

• ADT data breach affects 5.5 million customers as hackers begin leaking stolen info online
• 7 things you might notice when using a VPN for the first time
• 'The death of anonymity online' – Proton boss Andy Yen attacks current age verification laws

With the warmer temperatures, your lawn has come out of dormancy and will need regular mowing. And although it’s tempting to get outside in the fresh air and trim those green blades back, you could be unintentionally ruining your prized patch.

Instead of being proud of a beautiful, lush and healthy-looking lawn, you could be making a big lawncare mistake and mowing your lawn too much or too little. What's more, it's a budget-friendly lawn-care hack that won't cost you a dime.

Why over-mowing is bad for your lawn

“Over-mowing puts your lawn under real stress. When too much of the blade is removed at once, the grass loses a large portion of the surface it uses to produce energy,” explains Sarah Bendrick, landscape contractor, TV personality and spokesperson at STIHL. “That weakens the plant and slows down both top growth and root development.”

If you cut your grass too short, your lawn won’t react favorably, and you’ll often see browning, thinning, and patchy areas. She also adds that it will become susceptible to weeds, disease, and drought.

What happens if you don’t mow enough?

Despite the problems caused by over-mowing your lawn, leaving it too long between cuts can also upset the balance.

“The grass can grow tall and uneven, and the lower portions get shaded out and start to thin,” says Bendrick.

“When you finally mow, you usually end up taking off too much at once, which shocks the lawn and can leave it looking brown and stressed. It can also produce heavy clippings that sit on top of the lawn, blocking sunlight and airflow.”

It seems there’s a fine line between getting the cut just right and achieving the Godilocks moment.

Will it cause long-term damage to your lawn?

Luckily, Bendrick shares that in most cases, the damage starts as short-term stress. “A healthy lawn can bounce back if you correct your mowing habits quickly.”

But if you continue to mow your lawn too often or not enough, it can turn into a long-term problem. “You may end up with weaker roots, thinner turf, and a lawn that struggles with weeds, pests, and disease throughout the season.”

How to fix an over-mown lawn

The best way to correct an over-mown lawn is to be patient and slow things down. Bendrick suggests, “Raise your mower height and follow the one-third rule, only removing a small portion of the blade with each cut. Give the grass time to rebuild its strength between mows.”

Apart from adjusting how you mow your lawn, Bendrick says that your lawn will benefit from consistent watering and a light feed.

What’s more, removing debris and keeping the edges of your lawn tidy will also improve air flow and overall health.

How to care for an overgrown lawn

Just like when dealing with a lawn that’s been cut too much, you also need to exercise patience when dealing with long blades.

Instead of mowing the grass short in one go, Bendrick says you should bring the height down in stages. “Start with a higher mower setting and gradually lower it over a series of cuts, always sticking to the one-third rule. This prevents shock and reduces the risk of browning.”

Once you’ve mown your lawn, she suggests removing the clippings if they are heavy, or raking them over, so they don’t smother the grass below.

How often should you mow your lawn?

“Mowing frequency is less about the calendar and more about how fast your lawn is growing,” says Bendrick.

There are three elements that count — weather, rainfall, and grass type. But as a general rule she says most lawns do well when maintained around 2.5 to 3 inches in height, though that can vary by species.

“A good rule is to mow before the grass gets excessively tall, rather than waiting until it becomes overgrown. During peak growing periods, that often means mowing about once a week, and less often when growth slows,” she explains.

What adjustments can you make to encourage a thriving lawn?

A strong lawn doesn’t happen overnight. Bendrick says it comes from consistent, thoughtful care. Here she shares her top four tips for a thriving lawn.

1. Keep your mower blades sharp so you are cutting cleanly rather than tearing the grass.

2. Mow at the proper height for your grass type and avoid removing too much at once.

3. Water deeply but not too frequently to encourage deeper roots.

4. Seasonal fertilization, along with practices like aeration and overseeding, can help keep the lawn dense and resilient.

By staying on top of these four basic lawn care tasks, Bendrick says your lawn should be better equipped to handle stress and maintain a healthy, even appearance.

Lawncare essentials we love

More from Tom's Guide

• This is the reason why your lawn mower grass cuttings are clumping — and the simple fix to solve it
• How to use coffee grounds as lawn fertilizer — 5 tips for a lush lawn
• The secret to a lush green lawn is this $3 bathroom item — and you might already own it

Social media scams caused Americans to lose $2.1 billion in 2025, according to a new report from the U.S. Federal Trade Commission (FTC). The agency says that's an eightfold increase since 2020.

Of all the people who reported scams to the FTC in 2025, nearly 30% said the con started on social media. Meta-owned social media platforms dominated the scams, with Facebook claiming a majority of them. WhatsApp and Instagram were a "distant" second and third.

"In 2025, people reported losing far more money to scams on Facebook alone than they reported losing to text or email scams," the agency said.

Facebook was reportedly the originator of scams that cost consumers $794 million in lost money. WhatsApp and Instagram combined hit $629 million.

Three types of scams

Typically, these scams fit into one of three categories: investment, shopping, or romance. Contrary to popular belief, the malicious schemes affected every age group except individuals 80 and over, who were more likely to fall for phone call scams.

The FTC's data show that $1.1 billion was lost to fake investment scams in which people were duped by ads or posts offering programs that teach you how to invest. In some cases, the scammers posed as "friendly advisers" or created fake groups full of "successful investors" that led people to invest in false programs.

On the shopping front, 40% of people reported ordering an item they saw in an ad, ranging from clothing and cosmetics to car parts and even puppies. The ads would take users to unfamiliar websites that were used to capture their information. Some sites were fakes that claimed to offer big discounts on well-known brands.

As for romance scams, 60% of people who reported losing money said that it started on social media. In a classic scammer move, the thieves tailor their profile to match a person's profile. Eventually, a crisis would be invented that required the targeted individual to send money.

How to stay safe

The FTC has some advice to stay safe from online scams.

For one, never let someone you only know through social media direct your investment decisions. This is especially true if you maintain a public (not private) account.

Before you talk to new people on social media, you should first limit who can see your posts and contacts via the privacy settings. Be sure to set restrictions to give scammers less to pull from.

Also, before you purchase an item from an online ad, search the company name plus "scam" or "complaint" to see if they're legitimate.

Create a strong defense

Beyond the tips above, build yourself a strong defense by doing things like investing in one of the best identity theft protection services. Identity theft protection can help you get your life back together after an attack, whether it's lost money or a stolen sensitive number.

Additionally, you also want to protect your devices with the best antivirus software and best Android antivirus apps for your phones.

As with any topic, education is the best tool. Educate yourself by reading up on the latest scams and malware campaigns. That will help you know what signs to look out for, helping you be less likely to be a victim. Be sure to share your knowledge with friends and family to help them avoid falling victim to scams like these social medias one as well.

More from Tom's Guide

• AI voice cloning is everywhere — here's why Taylor Swift’s new ‘Legal Shield’ is a blueprint for your digital safety
• Gardeners urged not to make this one big mistake when planting tomatoes
• 100 million Mac users at risk: Hackers are hijacking ‘verified’ apps to sneak past your Mac’s security

Home security giant ADT revealed it was hit by a major data breach carried out by the notorious ShinyHunters extortion group earlier this month. Thanks to the data breach notification service Have I Been Pwned, though, we now know that 5.5 million individuals are affected.

As reported by BleepingComputer, the hackers managed to gain unauthorized access to ADT customer and corporate data on April 20 after breaching its systems. The home security firm detected the intrusion immediately, revoked the hackers’ access, and launched an investigation into the matter.

This is the third data breach ADT has suffered in recent years, following previous disclosures that exposed customer and employee information back in August and October of 2024.

Here’s everything you need to know about this latest breach, including what kind of personal data was stolen and the steps ADT customers should take right now to protect themselves.

From stolen to leaked data

After learning about this data breach, BleepingComputer reached out to ADT to confirm whether or not ShinyHunters’ claim that they had stolen over 10 million records containing both customer and corporate data was true. The company provided further insight on the matter and explained that the intrusion by the group was limited.

When it comes to what types of customer data were stolen, ADT says that names, phone numbers, and physical addresses made up the bulk of these records. However, in some cases, dates of birth, the last four digits of Social Security numbers, or Tax IDs were also exposed.

Fortunately, though, no payment information like credit card data or bank account numbers was accessed by ShinyHunters. The group initially tried to extort ADT by threatening to leak this stolen data online. When the company didn’t pay up, ShinyHunters leaked an 11GB archive of stolen data on the dark web via its leak site.

At the time of writing, ADT has yet to disclose how many individuals are affected by this breach. By analyzing the stolen data, Have I Been Pwned determined that 5.5 million people are directly impacted by this breach.

ShinyHunters isn’t resting on its laurels, though, as the group also claimed last week that it stole over 9 million records from the medical device maker Medtronic. Likewise, the group has also successfully breached the European Commission, Rockstar Games, McGraw-Hill, 7-Eleven, Carnival, Zara, and Udemy in recent weeks.

How to stay safe after a data breach

Finding out that a company you do business with or even one you don’t deal with directly has fallen victim to a data breach can be quite scary. If you’re an ADT customer, there are steps you can take right now to minimize the damage and prevent falling victim to any follow-up attacks.

ADT has already confirmed the breach and has begun the process of sending out data breach notification letters to affected individuals. In these notices, companies explain exactly what happened to the relevant authorities and detail the steps they’ve taken to ensure something like this doesn’t happen again. Likewise, they also lay out how they’re going to make things right for affected customers and individuals.

ADT customers caught up in this breach will receive this notice in the mail. It will tell you the types of your data that were exposed, along with some guidance on how to stay safe after a breach. ADT has already committed to providing free access to one of the best identity theft protection services to impacted individuals. However, you’ll likely need a code found in your data breach notification letter to take advantage of this offer.

As such, you should be keeping a close eye on your mailbox as data breach notification letters arrive the old-fashioned way, as opposed to over email or via text. In the meantime, you’re also going to want to be extra careful when checking your inbox. Since email addresses were exposed, ShinyHunters or even other hackers they sell this stolen info to could try to use it to launch targeted phishing attacks against impacted individuals.

Given that these phishing emails could contain malicious links or even malware, you’re going to want to keep your PC protected with the best antivirus software and your Apple computer secured with the best Mac antivirus software. That way, you’ll be protected from any potential threats. I wouldn’t rush out and sign up for identity theft protection just yet, though, as ADT is providing a free subscription to those affected.

The ShinyHunters group shows no sign of slowing down just yet, which is why every company should be taking this threat very seriously. Hopefully, law enforcement is able to catch and stop these hackers sooner rather than later.

More from Tom's Guide

• Scammers are abusing Apple account change notifications in new phishing attack — how to stay safe
• I put Apple’s new macOS ClickFix warnings to the test and they actually worked — now I want them on Windows too
• Over 1 billion Windows users at risk after disgruntled security researcher leaks Defender zero-days

If there’s one thing the AI boom has made clear, it’s that your face, voice, and identity are now federally protected assets. While superstars like Taylor Swift and Matthew McConaughey are leading the charge with sound trademarks, their 'legal shield' strategy is becoming the new survival guide for all of us in the age of deepfakes.

Tools that once required studios and technical expertise can now clone voices, generate realistic images and mimic personalities in minutes. While celebrities like Taylor Swift often become the headline when AI likeness concerns surface, the bigger story is what this means for all of us. Because you don’t need to be a global celebrity to have something worth copying.

If you post videos online, run a business, host a podcast, teach classes, create content or simply share your life publicly, your voice and image may already be part of the data economy. AI systems are trained on publicly available information, and impersonation scams are becoming more common.

That means protecting your identity online is no longer just a celebrity problem. It’s quickly becoming an everyday one.

Why voices are suddenly valuable

A voice used to be personal, but now it can also be data. AI tools can analyze tone, pacing, pronunciation and speech patterns to generate eerily realistic copies.

Some tools are used for legitimate purposes like accessibility, dubbing or narration. But the problem is, when voices are misused for scams, fake endorsements or impersonation.

We’ve already seen growing concern over AI-generated celebrity voices, fake robocalls and cloned family-member scams. As the technology improves, the line between real and synthetic keeps getting harder to spot.

That’s why the next phase of online safety may focus more on identity signals.

What Taylor Swift represents in the AI era

Celebrities often become the first battleground for new technology because their likeness has clear commercial value. Taylor Swift’s latest move leans heavily on the precedent set by the ELVIS Act, the first law of its kind to declare war on unauthorized AI voice cloning.

Not just for celebrities; it’s a 'humanity-first' law that protects everyday creators from identity theft. As the Tennessee Governor’s office explains, the law effectively puts a 'digital padlock' on your voice, acknowledging its immense value in our new synthetic economy."

Whether it’s fake songs, unauthorized images or misleading endorsements, stars like Taylor Swift highlight a larger issue of who actually owns a voice, face or recognizable identity online. Even for those of us without multiple Grammys or worldwide name recognition, we still have rights. The problem is, the enforcement speed. For "regular people" like you and me, getting platforms to remove fake content can be tougher, and that might more than owning a trademark. The lesson for us is that if identity has value at the highest level, it has value at every level.

Simply put, your reputation, trust and authenticity matter too.

How to protect your voice and image right now

The good news is, you don’t need a legal team to start taking smarter steps today. Here are a few ways to keep yourself safe to stop scams before they start.

• Audit what’s public. Search your name online. Check what videos, podcasts, photos and bios are publicly accessible. You may be surprised how much material exists that could be copied or scraped.
• Lock down old accounts. Unused social profiles, abandoned YouTube channels and forgotten public pages can become weak spots. Update passwords, enable two-factor authentication and remove outdated content where possible.
• Use official branding consistently. If you run a business or create content, keep usernames, profile photos and bios consistent across platforms. That makes fake accounts easier to spot.
• Inform family about voice scams. One of the fastest-growing threats is AI-generated calls pretending to be a loved one in distress. Create a family safe word or verification question now. Doing so can prevent panic later.
• Watch for fake endorsements. If you see your image, voice or name used in ads or suspicious posts, report it immediately through the platform.

The takeaway

The faster you act, the better. You don't have to be an influencer to have your voice cloned or manipulated so it's important to start protecting yourself now. We’re entering a world where proving something is real is getting more difficult every day.

This applies to everyone from celebrities to small business owners or really anyone with online presence. In other words, nobody is turly safe. The growing value of identity in a world where machines can imitate almost anyone is scary. Have you ever been a victim of voice cloning or know someone who has? Share your thoughts in the comments.

More from Tom's Guide

• I let Gemini scan my messy fridge photos to plan my meals — and I saved $150 this month
• I asked ChatGPT to use Charlie Munger’s ‘Inversion rule' to rethink my goals — and it beat every productivity app
• I asked ChatGPT to use Elon Musk’s ‘Relevance Rule’ to fix my memory — and I’m never going back to notes

Tomatoes are one of my favorite salad vegetables, and although you can buy them year-round, they are always much more flavorful when harvested from your own backyard.

Whether you choose to grow tomatoes from seed or buy seedlings, you could be making a big mistake when you plant. Instead of harvesting a luscious crop of juicy tomatoes, you could be gathering a meager selection of small fruits.

So, to ensure you’re not disappointed with your homegrown tomato harvest, check out the correct spacing required between plants.

Why you need to space tomatoes correctly

Apart from soil type, fertility and temperature, plant spacing should also be carefully considered.

While you might be tempted to cram in as many plants as possible, so you have a bumper harvest, increasing competition between plants can reduce the yield and vegetable quality in your yard.

This increased competition means your plants are fighting for sunlight, water, and nutrients, and are more susceptible to disease, as tight spacing reduces airflow and encourages pests to thrive.

Apart from encouraging your plants to grow a healthy crop of delicious tomatoes, adequate spacing will allow you to reach between plants to water and care for them without causing damage.

Your tomatoes are too close

If your tomato plants are positioned too close together, they may grow jungle-like, with branches intermingling. You may also notice abnormally tall and narrow, spindly plants as they compete with neighbors for sunlight. What’s more, due to the lack of sunlight and poor airflow, the lower leaves of your plants might turn yellow. And the leaves may remain soggy if there is a long period of rainfall.

Pests and diseases are another problem that are more common when tomatoes are packed in tight. Blight and fungus are encouraged by a lack of airflow, so watch out for early and late blight and powdery mildew. The warning sign is black or brown spots on your plants.

The biggest consequences are lower yields and smaller tomatoes, and, due to limited sunlight, your fruits may stay green for longer or not ripen evenly.

How to plant your tomatoes for optimum growth

Most tomato plants need to be spaced 24 to 36 inches apart for optimum growth, though this depends on the variety you're planting, whether you’re growing determinate or indeterminate types. But, before you start digging, check your seed packet or plant label for guidelines, to ensure you’re getting it right.

Determinate tomatoes, or bush tomatoes, are more compact than indeterminate types, which makes them ideal for small spaces or containers. When planting them in the ground, ensure they are spaced at least 24 inches apart.

Indeterminate tomatoes, also known as cordon or vining tomatoes, often need staking due to their height and need more space than determinate types. Give indeterminate tomatoes another foot, and plant them 36 inches apart.

Get this step right, and you can look forward to a healthy tomato harvest that grows to its full potential.

Gardening essentials we love

More from Tom's Guide

• 3 best ways to trellis tomatoes for an abundant crop
• 7 top tips for growing juicy tomatoes
• How to spot and prevent tomato blight — expert gardeners explain how

Mac users have felt safe behind Gatekeeper — the macOS digital security guard that only lets verified, trusted apps onto your machine. But now, that gate has just developed a massive crack, as hackers have found a way to get around it undetected.

On April 22, the research team at Mosyle Security discovered two forms of malware named “Phoenix Worm” and “ShadeStager.” With them, hackers are now successfully stealing developer keys, which act like a digital passport, and by hijacking them, cybercriminals can disguise malware as Apple-approved apps.

To your MacBook, these viruses don’t look like a threat; they look like trusted guests. And with over 100 million Mac users worldwide, this blind spot means that even the most cautious users could be downloading a disaster in disguise.

How it works

The attack doesn’t start with you, but with the people who make your favorite apps. Hackers target the developers with a tag-team effort between these two new threats. First, the Phoenix Worm is snuck onto a developers system through a range of social engineering attacks — think recruiters with fake job offers or urgent coding tasks from clients.

Once it's there, Phoenix Worm is the inside man, which gives your Mac a secret ID number, waits for instructions, and even keeps watch for security software to hide further away from it.

When the coast is clear, the Phoenix Worm calls in the heavy hitter: ShadeStager. This specialist comes in and takes over developer keys, cloud credentials and secret dev tools. And while this digital heist happens behind the scenes, the fallout lands squarely on your desktop.

With these master keys, hackers can forge Apple’s verified seal of approval on any malicious file they want. By compromising the tools used to build apps, hackers are essentially poisoning the well in the Mac’s walled garden — turning a trusted developer’s reputation into a backdoor onto your private machine.

How to avoid this attack

First off, given Apple’s real focus on security, I would not be surprised if a hotfix update is deployed in the next few days to strengthen its verification process. But ultimately, while these two exploits in tandem are sophisticated, they’re not magic — they still need people to let them in.

So from a developer perspective, it’s going to be all about being extra careful of the emails being received. In fact, Apple added a warning into macOS 26.4 when you’re about to paste potentially malicious code into the Terminal app. Stop immediately if you see it.

As for most of you reading this, if you’re downloading apps outside the Mac App store, it’s about exercising some extra caution and asking yourself a couple of questions:

• Do I really know this company?
• If it’s something I’ve never heard of before, is it worth the risk?

And of course, while the Terminal warning above is more to developers, it’s good general advice for you too. If ever you see a website asking you to open the Terminal at all, that’s an automatic “close tab” moment.

Like any computer, your Mac is only as safe as the things you allow it to do, and by staying vigilant and skeptical, you can keep yourself invisible to even the most sophisticated attacks like this one.

More from Tom's Guide

• Over 1 billion Windows users at risk after disgruntled security researcher leaks Defender zero-days
• Scammers are abusing Apple account change notifications in new phishing attack — how to stay safe
• 108 malicious Chrome extensions found stealing data and injecting ads into every page you visit — delete them right now

Everywhere I turn, I see people using robot vacuums, and although I’m perfectly happy with my Shark upright vacuum cleaner, it does make me think whether my next purchase will give me extra time to crash out on the couch.

What’s more, robots are also taking over outside in our yards. Instead of seeing your neighbors diligently mowing their lawns, you’re more likely to spot them sipping a cold drink while their robot lawnmower does all the hard work.

However, robot lawnmowers are a big investment. And despite their small stature, you can expect to pay at least $1,000 for a robot lawnmower, with Segway’s latest Navimow X4 Series setting you back at least $2,299 at Amazon.

You need to do some serious thinking before you invest in a lawnmower to make sure it can tackle your lawn. With this in mind, I approached lawn care experts to ask when your lawn isn’t suitable for a robot lawnmower.

1. When a robot lawnmower isn't the best choice

“Robotic mowers can work on a wide range of lawns, but not every yard is a perfect fit,” says Kevin Caleca, NA Robotic Product Manager at Husqvarna. “Complex layouts with disconnected sections, stairs, or very narrow passages can require more planning or specialized setups.”

Jonathan Davis, grass expert at Lawnsmith, adds that it’s not just about awkward areas, “Robot mowers work best on reasonably even, well-defined grass areas. If your lawn is on the wild side, heavily obstructed or like a meadow, you’ll see the limitations of a robot mower quickly.”

2. Bumps can be a problem

Whether a robot lawnmower can handle a bumpy lawn will depend on the model and a few other factors.

“Most robot mowers can handle some minor bumps and slightly uneven ground," Davis said. "But if it’s properly lumpy, with ankle-rolling divots, you’ll end up with patchy cuts, scalping and a potentially stuck mower."

However, he does suggest that if your lawn is uneven, a layer of topsoil can help rectify the problem.

3. Steep slopes are a challenge

The same is true for sloping lawns; it depends on the mower's capabilities. While you can expect a standard robot lawn mower to handle inclines of 20-30%, according to Davis, others are designed to cut steeper lawns.

Caleca adds that Husqvarna’s 435 iQ series Automower is designed to handle up to a 70% slope, while the brand’s iQ models are rated for up to 45%.

However, Gene Caballero, co-founder at GreenPal, says you will pay for this functionality. “There are some mowers that are specifically designed for steeper grades, but they are very, very expensive and more for commercial use.”

And of course, it’s cutting capability also depends on the conditions. “If the grass is slightly damp, you run the risk of it slipping. Any edges on slopes can also cause problems for your mower,” says Davis.

4. You have a small lawn

If you have a small lawn, you might think it’s not worth investing in a robot lawnmower, and you are probably right. “Robot mowers are recommended for large lawns and grassed areas that take a lot of maintaining. If it takes you 5-10 minutes to mow your lawn, a robot is probably not needed,” says Davis.

Instead, he suggests a smarter splurge would be investing in a cordless mower.

However, it all depends on whether you want to give up mowing your lawn. If you don’t want to call on the help of a lawn mowing service, a robot lawnmower could be the best choice for you.

5. Your lawn is split into sections

If, like me, your lawn is split into sections with paths and gravel areas, you may be wondering whether a robot lawnmower can cope with the layout.

“Paths, patios and graveled areas can be tricky. While some robot mowers can handle multiple zones, you’d need to be very careful when you’re setting it up, using boundary wires or the mower’s mapping,” says Davis.

Issues such as gravel paths can also stop a mower or damage its blades if it continues across them. “There’s also a risk of stones being flung by the blades and causing nearby damage,” he adds.

However, if you have a completed layout and pathways between lawn sections, Davis says, “It is manageable but not seamless. If your lawn is fragmented, the time you spend setting the mower on the right track might take longer than just mowing the lawn yourself.”

Caleca explains that handling multiple zones and surfaces is an area where robotic mowing technology has advanced quickly. With this in mind, we can look forward to these challenges being overcome in the future.

6. Your dog has dug holes in your lawn

While small divots are usually not an issue, as they can be filled in, Davis says, “if your lawn resembles a minefield, it can cause problems when mowing.”

And if you have a playful dog that likes to bury its toys in your neatly mowed lawn, it could be too much of a challenge for a robot lawnmower.

Davis adds, “The robot’s wheels could get stuck, your cut could end up being uneven, but it could cause blade damage if there are any rocks dug up, before your mower cuts your lawn."

7. Your lawn has poor drainage and gets water-logged

The general advice among the lawn experts is to never mow a water-logged lawn with either a robot or a standard mower. Davis, says it’s especially important to avoid using a robot mower, as the wheels are likely to spin and cause ruts, the mower will get stuck, and it will result in a poor overall cutting performance.

However, Caleco says that robotic mowers can operate in wet grass, but extremely wet conditions will result in slipping or rutting, regardless of the brand.

Although he explains that some robotic mowers with advanced systems can operate during rainfall and can integrate with weather data to help automate those decisions and pause mowing until conditions improve.

How to improve your lawn’s drainage
Drainage in your lawn can be fixed by improving aeration and filling in uneven surfaces where water pools.

The final cut

Before you invest in a robot lawnmower, remember that not all lawns are the same. You need to consider your lawn’s size, its gradient and any challenges, such as split areas. Then, you can decide whether a robot lawnmower is the right solution for your yard, and if so, match one that’s compatible with your needs.

Gardening essentials we love

More from Tom's Guide

• Segway Navimow i110 robot lawn mower review: Perfectly trimmed grass without lifting a finger
• I went hands-on with Roborock’s new RockMow Z1 robot mower — these 3 features are game-changers
• The Sunseeker X3 Plus robot lawnmower has been trimming my yard all summer - 3 things I like and 1 I don't

Getting a notification about an unknown purchase can certainly be startling. That is, until you realize it’s a fake just by checking the sender’s email address. However, a new phishing scam might make you think twice about that recent purchase you definitely didn’t make.

As reported by BleepingComputer, Apple users are being targeted by a new phishing attack currently making the rounds online. Just like with previous campaigns, this one claims that unsuspecting users bought a new iPhone. What makes this scam appear slightly more legitimate, though, is that the email comes from Apple itself — or at least it appears to at first — through the company's Apple account change notifications.

Here’s everything you need to know about this new phishing attack, including how to spot it and how to avoid it, along with some tips and tricks to help keep you safe from all manner of online scams.

Impersonating Apple to bypass security checks

BleepingComputer first learned of these fake iPhone purchase phishing emails last week when a reader reached out about them. They received the email in question informing them about “the following changes to your Apple Account.”

In the email, the reader was told that they purchased an iPhone for $899 and paid via PayPal. However, next to all this info at the top of the message, there’s a phone number to call if they want to ‘cancel’ the purchase.

Instead of canceling the fake purchase, calling that number puts potential victims into direct contact with the scammers behind this campaign. While on the phone, they might try to convince Apple users that their accounts were compromised. Likewise, they could also instruct them that they need to install remote access software (while walking them through the process to do so) or to provide financial information. As BleepingComputer points out, in previous callback phishing campaigns, remote access was used to drain bank accounts, deploy malware or steal data.

When it comes to phishing lures, fraudulent purchases are one of the oldest ones in the book. However, what makes this particular scam easier to fall for and much more interesting is how the hackers behind it managed to impersonate Apple so well.

After analyzing the email, BleepingComputer found that it was sent from Apple’s own infrastructure using the email address appleid@id.apple.com. It also managed to pass several authentication checks, and in a victim’s inbox, this email would appear as a legitimate one from Apple.

This was done by adding key details from the phishing message to the first and last name fields when creating a real Apple account. From there, the scammer modifies the account’s shipping information, which leads Apple to send out a security alert notifying them of the change. Since the iPhone maker uses the user-supplied first and last name fields when sending these alerts, the scammers behind this campaign are able to get their phishing messages embedded in official emails that come directly from Apple.

You might be wondering how the scammer got the Apple account change email to show up in the victim’s inbox. Well, they technically didn’t. Instead, they changed the shipping information in their own account, got the email and then sent it to the victim. That way, the message appears to come from appleid@id.apple.com when it technically didn’t. This is even more apparent in the header, where analyzing it shows that the original recipient differs from the final delivery address.

How to stay safe from phishing scams

When dealing with a phishing attack like this one, the first and most important thing you should do is to slow down, take a breath and try to keep a level head. Scammers want you worried and anxious so that you do things you normally wouldn’t, like call back the number on a random email that showed up in your inbox.

Whenever you get an unexpected account alert message in your inbox claiming that you purchased something you didn’t, you should always proceed with caution. While accidental purchases do happen, it’s more likely you’re dealing with a scam email.

To get some much-needed peace of mind, I recommend checking your bank account or the account in question first. If you don’t see any recent purchases that match what the email claims, then you can safely ignore it.

In order to protect yourself further, I recommend using the best antivirus software on your Windows PC or the best Mac antivirus software on your Apple computer. Both of which can help protect you from any malware or other viruses that may be included in phishing emails. Now, if you do fall for one of these scams, getting your stolen money back is nearly impossible. However, if you had signed up for one of the best identity theft protection services beforehand, you can use their fraud protection to recover any lost funds.

Apple continues to be one of the most popular companies in the world, and as such, scammers are going to keep trying to impersonate it in their attacks. That’s why it’s up to you to be extra careful when checking your inbox. If you proceed with caution and avoid clicking on links or calling back any numbers found in these messages, you should be safe.

More from Tom’s Guide

• Don’t call that number: Dangerous new Apple Pay scam tricks victims into picking up their iPhones
• I put Apple’s new macOS ClickFix warnings to the test and they actually worked — now I want them on Windows too
• Over 1 billion Windows users at risk after disgruntled security researcher leaks Defender zero-days

Even though those constant notifications can be annoying, having Windows 11’s built-in antivirus, Microsoft Defender, is ultimately a lifesaver. But what if the very software designed to protect your PC could be tricked into attacking it?

This is exactly what’s happening with three dangerous new zero-day flaws.

As reported by BleepingComputer, a disgruntled security researcher recently went public with the vulnerabilities. Posting under the alias Chaotic Eclipse, the researcher leaked the exploits as a direct protest against how the Microsoft Security Response Center (MSRC) handles bug disclosures. Essentially, he decided that if Microsoft wouldn't listen to his private warnings, he’d let the rest of the world see the code for itself.

Unlike a standard bug, these "zero-days" are a massive headache because there isn’t a patch available yet — leaving even the best Windows laptops and desktops vulnerable to active attacks.

Here’s everything you need to know about the BlueHammer, RedSun, and UnDefend vulnerabilities and, more importantly, how to stay safe until a fix arrives.

Already exploited in the wild

When it comes to these now disclosed zero-days, BlueHammer and RedSun are local privilege escalation flaws that affect Microsoft Defender. This means that in order to exploit them, a hacker would need direct, physical access to your Windows laptop or PC. Meanwhile, the third zero-day, dubbed UnDefend, can be exploited as a standard user to block Microsoft Defender’s own updates.

In a post on X, the cybersecurity firm Huntress revealed that it had already seen reports of all three zero-days being actively exploited in the wild. When dangerous zero-days fell right into their lap, cybercriminals wasted no time weaponizing them against vulnerable Windows systems.

Fortunately, Microsoft patched the BlueHammer vulnerability (now tracked as CVE-2026-33825) in its April 2026 security updates. In fact, yesterday, I noticed that two of the best mini PCs at my home had restarted out of the blue after automatically installing this update on their own.

It’s not all good news though as, at the time of writing, the RedSun and UnDefend vulnerabilities remain unpatched. Of the two, RedSun is particularly dangerous since it can be exploited to gain SYSTEM privileges on both Windows 10 and Windows 11.

The researcher provided further insight on just what his RedSun exploit is capable of in a post on Microsoft’s own GitHub, saying:

"When Windows Defender realizes that a malicious file has a cloud tag, for whatever stupid and hilarious reason, the antivirus that's supposed to protect decides that it is a good idea to just rewrite the file it found again to its original location. The PoC abuses this behaviour to overwrite system files and gain administrative privileges."

Essentially, if a malicious file has this 'cloud tag,' Microsoft Defender gets confused. Instead of deleting the threat, it actually copies the virus back onto your hard drive into a restricted system folder. Since the antivirus software is the one doing the moving, the computer doesn't double-check it — giving the virus 'Admin' powers to take over your entire PC. With admin-level privileges, it can now delete files, install spyware or even lock you out of your own computer.

How to keep your Windows PC safe

In order to stay protected from these three new Microsoft Defender zero-days, the first and most important thing you should do is to install Microsoft’s April 2026 security updates ASAP. This won’t patch all three flaws but it will protect you from any attacks exploiting the BlueHammer vulnerability.

As for the other two vulnerabilities, you’re just going to have to wait until Microsoft addresses them. Given the threat they pose, you’re going to want to regularly check for updates by going to Settings > Windows Update > Check for updates. When a fix arrives, you should install it as soon as you can to prevent falling victim to any attacks leveraging these new zero-days.

Although Microsoft Defender has improved significantly over the years, in this case, you may also want to turn to the best antivirus software for additional protection. Unlike Windows’ built-in security software, paid antivirus solutions are updated more frequently and they can help fill in any gaps in your protection. Many of them also include useful extras like access to a VPN, password manager and even cloud backup.

As for that disgruntled security researcher, his days of collecting bug bounties from Microsoft are certainly over. For the rest of us though, it’s just a waiting game until the software giant fully patches the remaining two zero-day flaws.

More from Tom's Guide

• 108 malicious Chrome extensions found stealing data and injecting ads into every page you visit — delete them right now
• Comcast is paying $117 million in data breach settlement — how to file your claim and how much you could get
• Dangerous new NoVoice Android malware could be undeletable on older phones — check your settings right now

Today, Anthropic officially released Claude Opus 4.7, the most powerful AI model available to the general public. On paper, it is promised to be a beast: a notable leap in advanced software engineering, substantially better vision for analysis capabilities and a new "self-verification" mode that allows it to audit its own work before it reports back to the user.

But there is a shadow hanging over this launch. For the first time in the history of frontier AI, a company has admitted to purposely making a model dumber in order to protect the world from it. Let me explain.

Opus 4.7 is the 'civilian-safe' version of the Mythos model

To truly get why the release of Opus 4.7 is such a milestone, you first have to understand the implications of Anthropic's Claude Mythos Preview. I'm mentioning it alongside today's launch mainly because Mythos remains the company's most powerful model. However, its release is strictly limited to cyber defenders and critical infrastructure partners. While Opus 4.7 is a "notable improvement" over previous versions, it is fundamentally a secondary tier.

In the release notes for Opus 4.7, Anthropic dropped a bombshell stating that during the training of Opus 4.7, the team experimented with efforts to "differentially reduce" the model’s cyber-offensive capabilities.

For you and me, that means the company intentionally nerfed the model’s ability to be used as a digital weapon.

Project Glasswing and the first real-world test

Opus 4.7 serves as the first live guinea pig for Project Glasswing, the security initiative Anthropic unveiled last week. This framework introduces automated safeguards that detect and block prohibited or high-risk cybersecurity requests in real-time.

For the average developer, this means a more helpful assistant. For the security community, it means a gatekeeper.

If you are a professional researcher, you can no longer access these features anonymously. You must now apply for Anthropic’s new Cyber Verification Program. That move effectively puts "Frontier AI" behind a background check.

Opus 4.7 upgrades

Even with its wings clipped in cybersecurity, Opus 4.7 is promised to be a massive upgrade for professional workflows. If you aren't trying to hack a mainframe, here is what you’re getting:

• Autonomous engineering: This new model makes it easier than ever to hand off your hardest coding work. Anthropic promises tasks that previously required "close supervision" can now be done with total confidence.
• Self-verification: Opus 4.7 no longer just "guesses." It devises ways to verify its own outputs, running internal logical checks before reporting back. This is huge for hallucination reduction and fact-checking.
• High-resolution vision: While image generation is still not part of Claude's features, the model can now see images in significantly greater resolution. This breakthrough could be useful for parsing complex technical diagrams, UI/UX mockups and even professional slides for your next presentation.
• Creative "taste": Anthropic claims the model is more "tasteful" when generating professional documents, producing higher-quality interfaces and docs that feel less "AI-generated" and more human-refined. This is something I'm still eager to play around with, as it's been studied that "taste" is one of the hardest human aspects to replicate.

The takeaway

Claude Opus 4.7 is a "safe" powerhouse with pricing remaining the same as Opus 4.6: $5/M input tokens, $25/M output tokens. Anthropic customers have reported a massive 3x increase in production task completion and nearly perfect vision accuracy (98.5%), all at the same price as its predecessor.

However, I'm cautiously optimistic because the real story here is that it’s the "civilian" version of Anthropic’s secret Mythos model; purposefully limited in its hacking abilities to test a new era of gated, identity-verified AI. We've entered a new era of AI and I'll be watching (and reporting) closely.

Have you tried it yet? Let me know in the comments what you think.

More from Tom's Guide

• ChatGPT’s new ‘Thinking’ mode just hit a 94% reasoning score — 7 prompts it can solve that standard AI can’t
• The 'Learn to Code' era is over — as an AI editor, here's the 'Intent Architecture' roadmap I’m giving my kids instead
• Google just unlocked 'Agent Mode' for Gemini 3.1 — here are 7 things it can now do for you

Even though we all know — or should by now — just how dangerous downloading a bad app on our phones can be, the same can’t be said for browser extensions. In fact, a new batch of malicious extensions with 20,000 combined downloads was just discovered.

As reported by The Hacker News, the supply chain security firm Socket found 108 malicious Chrome extensions posing as games, utilities, and other tools on the Chrome Web Store. While they might seem innocent at first, these extensions are actually designed to quietly steal your data in the background and inject ads into every site you visit online.

Surprisingly, even though these extensions are from five different developers, all the data they steal gets sent back to the same command-and-control (C2) server. This suggests a coordinated operation and not just a few bad extensions that managed to slip through the cracks.

Here’s everything you need to know about this new campaign, along with how to keep your browser and your data safe from malicious extensions.

Delete these extensions right now

If you have any of these 108 Chrome extensions installed in your browser, you should delete them immediately. Here are the ones with the most installs but you can find the full list in Socket’s report on the matter:

• Web Client for TikTok – 2,000+ installs
• Web Client for Telegram - Teleside – 1,000+ installs
• YouSide - Youtube Sidebar – 1,000+ installs
• Web Client for Youtube - SideYou – 1,000+ installs
• Formula Rush Racing Game – 1,000+ installs
• Page Auto Refresh – 1,000+ installs
• Page Locker – 1,000+ installs
• Text Translation – 1,000+ installs
• Web Client for Rugby Rush - SideGame – 1,000+ installs
• Telegram Multi-account – 1,000+ installs
• Black Beard Slot Machine – 1,000+ installs
• Clear Cache Plus – 1,000+ installs
• Speed Test for Chrome - WiFi SpeedTest – 1,000+ installs
• Piggy Prizes - Slot Machine – 500+ installs
• Master Chess – 500+ installs

If you’ve installed any of these extensions in Chrome — or any other Chromium-based browser like Microsoft Edge — you need to remove them immediately.

To do so, click on the three-dot menu in the upper right corner of your browser, then Extensions and Manage Extensions. From there, you can search for and remove any of these malicious add-ons.

Sharing the same backend

According to Socket, these 108 malicious extensions cover a wide variety of categories, from add-ons for YouTube and TikTok to games and utilities. They all target different types of users but share the same command-and-control (C2) server on the backend.

If you did install one of these bad extensions, you’d have no idea something was wrong. On the surface, they all function as intended. However, behind the scenes, one hijacked victims’ Telegram accounts every 15 seconds, 45 added a universal backdoor to the browser, and 54 of them stole users' Google “sub” IDs.

Of the 108 extensions, those last 54 are the most dangerous. While they also harvest your Gmail address, full name, and profile picture URL, the Google account identifier (or "sub" ID) is the most concerning. This is a digital footprint that Google assigns to your account that stays the same even if you change your password or email address.

With this identifier in hand, the cybercriminals now have a “master record” of who you are. If they catch you in a different scam years from now, they’ll know it’s the same person, allowing them to link your browsing activity across different platforms and build a permanent profile of your digital life.

How to stay safe from malicious extensions

Since malicious extensions still manage to slip through Google’s security checks and end up on the Chrome Web Store, you always need to be extra careful when downloading anything new.

As a general rule of thumb, it’s best to stick to well-known extensions from trusted brands, but I know you can’t always do that. Personally, I’ve found quite a few extensions from smaller developers that are incredibly useful. In those cases, I always check their ratings and reviews before installing them. However, I like to go a step further and check the Permissions tab. If a simple calculator or game asks for permission to "read and change all your data on all websites," it’s an immediate dealbreaker.

I also recommend turning on Enhanced Safe Browsing in Chrome's security settings. It provides real-time protection and will warn you if an extension you’re about to install isn't on Google's list of "trusted" developers.

Since even good extensions can go bad, you want to ensure that your Windows PC is protected with the best antivirus software. If you’re using an Apple computer, the best Mac antivirus software provides this same layer of extra protection. If a malicious extension does try to install malware on your system, antivirus software will detect and stop it before it can do any serious damage.

Given that browser extensions can be misused to commit fraud, you may also want to consider signing up for one of the best identity theft protection services too. Not only can they help you regain your identity after it’s stolen, but they can help you recover any funds lost to fraud as well.

Tricking unsuspecting users into installing malicious extensions is one of the easiest ways hackers can establish a foothold in your browser. While you could stop using them altogether, there are a ton of great ones that can really improve your experience. For that reason, I recommend exercising caution when downloading new ones and performing a manual audit of your installed extensions every few months to remove anything you no longer use.

More from Tom's Guide

• Don’t call that number: Dangerous new Apple Pay scam tricks victims into picking up their iPhones
• Comcast is paying $117 million in data breach settlement — how to file your claim and how much you could get
• Dangerous new NoVoice Android malware could be undeletable on older phones — check your settings right now

The travel site, Booking.com, has suffered a data breach that exposed customer data associated with reservations made on the platform. The company reportedly took immediate action forcing PIN resets for existing and past reservations.

Impacted users will receive an email about the breach but so far, Booking.com has declined to disclose how many people may be affected by the breach.

Booking.com is an online travel site that lets you book cars, flights, hotels, taxis and other travel related expenses. Like Expedia or Priceline it acts as a middleman between travelers and providers.

Redditors in the booking.com subreddit reported receiving an email about the breach over the weekend where the PIN reset was revealed. Reportedly, the email said compromised data included: full names, email addresses, phone numbers and some communications shared by hospitality providers.

"At Booking.com, we are dedicated to the security and data protection of our guests. In that spirit, we're writing to inform you that unauthorized third parties may have been able to access certain booking information associated with your reservation," the email reads.

There was some confusion from people who received the emails because nothing was sent out via the Booking.com app, meaning some people questioned the emails legitimacy.

However, a communications rep with the company confirmed the breach to BleepingComputer, saying:

“At Booking.com, we are dedicated to the security and data protection of our guests. We recently noticed some suspicious activity involving unauthorized third parties being able to access some of our guests’ booking information. Upon discovering the activity, we took action to contain the issue. We have updated the PIN number for these reservations and informed our guests," Sage Hunter of Booking.com told the site.

How to stay safe after a data breach

Booking.com platforms over "30 million accommodations" per its website and services hundreds of millions of customers. With potentially millions of people affected, it's best to get ahead of any potential malfeasance enacted with your stolen information.

Normally, a company exposed in a data breach offers free access to one of the best identity theft protection services. However, it's unclear if Booking.com is doing so for this breach. You may want to avail yourself of one of these services regardless.

I saw some Redditors saying that they received multiple emails about the breach. Booking.com does have a page with trusted emails. If any of your the email addresses you receive purporting to be from the platform aren't on that list I would delete the email.

Keep an eye out for potential phishing emails in general and try not to download malicious attachments that are designed to infect your devices with malware. Be sure to protect your PC or Apple comptuer with the best antivirus software or the best Mac antivirus software.

Impacted users should start seeing emails from Booking.com if you haven't already. If you aren't seeing one, be sure to check your spam folders, just in case but be wary of bad email addresses. Likewise, you may get a data breach notification in the mail shortly so be on the lookout for that as well.

More from Tom's Guide

• ‘Don’t be a victim!’ NSA warns to reboot your router right now
• Comcast is paying $117 million in data breach settlement — how to file your claim and how much you could get
• Don’t call that number: Dangerous new Apple Pay scam tricks victims into picking up their iPhones

Comcast will soon begin sending out payments following a 2023 data breach, and affected individuals can file a claim right now to get a portion of the $117.5 million settlement.

As reported by CT Insider, the U.S. cable and internet service provider suffered a data breach back in 2023 when hackers exploited a critical Citrix vulnerability to gain unauthorized access to its systems. During the three days they had access, the hackers managed to steal names, contact information, dates of birth and other sensitive customer information but not financial data.

Now almost three years later, Comcast has agreed to a $117.5 million class-action settlement. It’s still awaiting final approval by the U.S. District Court for the Eastern District of Pennsylvania on July 7. However, if your personal info was exposed as a result of this breach, you can file a claim now so you’re first in line when payouts start going out.

If you were previously sent a data breach notice by Comcast, you’re one of the 31.6 million people who are eligible to file a claim and get a portion of this settlement. Here’s how to do it and how much you can expect to get.

How to file a claim and how much can you get?

To get started, you’ll need to head to this website and fill out an online form to file a claim. It must be submitted by August 14th for review.

Alternatively, if you’d rather do things the old-fashioned way, you can also print out the form and mail it to Hasson v. Comcast Cable Communications LLC c/o Kroll Settlement Administration LLC P.O. Box 5324 New York, NY 10150-5324 by August 14th.

Likewise, if you don’t want to be a part of this settlement and would prefer to reserve your right to sue Comcast independently, you can do that as well. However, you will need to submit a written notice by mail by June 1st.

The amount you can get from this settlement depends on how many people actually go through the trouble of filing and what types of claims they file. If you had your identity stolen as a result of this breach though, you can file for reimbursement of out-of-pocket losses and lost time.

While Comcast hasn’t specified the total amount available for out-of-pocket losses, customers can receive up to $150 at $30 per hour if they can show they lost at least five hours of their time dealing with fallout from this data breach. Alternatively, you can opt out of demonstrating specific losses and claim an “alternative cash payment” which can payout as much as $50 depending on how many people file claims.

When can you expect to get paid

Given that the final settlement hearing will take place on July 7, the earliest you can expect to receive a check from Comcast would be later this year. As the settlement website notes, payments could be delayed if there are legal appeals to the final agreement.

Getting caught up in a data breach is never fun but, at least in this circumstance, serious personal and financial info wasn’t exposed. Still, given that your personal data was stolen by hackers, you deserve some compensation. So if you were affected by Comcast’s 2023 data breach, you have until August 14 to file your claim.

More from Tom's Guide

• ‘Don’t be a victim!’ NSA warns to reboot your router right now
• Worried about data breaches? The best identity theft protection can help keep you save
• Don’t call that number: Dangerous new Apple Pay scam tricks victims into picking up their iPhones

If you have one of the best iPhones and use Apple Pay in the U.S., you need to be on the lookout for a new scam targeting users of the popular mobile payment service.

As reported by ConsumerAffairs, this particular scam uses fake alerts to convince potential victims to call the scammers themselves. Additionally, the scammers may include a malicious link in their messages in the hope that targeted individuals will head to a fake site to pay up.

Surprisingly, this new Apple Pay scam is particularly effective despite its similarities to other online scams. In fact, one potential victim was entirely convinced it was real and was ready to withdraw $15,000 from their account before being saved at the very last minute by a bank teller.

Here’s everything you need to know about this Apple Pay Scam to help you avoid falling victim to it yourself.

Pressuring you to call or click

Like with other scams, this one starts with an unsolicited message — either a text or an email — claiming that there’s a problem with your Apple Pay account. Informing you about a problem and then offering an easy fix is a very common tactic used by both scammers and cybercriminals which makes it something you should always be on the lookout for.

The fake message may say that a purchase was attempted or declined, that your account is locked or under investigation or that immediate action is required or your account will be closed. All of these are common lures used in scam messages and phishing emails though.

What sets this scam apart is the phone number at the bottom of the message. While many people have learned to avoid suspicious links, calling a "support" number feels safer to the average person. Unfortunately, that number connects you directly to a fraudster impersonating Apple Support, a bank official, or even law enforcement.

Once on the line, the scammer will use personal details to build trust before claiming your funds are at risk. They rely on high-pressure tactics to keep you from hanging up and checking your account independently. Their goal is simple: convince you to move your money to a "safe" account, withdraw it as cash, or send it via Apple Cash and gift cards — something which a real Apple employee would ever ask you to do.

The scammer on the other end of the line will then claim that your money is at risk for one reason or another. To get you to trust them, the scammer will often use personal details in the conversation that the average person wouldn’t know. From there, victims are told to act immediately to “protect” the funds in their bank account. This is another common tactic that keeps being reused since instilling a sense of urgency is an easy way to get potential victims to act without thinking.

In order to keep their funds safe, victims are encouraged to move money into a “safe” account, withdraw cash at an ATM or bank or send funds via Apple Pay or Apple Cash. They also might be told to buy gift cards which is a major red flag and a serious sign that something is off since no company (Apple included) would ever encourage its customers to buy gift cards if their account was at risk.

How to stay safe from scammers

Although this new Apple Pay scam might seem easy to avoid on paper, the reason people have fallen for it is because it relies on social engineering instead of traditional hacking. Apple Pay is incredibly secure but that text message from a random number warning you that your account is at risk isn’t.

To stay safe from this and other scams, the first thing you want to be mindful of are unexpected messages. Sure, companies might send you a notification within their respective apps about a problem with your account but doing so via text message is very unlikely.

The other dead giveaway that something isn’t right is that not only are you encouraged to call a number but you’re also pressured to do so. For the most part, you can (and should) ignore random messages from unknown numbers.

If you or someone you know falls for the trap laid out in one of these messages or maybe curiosity just got the best of you, you need to be extremely careful while on the phone. If the person on the other end is asking for personal info, passwords or 2FA codes, hang up immediately and block that number. Other red flags to lookout for include being asked to move money, to lie to your bank or to buy gift cards.

In the heat of the moment, it’s easy to get caught up in what the scammer on the other end of the phone is saying. However, if you stop and think for a moment, you’ll likely realize you’re in the middle of a scam. This is why the scammers behind this new Apple Pay scam try to work so quickly because once you have a second to take a beat, it’s easy to see right through their deception.

When in doubt, you should always check the account in question on your own or contact your financial institution directly using the number on the back of your card. If you get a text saying your account is at risk or a fraudulent purchase was made and then you check and there’s nothing wrong, you’re definitely dealing with a scam.

Although the best antivirus software can protect you from malware and other viruses, it can’t always help with scams, especially those that use social engineering to appear more legitimate. In that case, signing up for one of the best identity theft protection services is your best bet as they provide cyber insurance that can be used to recover funds lost to scams. However, for identity theft protection to pay out, you need to have a policy in place before the fraud occurs, as they won't cover pre-existing losses.

Apple Pay is incredibly popular and used worldwide, so this won’t be the last time we see a scam like this. Ultimately, your best defense isn't a piece of software — it’s your own skepticism. Practice good cyber hygiene, never share a 2FA code with anyone, and always stop and think before handing over your hard-earned money to a voice on the other end of a phone.

More from Tom's Guide

• Your private Facebook photos may not be as safe as you think after a massive insider theft
• ‘Don’t be a victim!’ NSA warns to reboot your router right now
• I put Apple’s new macOS ClickFix warnings to the test and they actually worked — now I want them on Windows too

The National Security Agency is warning Americans to reboot their routers to thwart malicious attackers targeting home networks to steal their sensitive information.

“Don’t be a victim!" the spy agency says (via Forbes). "Malicious cyber actors may leverage your home network to gain access to personal, private, and confidential information.”

The push to reboot comes as the NSA joins the FBI in warning about increasing Russian GRU attacks. For the unaware, GRU is the post-Soviet Union intelligence agency that replaced the KGB after it "dissolved" in the 1990s. The American agencies are accussing Russian cyber actors of exploiting"vulnerable" routers to steal personal and sensitive data.

According to an inter-agency report, APT28 (aka Fancy Bear) hackers “have been collecting credentials and exploiting vulnerable routers worldwide, including compromising TP-Link routers using CVE-2023-50224.”

It comes only a couple of weeks after the Federal Communications Commission (FCC) effectively banned the import of all new foreign-made routers. That includes some of the best Wi-Fi 7 routers and the best mesh Wi-Fi systems. Especially ones from TP-Link.

The long and short of it is that the NSA recommends that you stop using a router that is near the end of its life or discontinued. Additionally, you should make sure your router is still supported with regular updates.

Clean up your router hygiene

The NSA's recommendations follow a number of best practices beyond just buying a new router.

For one, most people buy a router, set it up, and leave the default settings as is before going on with their lives. That's an excellent point of entry for hackers. Once a Wi-Fi router has been hacked a bad actor can get into all kinds of malicious activity from stealing your data to messing with your internet traffic or redirecting you to fake or malicious sites.

Older routers are the most vulnerable, especially if you haven't kept it up to date. Fix this by keeping your router updated and enabling a firewall - often available as a feature within the best antivirus software.

Additionally, you'll want to make sure you use a strong and unique password on your router and your internet connected devices. Make things easier for yourself by using one of the best password managers.

That all said, an older router can provide a worse online experience. It can cause a bottleneck slowing internet speeds or being unable to handle the number of connected devices in your home.

If you don't want the faster Wi-Fi 7 routers, one of the best Wi-Fi 6 routers is still a major upgrade.

All of these steps add an extra layer of protection for all the devices on your home network. Like outdated or unsupported software, an old router can put you risk, which is why you should take the NSA's recommendations seriously.

More from Tom's Guide

• Best Wi-Fi routers: Wi-Fi 7, mesh and budget models to fill your home with a strong signal
• FCC just banned sale of all Wi-Fi routers made outside US — what you need to know
• I thought Wi-Fi was good enough until I upgraded to a mesh router — now I’m wiring my whole home for Ethernet

Think your private photos are safe on social media? You might want to rethink that as a former Meta engineer is currently under criminal investigation after it was discovered he secretly downloaded 30,000 private images from Facebook.

As reported by The Guardian, the employee in question allegedly created a script that allowed him to access Facebook users’ private photos while avoiding Meta’s internal security checks. While the incident itself occurred more than a year ago, details about it are just now coming to light as a result of the UK’s criminal investigation by the Metropolitan Police’s Cybercrime Unit.

After discovering the security breach, the engineer was fired, Meta upgraded its security systems and then handed things over to the police in the UK. The engineer was reportedly arrested in November 2025 and is currently on bail until May 2026. Likewise, affected Facebook users whose private photos were downloaded without their knowledge have also been notified.

As Cybernews points out, the former Meta engineer’s intent hasn’t been disclosed yet nor has the script he created to download private Facebook images without rousing suspicion. It’s also unclear as to whether or not he shared the code with others before leaving the company.

How to stay safe on social media

Just like when we discovered that Chrome’s incognito mode was never really private, this incident could be a wake-up call for how you use Facebook and other social media platforms. Yes, your photos are technically private but if an employee can pull off something like this, there’s still a chance that your pictures could end up in the wrong hands.

As such, you want to be extra careful when posting anything on social media. In the same way that you would with a public post, you should think twice before posting private photos online. Once an image is on another company’s servers, it could be made public either through an incident like this one or as the result of a data breach.

If you’re worried about your private photos being stolen and made public, then you might want to consider self-hosting them instead. While you can use one of the best cloud storage services to share your photos securely, you could also store them on a NAS device (network attached storage) and then share them that way as well.

Given what’s in your private photos, they could be misused to commit blackmail, make deepfakes or even be used in other cybercrimes. This is why you might want to consider investing in one of the best identity theft protection services. Although this isn’t a traditional case of identity theft, the cyber insurance these services provide can often be used to recover lost funds, especially if their terms cover modern threats like cyber extortion or reputational harm.

As a general rule, it’s always best to keep the old adage in mind that once something is on the internet, it’s there for good. Before you upload pictures privately on Facebook or any other social networking site, you first want to consider what would happen if those pics got out.

We could find out more about the exact tactics used by this ex-Meta engineer once this case goes to trial, but for now, this cautionary tale is an excellent reason to think twice before you post anything online.

More from Tom's Guide

• Your iPhone has a secret photo vault to keep pictures hidden — here's how to use it
• These are the best photo storage and sharing sites right now
• I used Meta AI to enhance my selfies — here's how to try it

There's a new report making waves alleging that LinkedIn employs hidden JavaScript code to meticulously scan users' browsers, specifically targeting and cataloging installed extensions.

The report, which is being dubbed "BrowserGate," further claims that the business social network identifies and focuses on extensions that directly compete with its own suite of sales tools. Ultimately, the claim says LinkedIn wants to subtly pressure users to switch over to its offerings.

For its part, though, LinkedIn says these are the claims of a disgruntled extension developer who lost a court battle in Germany.

What is LinkedIn doing?

The report paints LinkedIn in a very negative light. It says, "LinkedIn scans for over 200 products that directly compete with its own sales tools, including Apollo, Lusha, and ZoomInfo. Because LinkedIn knows each user's employer, it can map which companies use which competitor products. It is extracting the customer lists of thousands of software companies from their users' browsers without anyone's knowledge."

Scanning without user knowledge sounds bad enough, but the report also claims "it uses what it finds. LinkedIn has already sent enforcement threats to users of third-party tools, using data obtained through this covert scanning to identify its targets."

It appears that the scanning portion of the claim is true, at least according to tests conducted by BleepingComputer, which found that LinkedIn uses JavaScript to check for exactly 6,236 browser extensions. "The script also collects a wide range of browser and device data, including CPU core count, available memory, screen resolution, timezone, language settings, battery status, audio information, and storage features,” BleepingComputer said in its report.

The publication continued, "The script also collects a wide range of browser and device data, including CPU core count, available memory, screen resolution, timezone, language settings, battery status, audio information, and storage features."

LinkedIn confirmed that it does scan for extensions. However, it claims it does so to identify users who violate its terms of use. "The claims made on the website linked here are plain wrong. The person behind them is subject to an account restriction for scraping and other violations of LinkedIn's Terms of Service,” the LinkedIn response says. “To protect the privacy of our members, their data, and to ensure site stability, we do look for extensions that scrape data without members' consent or otherwise violate LinkedIn's Terms of Service.

The key to LinkedIn's response is "We do not use this data to infer sensitive information about members."

LinkedIn also notes that "The court ruled against them and found their claims against LinkedIn had no merit, and in fact, this individual's own data practices ran afoul of the law."

It continued, "Unfortunately, this is a case of an individual who lost in the court of law but is seeking to re-litigate in the court of public opinion without regard for accuracy."

It's hard to see for sure who's in the right here, but with the German court already ruling in LinkedIn's favor, it's hard to think the social network is doing something malicious, even if it admits to scanning its users' browser extensions.

More from Tom's Guide

• ChatGPT has experimented with watermarking AI text — 5 ways to use AI without sounding like it
• I couldn't stand ChatGPT’s voice — so I made a better one that I can play back any time
• Not ready to QuitGPT? I tried this new tool that slows ChatGPT on purpose — and it says a lot about AI backlash

At this point, ChatGPT is embedded into my system.

Besides writing about it on a constant basis, I also refer to it from time to time for minimal and sometimes substantial tasks. I’ve used it to map out the best places to go in the city when I have a three-day weekend to look forward to, asked it to come up with professional responses when drafting email responses to my fellow colleagues, and asked it how I should lay out my meal planning for the coming week.

After months and months of interactions with ChatGPT, I’ve become a lot more comfortable with the convenience that comes with using an AI assistant for a myriad of situations. I’ve also recognized all the smart habits one needs to abide by if they want to protect their privacy and never run the risk of having their most sensitive details exposed to the world during a possible data leak.

Sticking close to every bit of the following three rules goes a long way towards keeping my ChatGPT chats safe and private.

1. Never share something you wouldn’t post in a public forum

This one’s simple and sticks to a common-sense mindset.

There’s no way I’d hop into a Reddit forum and willingly type in my phone number, address, log-in credentials or any other piece of personally identifiable information. So there’s obviously no way I’d do the same with ChatGPT.

The promise of data encryption from ChatGPT is trustworthy, but I still keep the threat of data leaking from an AI cloud service at the back of my mind whenever I start up a new chat. I always think of ChatGPT as a super-intelligent stranger that I wouldn’t want to give my bank account information or Social Security Number to.

I apply this same rule to chatting with the wealth of apps implemented directly into ChatGPT. There’s no need for me to tell OpenTable the names of everyone coming to my dinner party when making restaurant reservations. And even though the allure of buying live events tickets through the Vivid Seats app is enticing, I feel so much safer sharing my payment details and doing it right through their actual site instead of handling such an important task through ChatGPT’s app.

2. Keep data sharing off and don’t turn on your location

I’m not too keen on having ChatGPT use my conversations to train it.

I also don’t need it to know where my exact location is. When using ChatGPT, I make sure to click on my username in the bottom left of the screen on desktop to go into the Settings menu (tap on the two lines in the top right corner of your screen, then tap your username circle in the top right corner to access that same menu) to make two appropriate changes: turning off the option to improve the model for everyone in Data Controls and toggling off the Location option.

Parental controls can also be enabled through the Settings menu for parents who want to limit certain features, set time usage limits, and add safeguards for their children’s ChatGPT interactions.

3. Use Temporary Chats when discussing sensitive topics

There are definitely some instances where I go to ChatGPT to ask for some alternative options to choose from when discussing the more sensitive topics that come to mind.

For those sorts of discussions, doing this is a must: start a new chat, then click on the thought bubble displayed in the top right corner of the screen on desktop/mobile to turn on the temporary chat option. That way, those particular conversations related to the more sensitive details of my life are never saved and reduce the amount of stored information attached to my chats. My digital footprint is big enough as it is — there’s no need to spread it out even further by running the risk of exposing myself because of my ChatGPT discussions.

Deleting old chats altogether is also the way to go. They tend to pile up after a long while after you forget to get rid of them, so it’s always worth cleaning them all out to make room for new archived chats as time goes by.

Personally, I like it when ChatGPT brings up past conversations and memories about my profession and hobbies when I open up new chats. If that’s not your thing, you can hop into the Settings menu, go to the Personalization tab, scroll down to Memory and turn off the options for Reference saved memories and Reference chat history to disable those features.

The takeaway

ChatGPT has become my go-to chatbot for most things related to developing productivity routines, helping me discover new places to hang out, and choosing the better option for any dilemma that’s troubling me.

With all that being said, my online privacy will always remain a priority during my time spent with the chatbot. Which is why I follow these three rules to make sure my interactions with ChatGPT stay safe at all times.

More from Tom’s Guide

• I’m an AI power user — this 7-line ‘critical thinking’ prompt finally stops chatbots from being a ‘Yes-Man’
• How I use Claude for strategy, Gemini for research and ChatGPT for 'the grind'
• AI is making the internet invisible — and no one is talking about it