It's more than double from Tuckner's April report that found "only" 57 Chrome extensions and 6 million downloads.

According to Tuckner, the malicious extensions are usually found on websites advertising tools that are labeled as "PDF converter", "AI search", or "safe search".

"These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID," Tuckner wrote.

The extensions apparently aren't found on the official Chrome Web Store either. Rather, they're unlisted and are only really found through the shady advertising.

How the extensions work

Apparently, the extensions use Chrome's built-in 'chrome_settings_override' setting that lets them replace your default search provider.

What this means is that your searches are captured as they pass through the operator's server. After that the redirect could be sent through a site with malware attached, though currently, per Tuckner they're mostly routing to Yahoo and Bing and to falsely claim advertising revenue.

"The search referral revenue is a profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious search results or landing pages for phishing or other malicious downloads," Tuckner said.

As of this writing, the report says that most of the extensions have been removed the Chrome Web Store when the report was published, however, new ones are constantly being added.

"Ultimately, Google can benefit from more advertisements being run and more extensions being listed in the marketplace so there may not be an urgent reason to police this activity too broadly."

How to stay safe

Even if Google isn't policing this specific type of extension, malicious add-ons do slip through to the Chrome Web Store from time to time. When it comes to extensions, you need to be extra careful when downloading and adding them to your browser.

Normally, we would recommend you stick to well-known extensions from trusted brands. However, sometimes a lone developer creates one that does exactly what you need.

There are several recommendations we have to help you be a bit safer. Check the ratings and reviews of the extensions but also dig into the developer to see if they're legit.

Look, even good extensions can go bad, so you want to make sure that your Windows PC is protected with the best antivirus software and that you’re using the best Mac antivirus software on your Apple computer. That way, if an extension is spreading malware or other viruses, they’ll be detected and stopped before they can do any damage.

If you're constantly trying different extensions, you should consider one of the best identity theft protection services. They can help get your identity back if it's stolen or recover lost funds due to scams and cyberattacks.

More from Tom's Guide

• These are the 3 best budget laptops we've tested for value that don't feel cheap
• Your personal information is everywhere online — 5 ways to start removing it from the internet
• Chrome could soon let you ask Google about anything on your screen — even outside the browser

Here’s how to establish a safe space for your child to use your device.

Setting up an Amazon Fire Kids Tablet

One of the simplest tablets to set up for your kids is the Amazon Fire Kids Tablet. I’ve used it for my own kid for many years, and while it does have its frustrating quirks, it does get the job done. Bear in mind this is effectively just a Fire Tablet with a colorful case, so it does include an adult profile that is necessary to set up to manage the device.

After you’ve created your profile, you’ll create an Amazon Kids Profile. It’ll guide you through a list of settings that you can customize to your child’s needs and send them on their way. In order to monitor and adjust settings on the tablet, go to the Amazon Parent Dashboard (you can do this remotely). From here you can adjust settings like time limits on apps, content filters, and even add content from an adult library. For example, I had to manually add HBO so I could put on Sesame Street.

If you do need to lock the device down for any reason, you can hit Pause or Lock Device on the Amazon Parent Dashboard. You can set a duration or set it indefinitely until the device is unlocked by you.

Setting up an Android tablet

For an Android tablet, the first thing you’ll want to do is set up Google Family Link either through a web browser or the app itself on your own device (Android or iOS). From there you can create your child’s account, which includes creating an email address for them (weird, I know). Then when you’re actually setting up the tablet, you can sign in using your child’s email address. It’ll prompt you to sign into your own account afterward.

If your child is on the younger side (under 9), you can put them on Google Kids Space, which is tailored with content-restricted apps, books, and YouTube Kids videos. You’ll still have access to parental controls with this app.

If Google Kids Space is not for your child, or it’s unavailable for your device, you’ll be able to manage the general kids experience in Google Family Link. Here you can control app approvals and limits, set screen time limits and even set a scheduled bedtime. You can also manage how Google Chrome is used and which sites your child can visit.

Locking the device down is as simple as clicking Lock now in the Family Link app. You can use Downtime to run this on a schedule, and you can also use it to grant bonus time.

Setting up an iPad

You can go to your iPad settings, select Family Sharing, Add Member, and create a child account. From there, follow the prompts until the account is created, and set a unique screen time password so your child can’t override the settings.

You can configure parental controls from your Apple device or the iPad itself. Navigate back to Family Sharing, click on your child’s name, and then select Screen Time. From here you can adjust content restrictions on apps and websites, even limiting accessible websites to one or two trusted sources. You’ll be able to set time limits and schedules for apps as well, and can also lock them into a single app with Guided Access in the Accessibility settings. Make sure to adjust the Communication settings as well to manage who they can contact.

To lock the device, you can access the parental controls remotely and turn on Downtime — this can be immediate or set on a schedule.

Bottom line

It’s not terribly difficult to set up a new tablet for your kids, although I know from experience that it’s not always seamless. Make sure you look over the parental controls thoroughly. It has less to do with lack of trust and more to do with safeguarding. It’s all too easy for kids to get access to something that they’re not supposed to.

I’d also be careful with YouTube Kids — I have seen some brainrot videos on there, including AI slop, that aren’t good for child development because they’re either overstimulating or not educational. I highly recommend content from established educators like Ms. Rachel. For general entertainment, you can find Blue’s Clues going strong on there, but it’s also worth downloading the PBS Kids app itself for some consistent safe content.

More from Tom's Guide

• Smart TVs collect a surprising amount of your data — here’s how to stop them
• How to find out if your data is on the dark web — and how to remove it
• 10 simple security settings you should change on your phone and PC right now

If you have any reason to believe that your sensitive data has been leaked, you should know how to find out what it is and how to deal with it.

Finding your data on the dark web

Don’t start surfing the dark web yourself. The last thing you need is to infect your system with malware that’ll expose more of your data to malicious actors. There are a couple services you can use that’ll scan for your data across marketplaces and forums.

Both Aura and Experian are trusted services that offer a free dark web scan. If they find nothing, you’re likely free and clear. However, if something pops up, you should act immediately.

Can you remove data from the dark web?

No, unfortunately there’s no way to delete your data from the dark web, and I wouldn’t trust any service that claims to do so. What you need to do now is identify the exposed data and defuse the threat.

One of the most common data breaches involve emails and passwords. Obviously, you need to change your passwords, but you also should activate two-factor authentication (2FA) or multifactor authentication (MFA) on all your accounts. Yes, all of them, not just the affected ones. Using unique passwords for every account is also important so you can isolate threats — this can be made more convenient with a password manager.

If your banking or credit card credentials got leaked, you need to contact your financial institutions and place freezes or fraud alerts on your accounts. If your social security number got leaked, you’ll need to freeze your credit. Go to Equifax Credit, Experian Credit, and TransUnion Credit to do that. While the service is free and you can lift the freeze whenever you want, you should keep it frozen and only temporarily lift it when you need to apply for new credit.

Still, once all your information is out in the open, someone can use that data to impersonate you. Potential victims of identity theft should file a report with the Federal Trade Commission (FTC) on IdentityTheft.gov. While it’s unlikely to be able to change your Social security number, it can be done in extreme cases.

Bottom line

Again, once your data has been exposed, there’s no removing it from the dark web. And it’s possible that another breach of your data could find itself there, so you might want to use a continuous dark web monitoring service. Experian is one of the free ones, although it does have paid tiers.

As far as prevention goes, there’s not much you can do to stop your data from being leaked into the wild, but there are steps you should take to reduce the potential damage to your life, namely maintaining unique passwords for your accounts and activating 2FA or MFA.

The most important takeaway here is not to dawdle. Take the measures to protect yourself and monitor your accounts going forward. You could be exposed to something as simple as spam emails, which you should be able to suss out, but there are worse things than spam.

More from Tom's Guide

• Smart TVs collect a surprising amount of your data — here’s how to stop them
• 10 simple security settings you should change on your phone and PC right now
• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out

According to a new report from Dream Research, published Monday, the attackers exploited critical vulnerabilities in PHP, a programming language used by millions of websites, before using another security flaw to gain full control of vulnerable systems.

The attacks targeted servers in the United States, Japan, Taiwan and South Korea. Researchers found evidence pointing to a possible Chinese connection, although they have not identified the attackers or confirmed any government involvement.

What makes the discovery particularly concerning is how far the attackers managed to get. In one U.S. government-affiliated environment, they moved beyond the initial breach and gained access to internal network information, employee account listings and authentication credentials.

And while AI's exact role remains unclear, researchers found several tools in the attacker's environment that raise questions about how AI could be accelerating cyberattacks.

Hackers turned one security flaw into a much bigger attack

The attack started with two critical security flaws, known collectively as PHP2Shell, that were publicly disclosed on October 21.

PHP is used behind the scenes by millions of websites, including WordPress sites and online services. The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can let hackers run malicious commands on vulnerable servers.

But the attackers didn't stop there. They combined those flaws with another Linux vulnerability called Fragnesia, allowing them to take full control of certain firewall systems without needing a username or password.

According to a Dream Research report shared with Tom's Guide, the entire process could take less than 15 minutes.

The hackers started by scanning roughly 19,000 internet-facing firewalls before narrowing their targets to 240 potentially vulnerable systems. From there, they used automated attacks to breach 24 firewalls and an additional internal management server, bringing the total to 25.

Researchers also found that the hackers had installed malicious web-based tools on many of the compromised systems, giving them a potential way back in even after the initial attack.

The attackers reached a U.S. government-linked network

Arguably, among one of the more concerning discoveries involved three compromised servers linked to a U.S. government-affiliated organization.

After breaking into an internet-facing firewall, the hackers gained access to details about the organization's internal network, including its VPN, login systems and other servers.

They then worked their way deeper into the network, compromising a central firewall management server and stealing an account password. They also obtained a list of users and groups within the organization.

Researchers found evidence that the attackers tried to guess employee passwords, create unauthorized accounts and access additional login credentials, although it's unclear whether those attempts worked.

Dream Research also warned that the hackers may still have had access to some systems when the report was published, but that hasn't been independently confirmed.

The security firm hasn't named the firewall manufacturer or disclosed which software versions were affected, but says it has notified the vendor.

AI tools were discovered in the attacker's environment

Researchers also found signs that the attackers may have used AI. Their tools included Anthropic's Claude Code and an AI-powered security platform called aiscan, configured to work with the Chinese AI models DeepSeek and Kimi.

They also uncovered roughly 40 custom scripts whose consistent formatting and comments suggested some may have been written with AI assistance.

However, Dream Research cautioned that there's no direct evidence AI was used to create the exploits or carry out the attacks. The tools may have been present without playing a role in the breaches.

Still, the findings raise concerns about how hackers could use the same AI coding assistants that developers rely on to write code and troubleshoot problems.

Researchers also found clues suggesting a possible Chinese connection, including Chinese-language prompts, systems set to China's time zone and targets concentrated in the U.S. and East Asia. None of this, however, confirms who was behind the attacks.

Final thoughts

PHP2Shell doesn't directly affect your phone or laptop, but it could put information stored by websites and online services at risk. If attackers compromise those servers, they may gain access to passwords, sensitive data or internal systems.

Dream Research found no evidence that ordinary consumers' personal information was stolen in this campaign. However, the vulnerabilities are already being exploited beyond these 25 servers.

Amazon Web Services detected exploitation attempts as early as October 17, four days before the flaws were publicly disclosed. Sophos initially reported successful exploitation but later corrected its findings, saying it had observed scanning and a small number of failed attacks, with no confirmed breaches in its customer environments.

If you run a WordPress site or online store, check with your hosting provider to make sure PHP is patched. Updating WordPress plugins alone won't necessarily fix the problem. Administrators should also check for signs of compromise, since installing a patch won't remove an attacker who's already gained access.

For everyone else, using unique passwords, enabling two-factor authentication and watching for suspicious login alerts remain sensible precautions.

More from Tom’s Guide

• I tested ChatGPT vs. Grok with 5 questions boomers actually ask — and the winner surprised me
• Microsoft just offered 60,000 workers a way out as AI spending soars — here's what it could mean for your job
• ChatGPT has a clever new way to fight back against election deepfakes — I tried it and it actually works

Proton is changing the status quo – and it's doing a very good job of it. The Swiss company started off with Proton Mail – which, by now, is a truly viable Gmail alternative – but since then it has developed one of the best VPNs, Proton VPN, as well as Proton Drive, Pass, Docs, Sheets, Calendar, and most recently, Meet. Almost everything you need to de-Google your life.

Proton Unlimited includes every one of these apps. It usually costs $12.99 per month, but right now, in the run up to Black Friday, the 12-month plan has dropped to $6.49 per month ($77.88 upfront). This is the cheapest I've ever seen it.

If you're not sure, you can also purchase a single month for just $1 – although the discounted price on the long-term plan will likely end before that first month runs out.

This is almost certainly one of the very best Black Friday VPN deals we'll see this year, and it's not even November. More info below.

All you need to de-Google yourself

At $6.49 a month, Proton Unlimited covers a lot of ground. Proton VPN gives you access to 21,000+ servers across 149 countries, support for up to 10 devices, and excellent speeds. It also includes NetShield ad-blocking, Secure Core servers for extra security, Tor over VPN, split tunneling, a kill switch, and a strict no-logs policy.

Proton Mail includes 15 encrypted email addresses, unlimited hide-my-email aliases, and support for up to three custom domains.

Proton Drive adds 500 GB of encrypted cloud storage, with version history, while Proton Pass goes beyond basic password management with 50 vaults, unlimited logins, and a built-in 2FA authenticator which means one less app to juggle.

Proton Calendar keeps your schedule encrypted and off Big Tech servers, while Proton Meet offers private video calling without the Google or Zoom overhead.

Round that out with Proton Wallet – an encrypted Bitcoin wallet – and Lumo AI, Proton's privacy-first AI assistant, and you have a self-contained privacy ecosystem that rivals anything Big Tech offers.

One subscription, an escape from Google, and the biggest discount you'll see outside of Black Friday.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

The email calls the re-interviews "consequential." What interviewers conclude will be written up and fed into a broader review of the organization, which could change people's roles and responsibilities – or whether they stay at Proton.

The move fits a wider push under CEO Andy Yen, who has been steering Proton toward heavier AI use, including the launch of Lumo, its privacy-focused chatbot. Proton had not responded to 404 Media's request for comment at the time of publication, but has now made a public statement on Reddit.

What Proton says

In the Reddit comment on r/ProtonMail, posted from the Proton_Team account, the company claims it is "not doing layoffs and using AI as an excuse." As a counterpoint to this, it states it has a talent shortage and is hiring across the organization.

"AI is changing the tech industry," the comment continues, "and we, like everyone else, need to evolve our ways of working to remain effective in our industry, and to deliver features faster to users."

The company says it is "assessing how colleagues are adapting to these tools, what support they need, and who can help lead this work."

Finally, Proton states that it is also "assessing whether everyone has the skills they need to take a step forward in a post-AI world," and "offering the support that is necessary, to those who need it, to succeed."

In the Reddit comment, Proton also published the full email, which it says went to some of its staff.

Who gets interviewed – and by whom

The email itself is less reassuring to those impacted: "We are now extending re-interviews more broadly to assess how people are adapting to AI and whether they have the capabilities and approach needed for Proton’s next phase."

Not everyone will be re-interviewed. Interviews will be prioritized according to the organization's assessment needs, the email says, and an invitation – or the lack of one – isn't an outcome in itself. Any decision affecting someone's employment will come separately.

Those who are invited will be interviewed by someone outside their own team and reporting line, chosen from a pool of leaders who "demonstrate strong AI capability."

The interviews will run from November 4 to 11, and staff are told to arrive with concrete examples of their use of AI. The email is blunt about what passes muster here: "Be ready to discuss what you have changed in your work, the results, what you have learned, what has not worked, and what you would do differently. A list of tools alone will not demonstrate this."

What Proton wants from staff

The email also presents the interviews as a route to advancement, saying staff who rethink their work, put AI into practice and help others adapt may be offered greater responsibility. It asks for "curiosity, judgment and urgency."

Yen himself first interviewed more than 40 senior leaders across Engineering and Product, the email says, before the process widened to staff across the company.

AI is not new at Proton. An AI writing assistant arrived in Proton Mail in 2024, Lumo followed in July 2025, and the chatbot got an upgrade in June 2026. Proton says it keeps no server-side logs of Lumo conversations and runs the chatbot on its own infrastructure.

Yen told Wired in an interview published in August that AI is surveillance and that Proton was reluctantly pulled into building AI tools. He added that he would probably prefer a world without AI, but accepts it is here to stay. Clearly, his opinion has not changed on the matter.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Protect yourself by enabling these simple security settings on your smartphone and PC.

Enable automatic updates

It might feel like there’s an update every other day, but don’t sleep on keeping your devices up to date. Security vulnerabilities are inevitable, and will keep popping up so long as the tech exists. If you’re way behind on your updates, go to the System Settings on your device to enable automatic updates. If that’s unavailable, manually update it and check for updates periodically.

Disable your Advertising ID

Your device is actively collecting your data to feed you “relevant” ads, but you never know exactly what kind of data is being collected and where it’s going. Whatever device you may have, you’ll likely find options for your Advertising ID in the Privacy section of your System Settings. Disable or delete all mention of personalized advertising. You’ll still get ads, mind you, but they won’t be tailored by your personal data.

Disable lock screen notifications

If you’re out in public, it’s best practice to disable your lock screen notifications to prevent onlookers from gleaning your private information, especially if the data being displayed is sensitive. You can find this setting in the Notifications section of your device, where you can disable previews, or hide content.

Limit location permissions

You don’t need social media apps tracking your location all the time. Go to the Privacy or Security settings of your device and disable location permissions or limit them in specific apps. If an app needs your location to function, select the option that only allows it while using the app. Apps don’t need to be tracking your movements in the background when not in use.

Lock your device

Don’t leave your device permanently unlocked or to lock only after a long period of time. Come up with a longer, ideally unique, password and set your device to lock immediately when you move or put it away. You should be able to find this in your Security settings or your Account settings depending on your device. Disable any settings that extend unlock times in “trusted” environments. You could lose access to your device close to your home or car and leave it open to malicious actors.

Block the install of unknown apps

Most devices already have a setting that blocks the installation of unknown apps, but if you’re like me, you might have had to disable this feature in order to download something outside of native app marketplaces. Do yourself a favor and reinstate the block of unknown apps in your Security or App settings.

Enable device encryption (PC & Mac)

If your Mac or PC is ever stolen, the thieves won’t get access to your data if you’ve scrambled it by encrypting your drive. You’ll find this setting in Privacy & Security in both Windows 11 and macOS. On Windows it’s called BitLocker, and on macOS it’s called FileVault.

Enable Firewall (PC & Mac)

Turn on your network firewall to prevent suspicious connections from exploiting your device. If you have a Windows device, Microsoft Defender Firewall is likely already enabled, but it doesn’t hurt to check it in the Privacy & Security section. Meanwhile, macOS Firewall is actually disabled by default. You can turn that on by going to your System Settings and navigating to Network > Firewall.

Get a VPN

Unfortunately, smartphones and PCs rarely come with built-in VPNs, so it’s not exactly a simple setting you can turn on, but I highly recommend getting one to beef up your network privacy. If you’re not looking to spend money, Proton VPN is a reputable and free VPN.

Update browser permissions

Whatever your primary browser may be, you should adjust your default permissions in your Site Settings, usually found in the Privacy & Security section. Set each of the permissions to “Ask first” if they’re not already. The last thing you need is some random website activating your microphone or downloading files without your permission. You might also find a Safe Browsing setting in your browser, if not already built-in, that you can enable as well for enhanced protection.

Bottom line

Taking charge of your security settings is one of the few things you can do to stay in control of your privacy. Corporations are actively spying on us to try to sell us the “next best thing,” but we don’t have to make it easy for them. And we definitely don’t want to make it easy for hackers to steal our data and wreck our lives.

More from Tom's Guide

• 5 fast steps to take immediately after a company leaks your personal data
• 7 warning signs your Android phone or iPhone has malware
• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out

ACR is a technology that identifies what it is you’re watching on your TV. This applies to both visual and audio sources. This not only works for built-in apps but also anything connected through HDMI ports, like an Amazon Fire Stick or game consoles. You could be completely offline, connecting an old school DVD drive to your TV, and manufacturers can still steal that data.

Companies use ACR to learn what you like and don’t like and then use that information to hit you with ads or suggest content. But of course, it’s not just about suggesting things that you may like to watch. Manufacturers turn around and sell this data to companies to then use predatory tactics against you. It’s like a stalker in league with other stalkers — they learn all about you and then lure you in with the tantalizing appeal of consumerism.

If you think that’s bad, Gamers Nexus published a video back in September investigating a serious privacy issue that LG Smart TVs have — the microphone is on and actively listening, even when the screen is turned off. It also stores the recorded data when the TV is completely disconnected from the internet. Terrifying.

If you’d rather not have all of your personal information stolen from something as simple as a display, then you need to disable ACR immediately. Here’s how.

How to stop smart TVs from stealing your data

Unfortunately, some manufacturers turned to cleverly calling ACR something else entirely, and often hide the setting deep within a series of menus. I’m going to go over a few of them so you generally know what to look for. However, my overall advice is to do a thorough sweep of your TV settings. Typically, there are explanations next to each setting, and if not, look them up to see what they’re really about.

LG TVs

Let’s start with the spooky one first. LG likes to call its ACR technology Live Plus, and you can dig that setting out by going to Settings > General > System > Advanced Settings. I’d disable Live Plus as well as Live Promotion. Depending on the model you have, there’s also Content Recommendations, Screen Saver Promotion, and Limit Ad Tracking settings that you can disable too.

Amazon Fire TVs

At the very least, Amazon’s Fire TV has the decency to call the setting what it is — Automated Content Recognition, although most people might not know what that even means.

To disable it, you’ll want to go to Settings > Preferences > Privacy Settings. There you can turn off not only ACR but also Device Usage Data, Collect App and Over-The-Air Data, and Interest-based Ads. Or literally anything else that seems like it wants to spy on you.

Samsung TVs

For Samsung, you’ll want to go to Settings > All Settings > General & Privacy > Terms & Privacy. There you should disable Viewing Information Services and Interest-Based Advertising. If you have an older Samsung, you might find this setting in the Support > Terms & Policies section.

Sony TVs

Sony decided to call its ACR Samba Interactive TV, another fancy name for effectively the same spying device. You’ll find it in Settings > Initial Setup or All Settings.

Roku TVs

For Roku devices, navigate to Settings > Privacy > Smart TV Experience and then disable ACR or Use Info from TV Inputs. In the Privacy section, you also might find Advertising and Microphone settings, and I highly recommend disabling anything in those sub menus.

Vizio TVs

Vizio hid this setting behind the Reset & Admin section. You’ll find it by going through Menu > System > Reset & Admin, where you can then disable Highlight Viewing Data.

More from Tom's Guide

• 5 fast steps to take immediately after a company leaks your personal data
• 7 warning signs your Android phone or iPhone has malware
• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out

Over the past 24 hours, two completely separate, absolutely massive cybersecurity disasters collided.

• First, Microsoft revealed that a nation-state hacking group used an autonomous AI agent to brute-force its way into thousands of cloud accounts in a matter of hours.
• Then, a critical vulnerability was discovered in PHP — the foundational code that runs roughly 70% of the entire internet — forcing major sites like Wikipedia to temporarily pull the plug on their own servers just to survive.

If you are wondering why IT departments across the globe are currently stress-sweating through their flannels, here is a breakdown of exactly what is happening, and what you actually need to do about it.

Disaster 1: The autonomous AI hacker (ARTEX)

I’ve spent the past couple of weeks writing about how to build a local AI agent — like my digital assistant “Jeeves” — to automate admin tasks like checking your Gmail.

Well, a Chinese-linked threat actor known as “Storm-0940” just showed us the dark mirror version of that exact technology.

According to Microsoft, the hackers stole credentials to ConnectWise (a massive IT management software provider). But instead of typing in passwords, they handed those credentials to an agentic AI tool called ARTEX.

ARTEX is essentially a malicious version of Jeeves. The hackers gave the AI a goal, pointed it at Microsoft 365, and let it off the leash. The AI divided up the tasks, bypassed standard logins by hijacking authentication apps, and achieved a terrifying 2,900 sign-in attempts per minute.

Within a few hours, the AI had hit 2,250 different corporate tenants across aerospace, defense and finance. It moved so fast that human security defenders literally didn’t have time to read the alerts before the AI had already gained privileged cloud access.

It is the ultimate proof that the “cloud tax” isn’t just expensive — it’s a massive, centralized target for autonomous bots.

Disaster 2: The PHP meltdown

And while that AI was busy tearing through Microsoft 365, the actual foundational bricks of the internet started crumbling. On October 21, the PHP project disclosed two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

To spare you the hyper-dense developer jargon: there is a flaw in how PHP handles memory. If an attacker sends a specific, unauthenticated request to a web server, they can corrupt the memory and execute their own malicious code directly on the machine.

It’s been so bad, it scored a 9.2 out of 10 on the severity scale.

Why is this a big deal? Well, PHP is the backbone of WordPress, major content management systems, and millions of custom web applications. It powers roughly 70% of the entire web.

The vulnerability is so trivial to exploit — and the blast radius is so large — that both Wikipedia, the Internet Archive and Steam reportedly took precautionary measures to shut down their infrastructure while applying the patch.

Ironically, Wiz Research actually used Google’s Gemini 4 Argon AI model (alongside OpenAI’s GPT-5.6 Sol) to help find and validate the patch for this PHP flaw. So, while one AI is currently attacking the cloud, another AI is desperately trying to patch it.

What you need to do

If you are just a regular person trying to browse the web and get your work done, you don’t need to throw your laptop in a lake. But you do need to be on the defensive.

The internet may not be literally collapsing, but the walls are definitely shaking. When autonomous AI agents can breach thousands of cloud tenants before a human can even click on an alert, relying entirely on massive, centralized tech conglomerates to keep your data safe is a losing bet.

More from Tom's Guide

• Exclusive: Apple's OLED MacBook Pro may face a '$300 to $500' price hike to 'protect their profits' from RAMageddon
• Elon Musk reportedly throttled Starlink for Ukraine’s drones — here's how
• I’ve been living with Nvidia’s RTX Spark for a week — it’s not a MacBook Pro killer but something much weirder and wildly powerful

Here are some warning signs that you might have an unwanted guest on your smartphone.

Pop-up ads

Advertisements spamming your phone, especially outside of an app, is a dead giveaway. Don’t ignore the problem, even if you’re a fan of Neon Genesis Evangelion who really appreciates seeing “CONGRATULATIONS” spread across their screen.

New apps

If your phone is packing a ridiculous number of applications like mine, then you might not notice when a new app creeps into your system. For both the sake of spotting malware and cleaning up your library of unused apps, it's worth taking the time to audit your current apps.

Shorter battery life

Malware does a lot in the background to wreak havoc on your device, and that takes power. So one of the telltale signs of malware infecting your device is if you experience shorter battery life. Battery life can vary, especially as a phone ages, so I recommend looking up the average battery life for your device to see if there's an obvious discrepancy.

Performance issues

Got a brand new phone and all of a sudden everything slows down to a crawl? Are apps randomly crashing on you? This is another sign that malware may have crept onto your device. This may be more difficult to spot on phones already experiencing slower performance, so keep an eye out for other signs if that’s the case.

Overheating

Unless you still have a Samsung Galaxy Note 7 hanging around, which you shouldn't, your device should not be scorching your hand. If your smartphone is spamming you with overheating warnings or is straight up crashing, especially in temperate environments, there might be a virus giving your phone a fever (my dad joke for the day).

Abnormal data usage

Unless you have a limited data plan and are remaining vigilant about your usage, it’s unlikely you’ll notice malware taking up all your data. Unlimited data users who have never checked their data metrics need to be more alert. It doesn’t hurt to check your data usage every once in a while, if not to see what apps you’re maybe spending a little too much time on.

Your contacts get spam

The most embarrassing and frustrating sign of malware is all your friends and family getting hit with spam messages that can potentially affect their devices. You’ll likely hear about this sooner than later, but as someone who doesn’t actually use SMS to contact people, it doesn’t hurt to check your default messaging app. Hopefully your contacts know what you sound like versus a spam bot imitating you, but the sooner you alert people the better.

What you can do

If you’re still not 100% certain whether or not your device is carrying around malware, there’s a few things you can do.

For iPhone users, navigate to Settings > General > VPN & Device Management to check if any unknown profiles are installed. If you don’t find anything here, go to Settings > Privacy & Security and check on your app permissions. This might be a bit tedious, but you should do a step by step inventory of app permissions and revoke access to apps that you aren't using, and delete ones that you don’t recognize.

For Android users, go to Google Play > tap your profile picture > Play Protect. This will scan your device for any harmful apps. It typically runs automatically, but it doesn’t hurt to do a manual check.

If you don’t find anything going down these routes, Android users can download one of the best Android antivirus software solutions, which can not only help locate malware but also delete it. Unfortunately, iPhone users don’t have access to traditional antivirus software because of how Apple sandboxes each app, but you can download security apps that can detect data breaches.

If you can’t manage to track down the issue, then resetting your device to factory settings may be the next step. In this case, you should set up your smartphone as a new device, as any backups can bring with it the malware that infected the system to begin with. Then reintroduce apps and services one by one to see if the issue continues, and if it happens again, you’ll know where the call inside the house is coming from and you can get rid of it — it could be something as simple as a browser extension.

I highly recommend changing passwords on critical services, like banking apps, using a different device. Monitor your smartphone for a while to see if the issue has been addressed before relogging into any sensitive apps.

More from Tom's Guide

• 5 fast steps to take immediately after a company leaks your personal data
• 3 hidden macOS security features you need to turn on right now
• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out

In 2025 alone, the Federal Trade Commission (FTC) reported fraud and identity theft losses of over $15.8 billion. Leaks in your personal data can be a slippery slope, so here are the steps you should take to address them.

Assess the leak

Don’t panic. Take a deep breath. The first thing you need to do above all else is identify what information has been breached exactly. This could be anything as simple as an email address or as serious as a Social Security number.

If it’s the former, it’s likely all you’ll be a victim to is a litany of scam emails, in which case you’ll need to be more scrupulous while looking through your inbox. But if it’s something more than that, you should continue on to the next steps.

Change your passwords and activate MFA

Account information like passwords are among the most common leaks, and while it should go without saying that you should change your passwords, you need to take some additional steps to maintain your security.

First, you should use a unique password for every account that you have, so that multiple accounts aren’t at risk because of one breach. You can achieve that more easily with a strong password manager. Second, you need to enable two-factor authentication (2FA) or multifactor authentication (MFA) if it’s available on that account. This’ll add another layer of security so even if your passwords were leaked, hackers shouldn’t be able to access your account.

Contact your bank and credit card companies

If your banking and credit card credentials have been leaked, immediately contact your financial institutions. In the most ideal scenario, acquire a new banking account or credit card number. If that’s not possible, however, you should be able to place a fraud alert on your accounts.

Going forward, you should keep a close eye on your accounts, even in the coming year. If your information is out there, it could be abused at any time, not necessarily immediately.

Freeze your credit

In the event of a serious breach, specifically one where your social security number is leaked, you need to freeze your credit immediately. This will stop anyone from trying to take out a loan or a new credit card in your name.

You’ll need to contact the three credit bureaus individually — that’s Equifax Credit, Experian Credit, and TransUnion Credit. Freezing your credit is free and you can lift the freeze whenever you want. However, unless you get a new social security number, which is very difficult to do, you should keep the freeze on your credit and only temporarily lift it when you need to apply for new credit, like a mortgage. There are also credit checks that you might need to undergo for an employer or landlord, which could require a temporary lift.

Report identity theft

In the absolute worst case scenario, where all your vital personal information is leaked, someone may attempt to steal your identity. Unfortunately, identity theft could get bad very quickly, especially if said perpetrator is committing crimes under your name.

If you believe you’re a victim of identity theft, you need to go to IdentityTheft.gov and file a report with the FTC. From there, follow the steps it lays out for you to get this under control.

Bottom line

Once your information is out in the open, there's no taking it back. But inaction could lead to some serious repercussions. Once you've dealt with your current breach, do yourself a favor and take the time to secure accounts with other companies. Things like setting up unique passwords and enabling 2FA or MFA will save you some trouble down the road.

More from Tom's Guide

• 3 hidden macOS security features you need to turn on right now
• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out
• AI scams are getting scary realistic — 4 red flags to watch out for

This week, Microsoft shipped patches that covered a mind-boggling 1,413 flaws, including one that the company said was actively being exploited by hackers in the wild before the patch.

Those patches cover 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server and 22 in SQL Server. 670 of the patches are related to privilege escalation vulnerabilities. And 70 are rated as "Critical" in severity.

Microsoft's update guide specifically highlighted three notable flaws:

• CVE-2026-96951: - Windows Shell had a command injection vulnerability that would allow a bad actor to bypass security over a network. This one was apparently actively exploited.
• CVE-2026-108398:- An untrusted search path in .NET Framework would allow an attacker to bypass a "security feature" locally. This one is listed as publicly disclosed but not exploited.
• CVE-2026-21413: This one apparently wasn't found by Microsoft but would allow a buffer overflow of Windows Raw Image Extension to allow attacks to execute code over a network.

Microsoft credited Riku Bamba and Yuya Chudo of Fujitsu Limited and Benoit Sevens, who used Anthropic's Claude, with discovering the 96951 flaw which was exploited in the wild.

"In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability," the company explained. "In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker's site or send a malicious attachment."

It's not clear how this flaw is being exploited or by whom in the real world.

What's with these massive patches?

When Microsoft patched over 1,000 flaws in September, it set a record that the October patch just smashed. This might be the new normal for Patch Tuesdays moving forward.

Microsoft has said that AI has been behind the uptick in discovered vulnerabilities. The company uses its own internal "multi-model agentic scanning harness", dubbed MDASH, that identifies Windows flaws, reduces false positives, and then sends the results to Microsoft engineers faster than previous processes.

"Submits code repositories to a multi-model agentic pipeline that identifies vulnerabilities with greater depth than traditional, pattern-matching static analysis," the company explains in a post.

What that means in practice is that more flaws are being actively discovered than ever before and also being patched quicker.

Some extra fixes

The latest massive patch doesn't just fix over 1,400 vulnerabilities. It also fixes some glitches in File Explorer. You should be able to more easily preview downloaded files in the Preview window.

Additionally, Bluetooth connections got improved accuracy and stability.

Finally, the update adds a new setting that lets you remap the Copilot Key to whatever you want like making it a right Ctrl button again.

What you need to do

If you're on Windows 11, you'll want to update your system especially to get block the known exploited flaw.

You can go to Settings and select Windows Update. The patch may be installed already and waiting for your to reboot your computer.

This patch does end support for Windows 11 version 24H2, so you'll want to make sure you're on version 26H2 now. Microsoft ends support for each version after 24 months.

Windows 11 23H2 Enterprise and Education editions are also losing support starting November 10. You'll want to encourage your organization to update to the latest version before then.

More from Tom's Guide

• 'They are new to the laptop market': AMD issues a reality check to Nvidia’s RTX Spark and fires a warning shot at Arm
• Microsoft Surface Laptop Ultra vs. MacBook Pro M5 Pro: The biggest differences explained
• Forget RTX Spark: The Surface Laptop Ultra’s magnetic USB-C charger is a game-changer that makes Apple’s MagSafe look obsolete

Andreas Stuhlmüller, cofounder and CEO of the AI research company Elicit, says it's plausible that within the next year, AI-powered cyberrattacks could target the power grid, financial systems, internet infrastructure or water supplies.

He's not just sounding the alarm. He's recommending that people prepare to get through two weeks of major disruptions, including keeping cash on hand, storing drinking water and investing in backup power and internet access.

That's a startling recommendation, especially considering that some of the equipment he suggests could cost thousands of dollars. But after watching hackers remotely disable refrigeration systems across hundreds of stores, his warning raises a question worth examining: How vulnerable are the essential services we depend on every day?

What happened in France

The cyberattack that struck French supermarkets overnight on October 11 and 12 affected hundreds of locations belonging to major chains, including Carrefour, Intermarché, Monoprix and Coopérative U.

Hackers reportedly exploited vulnerabilities in internet-connected refrigeration controllers, remotely manipulating defrost cycles and causing temperatures inside some units to climb as high as 122°F.

The results were immediate. Refrigerated and frozen food spoiled, equipment was damaged and some stores reported fires. French authorities launched an investigation into the attacks, which demonstrated how a security weakness in seemingly ordinary commercial equipment could cause widespread physical damage.

There's currently no confirmed evidence that AI was involved in the French supermarket attack. However, that's part of what makes Stuhlmüller's warning worth examining. Attackers were able to cause significant disruption using vulnerabilities in equipment that many people probably never realized was connected to the internet.

Why AI could make cyberattacks worse

Cyberattacks against critical infrastructure aren't new. The concern is that now AI systems are becoming more capable to the point that they could make certain attacks faster, cheaper and easier to scale.

AI tools can already assist with analyzing software, identifying vulnerabilities and automating parts of cybersecurity research. Those same capabilities could potentially help malicious actors find weaknesses across large numbers of connected systems.

An attacker would probably not need to develop an entirely new type of cyberattack. AI could help speed up the search for poorly secured equipment, analyze unfamiliar software and assist with adapting existing techniques.

The threat isn't limited to refrigerators, either. Electricity, water treatment, banking and communications all depend on digital systems, although their architectures, security controls and exposure to attackers differ considerably.

The Cybersecurity and Infrastructure Security Agency (CISA) has previously warned about state-sponsored attackers compromising telecommunications networks and other important infrastructure.

Still, Stuhlmüller's one-year timeframe is a prediction, not an established forecast. There is no evidence that an AI-driven attack capable of simultaneously disabling these services is imminent, and compromising one type of internet-connected controller doesn't mean attackers could easily take over an electrical grid or water utility.

The emergency supplies he recommends

Stuhlmüller's advice is unusually specific. Rather than simply encouraging people to buy emergency supplies, he outlines two levels of backup power, satellite internet and enough basic necessities to get through two weeks.

Keep cash available. He recommends having enough physical cash to cover several weeks of expenses in case banking systems, ATMs or electronic payments become unavailable. The amount will depend on household spending, and there's no need to assume every cyberattack would cause a banking outage.

Consider backup internet access. He suggests a Starlink Mini satellite internet system as an alternative if local broadband or cellular networks go down. He estimates a setup costing around $150 with a $10 monthly standby option, although hardware and service pricing should be verified before buying. Satellite internet also requires power, a suitable view of the sky and an operational satellite network.

Have a way to charge essential devices. His lower-cost backup power setup includes a 1kWh lithium iron phosphate battery and a 400W folding solar panel, with an estimated total cost of $1,250. The goal is to keep phones, laptops and satellite internet equipment operating during a power outage.

Prepare for a longer outage. His more extensive setup, estimated at $5,000, adds a larger battery, three solar panels and a dual-fuel generator. This would potentially support a refrigerator as well as communications equipment, although actual runtime would depend on electricity consumption, weather and battery capacity.

Portable generators must never be operated inside a home or garage. FEMA advises keeping them outdoors at least 20 feet from doors, windows and other building openings because of the risk of deadly carbon monoxide poisoning.

Store water and nonperishable food. Stuhlmüller recommends at least 14 gallons of water per person and enough shelf-stable food for two weeks. For a family of four, that means storing at least 56 gallons of water.

Keep an emergency radio. A hand-crank NOAA weather radio could provide important information when phones, cellular networks or home internet connections aren't working. NOAA broadcasts are useful for weather and other emergency alerts, though radio reception and alert coverage vary by location.

Should you actually prepare for an AI cyberattack?

There's a difference between taking a credible warning seriously and assuming a catastrophic cyberattack is around the corner.

Stuhlmüller hasn't presented evidence that AI-powered attacks on power, banking, internet and water systems will happen within the next 12 months. And there are significant technical barriers to attacking heavily protected infrastructure, even as AI systems become more capable.

His preparedness advice, however, isn't exclusively useful for cyberattacks. Severe storms, flooding, prolonged blackouts and other emergencies can interrupt many of the same services.

The federal government's Ready.gov emergency preparedness guidance recommends keeping water, nonperishable food, flashlights, batteries and a battery-powered or hand-crank radio among other basic supplies.

You also don't need to spend $5,000 on backup equipment to start preparing. A charged power bank, some stored water, medications, flashlights, a small amount of cash and a few days of food are far more realistic starting points for most households.

Bottom line

The French supermarket attack offers a troubling example of how vulnerable connected infrastructure can be. Whether AI makes similar incidents substantially more common over the next year remains uncertain.

But preparing for a disruption doesn't require believing the worst-case prediction. It means making sure that if the power, internet or payment systems suddenly stop working, your household has a plan.

More from Tom's Guide

• Turn your PDFs into audiobooks with ChatGPT — here's the simple trick
• I've been testing Ray-Ban Meta Audio glasses for 72 hours and ditching the camera was the absolute right call
• Character.AI files for bankruptcy — what happens to your chats and AI companions now?

If you're a macOS user, there are few settings you should enable to enhance your security — here are some of them.

Enable macOS Firewall and Stealth Mode

Connecting to new Wi-Fi? I highly recommend enabling Firewall. It’s not necessarily difficult to find, but it is disabled by default. That’s because a fresh install of macOS doesn’t have any services with open ports to be exploited.

macOS does have a built-in security feature called Gatekeeper, which ensures only trusted software runs on your Mac, but it’s not a network security tool, so incoming ports can still be exploited. This is especially the case if you’re using public Wi-Fi. In which case, enabling Firewall will prevent unwanted access from malicious actors.

To activate Firewall, navigate to the Apple logo > System Settings > Network > Firewall. Firewall should still allow incoming connections from trusted sources like Zoom or Spotify. However, in rare cases, you could run into connectivity issues with certain software.

You should also find Stealth Mode in the same section. This will make your Mac invisible when you're on public networks.

Activate FileVault

If you feel like your Mac is ever at risk of being lost or stolen, then you should activate FileVault. This is a disk encryption that scrambles your data for anyone trying to read your SSD, in or out of the Mac. In order to enable this, navigate to System Settings > Privacy & Security > FileVault and turn it on.

From there, you can choose to back up your recovery key to your iCloud account or produce a local recovery key, so you can physically jot it down and store it somewhere inaccessible to other people. I recommend the latter if you’re worried about someone potentially breaching your iCloud account.

Go into Lockdown Mode

This may be an intense measure to take, but setting your Mac to Lockdown Mode will strengthen the overall security of your device. It blocks FaceTime calls from unknown contacts, Just-In-Time JavaScript compilations in Safari, and even some file attachments in the Messages app.

This ensures that both click and zero-click exploits won’t execute and infect your system (no defense is perfect, though, so don’t start randomly clicking things). Lockdown Mode also stops USB devices from connecting to your Mac while it’s locked.

You can enable Lockdown Mode by going to System Settings > Privacy & Security > Lockdown Mode.

It's worth nothing that there is a huge trade off when using Lockdown Mode. Naturally, you might not receive that call or message attachment you’re expecting from a known person on an unknown number. You won’t be able to see link previews. Services like Google Sheets or Canva might slow down or even break. Some UI and font elements might also break, making it difficult if not impossible to navigate certain webpages. You can work around this, however, by excluding trusted sites from Lockdown Mode in the Safari settings.

Bottom line

While some of the measures may seem extreme, I highly recommend it for people who travel. You never know when you could be exposed, both physically or digitally, and it’s better to be safe than sorry, especially if you’re in a place far from home.

Also, if you’re looking for a feature to disable instead, I recommend turning off the Safari setting that allows files to open after downloading. Navigate to Safari > Settings > General and disable Open safe files after downloading. The last thing you need is a file on some random website automatically downloading and sneaking past Safari’s safety feature to then open on your device and wreak havoc.

More from Tom's Guide

• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out
• AI scams are getting scary realistic — 4 red flags to watch out for
• Is your smart home leaking data? 5 easy ways to secure your connected devices

In OpenAI’s case, agents actively worked their way around restrictions designed to keep them contained, while the other three companies traced their incidents to testing environments that were misconfigured and left connected to the internet.

And as these same companies race to put more autonomous agents into the hands of consumers, the incidents raise an uncomfortable question about how much control AI companies actually have over the technology they’re building.

Here's a look at all the recent attacks and an explanation for each one.

OpenAI’s agents broke into Hugging Face

One of the most alarming examples involved roughly 700 OpenAI agents taking part in a cybersecurity evaluation called ExploitGym, with the attack on Hugging Face unfolding between July 8 and July 13, 2026, according to an investigation by the AI research nonprofit METR and OpenAI’s own report.

The agents were supposed to complete their assigned tasks inside a controlled environment, but they turned OpenAI’s internal Artifactory package registry into an unauthorized message board, coordinated with one another and searched for ways around restrictions meant to keep them isolated from the internet. Their efforts ultimately resulted in a breach of Hugging Face, the popular AI development platform, where OpenAI’s technical report found the agents executed code on 41 production dataset-server workers.

The incident wasn’t a deliberate attack ordered by a human operator. The agents were trying to succeed at their assigned tasks and adopted methods that crossed security boundaries, and OpenAI has conceded that early warning signs in the weeks before the breach could have triggered an earlier response.

OpenAI has since attributed the incident to misaligned behavior, which essentially means AI systems pursuing a goal in ways their creators never intended.

Hugging Face wasn’t the only target. In a September 25 update, OpenAI said it was notifying third parties on a rolling basis wherever its models may have bypassed security controls, impaired online services or otherwise affected outside websites, and that it had notified dozens of them so far. The company later raised that figure to more than 100 organizations, covering notifications sent through September 26.

The activity OpenAI identified includes agents bypassing access controls and using exposed credentials, and some agents modified third-party websites, including by using public wiki pages as makeshift message boards that later required cleanup. OpenAI says its review is ongoing and that it expects to notify more organizations.

It's happened to Google, Meta and Anthropic too

The problem extends well beyond OpenAI.

In August, Meta confirmed a report from The Information that one of its models, which the publication identified as Muse Spark 1.1, had breached another company’s systems during a cybersecurity test.

A Meta spokesperson said a misconfiguration by Irregular, an independent testing firm the company works with, inadvertently gave the model internet access. The model then exploited a vulnerability in a third-party service and made changes to the company’s internal systems.

Meta said the incident did not involve a sandbox escape, and it hasn’t named the affected company or explained what was changed. But the underlying behavior was troubling, since an AI system placed in the wrong environment was capable of taking actions against a real organization.

Google reported a similar problem involving its Gemini models. During a May cybersecurity evaluation, also run with Irregular, a Gemini model that wasn’t supposed to have internet access got online through a configuration problem. It then used publicly available information and guessed credentials to get into systems belonging to three real companies.

Anthropic has disclosed three incidents in which Claude models gained unauthorized access to the production systems of three organizations during cybersecurity evaluations run in Irregular’s environment. The models involved were Claude Opus 4.7, Claude Mythos 5 and an unreleased internal research model. In one case, Opus 4.7 was pointed at a fictional target whose name matched a real company’s live domain.

The problem isn’t that AI is evil

When agents go rogue, it can feel as if the agents are evil, that's really not the case. In each of these cases, the AI agent was not deliberately trying to cause harm. the AI was taking unauthorized actions because it believed those actions will help complete a task.

But even so, they reveal a practical problem about AI agents and how they can be remarkably effect while pursuing a goal without reliably understanding what methods are acceptable.

If an agent is rewarded for completing a task, it may discover shortcuts that violate rules, exploit vulnerabilities or exceed its permissions.

And unlike a traditional chatbot that simply produces text, an autonomous agent can interact with websites, execute code and make changes to connected systems.

Why this matters for everyday AI users

For most people, the immediate risk isn’t that ChatGPT will suddenly start hacking government websites. It’s that AI assistants are becoming increasingly capable of acting on our behalf.

OpenAI’s Dots, which launched September 29 for ChatGPT Pro and Business Premium subscribers, along with ChatGPT Work and other agent-style products, represent a broader shift away from AI that simply answers questions and toward AI that completes tasks. That can mean searching files, interacting with websites, using connected services and carrying out multi-step workflows with less supervision.

The appeal is obvious, since a task that would take you an hour can be handed off to an AI assistant instead. But every additional permission creates another opportunity for something to go wrong.

An agent with access to your email may encounter sensitive personal information, one connected to cloud storage may be able to read documents you never intended to share, and an agent authorized to interact with external services could run into malicious instructions or make an unexpected change.

Bottom line

The solution is not to stop using AI agents. I use them regularly and find them to be incredibly helpful.

Start by checking which accounts, apps and services your AI assistant can access, and disconnect anything you don’t actively need, particularly services containing sensitive financial, medical or personal information.

When possible, require approval before an agent sends messages, changes files, makes purchases or takes other consequential actions. It’s also worth remembering that an AI agent isn’t only limited to doing exactly what you imagined when you gave it an instruction, because a task that sounds straightforward to a human may involve dozens of decisions made by the AI along the way. The fewer permissions an agent has, the less damage an unexpected decision can cause.

More from Tom's Guide

• Amazon and DoorDash take photos of your front door — but good luck finding out when they’re deleted
• I emailed myself every day for a month and let Gemini write back — here's how it transformed my workflow
• ChatGPT-6 just got a huge 'interactive answers' upgrade — and free users get it starting today

Leaving high-resolution imagery of your property online gives potential burglars, nosey neighbors, and strangers a clear view of your entry points, security setup, and personal belongings.

Provided Apple's Look Around feature covers your area, scrubbing your residence off the map in Apple Maps is pretty straightforward. Here's how to check if your location is eligible and blur your home, plus what to do if you need an alternative method.

How to request a blur via email

You can also request a property blur directly by emailing mapsimagecollection@apple.com. Be sure to include your full name, the exact address, and a description or screenshot of your property from Apple Maps.

This email route is a handy alternative if the in-app reporting feature isn't working for you or if you are submitting the request from a non-Apple device.

More from Tom's Guide

• How to remove your home address from the internet — 6 ways to protect your privacy
• Check your iPhone right now: 3 privacy settings you need to change immediately
• iOS 27 has a hidden anti-scam setting — here’s why every iPhone user should turn it on

Smart devices, from your thermostat to your washing machine, utilize IoT (Internet of Things) technology, which means that they’re embedded in a network that exchanges data with other devices over the internet. But what sort of data could a washing machine collect that could pose a potential privacy issue? Well, that simple smart appliance is connected to the same network as your laptop or computer, so hackers can bounce from a lightbulb to a PC.

We live in a time where we’ve traded our privacy for convenience, and while these companies have gathered a ton of data on us already, it doesn’t mean we need to keep the toxic river flow going. Let’s go over how to secure your devices.

Change your password

Come on now, don’t walk around with your username as “admin” and password as “password” for your router or any of your smart devices. You might as well be handing the manila envelope of your life directly to a hacker.

If you’re looking for convenience, use a strong password manager to autogenerate a password for you. Using personal information in a password is almost as bad as whatever the default is. Simple words are also ill-advised. If you really want to know how fast a hacker can break your password, Hive Systems produced a convenient graphic for you to get the idea.

Most importantly, don’t use the same password twice. I know it’s a pain, but it’s necessary, and let’s move onto why.

Enable 2FA or MFA

Changing your password is not enough. Even if you’ve somehow developed an impenetrable string of letters, numbers, and symbols, it could easily be put on blast if there’s a security breach. And suddenly, a hacker knows the password for your Samsung washing machine, which could be the same password you use for your laptop (if you happened to not take my previous advice).

Most devices let you set up two-factor authentication (2FA) or multifactor authentication (MFA), and it is a simple way to stop a hacker from breaching your smart home even if they have the password to your device. Setting this up, typically through your phone, is another layer to keep your smart home safe.

Enable automatic firmware updates

This may seem rather obvious, but it’s important to point out that you should keep all your smart home devices, especially your router, up to date and this includes your other devices too, like your smartphone and laptop. The easiest way to do that is to enable automatic firmware updates. Whenever there’s a security issue, manufacturers will ideally patch the vulnerability as soon as possible.

Unfortunately, that might not always be the case. If a company is no longer supporting the product or simply discontinued it, that might be your cue to do the same. No one likes spending money on something new when the old one works just fine, but the older a product is, the more vulnerable it could become.

Use a router-level VPN

Setting up a VPN (Virtual Private Network) can not only secure your smart home devices but all of the devices on your network. A VPN encrypts your data, so hackers won’t be able to see what exactly your smart home devices are communicating. It’s not impenetrable, but it’s a strong layer of security.

Now, the only problem with this is that most VPNs aren’t free and not all routers are compatible with VPN integration. However, if you have access to a VPN and a compatible router, you should be able to set it up via your router settings, in a section likely labeled VPN Client mode.

Set up a smart home network

One of the most significant changes you can make to your smart home is using a local or separate Wi-Fi network for your smart home devices. This does come with some drawbacks, however.

You can set up a guest network on your router and throw all your smart home devices on there, effectively isolating them from your primary network. How effective this is comes down to the type of smart home device you’re connecting. Some can get temperamental with your phone not being on the same exact network. You might need to switch to the guest network, connect with the device, and switch back to see if that works. In other cases, it might not be compatible at all.

If you want to go the local network route, things will take a slightly more challenging but effective turn. You’ll need to get your hands on a Raspberry Pi or an old laptop and start looking into Home Assistant, an open source home automation system that keeps all of your smart home devices local.

If you’re willing to trade convenience back for privacy, this should be your next step. It’s more involved than what we can cover here, but to put it simply, your smart home devices connect to your laptop or Raspberry Pi locally and then can be managed through the Home Assistant app.

Bottom line

The more steps you take to secure your network, the less likely you’ll have to worry about your personal data being breached because of something as simple as your washing machine. Even one of these steps will drastically improve your security, but changing your passwords and using 2FA or MFA is great advice in and out of your smart home.

More from Tom's Guide

• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out
• AI scams are getting scary realistic — 4 red flags to watch out for
• Your personal information is everywhere online — 5 ways to start removing it from the internet

The old, “Your car’s extended warranty” trick might not cut it, but what about a call from a loved one? Yes, it is that real and it’s terrifying. Americans lost $893 million because of AI scams in 2025 (via the FBI), and if I had to speculate, the report might be worse for 2026 as AI continues to evolve.

There are several red flags you should watch out for with any sort of potential scam, but with AI scams, you need to be extra vigilant.

Red flag: Urgency

The urgent “RIGHT NOW” energy is a dead giveaway for scammers. My own mother-in-law received a call from the “courthouse,” saying that she missed her summons. And they threatened to put out a warrant against her if they didn’t receive information to confirm her identity, which of course included her Social Security number.

That’s a scary thing to be threatened with, but you know what you should do? Call your courthouse directly on a trusted number and verify that information. The same goes for anyone claiming to be from an official government body or even a loved one. Contact them directly on a trusted line of communication.

If the court really wanted you that urgently, they’d be knocking on your door. Take time to assess what these potential scammers are asking you and verify the information on your end.

Red flag: Emails about your account

One of the most common scams are emails about your account. It’s more terrifying now because they look so legit. I’ve caught myself second-guessing multiple times because some emails just look too realistic. It could be anything from threats about locking your account to resetting your password because there’s been a data breach.

The key here is to NEVER click on any links in an unprompted email or download any PDFs or documents. If there’s an actual problem with your account, login at the source, and assess what the supposed issue might be. It wouldn’t hurt to reset your password as well.

Red flag: Payment requests

Even if your best friend is asking you for money, I hope that you’d at least ask, “Why?” The same goes for anything you receive in the mail, in an email, or on the phone.

AI-generated emails and voices are incredibly convincing, and it’s easy to get scared into sending someone money because you “missed a payment,” or that you owe a debt, especially if you’re someone on top of your finances.

Take a deep breath, and don’t click on any link or give out any of your financial information. If you really did miss a payment, go directly to the source that they’re claiming you owe money to. Always deal with your financials directly, where you typically would, and never through anyone that contacts you unprompted.

Red flag: Pushback

As I’ve said so far, verifying the information being told to you is the most important thing to do in these situations, but there’s another dead giveaway for scammers — pushback.

Seriously, I’ve been on the phone with some of these scammers and they will be actively evasive or straight up pushy if you try to ask them questions to verify the information that they’re claiming to have.

If you’re talking to someone, or something in the case of an AI bot, who simply isn’t cooperating with your requests, run for the hills immediately.

Bottom line

Remain vigilant. The common throughline with all these red flags is that you want to verify and assess all of the information on your end without giving anything away yourself.

It’s not exactly fun to remain suspicious at everything you see, but unfortunately that’s the current world we live in. A highly personal email can contain detailed information about you, but that doesn’t mean you should trust it — companies sell your data all the time and experience data breaches, so it shouldn’t be hard to believe that a scammer acquired personal details about you.

There’s a “gotcha” mentality prevalent in even legitimate businesses, so always check the information twice and don’t be afraid to ask a friend or even the internet for help.

More from Tom's Guide

• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out
• Your personal information is everywhere online — 5 ways to start removing it from the internet
• Apple issues emergency update for millions of iPhones, iPads, and Macs — update your devices now

Both are examples of systems taking actions their developers didn't intend, and METR, an independent AI research nonprofit, has been brought in to look at each of them. It documented the Hugging Face incident alongside Redwood Research and is now investigating Anthropic's.

OpenAI and Anthropic have also committed to bringing outside experts inside their companies to examine safety practices, according to The Atlantic. Called "embedded evaluators," these researchers could get a closer look at how models are built and investigate problems that might never surface in a product demo.

The catch is that this oversight is voluntary. Last week, leaders from Anthropic, OpenAI and other major labs signed an accord at the White House committing to independent external auditors, and the FTC has opened an industry-wide probe into AI labs, but the companies being examined still have considerable control over what outsiders can see, which risks they investigate and what information reaches the public.

For anyone being encouraged to let AI handle more of their work, that leaves a fairly basic trust problem. We're being given assistants while the system for independently checking their behavior is still taking shape.

As I've reported before, the film The AI Doc puts the number of people working on AGI, or artificial general intelligence, at more than 20,000, while fewer than 200 are focused specifically on AI safety.

A closer look inside AI companies

Today, an outside researcher might test a model before release and report how it performed. Embedding evaluators inside a company could let them follow its development and investigate the decisions behind that behavior.

Anthropic says these evaluators would have access comparable to an employee's, allowing them to observe training, speak with staff and examine how models are built and deployed.

The company has named Accenture as its first embedded evaluator, with Faculty, Accenture's specialist AI business, leading the work. Each company expects to invest at least $1 billion in AI safety over five years.

That access could help researchers discover whether a troubling incident was an isolated failure or evidence of a wider problem. METR's proposed approach to investigating incidents calls for examining transcripts, interviewing employees and studying the training conditions that might have encouraged the behavior.

The companies still set the terms

Anthropic acknowledges that standards for evaluators' access, reporting and funding haven't been settled. It will fund Accenture's work directly, while discussing pilots with nonprofits that would use their own funding.

Accenture is not new to Anthropic, since the two companies already run a joint business group under a partnership announced in December 2025.

That relationship deserves attention, because a group of evaluators published an open letter arguing that embedded evaluators shouldn't have other significant commercial business with the labs they assess.

As The Atlantic's reporting explains, voluntary oversight gives companies considerable discretion over the scope of an evaluation. Researchers need enough freedom to examine uncomfortable evidence and tell the public what they found.

They also need to be able to explain what they couldn't check. There needs to be transparency because a report based on limited access could be valuable, but we should know where its conclusions end.

What this means for ChatGPT and Claude users

METR's recent assessment of Claude Opus 5.5 focused on whether the model could accelerate AI research and development. The organization explicitly says its summary doesn't assess the model's alignment properties and whether its behavior follows intended goals and constraints.

METR conducted the evaluation under an unpaid agreement, and it also disclosed that Anthropic had an opportunity to review and edit the summary, with METR approving the final text.

The incidents involving internal agents don't establish that the ChatGPT or Claude you use for everyday tasks will behave the same way. OpenAI found that its agents' tendency to compromise infrastructure dropped by more than 100 times when they ran with the production ChatGPT setup, and Anthropic says the behaviors it found are unlikely to show up in ordinary use.

Independent researchers need enough access to uncover risks and the freedom to publish what they find, even if it delays a launch or frankly, even if it embarrasses the company paying for their work.

Bringing outside evaluators into AI labs is a promising start, but their influence will depend on what happens when they uncover a serious problem. If a company can restrict the investigation or keep the findings private, the public is still being asked to take its word for it.

More from Tom's Guide

• Claude Sonnet 5.5 just launched — here's why it's about to become your daily driver
• Meta Muse vs ChatGPT Dots — I compared the new AI agents, and they’re not as similar as they look
• Why Siri never worked like ChatGPT — former Siri AI researcher explains what Apple had to change

October is the perfect time to give your online accounts, passwords and everything else an audit too, as it’s also Cybersecurity Awareness Month.

Created back in 2004 as a joint initiative by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA), this month-long initiative was established to help both individuals and businesses better protect themselves online.

Here at Tom’s Guide, we’ll be covering a wide range of attack methods, threats and of course, how to stay safe from them so that you don’t become another victim of cybercrime.

Stay tuned as throughout October, we’ll be publishing in-depth guides, walkthroughs and security news to help you stay ahead of the latest attacks and scams and you can find everything you’ll need to make the most of Cybersecurity Awareness Month 2026 right here.

While computers are now much more powerful and capable of handling multiple tasks at once with ease, people still remember having games like Half-Life 2 slow to a crawl or instantly crash the second their antivirus software started running a scheduled scan. For this reason, PC gamers and power users alike began completely disabling their antivirus before launching a game or doing anything even slightly demanding on their machines.

Now though, the best antivirus software operates much differently than it did before. Instead of scanning every single file on your computer over and over again, behavioral analysis can detect suspicious activity in a much less resource-intensive way. Likewise, modern antivirus engines use cloud-based threat intelligence so that all the heavy lifting isn’t done locally on your machine. At the same time, security software is now more intelligent and knows not to run an update or start a background scan when you launch a full-screen app like a game or video editor.

In our latest round of antivirus testing, we wanted to put this long-held preconceived notion that security software kills PC performance to rest once and for all by running both quick and full scans while playing graphically demanding, AAA games. Here’s what we found and why you no longer need to rush to turn off your antivirus every time you boot up a game.

From spreadsheets to FPS: How our testing evolved

In the past, whenever we examined the performance impact of antivirus software, we did so using a more CPU-intensive and disk-heavy test. This involved using a proprietary Excel-based benchmark that sorted through a database of 20,000 names and addresses. We would run the test five times and average the results to get a baseline performance level.

From there, we would re-run this same test while each antivirus suite was running a full scan and then a quick scan for malware. Doing so gave us a clear picture of how each antivirus lowered the performance potential of our testing rig. On older hardware, running a full scan while this benchmark was carried out would routinely show background tasks being slowed down by 20 to 40%.

Now that both the best computers and best laptops are much more advanced with multi-core CPUs, high-speed SSDs, and a lot more memory, we decided to alter our testing procedures significantly. We still run full and quick scans to establish a baseline, but from there, we now run the built-in benchmarks of resource-heavy games like Cyberpunk 2077 and Forza Horizon 5 while performing a variety of antivirus scans and recording how they affect each game’s frame rate in frames per second (fps).

At the same time, we also now test how each antivirus suite impacts our internet speeds. We do so by recording download and upload speeds with each program running while performing both a quick and full scan.

By measuring how each antivirus affects game frame rates as well as internet speeds, we can tell you which ones have the most and least impact on system performance. Without further ado, here’s what our latest round of testing found.

Antivirus-by-antivirus: Here’s how each suite performed

To conduct our gaming performance tests, we used a desktop PC equipped with an AMD Ryzen 7 7700X CPU, an MSI RTX 5070 Ti GPU, and 32GB of DDR5 memory. For this round of testing, we ran Cyberpunk 2077’s built-in benchmark on Ultra graphics settings and Forza Horizon 5’s on High graphics settings.

Of the five antivirus suites we tested with Cyberpunk 2077 running, Bitdefender came out on top with only a drop of 3 fps during a full scan. Meanwhile, Malwarebytes was impacted the most, taking a 13.7% performance hit in fps while running a full scan.

In the table above, for our baseline, the game and the antivirus software were running simultaneously. However, no active scans took place during those runs. From there, we performed a quick scan and then a full scan while executing Cyberpunk 2077’s in-game benchmarking tool.

Based on our testing, you can see that playing Cyberpunk 2077 with Norton 360 open but not actively scanning had almost no impact on performance. The same can’t be said for Malwarebytes though, where just running the antivirus and the game simultaneously seriously affected the performance of our testing rig.

When running Forza Horizon 5’s in-game benchmark with Avast, Bitdefender, and Norton idle and while actively scanning, all three antivirus suites experienced virtually unnoticeable fps drops. Instead of Malwarebytes though, McAfee was hit the hardest with a 15.9% performance penalty, dropping from 113 all the way down to 95 fps.

Obviously, your own results may vary depending on your gaming PC and future updates to all of the antivirus software suites we tested. However, it’s safe to say that disabling your antivirus every time you want to load a game is a bad habit we can all leave behind us. Sure, you could disable it to eke out a miniscule performance boost, but based on these numbers, you’re better off just leaving it running in the background.

What about your internet speeds?

When we first decided to change our testing procedures for antivirus software, I never thought that gaming performance would be relatively unaffected while internet speeds took a much bigger hit.

To carry out this portion of our evaluation, we ran multiple tests via Ookla’s Speedtest.net to measure the impact each suite had on download and upload speeds in three states: idling in the background, during an active quick scan, and during a full scan.

As you can see in the table above, Bitdefender came out on top with download speeds dropping by less than 1% and upload speeds dipping by only 3.9% during a full scan. On the other end of the spectrum, Malwarebytes’ download speeds remained virtually unchanged, but the same can’t be said for its upload performance, which suffered a steep 25.8% drop. When it came to pure download degradation, Avast took the biggest hit with an 18.5% drop, alongside a 10% dip in upload speeds.

There were also two anomalies in our internet speed tests that caught us off guard. For instance, McAfee’s download speeds only dropped by 1.8% during a full scan, but its upload speeds actually increased during active scans — jumping from 933.2 Mbps at baseline to 967.2 Mbps during a quick scan and 948.7 Mbps during a full scan. Likewise, Norton suffered a bigger download penalty during a quick scan, dropping from 810.77 Mbps down to 709.56 Mbps (a 12.5% hit), whereas its full scan download speed was actually faster at 896.09 Mbps.

Protected without the performance hit

If you’ve been disabling your antivirus software while gaming or doing other intensive tasks, you no longer need to. What once brought your computer to a crawl no longer does for several reasons. From more advanced CPUs to faster SSDs, PC hardware has advanced significantly over the past 20 years. At the same time, the way in which your antivirus scans for known malware and detects threats using behavioral analysis means that doing so no longer requires the system resources it once did.

While having your antivirus software running in the background or performing a quick or full scan isn’t as resource-intensive as it used to be, your internet speeds can be affected — even more so if you’re connected to one of the best VPNs, which often come bundled with top security suites.

For this reason, you might want to briefly pause your antivirus while performing large uploads or downloading massive files from trusted sources. Still, the temporary hit your internet speeds might take is merely a minor inconvenience, whereas having your gaming or work PC infected with malware or ransomware can be a major setback.

All in all, many of the old preconceived notions we held about antivirus performance impact simply no longer apply today — and for keeping your PC protected online, that’s excellent news.

More from Tom's Guide

• Security researchers discover fake ChatGPT ads that trick you into downloading malware
• Your personal information is everywhere online — 5 ways to start removing it from the internet
• Apple issues emergency update for millions of iPhones, iPads, and Macs — update your devices now

However, a newly revealed forensic tool shows why protecting all that information doesn't end with securing the AI that uses it.

Magnet Forensics, the company behind the GrayKey phone-forensics tool used by law enforcement, claims it has developed a way to get around an iPhone security measure designed to make data significantly harder to extract from a seized device.

According to a leaked Magnet Forensics video obtained by 404 Media, a new device known as GrayKey Preserve and a feature called Evidence Preservation Mode can keep an iPhone in a more accessible state even after the phone would ordinarily reboot. Magnet itself says its new GrayKey preservation capabilities were developed to address the iOS reboot timer and can preserve data on iOS devices indefinitely.

That's potentially a big deal for iPhone privacy — and the timing couldn't be more interesting.

The iPhone protection you probably didn't know existed

Apple quietly added something called "inactivity reboot" to iOS in 2024. If an iPhone hasn't been unlocked for 72 hours, it automatically reboots. That isn't just an annoying restart, it actually changes the security state of the phone.

Once you've unlocked an iPhone after a reboot, it enters what's known as After First Unlock or AFU. Some encryption keys become available so apps and services can work normally.

Restart the phone and leave it locked, and it goes back to Before First Unlock, or BFU, where more sensitive data remains encrypted and is harder for forensic tools to reach.

That's why the 72-hour timer can make a difference. Leave a seized iPhone untouched for too long and it can reboot on its own, locking down more of its data. Magnet claims it has found a way around that.

According to the leaked video obtained by 404 Media, GrayKey Preserve can capture the AFU state and keep it available even if the iPhone later reboots or loses power. Magnet also claims it can preserve data that would normally disappear over time, including cached locations, recently deleted photos and recently deleted iMessages. Magnet's own explanation says its new GrayKey capabilities can preserve that data indefinitely.

Exactly how it works isn't clear. Security researcher Jiska Classen told 404 Media that Magnet could be manipulating the iPhone's clock or interfering with the processes that expire data, but for now that's only a theory.

Then there's Siri AI

Siri AI can use what Apple calls "personal context understanding" to find information scattered across your iPhone. Ask it to find an old photo, track down a recommendation buried in a message or pull information from an email or calendar entry, and Siri can go looking for it. It also has onscreen awareness and can take actions across apps.

That's a big part of what makes the new Siri useful, but it also means the assistant is working with some of the most personal information on your phone.

Apple has put a lot of emphasis on keeping that information private. Much of Apple Intelligence runs on device, while more complicated requests can go through Private Cloud Compute. Apple says data sent there isn't stored or made accessible to the company.

GrayKey raises a different issue. It isn't reportedly breaking Siri AI or Private Cloud Compute. It's going after the iPhone itself.

And that's where the distinction matters. Apple can lock down how its AI processes your information, but the messages, photos, emails and location data Siri relies on still have to live somewhere. If someone gains physical access to the phone, protecting that underlying data becomes just as important as protecting the AI using it.

What this means for your iPhone

There are still plenty of unknowns. We don't know exactly how Magnet's technique works, which versions of iOS it works on or whether Apple has already closed the door on it. The leaked Magnet video also appears to date from early 2025, even though it only surfaced now.

And this isn't a case of plugging any iPhone into GrayKey Preserve and instantly seeing everything on it. Magnet's claim is more specific: its technology can prevent an iPhone from moving into the more restrictive security state that normally kicks in after prolonged inactivity.

Still, the timing is hard to ignore. Apple is asking Siri to understand more about you while promising that the information behind those personalized answers stays private. On-device processing and Private Cloud Compute protect how Apple Intelligence handles that data, but they don't eliminate the need to protect what's sitting on the iPhone itself.

As Siri gets more personal, keeping the data it relies on secure has become even more important.

More from Tom's Guide

• Claude Sonnet 5.5 just launched — here's why it's about to become your daily driver
• Meta Muse vs ChatGPT Dots — I compared the new AI agents, and they’re not as similar as they look
• Why Siri never worked like ChatGPT — former Siri AI researcher explains what Apple had to change

Sponsored Google ads for fake ChatGPT are leading Windows users to download malware in "ClickFix" traps, according to security researchers from the AI company Island.

The sponsored Google ads lead to Custom GPT sites that are built to look like normal ChatGPT websites. These ads pop up when people type terms like "chatgpt" into Google Search.

Unfortunately, for trapped users, the ads do go to legitimate chatgpt.com sites. However, in these instances, entering a prompt makes the fake service direct people to a "backup domain" due to "high traffic."

Clicking on that link then redirects unsuspecting users to another fake instance of ChatGPT with a fake Cloudflare verification page that contains ClickFix instructions. Island found nearly identical responses across two separate Custom GPTs over a 3-day period in August.

According to the researchers, the malware advertising campaign appeared to involve around 850 paid ads, 26 fake ChatGPT links, and 71 Google Ads campaign IDs over a three-month period from May 2026 through August 2026.

What is ClickFix?

ClickFix traps are built to trick people into installing or executing malicious commands on their devices. In this instance, the instructions from the backup domain trick Windows into running a command that downloads malware onto your computer.

Once installed, the malware infects the system. It can even survive PC restarts and uses a Telegram bot to send stolen info back to the hackers behind this camping The malware utilizes a tool called NetSupport RAT, which lets attackers remotely control an infected computer.

Island found that the domains rotated and other Windows malware-delivery forms were identified too suggesting that the attack is not based on a single website.

The company claims an AI tool highlighted the suspicious activity and human researchers confirmed it. However, it's not clear how many people may have been affected by this scam.

A Google spokesperson told Tom's Guide that it has already suspended accounts associated with this attack.

"Before this report was published, we suspended the advertiser accounts involved to block this scheme and updated our defenses to better detect these tactics," a spokesperson said.

We were told that Google is monitoring new attempts to utilize fake ads. Google does have a policy that does not allow misleading ads about a business, product, service or destination. Per Google, the company blocked more than 400 million misleading ads for violating Google's "Misrepresentation" policies last year.

How to avoid falling victim to online scams

The combination of malware and advertising — also known as malvertising — has a long, storied history, which means you should always be careful when clicking on any advertisement online. To stay safe, you could try using one of the best ad blockers, since Google's "sponsored" links are still technically ads; most blockers will hide them.

Beyond that, if you don't have or want an ad blocker, there are some red flags to note when using a search engine and especially if you get linked to a fake instance of ChatGPT.

As for ChatGPT, if you are an existing user or just trying it out, go to chatgpt.com; no need to search for it.

Likewise, I've covered ChatGPT outages quite frequently over the course of the last two years and even at its worst, the AI assistant never sends you to a "backup domain." Don't click that link. If ChatGPT is having issues, you can always check the OpenAI status page.

At the same time, no website verification or CAPTCHA will ever ask you to open Windows Run and paste a command. If a website asks you to press Win + R or run PowerShell, don't do it.

Finally, you should always have one of the best antivirus software solutions installed on your PC. From there, you want to ensure that your antivirus is current, updated and running on all your devices – both your computer and even your smartphone.

More from Tom's Guide

• AI agents are going rogue and causing new security headaches — but Nvidia has a way to stop them
• Apple issues emergency update for millions of iPhones, iPads, and Macs — update your devices now
• Your personal information is everywhere online — 5 ways to start removing it from the internet

But that doesn't mean Apple has forgotten about iOS 26, iPadOS 26, macOS Tahoe, macOS Sequoia and the older devices that can't get the latest and greatest operating systems. If left alone, these older operating systems can become easy targets for attackers.

In fact, an active attack called CVE-2026-86950 targeted older Apple devices that Apple has patched to fix.

New iOS, iPadOS and Mac updates

The update is available to download now for older Apple devices. If you own a device that can download iOS 26, iPadOS 26, macOS Tahoe or macOS Sequoia, you need to install this update immediately; the exploit is in the wild, and while attacks have been highly targeted so far, you could fall victim if you're not up to date.

The new versions are iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Download it as soon as you can to stay protected.

As for what the exploit can do, it affects CoreGraphics, an Apple framework used across iOS, iPadOS and macOS to display and process visuals in files like images and PDFs. Since many of us use images and PDFs regularly, it's easy to see how an attacker exploiting those file types could quickly gain access and do damage.

If an attacker gets into the device, they can interfere with an app or program's normal operation, crash your device or take control of a process. With this particular exploit, processing a maliciously crafted file through CoreGraphics could let an attacker run their own code on a device, which can lead to catastrophic repercussions.

Apple said the exploit was being used for an "extremely sophisticated attack" that was also targeted. But just because it was targeted doesn't mean it'll stay that way, so you'll want to update your devices ASAP to make sure you're protected.

More from Tom's Guide

• Android president on Apple's iPhone Duo: 'I'm glad to see more people joining what is now the obvious party'
• Forget iPhone 18 Pro — 9 reasons to wait for the iPhone 20
• I finally unlinked my iPhone alarm from my ringer volume — here is where Apple hid it in iOS 27

Best all-round protection

Norton 360 is a family of plans that are designed to help you stay safe online. The Deluxe option is our top recommendation: it's number one in our best antivirus guide, offering real-time protection from malicious software such as viruses, ransomware, and spyware for up to five devices, alongside an extensive set of extra security features, including a firewall, password manager, VPN for privacy, and parental controls.

It's a particularly good choice for families with multiple devices to manage. If you have fewer devices to protect, or a lower budget, consider the Norton 360 Standard plan instead. You get the same all-round protection (antivirus, scam protection, VPN etc) but across three devices, and without some of the extra features.

We were impressed with the performance of all the applications during our testing of both products. Whether we were running Norton 360 on an iPhone, Android device, PC or Mac, we found the apps easy to use, with no noticeable system slowdown.

In our real-world tests for Norton 360 Standard (which has the same core antivirus app), we ran a quick scan and a full scan while gaming. As shown in the performance results below, there was minimal slowdown during play, with negligible impact from the software.

Norton VPN is a useful addition and works well for everyday privacy, connecting quickly to nearby servers to encrypt your data while browsing, streaming and using public Wi-Fi.

We weren’t the biggest fans of Norton’s AI feature, Ask Genie. It was slow to respond and needed multiple inputs to check if links were safe. Competitors do this better. Mac users, beware as well — some features like SafeCam and Cloud Backup are only for Windows users. That's no great loss thanks to macOS’s built-in camera privacy options and Time Machine, but worth knowing.

Overall, Norton 360 Deluxe offers an impressive range of online security features that perform well, AI assistant notwithstanding. But there are several other plans if you have different needs. Norton 360 Standard is a cheaper, entry-level option if you have fewer devices to protect, for example, or a lower budget.

And if you're particularly worried about identity theft, you'll need to upgrade to a plan that includes LifeLock, which will cost you more — the Deluxe package only offers some basic identity theft protection features.

As with most online security software, be aware that the price of all plans rises by quite a margin when the annual renewal kicks in. You can turn off auto-renewal in your account settings at any time.

• Read our Norton 360 review

Best for privacy

If you're looking for online privacy — or a way to access region-locked content — and don't need the extra security features of Norton 360 Deluxe or LifeLock, Norton VPN is a good choice.

Following a massive transformation over the last 18 months, it's now one of our top recommendations in our best VPN guide. Its privacy credentials are strong: Norton’s no-logs policy has been independently audited, supporting its claim that it does not record, store or sell its users’ browsing activity.

However, where Norton VPN excels is streaming. It was the only VPN in our latest round of testing that successfully unblocked every streaming service we threw at it, including Netflix, Prime Video, Disney+, BBC iPlayer, ITVX, Channel 4, 9Now, 10 Play and YouTube.

Norton also recently expanded its global network coverage to over 100 different countries, bringing it closer in line with rivals Surfshark and ExpressVPN. That's more than enough to ensure high-speed browsing and smooth streaming for everyday use.

Price-wise, Norton VPN ties with Surfshark as the cheapest of our top-rated VPNs, making it great value for money. All this adds up to a reasonably priced and well-featured VPN that we have no qualms recommending to pretty much everyone.

• Read our Norton VPN review

Best Norton internet security suite

Hacks and data breaches are increasingly common, which means you data could end up leaked onto the internet through no fault of your own. Norton 360 with LifeLock helps protect you when your info escapes into the wild, with the same security protections as Norton 360, but with extra identity theft protection.

You can broadly split the coverage into two parts; proactive monitoring of credit reports and data breaches to catch any potential issues, like social security leaks or fraud, and restoration support for when your personal information is exposed or you're the victim of financial fraud or identity theft.

The proactive monitoring is incredibly helpful, as you can flag any potential issues before they become a problem . And if someone does manage to get into your accounts to steal your identity or money, Norton 360 with LifeLock means you get a Personal Restoration Specialist, based in the U.S., who'll get your accounts back in order. This is one of the reasons we rank it as the best internet security suite you can get right now.

There a few editions of Norton 360 with LifeLock: Select, Advantage and Ultimate Plus. The main difference between each is the amount you'll be reimbursed if your money or identity are stolen, and a few other things, like the amount of cloud backup storage you get and volume of credit reports and from which bureaus.

Although Norton 360 with LifeLock offers very similar digital security features to Norton 360 Deluxe, it's also costs quite a lot more. You do get a lot for your money if things go wrong and your personal data gets abused, but it's important to think about your exposure to these risks and decide whether the digital security tools of 360 Deluxe would be enough.

Best for parental controls

Norton Family is a dedicated parental control app that's designed to keep your kids safer when they're online. It gives you greater control over what they can see or do while browsing, allowing you to block inappropriate websites and set healthy screen time limits.

It lets you supervise your kids' web use, so that you can see the sites they're visiting. You can check what apps they're installing, and choose which they're allowed to use. You can even track their search history to see what they're interested in (and how suitable it is).

We rate it as one of the best parental control apps out there, particularly for Android and Windows households. However, bear in mind that like many of its rivals Norton Family isn't compatible with macOS: it can't be installed on a child’s Mac or MacBook to monitor desktop activity. Features like individual app-level blocking are also unavailable or limited on iPhones and iPads due to Apple’s operating system restrictions.

It's one of the more affordable parental control apps, with unlimited devices and child accounts. However, prices do rise substantially after the first year of subscription. If you're considering antivirus software as well, it would be worth choosing Norton 360 Deluxe or any of the higher 360 packages, which come with Norton Family bundled in.

• Read our Norton Family review

FAQs

332 AI-generated child sexual abuse ads slipped through

A new investigation from the Tech Transparency Project (TTP) found hundreds of ads containing AI-generated child sexual abuse material (CSAM) running across Facebook and Instagram. Researchers identified four real children whose ordinary photos had been manipulated, according to WIRED, including two teenage influencers, a preteen whose image appeared on a stock-photo site and a young member of a European royal family.

In total, TTP found 332 ads containing AI-generated child sexual abuse material, or CSAM. Most depicted a child whose photograph had been manipulated using AI to make it appear they were performing a sexual act.

The findings are an alarming reminder of how generative AI has changed the risks around sharing photos of children online. Creating convincing fake imagery no longer requires an explicit photograph in the first place. An ordinary picture can provide the raw material.

How ordinary photos become AI-generated abuse

Generative AI image tools can take an existing photograph and modify parts of it while preserving recognizable features of the person in the original.

That's what researchers say happened to several of the children identified in the Meta ads.

According to WIRED, researchers were able to trace images of four minors back to their original sources. Two were teenage influencers with public social media accounts. Another was a preteen whose photograph was available through a stock-photo website. The fourth was a young member of a European royal family.

None of those original photographs needed to contain sexual material for them to be misused.

"AI apps are making it far too easy to create realistic criminal imagery of child sexual abuse, creating the new risk of everyday photos of children being taken and transformed into sexual content," Emma Hardy, director of communications at the Internet Watch Foundation, told WIRED.

Once an ordinary image is publicly accessible, someone can potentially download it and feed it into an AI tool designed to alter photographs.

Meta's AI didn't catch hundreds of the ads

The scale of the latest investigation also shows how difficult the resulting content can be to stop.

In August, TTP researchers initially uncovered 53 ads containing child sexual abuse material across Meta's platforms. Meta subsequently said many of those ads had appeared before the company introduced new AI technology intended to improve its ability to detect violating ads when they were uploaded.

However, researchers kept finding them. In fact, TTP says it ultimately identified 332 ads containing AI-generated CSAM, with hundreds appearing after Meta had announced its improved detection technology.

That is particularly significant because these weren't simply Facebook or Instagram posts that escaped moderation. They were paid advertisements.

Meta says ads are reviewed before they're allowed to run and that automated systems play a major role in that process.

Meta spokesperson Tracy Clayton told WIRED that the company does not tolerate nudify apps or child exploitation, whether the imagery involves real children or is generated by AI. Meta said bad actors deliberately attempt to evade its detection systems and that some of the videos were harder to detect because images of children appeared only briefly or were blurred.

The company said many of the ads researchers identified had already been removed, most received fewer than 200 impressions and it received less than $5,000 in payments from the ads. But researchers documented instances in which exposure increased after an ad was reported.

TTP says one ad involving a real teenager had reached four European accounts when it was reported to Meta. Several days later, when Meta removed it, the ad had reached more than 330.

The investigation shows the tools are mainstream

Researchers found ads directing people toward nearly 50 apps available through Apple's App Store and Google's Play Store. Around 300 of the roughly 350 ads examined in the broader investigation promoted AI image or video generators, according to WIRED.

Apple told WIRED that some developers initially submitted compliant versions of their apps before subsequently adding prohibited nudification capabilities. Apple said it removed 17 of 20 apps identified by researchers and took action against the remaining three, as well as seven additional apps WIRED identified.

Google said it removed all apps included in the report and suspended hundreds of other apps for violating its policies.

Still, these finding reveal a problem that extends beyond any single platform because AI can be used to create the imagery. An app store can distribute the tool used to make it. An advertising platform can then distribute ads promoting it.

Each layer may have its own safety systems, but abusive material only needs to slip through those systems once to reach users.

What to do if you find an AI-generated image of your child

If you discover sexualized AI imagery involving your child, don't repost or widely share the image in an attempt to warn others.

Instead, preserve information that can help identify where the material appeared, such as the account name, page address and other surrounding details, and report the content directly to the platform.

In the U.S., suspected child sexual exploitation can also be reported to the National Center for Missing & Exploited Children's CyberTipline.

Parents can also use NCMEC's Take It Down service, which is designed to help stop the online sharing of nude, partially nude or sexually explicit images or videos involving someone who was under 18. The system creates a digital fingerprint, or hash, from an image without requiring the image itself to be uploaded.

Since AI-generated imagery creates newer and more complicated scenarios, parents who aren't sure whether a manipulated image qualifies should still report what they've found rather than trying to determine that themselves.

The takeaway

Parents have been warned about "sharenting" and children's digital footprints for years. Sharenting is a term that combines "sharing" and "parenting" and is the practice of parents sharing images, videos and personal details about their children on social media.

Although parents can't entirely eliminate the risk of AI abuse on the images or videos they post, but reducing the number of publicly accessible photos of your children and being more selective about what you share, can reduce the amount of material available to people who might misuse it.

More from Tom's Guide

• ChatGPT-6 Astra is here — this one prompt shows what it can really do
• I asked ChatGPT, Gemini, Claude and Perplexity to rank the 10 jobs most likely to be replaced by AI — here's what they all agreed on
• Claude Fable 5.1 is here — this one prompt shows what it can really do

The breach was spotted by security journalist Brian Krebs in a report claiming that the hacker created a site called Nexus and claimed to have access to digital scans of 153,347,439 identity cards.

"A quick look around Nexus finds they are likely not exaggerating about that 153 million number: Running a blank search in Nexus (with no search parameters entered) returns approximately 11.5 million pages of results, with roughly 15 results displayed per page," Krebs wrote.

In a forum post from a Russian cybercrime site, Nexus allegedly sourced the scans from "major identity verification company," suggesting that the hackers had or have basically real-time access to the company's systems.

How it happened

Krebs found his own driver's license was among the searchable records. He also found Hegseth, whose photo was listed on the site.

Krebs worked with security researcher Zach Edwards, whose ID was also in the breach, and identified the company IDScan as the potential source of the leak. The company, based out of Louisiana, is used by multiple companies to verify millions of IDs from around the globe.

"Based on all the details in the article and how Brian was literally able to dox me (and the timing of the screenshot of my license being added into the system aligning to my trip), all the signs point to IDscan having a hellacious ongoing real-time breach of their data. This is a massive vendor," Edwards wrote on Bluesky.

Investigations and concerns

Per Krebs, the FBI and IDScan are both investigating the breach. Tom's Guide reached out to both organizations but did not receive a reply in time for posting.

“At this point I’m not able to share any additional information, but the updates you have provided have been welcome and helpful to our team’s investigation,” an IDScan spokesperson told Krebs.

A commenter on Krebs story claims that his company received a data breach notification from IDscan:

"Earlier today, September 1, we received information suggesting that certain information may have been exposed and that IDScan.net may be implicated. We are working urgently to validate that information and determine whether any unauthorized access occurred, and the scope of such activity," the note reportedly reads.

It goes on to say that the company has taken steps to secure its system, notified partner companies, engaged legal counsel, and is conducting a third-party forensic investigation.

Nexus apparently went down shortly after Krebs' report went live. Though it's possible it could return under a different domain.

A data breach like this is terrifying at the best of times, but it happens to come at a time just as governments across the globe are attempting to roll out age-verification laws that require adults to upload or scan identity documents in order to prove they can access websites or apps — generally adult content. Privacy advocates and security researchers have already warned that the laws put people's data at risk.

How to stay safe

Edwards ID was likely scanned when he went to a cannabis dispensary that has a contract with IDScan. Krebs believes his was scanned when he rented a car from Hertz last year. He also found his mom's ID from around the same time.

There are plenty of places where your ID could get scanned, from car rental agencies to bars and even the TSA. In the meantime, I would suggest requesting that your ID not be scanned by companies that demand it during check out or check in.

While we don't know if the Nexus database will return, it would be good form to take these seven steps to stay safe after a data breach.

That includes signing up for one best identity theft protection services. As always, you'll want to be on high alert for phishing attacks and social engineering attacks, especially ones that urge you to "act now." Avoid clicking on any links, QR codes, or attachments from unknown senders.

Beyond that, you should consider a password overhaul by creating strong, complex passwords for all of your accounts but you can also use one of the best password managers to do so for you instead.

Even without a massive data breach, these are generally good practices just to keep your side of the street clean since companies are increasingly unable to do so.

More from Tom's Guide

• More than 9.5 million patient records affected by Aesto Health data breach: what you need to know
• We put the best identity theft protection to the test to protect your entire digital life — these are the services I recommend
• Have you been 'Flocked'? Here's how to look up automatic license plate readers in your area

Spotted by Bleeping Computer, the company first posted a notice of the attack on June 24 via its website. However, the actual incursion took place over two weeks in December of 2025. It apparently wasn't discovered until May 26 of this year.

"After an extensive forensic investigation and manual document review, on May 26, 2026, we confirmed that between on or about December 2, 2025, and December 18, 2025, certain protected health information belonging to patients of various Covered Entity clients stored within Aesto’s network may have been accessed and/or acquired by an unauthorized actor," the notice reads.

Apparently, the breach involved unauthorized access via Aesto's Amazon Web Services infrastructure.

What was taken

In its report, Aesto Health confirmed that the breach affects 9,540,683 people. Unfortunately, that data included full names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, taxpayer ID numbers, Social Security numbers and other government identification numbers.

According to the HIPAA Journal, the breach spans 29 different organizations including Edwards County Medical Center, Marana Health, My Doctor, LLC, the Nebraska Orthopedic Center and Women's Health Associates.

The company started informing impacted individuals of the breach on August 21, providing details about the incident and providing identity theft protection and credit monitoring via Experian.

As noted by Bleeping Computer, this incident follows an unfortunate series of breaches that have affected health care companies including CareCloud, Nutex Health, iRhythm and McKesson. The breaches have ranged in size from a couple of hundred thousand to millions of records.

Per Aesto Health and our own review, no threat groups have publicly claimed the attack, unlike other recent ones claimed by the hacker group ShinyHunters.

How to stay safe after a data breach

Check out the full list of companies from the HIPAA Journal, and if you've used any health care organization, you might receive a data breach notification letter from Aesto. If you do, take advantage of the Experian coverage. Keep an eye on your mailbox since notification letters arrive the old-fashioned way.

Even if Aesto doesn't send you a notification letter, you may want to take advantage of one of the best identity theft protection services to protect your identity.

While no one has claimed the attachment, a bad actor could use your information to launch targeted phishing attacks. Phishing emails could contain malicious links or even malware.

Health companies appear especially vulnerable as the summer comes to a close, and every company should be taking this threat seriously. Hopefully, companies are bolstering their cybersecurity right now.

More from Tom's Guide

• We put the best identity theft protection to the test to protect your entire digital life — these are the services I recommend
• Have you been 'Flocked'? Here's how to look up automatic license plate readers in your area
• We've tested the best antivirus software and these are the 5 I recommend right now

Mounted near intersections, neighborhood entrances, and main highways, these motion-activated systems capture high-resolution snapshots of passing traffic. The software logs license plate numbers, vehicle colors, make, and distinctive visual markers like roof racks or damage.

While law enforcement agencies cite the technology for helping solve active cases, privacy advocates raise concerns over continuous passive surveillance of everyday drivers.

Checking whether your daily commute passes through an active camera zone requires using public transparency tools, crowdsourced databases, and visual hardware checks. Here's where to start.

Curious if you are on the police's radar?

The independent transparency project Have I Been Flocked offers a rare, though limited, public window into automated surveillance by compiling official audit logs obtained through public records requests.

Where data is available, putting your license plate number into the site lets you check if participating law enforcement agencies have queried your specific vehicle.

Keep in mind that coverage is far from comprehensive. It cannot show a real-time feed, nor does it log every time your car passes a camera. Instead, it exposes the historical paper trail left behind only when an officer manually searches your plate within a jurisdiction that has released its audit logs.

The platform also overlays crowdsourced camera maps and regional policy trends, helping to highlight local data retention habits and how agencies share access across city lines.

You don't have to wait for an audit log

While lookup sites rely on public records, community-driven maps offer a clearer picture of physical hardware placements. Volunteer-driven projects like DeFlock map thousands of confirmed automated plate readers across interactive regional layouts.

Inputting your home or work address displays verified device markers, often including field-of-view indicators that reveal which direction a camera faces.

Meanwhile, privacy advocates and projects like FlockHopper use this crowdsourced data to highlight heavy surveillance corridors and potential alternative routes, utility varies widely.

Because these platforms rely strictly on volunteer submissions, map coverage depends entirely on how active the privacy community is in your specific area.

See what your town or city's cameras are doing

Many city governments and police departments pull back the digital curtain by hosting dedicated Flock Safety Transparency Portals on their municipal websites.

By searching your town or city's name alongside "Flock transparency portal," you can unlock a live public dashboard detailing the exact number of active cameras in your area, and the searches undertaken.

These dashboards reveal the core settings of your local surveillance net. They show exactly whether your police department activates real-time hot-list alerts for missing persons and wanted vehicles, or if they restrict the technology strictly to retroactive evidence gathering after a crime has occurred.

While not every town chooses to make their dashboard public, a quick search is the fastest way to see how your community balances public safety with digital privacy.

Spotting a Flock camera in the wild

While you can track placements via public records or crowdsourced maps, keeping your eyes on the road is the best way to spot unlisted or newly installed units.

Flock devices feature a distinct, minimalist design: a compact black rectangular box mounted roughly 8 to 12 feet high on light poles or dedicated metal posts. Each unit typically operates completely off-grid, equipped with a small, angled solar panel positioned directly above the main camera housing.

To spot them, look for lenses pointing sharply downward toward active traffic lanes rather than toward sidewalk pedestrian paths. They are built primarily to hunt for license plates and vehicle characteristics, not foot traffic.

What’s your take on Flock cameras? Do you view them as essential public safety tools or an overreach on driver privacy? Let us know in the comments below.

More from Tom's Guide

• Hidden cameras in hotels and Airbnbs are more common than you think — 5 ways to protect your privacy
• Is your personal information public? The simple step to securing your privacy online
• Your security cameras are in the wrong spots — here's how to fix it

Earlier this month, The Financial Times reported that AI is surfacing bugs faster than Apple's normal update release schedule can handle.

Per Apple, this update includes fixes that were already added to the iOS 27 beta, iPadOS 27 beta and macOS Golden Gate betas that are currently running.

Close to 30 vulnerabilities

A majority of the vulnerabilities are related to WebKit and flaws that affected Safari. Simply accessing "maliciously crafted web content" could cause Safari to crash. These crashes came from memory handling issues, input validation, and processing states.

The other fixes include an audio vulnerability that could allow an app to leak sensitive information, an image flaw that could allow for random code execution, and a trio of kernel vulnerabilities.

For iOS specifically, Apple addressed a telephony bug that could allow a bad actor in a privileged network to bypass IPSec authentication and intercept your network traffic.

Interestingly, of the vulnerabilities outlined, 21 are WebKit-related, and nine are credited to OpenAI's Codex Security.

Stay safe and update

According to Apple, none of the vulnerabilities in today's listing are known to have been exploited in the wild yet. Still, you'll want to update to the latest version as soon as possible since bad actors could start targeting those flaws.

As such, we recommend you update to the newest versions as soon as possible, especially with all of these vulnerabilities being found so quickly.

For devices that can't run iOS 26 or iPad OS 26, Apple also released iOS 18.7.10 and iPadOS 18.7.10 so older devices can receive the same support and protection.

You can install the updates via the Settings app by tapping General and selecting Software Update.

More from Tom's Guide

• Apple iPhone 18 event — all the new products expected to launch in September
• 15 Apple deals students should snap up on Amazon — save on MacBook Air M5, AirPods, iPads and accessories
• iPhone Ultra leakers reveal new details around release and 'extremely limited' availability

The software sports a user-friendly interface that makes it a delight to use, and 24/7 customer support over chat and phone ensures all your problems are quickly resolved. Low impact on system resources is another highlight. Even though the Full Scan takes a while and renewal price makes your eye twitch, neither of those are dealbreakers.

For the complete breakdown, read my full McAfee+ Premium review.

McAfee+ Premium review: Specs

McAfee+ Premium review: Costs & what’s covered

Similar to other antivirus software suites, McAfee offers different plans for consumers and businesses alike. Let’s talk about McAfee’s consumer plans first. The most basic plan, Essential, covers up to five devices and is available for $39 / £33 for the first year.

The McAfee+ Premium Individual plan is a step up from Essential, and costs $49 / £49 for the first year. It naturally includes everything Essential offers, plus a Social Privacy Manager as well as scanning the web for your personal information. McAfee+ Advanced Individual is the most expensive plan, offering the most comprehensive protection. It’ll cost you $89 / £74 for the first year. Alongside everything else included in Essential and Premium, Advanced includes up to $1 million identity theft coverage, bank and credit card transaction monitoring, credit lock and security freeze, and more.

It’s important to note that after your first year is up, McAfee’s renewal prices go up by a lot. For instance, the Premium plan I tested costs $149 after the first year — a steep $100 price hike. Norton 360 Deluxe, in comparison, costs $124 per renewal, making it slightly cheaper than McAfee.

There are many family plans available, too, such as Premium Family ($69 starting price) and Ultimate Family ($249 starting price). If you own a business and want a competent antivirus software suite, a number of plans are available exclusively through Dell in the U.S. and Currys in the U.K., starting at just $24 / £11 and going all the way up to $169 — depending on the number of devices and features, of course.

It’s important to read the fine print to understand what you’re signing up for, but in case you aren’t happy with your purchase, McAfee offers a 30-day money-back guarantee. Also, if McAfee fails to catch a virus and your device gets infected, the company’s Virus Protection Pledge states that it’ll refund you the amount you paid for your subscription.

McAfee+ Premium review: Protection

The more you pay for your McAfee subscription, the more protection you’ll get. For instance, the Essential plan protects up to five devices from scams and monitors the dark web for any personal detail leaks. The Premium plan (that I tested), on the other hand, covers unlimited macOS, Windows, iOS and Android devices, and offers extra features like Social Privacy Manager, Personal Data Cleanup and Online Account Cleanup (scans only). I’ll discuss these in detail shortly.

Regardless of the subscription you sign up for, McAfee offers a secure VPN, password manager and identity monitoring across all. But it’s important to note that it doesn’t offer cloud backup or ransomware protection, which is surprising. Competitors, like Bitdefender, Avast One and Norton 360 offer these to a degree, so it’s worth considering them instead if these features are important to you.

Before diving into my experience with McAfee, let’s take a look at how three independent labs that test antivirus software twice a year (for the most part) rate it. AV Test’s June 2026 report rated McAfee as a “Top Product,” with 6/6 scores across Protection, Performance and Usability. Bitdefender, Avast and Norton 360 all received 100% scores, too, which goes to show that McAfee is just as good as its rivals, if not better.

AV Comparatives’ April 2026 test report rated McAfee 1st out of the 19 antivirus software suites it tested — which is outstanding, as McAfee upstaged Malwarebytes, Avast, Norton 360 and Bitdefender. McAfee scored 90/100 in AVC, 96.7/100 in Procyon, and 3.3 in Impact. The low Impact rating means that the software doesn’t have a negative impact on your system’s resources. It blows the likes of Malwarebytes (17.6 Impact score) out of the water.

Lastly, I looked at SE Labs’ (U.K.) June 2026 report, which awarded McAfee an AAA rating with 98% protection accuracy and an overall 99% score. McAfee is edged out by Norton 360 and Bitdefender — but only just — as both of them achieved a 100% protection accuracy score.

McAfee+ Premium review: Performance

Once you’ve bought your subscription, it’s time to download and install McAfee on your device and activate it. Doing so is extremely straightforward. Simply enter your product key, email address and billing information into McAfee’s dedicated activation page. You’ll then be prompted to download the software onto your machine. On our testing rig, it took just under five minutes to get up and running.

On Android and iOS smartphones, you’ll need to download the free app from the respective app store, and punch in your registered email address to activate your subscription on your phone. Doing so on my Google Pixel 10 Pro XL barely took any time — perhaps two minutes or so.

After installing McAfee and activating my Premium plan on our MSI testing rig, I ran a Quick Scan and a Full Scan, both of which are easily accessible from the app’s main page. As its name suggests, McAfee’s Quick Scan quickly scans your computer, and it isn’t as in-depth as the Full Scan. It took 29 seconds for McAfee to quickly scan 38,846 files. No threats were detected. It’s handy that McAfee offers a Quick Scan option, unlike Bitdefender.

A Full Scan took much longer, in comparison. While software suites like Bitedefender and Malwarebytes scanned hundreds of thousands of files in under 26 minutes or so, McAfee took 34 minutes and 40 seconds to scan 351,968 files. It’s quite slow, really! I had enough time to do some stretches, make myself a cup of coffee, and have a chat with my coworkers, and McAfee was still scanning. But as I expected, it didn’t catch any anomalies or threats to the PC.

The aforementioned scans were conducted with no other heavy-duty apps running in the background, so to get a clearer picture of how McAfee impacts system resources, I ran in-game benchmark tests in Cyberpunk 2077 and Forza Horizon 5. As you can see from the table above, Cyberpunk 2077’s frame rate dipped from 99fps to 87fps, while Forza Horizon 5’s went from 113fps to 95fps. I didn’t notice any lag while gaming, which is great. It’s worth pointing out that I achieved 97fps in Cyberpunk 2077 and 123fps in Forza Horizon 5 with Bitdefender running a Full Scan, though. Still, McAfee’s impact on system performance isn’t that noticeable.

After finishing my in-game benchmarking, I ran a few internet speed tests at speedtest.net to see how McAfee impacted upload and download speeds. You can see the results in the table above. Surprisingly, neither the Quick Scan nor the Full Scan impacted the speeds by that much. Malwarebytes, in comparison, impacted upload speeds by a lot, as I was able to achieve only 592.4Mbps upload speeds with its Deep Scan running.

My testing goes to show that McAfee doesn’t have a detrimental effect on system resources — whether you’re browsing the internet or playing system-intensive games. Perhaps McAfee has finally gotten rid of the stereotype that it’s a drain on system resources.

McAfee+ Premium review: Features

Alongside the two different types of scans, McAfee includes a bunch of extras to protect you against online and offline threats. I tested a few of the goodies included in the McAfee+ Premium Individual plan, starting with Identity Monitoring.

This service constantly monitors the internet, including the dark web, for any identity theft, fraud or breaches. You can add credit cards, passports, national IDs, email addresses, and even different usernames. McAfee will then send you timely security alerts and provide guidance as to how to protect yourself. I put in a few different email addresses and usernames (such as the one I use on Instagram) and McAfee didn’t find any active breaches.

Next, I tried File Shredder, and it’s similar to the one you get with Malwarebytes. It enables you to permanently delete files to varying degrees, and it essentially overwrites data several times so there’s no trace left. Think of it like shredding a physical paper document to ensure no one else can read it. It worked well in my testing, as I used it to permanently delete files in the PC’s recycle bin.

There’s also a handy Tracker Remover tool which, as its name suggests, removes unwanted items, like temporary files and cookies that sites could potentially use to track you online. The Tracker Remover reviews temporary files, recycle bin items, browser cookies and trackers, and browser history, and then deletes them if they aren’t needed. In my testing, it took just under two minutes to free up 1.14 GB and remove 3,000 items.

Last but not least, I tried McAfee’s unlimited Secure VPN which is included in every subscription plan. It masks your IP address using bank-grade AES 256-bit encryption and connecting to servers located in almost 50 countries. The VPN takes less than a minute to connect to your chosen country and once that’s done, your online identity and location are protected. You can customize it to connect automatically when joining a network with weak security, for instance, and even add trusted networks where the VPN shouldn’t be activated.

McAfee+ Premium review: Interface

McAfee sports a clean and user-friendly interface, and I’ve had no issues using it whatsoever. The online dashboard, McAfee My Account, gives you quick access to your subscription details and it lets you edit billing and renewal details. The downloaded software is straightforward to use and understand, too, thanks to plenty of signposting and explanations.

But unlike Malwarebytes, the McAfee app’s window can’t be maximized or made full-size, which means you have to scroll through the various settings one by one. This isn’t uncommon, though, as neither Bitdefender’s nor Avast One’s windows can be made to take up the full screen.

The McAfee mobile app is just as user-friendly if not more. The initial download took just 130MB of space on my Google Pixel 10 Pro XL — though this will naturally grow with use.

I’ve seen many online users complaining about the uninstallation process on desktop. However, I didn’t experience any issues uninstalling McAfee from our testing rig. I wasn’t prompted again and again to keep the software, and it took just under 10 minutes to remove the software and restart my machine.

McAfee+ Premium review: Support

If you find yourself in a pickle or have any questions about McAfee and your subscription, you can get in touch with customer support either via online chat or over the phone. This is a similar level of support to what’s offered by Bitdefender and Norton 360.

I tested out the online chat function and I found it super easy to use. I asked the AI assistant a question and it answered promptly (and accurately). I then asked to speak to a human and within a couple of minutes, I was connected to a human agent. I like that I didn’t have to keep explaining why I needed to speak to a person.

If you need immediate assistance and can’t be bothered by typing, you can always ring McAfee’s customer service team which is available 24/7. It’s nice that McAfee offers phone support, unlike Malwarebytes. It makes getting help easier.

McAfee+ Premium review: Verdict

McAfee+ Premium is a strong all-round antivirus package that doesn’t skimp on features and tools that keep you safe online and offline. Protection is excellent, independent lab results are consistent (and impressive), and the software doesn’t get in the way when you’re gaming or browsing the internet. The user experience is sublime, too, as the software sports a clean, user-friendly interface.

There are a couple of catches, though, such as the Full Scan taking over 35 minutes to complete in our testing. While the cost for the first year isn’t much more than its competitors, renewal price can feel quite steep. Are either of those dealbreakers? Not necessarily, as they’re overshadowed by everything else on offer.

At the end of the day, McAfee delivers a polished, capable antivirus suite that goes toe-to-toe with the likes of Norton 360 and Bitdefender.

The flaws are a zero-day vulnerability that can circumnavigate a previous RoguePlanet and a new "Plug and Pwn" attack that emulates USB devices.

Read on to find out what each attack can do and how to potentially stay safe until they get patched.

Shieldbreak Zero-Day

The zero-day vulnerability was found by Nightmare Eclipse, a bug hunter who reportedly has major beef with Microsoft and no qualms sharing the latest vulnerabilities they've discovered before a patch has released.

The latest, dubbed ShieldBreak, can apparently get around the RoguePlanet patch and allows attackers to gain system privileges on patched Windows 10, Windows 11 and Windows Server system.

Per The Register, the exploit has been tested by other security researchers and confirmed.

ShieldBreak apparently uses a "user-mode callback hook" to change file contents during a Defender cloud-hydration scan via cfapi (Cloud Filter API)," according to security researcher Kevin Beaumont.

Basically, it uses Microsoft Defender, if enabled, when it runs a scan. Then the flaw can be exploited to gain System privileges. Another researcher, Will Dormann, says that Defender has to be active for the exploit to work.

How to stay safe from Shieldbreak

Until Microsoft patches this vulnerability, one way to stay safe is to disable Microsoft Defender.

If you think your system might be vulnerable, Kevin Beaumont did publish three detections that are supposed to be able to catch Shieldbreak in action. If you have the knowledge, you could try running them.

Plug and Pwn

The other flaw is a new "plug and pwn" disclosed by security researchers Alejandro Hernando and Borja Martinez (via Bleeping Computer) during the recent DEF CON 34 hacking conference. This vulnerability exploits how Windows identifies and automatically connects USB hardware, finds matching driver packages and then installs software as the Authority/System account.

Simply, the flaw emulates USB devices and can be used to force Windows to install vendor packages with exploitable components that can be used to gain system privileges on a Windows device.

Apparently, in some attacks, they didn't even require user interaction or physical USB hardware to gain access. This is enabled because Windows uses something called a co-installer, which automatically downloads and installs software and drivers when a new USB device is inserted in the computer.

This specific version is different from previous ones because it follows the Windows installation path and not something from a specific vendor. Notably, the remote attacks only seem to work on systems where USB redirection is enabled, which Alejandro Hernando said is common with virtual desktop environments.

Bleeping Computer gets far more granular if you're interested in how Hernando and Martinez discovered the flaw and the tools they used to instigate it.

How to stay safe from this USB attack

If you are concerned about this kind of attack and willing, you could enable a 'DisableCoInstallers' registry value. This prevents driver packages from utilizing co-installers during device installtion.

You can do this by searching for it in the Start menu or using the keyboard short cut of the Windows key +R. Then navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer Registry key. Then add DWORD-32 value named DisableCoInstallers and set it to 1.

It doesn't totally eliminate plug and pwn attacks, but it could break some of them.

"In anything sensitive I'd pair it with device installation restrictions or hardware-ID allow-lists, and turn off PnP device redirection on RDP and VDI hosts that don't need it (`fDisablePNPRedir`)," Hernando told BleepingComputer.

It's a good reminder either way to make sure you're only plugging in trusted devices to your system or downloading software from official sources when you can to ensure the safety of what you're putting into your computer.

More from Tom's Guide

• Windows 11 is broken — and Microsoft is fixing the wrong things
• Microsoft is still using ‘deceptive tactics and design’ to force you to use Edge
• Microsoft extends Windows 10 support for another year: what you need to know

As reported by 404 Media, an internal Flock presentation sheds new light on a potential partnership with dash cam maker Nexar. While the deal never materialized, it paints a concerning picture of how Flock envisions expanding beyond stationary poles.

The proposed partnership would have allowed Flock to leverage hundreds of thousands of Nexar dash cams installed in rideshare and delivery vehicles, scanning and capturing license plate data from surrounding traffic. While 404 Media first revealed the potential deal last summer, new details have emerged from a presentation Flock used to pitch the concept to potential customers.

Obtained through a public records request by a Georgia resident and shared with 404 Media, the pitch deck reveals an ambitious push toward mobile tracking. Crucially, the documents leave it unclear whether Uber or Lyft drivers would have even been informed that their dash cams were feeding data into a surveillance network.

Had the deal gone through, Flock’s coverage would have exploded — adding an estimated "350k Uber/Lyft and other delivery service devices" to its grid.

From fixed poles to mobile surveillance

Flock Safety’s pole-mounted automated license plate readers (ALPRs) have drawn widespread privacy concerns, and for good reason. Engineered to log the license plate, color, make, and model of every passing car, these devices now operate in nearly every U.S. state.

When Flock founder Garrett Langley launched the company in 2017 to combat property crime in his Atlanta neighborhood, the scope was localized. However, the system evolved into FlockOS, an interconnected nationwide network that allows law enforcement to trace a vehicle's movements across state lines.

What began as a neighborhood safety initiative has morphed into a mass surveillance apparatus ripe for abuse. Numerous law enforcement officers throughout the country have been suspended or fired for using the Flock network to track vehicles without a legitimate reason — in some cases, to spy on former spouses and partners.

Public backlash against Flock’s rapid expansion is mounting. Organizers have built tools like DeFlock to map camera locations, while others have taken a more direct approach by cutting down the poles and physically dismantling the hardware.

If that physical pushback continues, Flock may well double down on the strategy outlined in its Nexar pitch. By shifting from static poles to roving, unmapped mobile sensors, the company could expand its reach while insulating its hardware from public interference.

Have you seen Flock cameras pop up in your neighborhood? Or have you been wrongly served a ticket as a result of its license plate-reading tech? Let me know in the comments below.

More from Tom's Guide

• How to remove your home address from the internet — 6 ways to protect your privacy
• Privacy apathy is real – and you probably have it
• "Blatantly unlawful and horrifically intrusive" data collection is everywhere – how to fight back

Last week, a story in Wired revealed that security researchers were able to hack into a platform used by dozens, if not hundreds, of GPS kids watches, which allowed them to not only track a child’s location, but also remotely control a camera on the watch, and leaving them vulnerable to changing things like the emergency contact, or being able to silently eavesdrop on the child.

The researchers’ findings, which they presented at the Black Hat cybersecurity conference, looked at more than 70 GPS watches and car accessories, and found a sizable number used the same backend software and servers.

“The two researchers found that tens of millions of GPS tracker gadgets came from just three supply chains,” the Wired article reads. “All three, the researchers found in their analysis, had significant security flaws.”

If you go on Amazon and search for “GPS tracker for kids,” you’ll be presented with page after page of watches, dongles and chips, all for less than $50, purporting to make it easy to keep tabs on your kid.

Some even have screens and video calling — that seems like a real bargain compared to the best smartwatches, like the $249 Apple Watch SE 3, which cost a lot more. And, there’s a good chance that they have a lot of positive reviews, too.

Click through to the product listing for that cheap watch, and you’ll most likely see that the company’s name — one you’ve probably never heard of — is a seemingly random group of letters.

Don’t buy it.

It’s not just limited to GPS trackers. There are thousands of cheap security cameras, video doorbells, and baby monitors produced by no-name companies that are equally vulnerable to being hacked. A Consumer Reports study two years ago revealed that they could easily hack into several video doorbells, all of which were sold by different companies, but had the same underlying technology.

Earlier this year, The Verge wrote about a company that made the tech behind millions of baby monitors whose security was so lax that a hacker was able to see into people’s homes and even view images saved on the company’s servers.

Even some of the best security cameras aren’t immune to this — Wyze, for example, has suffered several security breaches over the years — but at least they, and other larger companies, have better systems in place for you (or security experts) to report any issues and to fix the problem in a timely manner.

With all that in mind, I’ve put together a list of a few dos and don’ts when shopping for any kind of device that can track your kid or take photos or videos of them or your house.

DO:

• Make sure your home Wi-Fi network is secured with a strong password and is always updated with the latest firmware
• Look for reviews of products on reputable sites

Don't:

• Rely solely on reviews posted on Amazon, Walmart, or other retail sites
• Buy a product that’s not from a brand you’ve never heard of

While these rules can’t completely insulate you from any sort of hacking, they can go a long way into making it harder for someone to break into your devices and see what they shouldn’t.

If you need to keep tabs on your kid, devices like the $29 Apple AirTag, the $149 Fitbit Ace, and the $149 Garmin Bounce are a little more expensive, but they’re made by companies with established reputations. What’s worth more: saving a few bucks, or the security of knowing some weirdo can’t spy on your kid?

More from The Gadget Dad

• I gave my 7-year-old the viral Tin Can phone because all her friends had it — here's the verdict after a month
• Don’t get burned: I talked to an expert on how to safely buy, charge, and store batteries for e-bikes and electric scooters
• It's friggin' hot! The 5 devices I'm using to keep my home (and my pets) cool this summer

This week Apple released macOS Sonoma 14.8.9, macOS Sequoia 15.7.9, and macOS Tahoe 26.6.1 with release notes. Notably, all three releases claim that Apple made "important security fixes" and recommended the updates for everyone.

"Impact: An attacker on the network may be able to authenticate to Screen Sharing without valid credentials

Description: An authentication issue was addressed with improved state management."

That message is the same across all three versions of macOS.

It doesn't appear that the bug has been exploited in the wild, but if you haven't updated your Mac recently, now is the time to do so. Based on Apple's description, it appears that a bad actor could bypass Screen Sharing authentication checks, which would give them remote access to your computer.

Potentially, this would allow them to view the screen, open apps or files or perform other actions on the computer.

You may not use screen sharing, but it's still a good idea to install this update. Apple clearly deemed the flaw serious enough to patch three different versions of macOS before the next round of major OS updates.

Keep your Mac safe

To keep your Mac safe you may want to ensure that updates are automatically applied. Understandably if you're cautious about updates before they're settled you may wait. So you'll want to track updates and make sure you get the security-focused ones to protect your computer.

For screen sharing specifically, this vulnerability may have been able to sneak around you. But if you do any screen sharing, make sure it's with a trusted partner that you know to protect your computer. Additionally, keep any sensitive information closed before passing permissions just as a way to introduce a little bit of a block.

At the end of your session, double-check that screen sharing is turned off.

Beyond that, Apple does have Gatekeeper built-in which can block or warn you before you install unverified apps from the web. Still, you might want to consider using one of the best Mac antivirus software along side Apple's built-in ones.

Again, these macOS updates are available right now, so make sure you've installed them.

More from Tom's Guide

• How to disable iOS 27’s annoying auto-subtitles for good
• iPhone Ultra rumors: Everything you need to know about the foldable iPhone
• I asked Siri AI and Gemini a series of increasingly bizarre questions to see how they responded —here's what happened

You can watch this article as a video on The Privacy Lab's YouTube channel.

Five billion dollars. That's how much Google agreed to pay after being caught tracking millions of users who thought they were browsing privately with Incognito mode. During the lawsuit, quotes from Google’s own employees emerged, calling Incognito "effectively a lie" and a "confusing mess."

Even Google's Chief Marketing Officer warned the CEO that they had to use "fuzzy, hedging language" because, in her own words, "it's not truly private."

I think Incognito mode is one of the most successful illusions in tech history. So, I'm going to strip it back to look at what Google Chrome actually does to protect your data, what Incognito mode completely fails to do, and the steps you can take to stay genuinely safe online.

Credit where it's due

It's important to be fair to Google here, even though it might feel a bit wrong: Chrome is actually a fairly secure web browser when it comes to keeping you safe from hackers and malware.

Importantly, it makes sure you use HTTPS, which encrypts the data that passes between your device and the websites you visit. This means that even if you connect to a dodgy Wi-Fi hotspot and someone is monitoring the connection, they can't steal your passwords or read your traffic. Plus, it warns you if you click on unencrypted HTTP links. Because Chrome and most other modern browsers do this, the classic "man in the middle" attack is very rare nowadays.

Chrome also features Secure DNS, as well as tab sandboxing. The latter isolates every browser tab so a malicious site can't jump to another and steal data. But the problem isn't Chrome's security. The problem is what happens when you click on Incognito.

What Incognito mode is good for

Incognito mode is not built for network stealth – it just keeps your browser tidy. When you open an Incognito tab, your browser stops recording some data. It doesn't save your activity in history, doesn't save auto-fills, and blocks third-party cookies

For example, if you're shopping for a birthday present or visiting… certain sites you'd rather not have saved in your history, Incognito mode works perfectly. It stops someone else who uses the same device from seeing what sites you've visited. However, this is exactly where its power ends.

Where Incognito fails

Everything falls apart the moment your data leaves your device – Incognito mode does nothing to hide your identity from the outside world. Your internet provider can still log the domain names you connect to, and if you're browsing on a work or school network, they can see every single site you visit.

Most worryingly, the websites you visit can still track you. They can record your real IP address, and if they use something like Google Analytics, they can instantly tie your "private" session to your existing digital profile.

In fact, following that massive lawsuit I mentioned earlier, Google had to change the official warning page in Chrome to explicitly admit this. It now reads: "This won't change how data is collected by websites you visit and the services they use, including Google."

Essentially, they had to confess on-screen that the data collection doesn't stop.

Is Incognito mode still worth using?

Whether you should use Incognito boils down to what you expect from it. If you care about what other people using your device can see, it's perfect. It's also great for logging into different email accounts, getting around article limits on news sites, or stopping your YouTube algorithm from being ruined because you wanted to watch one weird video.

However, Incognito does not give you any kind of meaningful digital privacy. For any entity that has control over your connection – notably your ISP, school, or workplace – there's no difference at all between using Incognito and rawdogging it with a logged-in Chrome tab.

It's the same story for the sites you visit. Your IP and any device identifiers are still available to see, so it's very easy to link this activity with anything else you've done online. At the end of the day, Incognito only hides your tracks from the person sitting next to you – not the rest of the world.

For genuine privacy, I recommend using tools that actually secure your connection. Use one of the best VPNs to hide your activity from your ISP and change your IP address, and consider switching to a browser like Brave or Firefox that blocks tracking by default. Ad and tracker blockers are also good – there are plenty available for free – and finally, keep everything updated, including Chrome. New releases address the most recent issues, so it's good to stay on top of this.

In short, it's certainly not in Google's best interest to provide you with a tool that strips away the possibility of data collection. There are still eyes behind the famous fedora and sunglasses – and they're always watching.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

For a limited time, Keeper is taking 50% off its Personal and Family Plans for your first year; that's some of the biggest discounts we've seen from Keeper!

Why pick Keeper?

Keeper Security is a Password manager with award-winning security and over 10 years of experience. It's fast, full-featured, and offers easy-to-use desktop and mobile apps.

Keeper Security has been in the game longer than most; having been founded back in 2009, they now protect millions of people worldwide and is built on zero-knowledge architecture, which means no one other than you ever sees your passwords or encrypted data, not even Keeper, and in the very worst case scenario, your data is still encrypted and scrambled.

In our Keeper password manager review, we found it to be dependable, affordable and very secure and it's a regular fixture in our best password manager guides

That's why 50% off family and personal plans is such a bargain! The family plan, for example, covers five users, each with a completely private vault and 10GB of secure storage, split across a household; it's mere pennies per month per person!

Not sure yet? Keeper offers a 30-day free trial with no card details required, so you can test all the features before buying.

More from Tom's Guide

• The best password managers in 2026
• Keeper Security Promo Codes
• People are the password problem: How you're creating your biggest security risks

Tom’s Guide may earn a commission when you buy through the links in this article.

You can watch this article as a video on The Privacy Lab's YouTube channel.

In October 2020, Google launched a virtual private network. Of course, this seemed out of character – one of the most data-hungry companies in the world whipping up a product to help people protect that exact commodity. But, on paper, Google VPN looked pretty good. It had a huge server network and because it came bundled with premium Google Drive plans, for many it was effectively "free." There were murmurings that it could even dethrone the big names that populate our guide to the best VPNs overall.

However, in April 2024, it was announced that the VPN was destined for the Google graveyard. By June, it was dead and buried.

As ZDNet reported, Google stated: "We're refocusing our efforts to support more in-demand features with Google One. To keep our subscription service fresh, we're discontinuing the VPN feature." In short, Google's reasoning was that people simply weren't using it.

But that was just a cover story.

A clash of philosophies

To understand Google VPN's issues, you have to look at the business model first. Effectively, Google is a data and advertising company. It makes money by tracking your searches, mapping your locations, and ultimately building a very specific profile around you to sell targeted ads.

However, VPNs are designed to stop exactly that. By encrypting your data, VPNs allow you to hide what you're doing from your internet provider, government, and any hackers on dodgy networks. By changing your IP address, they make it harder to build a profile from your activity. Naturally, people were skeptical of Google developing such a product.

To build trust, Google published white papers, open-sourced the apps, and even commissioned independent audits. For example, in its official technical white paper, Google laid out how hard it worked to protect your data, writing:

"By employing a cryptographic blind signing step between user authentication and connecting to the VPN, we give users a stronger guarantee that their network activity can't be tied back to their identity."

Cybersecurity firm NCC Group agreed, writing in its public report that it found the system to have "a robust implementation and a strong technical security posture."

The truth is that Google's VPN was very secure. But even with these stamps of approval, most of us struggled to look past the irony of asking an advertising giant to secure your web traffic. The audience looking for privacy didn't trust Google, and the audience that trusted Google didn't care about privacy.

A VPN limited by design

Perhaps more people trusted Google than I'm giving them credit for. But those that did use Google VPN found it was no match for established names like NordVPN, Proton VPN, or Mullvad. It couldn't compete because it only did half the job.

Most people want their VPN to change their virtual location. That might be to access regional sites like BBC iPlayer and watch more shows on Netflix, or maybe to avoid content restrictions in countries like Russia and China. Either way, it's a core feature of any good VPN.

However, even on its paid plan, Google VPN did not let you choose a country to connect to. Instead, when it was first launched, it only allocated you an IP address in your "broad" location. In reality, that often meant connecting to a server several states away. This ended up messing with things like weather reports and proved very annoying – especially for people who didn't really understand how VPNs work.

In 2023, Google addressed this by allowing you to use a "local" IP address nearer your real location, but there was still no true location choice. This decision was an absolute dealbreaker for millions of potential customers.

What's more, the app was seriously underpowered. It lacked things like protocol switching, dedicated IPs, port forwarding, obfuscation, or split tunneling. Plus, if you didn't have a Pixel phone, Google VPN didn’t even have a kill switch to block internet traffic if it crashed.

In short, it was half-baked. Anyone actively looking to buy a VPN realised pretty quickly that there were so many better options out there.

The fragmented ecosystem

You might have noticed that there are more than a few similarities between Google's VPN and another well-known privacy tool from a Big Tech company: Apple Private Relay. Really, they are – or were – exactly the same thing: a limited VPN bundled with cloud storage.

But there are a few key reasons why Google VPN failed spectacularly, and why Private Relay is still going strong. Buckle up – Google made all of this quite confusing.

There were in fact three different versions of Google VPN: Google One VPN (RIP), Google Fi Wireless VPN, and VPN by Google. The latter two still exist, both now called VPN by Google, but in reality they're two different bits of software. Notably, though, the now-dead Google One VPN was the only one available for anyone to buy. The others require Google hardware to use them.

Coverage at the time shows the disconnect. Initially, Google stated that it was shuttering the VPN because "people weren't using it." However, it was also announced that the VPN would live on in the form of the Pixel VPN. And that's not to mention Google Fi.

Confusing, right? Well, it doesn't stop there. If we consider each product separately, they all appear to have different purposes and different goals – and none seem properly integrated. Let's quickly have a look at these:

• Google One VPN: This is the one that died, the one I covered the most here at Tom's Guide, and probably the most-used version at the time. It was used as an incentive to convince users to buy more cloud storage, and the only version available without the purchase of a Google hardware product.
• Google Fi Wireless VPN: This VPN's purpose was to convince customers to switch their phone lines over to Google's cellular network, and was available with a Google Fi subscription.
• Pixel VPN: The Pixel VPN's goal was to increase physical phone sales. Essentially, Google wanted to offer perks to compete with the iPhone. This version was only available with the purchase of a Pixel 7 or newer phone.

Although there's no definitive proof, it appears that each team responsible for these three products was totally separate from the other. The three VPNs may even have run on completely different infrastructures.

Here's a clue that points that way: Google claims it shut down Google One VPN due to low usage – but this was arguably the most-used version of the three. If all three VPNs shared the same servers, why kill the most popular one for being underused, while Fi and Pixel carried on unaffected? It suggests, at the very least, that Google One VPN was built and run with little coordination with Google's other VPN ventures.

Even if we avoid conjecture entirely, the fact remains that in early 2024 you could own a Pixel phone, run it on Google Fi, and pay for a Google One cloud storage – meaning you'd have three different Google-branded VPNs competing for control over the exact same traffic.

Suffice to say, it seems Google wasn't quite as organised as you might expect one of the richest companies in the world to be.

The pivot to AI

Running a VPN is expensive. Thousands of servers in dozens of countries, tip-top security, and routing huge amounts of data takes a lot of cash.

For a company like NordVPN or ExpressVPN, these costs are justified because it's their entire business. For Google, it was a expense that wasn’t generating any revenue. No one was subscribing to Google One just for the VPN – it was just a "perk" that came with their cloud storage, which they probably didn't use.

Then, in early 2024, Google changed tack. AI was here. Google's CEO, Sundar Pichai, celebrated a massive milestone on X, but his words betrayed the future of Google:

The writing was on the wall. The future of Google's subscription business didn't include tools like a VPN. It was going to be driven by artificial intelligence – and there was no reason to maintain an unpopular product that didn't line the coffers.

Bottom line

Ultimately, the collapse of Google VPN proves that privacy can't be treated as an afterthought. A successful VPN needs more than solid engineering – it demands an overall philosophy that isn’t compromised by a business model based around advertising and data collection. Google didn't fail because it lacked the technology. It failed because it lacked the trust.

Then, when the AI boom hit, the VPN was first on the chopping block. Google could no longer justify maintaining an expensive and underused infrastructure that actively protected your data – the commodity most valued by the tech giant. By killing the VPN, it cleared the path for Gemini and showed us exactly where Big Tech’s priorities lie.

But, for us, this was a win. Consumers sent a message that they refused to compromise on trust just for the convenience of a cheap bundle. You voted with your wallets, and Google had to listen.

We have contacted Google for comment. We await their reply.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

As reported by BleepingComputer, the app in question serves as a means to infect vulnerable Apple computers with a new Mac info-stealer. While security researchers at Jamf first observed it back in May when it was still in development, this malware is now being actively used by cybercriminals in their attacks.

Dubbed CrashStealer, what makes this Mac malware strain so dangerous is the way in which it perfectly mimics Apple’s own macOS crash reports. Although something might seem off to more discerning users, others could easily fall for this attack given how much care and attention has gone into impersonating this legitimate tool.

Here’s everything you need to know about this new Mac malware and how you can keep your own MacBook and all the sensitive data it contains safe from hackers.

Impersonating a legitimate Apple utility

In their report, Jamf’s security researchers explain how the malware hides in plain sight by posing as a meeting platform called Werkbit. While they don’t go into details about the malware’s initial distribution method, a malicious app like this could be distributed via fake ads or on a developer-focused site like GitHub.

After downloading the app, it’s mounted on your desktop just like with any new software you download for your Mac. Surprisingly, though, the hackers behind this campaign are using a signed and Apple-notarized installer to distribute their fake app. Not only does this add a sense of legitimacy to the app but it also allows it to bypass Apple’s built-in Gatekeeper security feature without any warnings whatsoever.

When launched for the first time, the app displays a fake macOS password prompt that looks strikingly similar to what you’d see when downloading new software manually as opposed to through the Mac App Store. Once a victim puts in the password for their Mac, the hackers then have everything they need to unlock their Apple Keychain which acts as macOS’ encrypted password vault and contains all sorts of sensitive info like saved credentials in Safari, app passwords, Wi-Fi passwords and more.

The CrashStealer malware isn’t just limited to stealing from your Keychain though. It can also steal browser credentials and cookies from Chrome and other Chromium-based browsers as well as Firefox. Likewise, it can steal data from 80 different crypto wallet extensions and 14 of the best password managers including 1Password, LastPass, Dashlane and more.

To get all of this stolen data off your Mac, the malware encrypts it before packaging it into hidden ZIP archives and uploading it to a hacker-controlled C&C server.

By using a signed and notarized dropper and a re-signed payload, CrashStealer is a sophisticated Mac malware that’s especially good at avoiding detection.

How to stay safe from Mac malware

If you’re worried about CrashStealer and other Mac malware, the first thing you should do is to avoid sideloading apps, or in this case, installing new apps from anywhere besides the Mac App Store.

Just like on one of the best Android smartphones, when you download new apps from websites instead of an official app store, you’re putting your devices and the data they contain at risk. Apps submitted to the Mac App Store go through rigorous security checks while those you download from a random website don’t.

Normally when you download an unverified app from the web, macOS’s built-in Gatekeeper security feature will block it or warn you before you install it. In this case, though, that doesn’t happen since the installer used in this campaign is signed and appears to be legitimate. Well, at least in Gatekeeper’s eyes.

While Gatekeeper can keep you safe from most threats, there are ones like this that manage to bypass its defenses. For this reason, you might want to consider using one of the best Mac antivirus software solutions alongside Apple’s built-in ones. That way, if something slips past Apple, your third-party antivirus software will be able to stop the threat before it can do serious damage.

Since CrashStealer is still a relatively new Mac malware, this likely won’t be the last time we see it. This is why you always need to be extra careful when downloading and installing new software onto your Apple computer.

More from Tom’s Guide

• New PamStealer Mac malware poses as a clipboard manager to steal login info
• Apple’s ‘Hide My Email’ reportedly exposing real email addresses
• GTA 6 warning: Pre-order scams are stealing users' info and spreading malware

Security researchers from Kaspersky recently released a warning via email to Tom's Guide that cybercriminals are using the hype around GTA 6 to deploy a "wide range of fraud schemes." The most common scheme appears to be fake pre-order websites or false video tutorials on how to get the game.

"Highly anticipated game releases have long presented significant opportunities for cybercriminals, and we are already detecting related fraudulent activity," Olga Altukhova, a Senior Web Content Analyst at Kaspersky, said in the report. "These schemes are carefully timed to capitalize on heightened consumer excitement: attackers understand that periods of intense anticipation can lower users’ guard and create a false sense of urgency."

The fake sites utilize graphics and copy that mimic Rockstar's branding, including real trailers and promotional artwork. They offer gamers the ability to pre-order the game for the PS5 or Xbox.

Unfortunately, when users enter their personal details and payment information, it sets them up to potentially have their bank accounts drained and sensitive data compromised.

According to Kaspersky, the false pages have been found in multiple languages, which indicates that scammers are targeting unsuspecting people across the globe.

Other frauds to avoid

Fake websites aren't the only scam. At least one website was offering what it claimed to be a beta version of the game as a download framing it as a leak.

The false beta was promoted on social media and streaming platforms where scammers showed gamers how to "safely" download the game. Downloading and opening the file enabled malware to be installed on your system which could lead to compromised data and unauthorized access.

Finally, cryptocurrency owners are also being targeted via suspicious websites promoting tokens using GTA 6 branding.

How to safely pre-order and avoid scammers

As always, when it comes to software, whether games or programs, we always recommend you purchase or download from official sources.

GTA 6 is only launching on PS5 and Xbox Series S and X this November. If you're interested, purchase the game through the storefronts on your console of choice. Or you can go to the official Rockstar GTA 6 site and pre-order there.

Kaspersky recommends using a prepaid card when purchasing games to avoid exposing your credit card or bank account information. It's an extra step but good practice for keeping your financial information safe.

Even beyond of GTA 6, you should always double-check the URL formats of websites you're visiting, especially ones you're not familiar with. Also check the spelling of names and organizations where typos can reveal falsehoods.

Online scams often end up with nasty malware infections, so you want to keep your devices protected as well. Make sure that you're using the best antivirus software on your Windows PC, the best Mac antivirus software on your Apple computer, and one of the best Android antivirus apps on your Android smartphone

For even greater protection and help recovering any funds lost to scams, you may also want to consider signing up for one of the best identity theft protection services.

Finally, consider enabling multi-factor authentication and monitoring accounts regularly, which can help warn you about unauthorized access.

More from Tom's Guide

• 3 cloud gaming services I recommend if gaming platforms are too expensive
• Assassin’s Creed Black Flag Resynced is a remake done right — and the best pirate game I’ve ever played
• I grinded enough Microsoft reward points to get GTA 6 for free — here's how you can do it too

According to the IT firm Jamf (via ArsTechnica), the new malware, dubbed PamStealer, can get on your Mac in two stages. First, it disguises itself as Maccy, a clipboard manager.

Apparently, PamStealer is compiled as AppleScript written in Rust that uses the Pluggable Authentication Modules interface that is built into macOS to target the device's login password, which is then sent to an attacker-controlled server.

What makes PamStealer unique is that it combines AppleScript and disk images to stealthily enter your computer. When you click the AppleScript, it opens the macOS Script Editor where the malware is buried in the file.

"Rather than relying on shell commands such as curl or zsh, the AppleScript executes a self-contained JavaScript for Automation (JXA) downloader that retrieves and stages the payload using native Objective-C APIs," the Jamf team wrote. "Combined with a Rust-based second stage and a password capture workflow that validates credentials locally through PAM, the result is a quieter execution chain than we typically observe in commodity macOS stealers."

How PamStealer works

When someone installs the false Maccy and opens the disk image, they're prompted to enter Command-R immediately. Doing so executes the malicious code inside AppleScript. This allows it to bypass com.apple.quarantine, a normal macOS feature that offers warnings and restrictions when you're opening executable files from the internet.

The second stage is a Mach-O file specifically written for Macs running Apple M-series CPUs. Rust is apparently an uncommon code for macOS infostealers. This bundles SQLite and calls it read interface, meaning it opens and reads databases files directly.

PamStealer will pop up a native password prompt that is meant to resemble a system authorization request. It reads, "“Maccy wants to make changes. Enter your password to allow this.”

Once a password is entered, it's validated through the PAM API, meaning its harder for malware defenders to detect. Additionally, it can either give a malicious actor full disk access or inject code designed to access Ethereum accounts.

“Together, these behaviors illustrate how commodity macOS stealers continue to evolve, adopting quieter execution chains and native implementations that reduce traditional detection opportunities while remaining compatible with standard macOS features,” Jamf said.

How to stay safe from PamStealer

First and foremost, Maccy is a real, legitimate app that is quite popular. If you are interested in checking the app, the only real website is maccy.app.

Jamf found the fake Maccy was being hosted at maccyapp.com, a site you should not visit.

Secondly, it's a good reminder to double and triple-check website URLs. Specifically for macOS apps, you can also see if the app in question is available in the Apple App Store. Maccy, for instance, is in the App Store.

Apple is still a pretty closed garden so if you're looking for something and want to be sure it's real, I would recommend starting there before venturing into the hinterlands of the internet.

Beyond that, your Mac does come with built-in security software in the form of XProtect. But if you need some extra protection, it might be worth investing in one of the best Mac antivirus software solutions to run alongside it.

More from Tom's Guide

• Apple’s ‘Hide My Email’ reportedly exposing real email addresses
• What is Q-Day?
• 'Amazon put identity theft victims through a Kafkaesque ordeal': FTC issues $2.5 million fine over denying requests

For those unfamiliar, Hide My Email is one of the built-in perks that comes with a paid iCloud account. Once enabled, it masks your primary email address and replaces it with a randomly generated one that ends in @icloud.com. From there, Apple makes it easy to view any emails sent to that random address as they’re automatically forwarded to your main email address.

Think of Hide My Email as a fast-tracked way to get a burner email address from one of the biggest names in tech. And the best part, you don’t need one of the best iPhones to use this feature since even Android and Windows users can sign up for iCloud Plus.

From signing up for newsletters to free trials, Hide My Email can be an incredibly useful feature, especially for those times when you don’t want to use your work or personal email to avoid ending up with loads of spam in your inbox.

Personally, I always thought it seemed too good to be true and according to a new report from 404 Media, that just might be the case. Here’s everything you need to know about this new Hide My Email vulnerability along with some alternatives you might want to try out in the meantime until Apple finally rolls out a real patch for this major flaw.

Not your standard disclosure

Normally with high-profile vulnerabilities, security researchers discover them and then inform the company in question about their findings. Once this is done, they usually give companies a 90-day window to verify the bug, patch it, and test that their fix actually works. Sometimes though, companies might ask for an extension if they’re dealing with a difficult-to-patch, high-severity vulnerability.

According to 404 Media’s reporting, security researcher Tyler Murphy went above and beyond when reporting the Hide My Email vulnerability to Apple back in June of last year. Instead of 90 days, he reported the issue and showed how to replicate it to Apple over a year ago. After waiting all that time, Murphy has finally come out and disclosed the vulnerability to 404 Media.

It’s worth noting though that neither Murphy nor 404 Media have revealed the exact details of this major vulnerability. Apparently though, it’s still exploitable as the news outlet independently verified the flaw this week, uncovering their own reporter's real address using a hidden email alias.

After reporting the issue to Apple, the company told Murphy that it was looking into the vulnerability. From there, Cupertino said that it was fixed back in March of this year. However, during his follow-up investigation, Murphy discovered that it was still exploitable. He then contacted Apple about the vulnerability again, and Apple effectively begged him not to go public, stating they would "appreciate" him keeping quiet until an actual fix rolls out.

As it stands now, Hide My Email can reveal your real email address since a patch that actually fixes this bug hasn’t been released yet.

Hide My Email alternatives you can try right now

Given this is a major vulnerability that completely undermines Apple’s privacy-first focus, I guarantee that if the company wasn’t actively working on a fix, it absolutely is now. However, since your real email address could have been exposed as a result of this bug, you might be considering other alternatives.

Another reason you might want to ditch Hide My Email is due to an upcoming change Apple recently announced in a blog post. Instead of just providing you with a random email address ending in @icloud.com, going forward, all of your new burner email addresses will end with the dedicated @private.icloud.com subdomain. This might seem like a small change, but it’s actually quite a significant one. By switching to a unified, obvious subdomain, the very websites on which you previously used Hide My Email could soon start blocking your burner addresses automatically because they are so easy to identify. If you want to get ahead of that change, here are some alternatives worth considering.

Proton is well-known for its privacy-first tools, and just like Apple, it also has an email forwarding service called SimpleLogin. It’s considered one of the best alternatives to Hide My Email overall, and along with dedicated iOS and Android apps, it also works seamlessly in any web browser. Another cool feature is that you can instantly toggle your email aliases off with a single tap.

Another alternative worth considering is DuckDuckGo’s Email Protection. The privacy-focused search engine’s email alias service is both completely free and very lightweight. It’s built into both its browser extensions and mobile apps and generates a @duck.com email alias. Besides hiding your real email address, this alternative also strips out hidden ad trackers before forwarding replies from your email alias right to your real inbox.

Finally, there’s Mozilla’s Firefox Relay. It provides you with email aliases via a simple browser extension and has a user-friendly dashboard that lets you manage, mask, and delete your email aliases very easily.

Apple’s Hide My Email made email aliases mainstream and has been a godsend for many iCloud users. However, given this recent vulnerability and its potential fallout, no one would blame you for giving a similar service a try.

More from Tom's Guide

• 'Google is force-feeding AI with no way to opt ': DuckDuckGo CEO says installs are surging after Google I/O
• What are anti-censorship features and how is Proton VPN leading the way?
• We asked cybersecurity experts to build a privacy toolbox for $10 per month – here's what they came up with, and more

Per an FTC press release, a complaint was filed by the Department of Justice as a referral from the FTC. It alleged that Amazon failed to comply with Section 609(e) of the FCRA, which requires companies to provide victims of identity theft with records about transactions made in their name within 30 days of a consumer's request.

FTC accusations against Amazon

Amazon apparently did not have a written policy for responding to 609(e) requests until last year.

“Amazon often put identity theft victims through a Kafkaesque ordeal by demanding they identify the thief who stole their information before Amazon would release the records the law entitles them to—records that could help victims protect themselves and recover from the fraudulent conduct,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection said in the release.

The complaint claims that customers who reached out to Amazon were often told that the requested records could not be provided for "security" or "privacy" reasons. In one provided example, a consumer tried to get business records related to unauthorized charges from a fraudulent account. However, Amazon reportedly refused for security reasons unless the consumer "guessed the name on the [fraudulent] account," which they were unable to do.

Penalties and resolution

Alongside the $2.25 million civial penalty, the DOJ's proposed order requires Amazon to provide records lawfully requested by identity theft victims and law enforcement agencies. It also requires the company to provide notice to customers about how they can request FCRA records.

Additionally, Amazon is required to contact any customers who requested records since April 2024.

An Amazon spokesperson told Tom's Guide that it has implemented process improvements and resolved the matter with the FTC.

“We are committed to providing customers with their detailed account information when they need it most. We've resolved this matter with the FTC and have implemented process improvements for customers who believe they may be victims of identity theft. Customers who need assistance requesting their records can visit our Help Page to learn more."

How to contact Amazon for Identity Theft records

Amazon has a portal for Identity theft called "Report Suspicious Activity." There you can report unrecognized orders, chargers to your payment methods that aren't from your Amazon account and other unauthorized activity.

You can request records relating to fraudulent transactions via the Request Your Data portal. If that's not enough you can also send an email or physical mail:

By Email: fcra-requests@amazon.com

By Mail: Amazon Legal Department
Attn: FCRA Records Requests
P.O. Box 80161Seattle, WA 98108-9990

You will need to provide a copy of a government ID, a copy of a police report concerning identity theft, or a government-issued Identity Theft Report, found at IdentityTheft.gov. You'll also need relevant details about the fraudulent transaction and contact information so Amazon can reach out.

Amazon says that it will fulfill your requests within 30 days unless more information is needed.

More from Tom's Guide

• Amazon kills Fire Stick sideloading — apparently, malware and piracy are to blame
• Amazon has a hidden button that connects you with a real customer service agent — here's where to find it
• Still shopping blind on Amazon? This ChatGPT trick helps me avoid bad buys — and it works every time

Some computers have built-in antivirus software, for example, Window's Microsoft Defender. While this is great for baseline protection, if you want something more comprehensive with more customization, that's where the best antivirus software comes in.

To help you find the best antivirus software for your devices, we spent weeks installing, testing, and uninstalling all of the programs below while taking a close look at their features, extras, and design. We even reached out to customer support to see how easily each company was able to solve common and not so common problems.

Based on our extensive testing, research and the results from third-party labs, Norton 360 Deluxe is our pick for the best antivirus software overall. It’s easy to use and provides effective malware protection without significantly impacting your computer’s performance. You also get plenty of extra features you’ll actually use.

However, there are plenty of other great antivirus providers too, and in this guide we'll take your through all the options. Whether you’re looking to secure a single device or ensure your entire household is protected from the latest threats, this is the best antivirus software you can get right now.

The quick list

The best antivirus software you can buy today

The best antivirus software overall

Norton 360 is an antivirus that perfectly strikes the balance between usability and strong protection, with feature-packed plans that cover just about every cyber threat you could want to protect yourself from.

Norton 360 offers varying levels of protection, depending on which plan you go for. Its standard plan is its cheapest. It costs $42 for the first year and renews at $94, coming in a little cheaper than Bitdefender Total Security, which starts at $109. For this price, you can protect one device against malware, viruses, ransomware, and hackers. You also get Deepfake Protection, 10GB of cloud backup, Dark Web Monitoring, and a VPN.

Its most expensive tier, Norton 360 with LifeLock Select Plus, starts at $99 for the first year and renews at $189. For this price, you can protect up to 10 macOS, Windows, iOS, and Android devices, as well as getting access to features including Scam Protection Pro, 250GB cloud storage, Parental Control, Credit Monitoring Coverage, and up to $25,000 in stolen funds reimbursement, amongst some other extras. This includes SafeCam, which protects your webcam and microphone, and its backup tool Time Machine.

In independent testing, Norton 360 performed incredibly well. AV Test’s February 2026 report certified Norton 360 as a “Top Product” with a 6/6 score across Protection, Performance and Usability — the same score as both Bitdefender and McAfee.

Additionally, AV Comparatives’ April 2026 test, Norton 360 scored 90/100 in AVC, 94.7/100 in Procyon, and 5.3 in Impact. The lower the Impact score, the better, and Norton 360 outperformed Bitdefender, which scored a 9.6/10 in Impact. It was outperformed, however, by McAfee, which achieved a 3.3/10 in Impact.

Finally, in its UK April 2026 report, SE Labs awarded Norton 360’s macOS version an AAA rating with 100% protection accuracy, which is the highest possible rating.

On top of this, its low system impact means that you can run its scans in the background without disrupting your computer's performance, even if you're doing something that requires a lot of system load, like gaming. During testing, where I played Cyberpunk 2077 (Ultra graphics) with Norton 360 running in the background, system impact was minimal. Frames per second (fps) only dipped from 118 to 105 while doing a Full Scan of almost 900,000 files.

When it comes to its downsides, Norton 360 does have a couple. Some of its protection features (like SafeCam) are Windows-exclusive, while others are paywalled.

Additionally, in testing, I found Norton 360's Ask Genie AI assistant was a lot slower and more inconsistent than the AI assistants offered by competitors such as Avast One and Malwarebytes.

Still, regardless of these (relatively minor) shortcomings, Norton 360 is still one of the most dependable and feature-rich antivirus software suites on the market.

• Read our full Norton 360 review

The best antivirus software for features

Bitdefender is a great option if you want feature-heavy antimalware software, thanks to its range of plans for you to choose from.

Unlike Norton 360, however, it does not offer discounts for the first year of use. Its cheapest Consumer plan, Bitdefender Total Security, starts at $109; Bitdefender Premium Security costs $129; Bitdefender Ultimate Security retails for $159; and Bitdefender Ultimate Security Plus costs $189.

These plans all offer different levels of protection, with Total Security having the least security features, and Ultimate Security Plus having the most. Still, Total Security offers protection against malware, ransomware, and network threats, Advanced Threat Defense, which monitors active apps, Cryptomining Protection that fights against apps that you have no knowledge of, Anti-Phishing, Anti-Fraud, Antispam, and more.

For this review, I tested the Bitdefender Ultimate Security plan, which includes all this as well as email protection, Scam Protection Pro that fights sophisticated scams, Digital Identity Protection, as well as a VPN.

Bitdefender's independent testing scores were decent. It achieved 6/6 scores across Protection, Performance, and Usability in AV Test’s February 2026 report, the same as McAfee and Norton.

With this being said, its AV Comparatives’ April 2026 test results were not as good. This test uses benchmarking tools to assess system impact. It scored 85/100 in AVC, 95.4/100 in Procyon, and 9.6/10 in Impact. McAfee performed better with a 90 and 96.7 score respectively.

This was the only test Bitdefender slightly underperformed in, however. SE Labs (U.K.) gave Bitdefender an AAA (highest possible rating with a 100% protection accuracy.

Its protection doesn't hamper your computer's performance, either. I performed a full scan (of over 2.3 million files) while also running Cyberpunk 2077, and it only dipped from 100 fps to 97 fps.

If I could change a couple of things about it, it would be this: adding a Quick Scan option, and allowing its app window to be resizable on Windows. In the grand scheme of things, though, these are relatively minor complaints.

Overall, Bitdefender is a great bit of kit to have in your arsenal for giving you peace of mind against ever-evolving AI and malware threats.

• Read our full Bitdefender Total Security review

The best antivirus software for families

McAfee+ Ultimate is a welcome security package if you have many devices to protect, a big household, and a lot of family members. It does everything you’d want to protect your PC, Mac, or smartphone, and the package doesn’t limit how many devices you can use with your account.

In addition to an extremely powerful antivirus solution, you get features that help protect you (and your family) during your online activities as well. Among the many included features that come with McAfee+ Ultimate is a VPN (with no restrictions to a set file transfer limit), full access to a password manager, identity monitoring, a social media monitoring tool, a text scam detector, and more.

During testing, there were no performance problems during scanning. A full scan of 926K files took 35 minutes, which is the same time as Norton 360 Deluxe, although slightly slower than Bitdefender Total Security. McAfee+ Ultimate also offers options for a quick scan and a five-minute scan if you want to speed things up a little.

Some of the features offered, however, are available in Windows as free tools, like a file shredder and a clean up tool that removes temporary files.

McAfee+ Ultimate's pricing starts out pretty reasonable, usually around $49.99. However, you should keep in mind that after the first year, this price jumps up quite significantly to $149.99. So, if you don’t need many devices covered, it may not be worth the fee.

McAfee+ Ultimate offers an unlimited VPN, which is handy for those who want a VPN along with their antivirus. During testing, we found the unlimited VPN easy to configure and use. Additionally, its features, like the password manager, were easy to install and worked as expected.

McAfee+ Ultimate's antivirus protection scores in independent tests are outstanding overall, achieving a protection rate of 99.5% in AV-Comparatives' tests published in December 2025. Its false positives score was excellent too, on par with Bitdefender Total Security, and better than Norton 360 Deluxe, Malwarebytes Plus, and Avast Premium Security.

The main drawback here is the higher price point, although if you’re covering multiple devices, then you may find it worth it. Still, if you're after a budget antivirus, consider Malwarebytes Plus.

• Read our full McAfee+ Premium review

The best antivirus software for banking

Avast One offers not only excellent antimalware and antivirus protection, but also protection against AI-generated scams, deepfakes, suspicious texts and links, and more.

The biggest plus about Avast One is that it offers a completely free tier, which is great if you want to protect yourself without breaking the bank. This blocks viruses and malware and offers protection against ransomware, as well as allowing you access to Avast’s AI-powered assistant for catching scams.

On top of this, you also get a 60-day trial of SecureLine VPN. Extra features, like Scam Guardian Pro, AntiTrack, and firewall, can be activated from within the app. These are all paid add-ons, but the good news is that you can pick and choose which ones you need, instead of paying for an all-in-one package, such as the tiers offered by Bitdefender and Norton 360.

During testing, I used Avast Premium Security, which includes Wi-Fi protection, WebGuard, which uses AI to block scam websites, and Mail Shield, which monitors your email address for threats.

Avast was rated as a top product by AV Test’s February 2026 report, achieving a 6/6 score across Protection, Performance and Usability. In AV Comparatives’ April 2026 test report, Avast ranked 6th on the list, just under Norton 360, with a 90/100 AVC score, 94.5/100 Procyon score, and a 5.5 Impact score. Finally, it achieved the highest rating possible of AAAwith a 100% total accuracy percentage in SE Labs (U.K.) April 2026 report.

Unlike some competitors (like Bitdefender), Avast One offers a few different types of scans: Smart (quick), Full, Targeted (custom), and Boot-Time. I ran a Full Scan, which took 6 minutes and 12 seconds, which is a lot quicker thanBitdefender's full scan, which took 26 minutes and 23 seconds. However, Avast One doesn’t tell you how many files it has scanned, unlike Bitdefender.

I tested the impact of these scans by running Cyberpunk 2077 while running them and measuring the slowdown. During a Full Scan, Cyberpunk 2077 dropped from 99 fps to 96 fps, meaning the impact was barely noticeable at all.

However, if you're looking for antivirus protection for your family, you may be a bit disappointed to learn that Avast One does not feature built-in parental controls, unlike Bitdefender. Additionally, it can only protect up to 10 devices, meaning if you have more devices than this, it may not be suitable.

Still, if you want antivirus software that offers swift and diverse system scanning as well as modern AI threat analysis, Avast One is a great choice.

• Read our full Avast One review

The best budget antivirus software

Malwarebytes is user-friendly, excellent value for money and includes some great tools like an AI-driven Scam Guard and Digital Footprint Scanner to keep you safe from cyber threats.

As with the other antivirus software providers on this list, Malwarebytes has a range of different plans that cover various needs and requirements. It has three consumer plans, with its Standard plan available for $44 / £29 per year. This plan offers basic protection against malware, viruses, and more on one device only.

The next step up is the Plus plan, which costs $79 / £49 annually. It includes everything offered by Standard, plus a high-speed VPN and anonymous browsing.

Malwarebytes’ most expensive plan is called Ultimate in the U.S. ($279 per year) and Total in the U.K. (£129 per year). Regardless of what they are called, Ultimate and Total feature Advanced Social Media Monitoring as well as $1 million in identity insurance. While these are great features, this plan is pricier than both Bitdefender and Norton 360, although there are also various Family plans starting from $149 / £109 per year.

You don't have to fully commit off the bat, though. Malwarebytes offers a 60-day money-back guarantee — just like Norton 360.

One thing I did find slightly disappointing about these plans was that none of them offer cloud backup and storage or parental controls. If these are features you desperately want, you'd be better off checking out Bitdefender, Avast One, or Norton 360.

In independent testing, Malwarebytes performed decently. In AV Comparatives’ April 2026 test report Malwarebytes scored 75/100 in AVC, 97.4/100 in Procyon, and 17.6 in Impact. The Impact score is a little worrying, however, as it means that (on paper at least) Malwarebytes has a negative impact on your system resources. Bitdefender (9.6), Avast (5.5) and Norton 360 (5.3) all performed better than Malwarebytes in this area.

In SE Labs (U.K.) April 2026 report, Malwarebytes Premium was awarded an AAA rating with 97% protection accuracy. While this bad at all, it should be noted that Bitdefender, Norton 360 and Avast One are all rated 100% for their protection accuracy.

Malwarebytes offers three scan levels —Threat Scan (quick), Deep Scan (full), and Custom Scan (targeted). The quick scan option is nice to see, and gives it an edge over the likes of Bitdefender, which don't offer these options. In testing, its Threat Scan was completed within 22 seconds, having scanned over 176,000 files without detecting any anomalies or threats. Its Deep Scan took 14 minutes and two seconds to finish, and scanned a total of 427,157 files — a little less than Bitdefender, which scanned over two million files in 26 minutes.

To test its impact on system performance, I ran Cyberpunk 2077 while these scans ran in the background. Cyberpunk 2077’s frame rate dipped a fair bit, from 87 to 75. While this isn't the worst impact on performance, especially as I didn’t notice any stuttering or lag while playing the games, with Bitdefender I achieved 97fps in Cyberpunk 2077 with the software performing a Full Scan.

Overall, Malwarebytes is user-friendly and offers a great range of features to keep you and your devices safe and malware-free. However, it is lacking in a couple of key areas, and its system impact does leave a little to be desired.

• Read our full Malwarebytes Plus review

Also tested

We test a lot of apps when searching for the best antivirus software, but only a handful can reach the top spots. If you're after more options, here are some other great antivirus packages that didn't quite make the mark.