Facebook users started seeing more problems today, June 18, less than a week after users were unable to log into the social network.

Reports started to spike on DownDetector at 6:30 am ET / 11:20 am BST with over 1,000 users reporting problems. According to the reports, 80% of affected users claimed there was an issue the Facebook app loading.

Earlier this week, Facebook's parent company Meta experienced issues for around four hours that also impacted other services like Instagram and WhatsApp. Today's problems lasted little more than a couple of hours and seemed to affect primarily Android users. It could have been due to an update to Facebook's Android app that was released yesterday.

Here's how our coverage of the reports unfolded:

Full recap

Reports surge past 1,000 on DownDetector

Our clearest picture that there's some trouble at Facebook comes from the website DownDetector, which has suddenly shown a spike of over 1,000 users reporting trouble with the social network. Less than a week ago, similar problems hit Facebook for over four hours.

New York, Chicago and Dallas

Most of the reports of Facebook's troubles on DownDetector appear to be coming from three main cities: New York, Chicago and Dallas. If you're based in one of those regions and are having trouble accessing your Facebook profile right now — let us know!

Meta isn't reporting anything, yet

Meta doesn't have a status page for its consumer products, so we can't see if there's anything officially amiss, but it does run an equivalent for its business products. As we can see at the time of writing, there are no reported problems there.

So, if people are experiencing issues this morning, it may be a more localized problem and one that hasn't touched Meta's central nervous system yet. We'll keep circling back to this page and let you know if there are any updates.

Instagram and WhatsApp unaffected

While we're seeing reports spike across Facebook, there seemingly aren't any issues with Meta's other services at present. Instagram, WhatsApp, Facebook Messenger and Threads all appear to be working normally.

Facebook failing to load?

When issues started to occur for Facebook earlier in the week, users trying to access the app were bumped right out to the login screen of the app. This affected the app both on Android and iOS.

I'm based in London in the U.K. and — for me at least — the app appears to be working as normal. If you're seeing something different, let me know in the comments.

Reports are starting to slip

This could be little more than a blip for just a few folks. The reports on DownDetector — while still north of 1,000 — are starting to slip. Sometimes this can indicate the issues were only very temporary.

They could be a result of a small update or configuration change that's been pushed through by Meta that's caused a hiccup in servers along the network.

It could be an Android issue

Android users may be feeling today's Facebook problems more than iPhone users. One commentator on DownDetector says that the issue is persisting on their Samsung Galaxy Note 20.

If that's the case then it could be that the problems being reported today are specific to one particular app version rather than anything more widespread.

Reports falling, but users report problems on X

Reports are continuing to decrease sharply on DownDetector right now — falling down to below 800. Usually, if there are prolonged issues we would expect to see another small spike occurring right now but that hasn't happened.

Users are still reporting problems with the service over on X/Twitter. But this looks very much like it could just be a flash in the pan.

Are you having problems with Facebook this morning?

A problem we're seeing reported is that users are able to log into the Facebook mobile app for a few seconds before it then bounces them back out again to the login screen.

It seems like reports are starting to subside, so this might not be an ongoing problem but if you're experiencing an outage on Facebook today, let us know in the poll below. We'll continue to monitor the situation as it unfolds.

How to clear your Facebook cache

If these recent problems with Facebook have got you concerned about how the app is running, one thing you can do to juice up the performance is clear your cache.

Providing you can access Facebook's app, you'll need to tap Menu > Settings & Privacy > Settings. Then, under the Preferences section, tap Browser, then select Clear next to Cookies and Cache.

Less than 500 DownDetector users now reporting problems

Reports on DownDetector have now sunk to below 500 reports and there's been no official statement from Meta on any problems with its app.

A quick glance at the Play Store shows the Facebook Android app was given an update yesterday, June 17, so it's highly likely that it has caused some teething problems with Android users. Especially if those users own older devices. For the vast majority of Facebook users, it appears that the social network is operating as normal today.

Calling time on today's outage

We can call time on today's outage as reports have dwindled to under 100 on DownDetector, and the comments on social media have dried up. Unlike the outage earlier in the week, this one was just a blip. We can all rest comfortably now that Facebook is back up and running — thanks for reading along, everyone.

Starting around 9:30 am ET, multiple Meta services suddenly stopped working, including Instagram, Facebook, and Messenger. From what we can tell, WhatsApp, also owned by Meta, was not affected.

Initially, it was hard to track since the outage tracking site Downdetector appeared to be having issues as well. However, that resolved soon enough and we were able to see reports hit highs of 110,000 for Facebook, 15,000 for Messenger, and 10,000 for Instagram.

In total, the outage lasted for about four hours, though some services came back quicker than others. The Facebook and Messenger outage only lasted for an hour.

Instagram unfortunately took longer to resolve.

Meta doesn't have a specific status page for the three services, but there is one for the developers and business accounts. We were able to see "High Disruptions" in several parts, including Ads Manager. "We are aware of an issue that may be impacting ad delivery. Our engineering teams are aware and are actively looking to resolve the issue as quickly as possible," read the page.

Outside of the page, only Andy Stone, Meta's VP of Communications, made any kind of statement when he tweeted, "We're aware people are currently having trouble accessing our services. We're working on it." That was at 10 am ET. An hour later, he tweeted, "We're coming back, though it may take a bit of time for everything to be fully back to normal."

Otherwise, the company did not release a statement, and eventually things returned to normal around 1 pm Eastern.

Facebook, Instagram and Messenger are down — live outage updates

What's happening at Meta?

Meta services aren't working for many members of the Tom's Guide staff and we saw a spike in reports on Downdetector before the website stopped worked, so we're quite confident that something is off.

Meta acknowledges the issues

Facebook Ads manager is showing "High disruptions" as the status right now, which is a clean indication that something isn't right with the social network.

"We are aware of an issue that may be impacting ad delivery. Our engineering teams are aware and are actively looking to resolve the issue as quickly as possible," reads the Meta outage page.

Downdetector working?

It looks like Downdetector is back, which will make it a lot easier to keep track of this massive Meta outage.

Or is it?

When you click on a service on Downdetector, it's going to a 404 page. So while you can see the massive spikes in reports on the Downdetector homepage, we can't get any actual numbers.

What are users seeing?

Users trying to access Facebook right now aren't seeing much of anything. I just tried to log into my own profile and I was bumped right out to the login screen of the app. I tried to fire up the social network on both an Android phone and an iPhone and neither would load.

Are you having the same trouble? Let me know about it in the comments box below.

Meta's Status page is listing two incidents

When service outages like this happen, one of the best places to look for updates is the provider's own status check page. Unfortunately, Meta (which owns Instagram) doesn't have one for its consumer products.

However, there is a status page for its business tools, which does tell us the company is facing two incidents right now. Both Facebook Ads Manager and WhatsApp Business Platform are listed as facing "High Disruptions" while the rest of the company's services are apparently unaffected.

It's kind of working for me?

Sometimes, I can get Facebook and Instagram to load on my laptop and sometimes it just gives me a big Facebook and Instagram logo on a white page. There doesn't seem to be much predictability about it — sometimes I refresh and doesn't work and sometimes it does.

Hit the comments on this post and share your experiences with Meta services like Facebook, Instagram and Messenger and let us know what you're seeing and we might feature your comment in this live blog!

Now showing issues with all parts of Ads

Before, the Meta status page was only showing issues with serving ads, but now it's showing all three categories as having issues: Ads Creation and Editing, Ads Reporting and Ads Delivery all appear to be having problems, which is likely affecting Facebook and other platforms.

More Meta status issues popping up

Taking another dive into the Meta status page shows that more issues are popping up, now with Messenger. The Messenger API for Instagram and Messenger Platform are being reported as having "High Disruptions," which is obvious to anyone trying to use either service.

Still, it's nice to know that Meta is aware of the situation, though it hasn't offered a timeline for when we can expect things to be fixed.

Downdetector showing almost no reports

Downdetector is showing a giant drop in reports and then a small increase. Presumably, this is because no one could access Downdetector to report issues, but we'll keep monitoring to see if that's the case or if the outage is actually coming to a close.

Personally, I think it's the former, as Meta's status page is still showing everything being down, but we'll see.

Higher than they look

The visual graph is actually deceiving, as it looks like there are few reports at first glance. However, that's only because the peak was more than 100,000. Even with the dramatic decline, it's still at more than 12,000 reports.

Ad delivery fixed

Meta has apparently fixed Ad Delivery on its platforms. "We have recovered from an earlier outage impacting ad delivery across our platform, and services have now been restored. We apologize for any inconvenience that this may have caused," reads the status page.

'I can't access my profile'

According to a user on Downdetector, profile access is limited. "I can't access my profile, and I get an error "Unable to load" or something similar. I've tried both on mobile and PC, and I've also tried using the browser on my phone and computer. I still get the same error message," said user Brian Reid.

Instagram declining less

While the number of reports on Instagram didn't come anywhere close to the Facebook numbers, it didn't drop as much, either. It's currently still at more than 5,000 Downdetector reports.

Meta Business Suite joins the problem

Well, it looks like Meta Business Suite is the latest service to find itself on the Meta Status page. "We are aware that some people may be having trouble with messages in Inbox in Meta Business Suite. Our team is actively working to resolve the issue as quickly as possible," reads Meta's status page.

Like the other outages, Meta is working to resolve it, but there's no indication of how long it'll be down for.

Downdetector reports lower than they've been

Despite Downdetector working again for a little while, the reports are still trending downward, dropping by just over 4,000 as of this post.

Marketing and Graph API join

Marketing API and Graph API are now on the Meta Status page, showing as having "Medium Disruptions."

"We are recovering from an earlier outage impacting editing and creation for Marketing API, and services are in the process of being restored. We apologize for any inconvenience that this may have caused," says the status page.

Instagram is the highest

Currently, Instagram is the highest in terms of raw reports at 4,860. Facebook has dropped to around 2,400 and is down to just over 600.

"May take a bit of time" to get back to normal

Meta's Andy Stone said that everything is coming back about an hour ago.

"We're coming back, though it may take a bit of time for everything to be fully back to normal," Stone posted.

That does appear correct, as Facebook seems to have recovered. However, Instagram still seems to be having issues.

Reports take a steep dive

Starting around 9:00 am PT, reports on Down Detector started to decline but in the last 15 or minutes or so they've taken a steep dive.

As of this posting, I'm seeing 1500 reports, down from the steadier 5,000 earlier and the peak of 10,000 reports around 7:00 am PT.

Resolving issues

Meta doesn't really have a status page for Instagram or Facebook that we can use to get updates on what's happening with the social platforms.

However, the company does have a business status page for advertisers and developers that we can use to infer how things are going.

For example, previously, Facebook Ads was showing High Disruptions, but now it reads resolved.

That said, the developer platform is showing more issues but seems to be affecting more background APIs and business accounts.

Meta has remained mostly quiet

Beyond the two tweets from Meta's Andy Stone, the company has largely remained quiet about the outage.

And since Stone said the company was working on it he has also gone silent.

Fortunately, I suppose, it appears things are getting to normal.

Meta outage appears to be over

With reports finally under 500 reports for the first time today, it finally appears that the Instagram and Facebook outages are have pretty much resolved.

The Meta developer status page is basically green across the board.

Anecdotally, I've been able to access Instagram and Facebook fairly consistently for the last 15 minutes or so.

I will keep an eye on things for a little bit longer, but I am going to call it for now.

Think your private photos are safe on social media? You might want to rethink that as a former Meta engineer is currently under criminal investigation after it was discovered he secretly downloaded 30,000 private images from Facebook.

As reported by The Guardian, the employee in question allegedly created a script that allowed him to access Facebook users’ private photos while avoiding Meta’s internal security checks. While the incident itself occurred more than a year ago, details about it are just now coming to light as a result of the UK’s criminal investigation by the Metropolitan Police’s Cybercrime Unit.

After discovering the security breach, the engineer was fired, Meta upgraded its security systems and then handed things over to the police in the UK. The engineer was reportedly arrested in November 2025 and is currently on bail until May 2026. Likewise, affected Facebook users whose private photos were downloaded without their knowledge have also been notified.

As Cybernews points out, the former Meta engineer’s intent hasn’t been disclosed yet nor has the script he created to download private Facebook images without rousing suspicion. It’s also unclear as to whether or not he shared the code with others before leaving the company.

How to stay safe on social media

Just like when we discovered that Chrome’s incognito mode was never really private, this incident could be a wake-up call for how you use Facebook and other social media platforms. Yes, your photos are technically private but if an employee can pull off something like this, there’s still a chance that your pictures could end up in the wrong hands.

As such, you want to be extra careful when posting anything on social media. In the same way that you would with a public post, you should think twice before posting private photos online. Once an image is on another company’s servers, it could be made public either through an incident like this one or as the result of a data breach.

If you’re worried about your private photos being stolen and made public, then you might want to consider self-hosting them instead. While you can use one of the best cloud storage services to share your photos securely, you could also store them on a NAS device (network attached storage) and then share them that way as well.

Given what’s in your private photos, they could be misused to commit blackmail, make deepfakes or even be used in other cybercrimes. This is why you might want to consider investing in one of the best identity theft protection services. Although this isn’t a traditional case of identity theft, the cyber insurance these services provide can often be used to recover lost funds, especially if their terms cover modern threats like cyber extortion or reputational harm.

As a general rule, it’s always best to keep the old adage in mind that once something is on the internet, it’s there for good. Before you upload pictures privately on Facebook or any other social networking site, you first want to consider what would happen if those pics got out.

We could find out more about the exact tactics used by this ex-Meta engineer once this case goes to trial, but for now, this cautionary tale is an excellent reason to think twice before you post anything online.

More from Tom's Guide

• Your iPhone has a secret photo vault to keep pictures hidden — here's how to use it
• These are the best photo storage and sharing sites right now
• I used Meta AI to enhance my selfies — here's how to try it

In 2026, Microsoft is once again in a top spot — but not on a list that the company would want to land on. Once again, the software giant is listed as a top brand used in phishing attacks by scammers.

This makes it the second year in a row for Microsoft, even though last year’s results came from Check Point researchers, while this year’s list was published by Guardio Labs. Previously, Guardio had Facebook in the No. 1 spot, with the social media site finishing second behind Microsoft this time around; Roblox takes third place, and you'll find the top 10 below.

Guardio researchers found that the phishing activity surged heavily at the end of 2025 — unsurprisingly, as attackers often choose times when people are most distracted or overwhelmed. Phishing is a technique that relies on victims to be busy, unaware and to rely on brand trust. The end of the year is when people are often online for more hours, shopping, renewing subscriptions and performing business tasks like end-of-the-year reviews. This extends even into January, when people are more likely to begin job hunting.

Microsoft makes for a particularly attractive target, as it offers a vast ecosystem of software: email, cloud storage, enterprise services and more. That means attackers have a wide array of ways to reach victims. Worse still, it means that once attackers have compromised one account they’ll have access to the whole suite and all the other files, systems, email and cloud accounts tied to it.

AI has also assisted hackers in making increasingly convincing fake login pages, phony security alerts and malicious billing notices that are nearly indistinguishable from the legitimate ones sent by Microsoft and other companies. Phishing kits also have grown more useful — not only do they offer malware services capable of stealing passwords, but they now can also take session cookies and multi-factor authentication tokens as well.

Guardio researchers raised concerns about the addition of Roblox to the list of phishing attacks. With the game already suffering so many security related issues, youth-targeted fraud is just another problem on the list.

Younger players are much less savvy about security and phishing attempts that promise free in-game currency and exclusive items or that send fake suspension warnings are more likely to get clicked on by teenagers or kids who cannot tell a scam attempt from a legitimate communication.

Ten most impersonated companies in phishing attacks in 2025

1. Microsoft
2. Facebook
3. Roblox
4. McAfee
5. Steam
6. AT&T
7. Amazon
8. Google
9. Yahoo
10. Coinbase

How to stay safe from phishing attacks

Here are the phishing rules that we live by: don’t trust any email you receive that says there’s an issue with your account. Watch out for phishing lures — if an email is trying to instill a sense of urgency or pressure you to do something like resetting a password or “fixing” a problem with an account.

Always find an independent way to log in to verify a potential problem, like going directly to the web address in your browser to check your account or messages. If you receive something suspicious in text or email, search the phone numbers and email addresses to verify the contact information. You should also hover over links to see where they redirect to as well.

Never click on or download anything that appears in an unexpected email, and don’t respond either, as doing so shows scammers that they’re interacting with an active phone number or email account. Additionally, make sure that you enable two-factor authentication (2FA) to add an extra layer of security for your online accounts to prevent scammers from accessing them if they do manage to steal your credentials.

Of course, you'll also want to protect all your devices with one of the best antivirus programs on your computer, tablet and smartphone. You also want to make sure that you're familiar with all of its features that can help you stay safe online like a VPN or a hardened browser.

More from Tom's Guide

• New California regulations help delete your personal information off the internet – here’s what to know
• People are the password problem: How you're creating your biggest security risks
• Nearly 500,000 patients hit in massive healthcare data breach — everything you need to know

VPN usage dramatically increased in Nepal following a government imposed social media ban.

Proton VPN, one of the best VPNs, reported a sign-up increase of 8,000% over the baseline. This came as the Nepalese government blocked access to 26 social media apps.

Reports indicated Instagram, WhatsApp, Facebook, and X all went offline, with the shutdown first occurring on Thursday, September 4.

The move sparked huge mass protests in Nepal's capital Kathmandu, mostly made up of young people. As of September 9, 21 protesters had been killed and hundreds injured.

Following the Prime Minister's resignation, it appears as though the social media ban has now been lifted – but anger, and the troubling rise of internet restriction, remains.

Cracking down on misuse

Social media apps were blocked after failing to register with the authorities. Nepal's government cited misuse as their reasons for the ban.

As reported by Reuters, the government said false social media accounts were "spreading hatred and rumors, committing cyber crime, and disturbing social harmony." Tackling hate speech, online fraud, and fake news were also given as reasons.

Internet usage in Nepal is high, with around 90% of the population having access.

Social media companies were required to register with the Ministry of Communications and Information Technology, as well as naming a "local contact, grievance handler, and person responsible for self-regulation."

Those who didn't comply would be shut down, and on Thursday, September 4, the Nepal Telecommunications Authority (NTA) regulator received a government order to deactivate unregistered social media apps.

TikTok and Viber are two apps said to have registered, whereas Facebook, Instagram, X, and WhatsApp were not. Nepal's government believed companies were given enough time to register.

Mass protests erupted following the ban, as demonstrators expressed their anger at the social media crackdown and perceived government corruption. Various government buildings, including parliament, have been targeted in Kathmandu and Nepal's Prime Minister, Khadga Prasad Sharma Oli, resigned on Tuesday, September 9.

Amid the protests, VPN sign-ups have rocketed. Proton VPN, via the Proton VPN Observatory, recorded usage initially rising to 500% over the baseline, before accelerating to 6,000% in just three days.

At the time of writing, the figure is 8,000% over the baseline. But it is unclear whether this number will drop or remain high in the wake of the ban's lifting.

Proton VPN has a host of dedicated anti-censorship features, including its free VPN offering Proton VPN Free. Other features include Guest Mode, discreet app icons, and its Stealth protocol – which provides VPN obfuscation.

In a tweet describing its VPN spike, Proton VPN warned those affected by government censorship to "stay away" from VPNs with potential links to China. These VPNs can be dangerous and Proton VPN warned "they only serve to harvest your data."

Tom's Guide reported on research by the Tech Transparency Project (TTP) back in April 2025, listing 20 VPNs that posed a risk to your data. These apps were found on the Apple App Store and Google Play Store and some were still there in June 2025, two months after being discovered.

Further investigations into these apps found that many were connected. 18 apps were found to share data and even security flaws. Code, IP addresses, VPN protocols, and ownership were some examples of similarities.

Whether it's a paid VPN or a free VPN, your chosen provider needs to be reputable and secure. This is even more important with free VPNs, as harvesting and selling your data is what can make these providers money.

Only the best free VPNs – including Proton VPN Free – are genuinely safe free VPNs and almost all other providers should be avoided.

Nepal's history of internet restrictions

This is not the first case of online restrictions in Nepal. In 2023 a directive required social media companies to register and establish a local presence – it appears as these rules have been the catalyst for this month's bans.

According to Al-Jazeera, Telegram was blocked in July, with the government citing a rise in online fraud and money laundering.

A ban on TikTok was lifted after nine months in August 2024 after the company agreed to comply with the government's regulations.

Despite the ban seemingly being lifted, Nepal's actions are another troubling example of the increased tightening of online freedoms for millions around the world. In recent months, we have seen incidents in Pakistan, Russia, Myanmar, mainland Europe, and even the UK.

24 cases of internet restrictions occurred in the first six months of 2025 and there are no signs of this slowing down.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Meta has quietly introduced new settings that allow Facebook to analyze photos in your camera roll, even ones you've never posted or shared. They claim these "camera roll sharing suggestions" provide AI-powered recommendations like travel highlights, collages, and themed albums based on your private photos.

While Meta insists these features are opt-in only and not enabled by default, numerous users report discovering the settings already turned on in their Facebook apps without any memory of agreeing to them.

This confusion highlights the importance of checking your privacy settings and understanding exactly what permissions you've granted. Here's how to check if Meta is accessing your camera roll on Facebook and opt out if needed.

More from Tom's Guide

• I used Meta AI to enhance my selfies — here's how to try it
• I tested Meta AI vs Perplexity AI with 7 prompts — here’s the winner
• 7 hacks to get more out of WhatsApp using Meta AI

Photos on your phone could be analyzed by Meta AI on Facebook without your knowledge and despite people opting out, the scanning could be toggled on.

Back in June, Meta announced a new feature (via TechCrunch) meant to automatically suggest AI-edited photos such as "personalized creative ideas, like travel highlights and collages" — including ones that you haven't uploaded to Facebook. The tested "cloud processing" tool is supposed to ask you to opt in via a prompt when you attempt to create a new Story on Facebook.

Since it's a test though, not everyone may have received the prompt, but it seems (via ZDNet) that the feature is rolling out to more Facebook accounts. Some people have claimed the prompt never popped up but the feature was switched on.

If you did see the prompt, toggling it on, has you agree to Meta's AI Terms of Service which permits it to analyze "media and facial features."

That analysis uses your images, including dates, people, and objects, to suggest posts like collages, stories and albums. Meta has claimed that the scan won't be used for targeted advertising.

Either way, it's a serious privacy concern whether you've opted-in or not.

How to turn AI scanning off in Facebook

My personal Facebook account, which I have pretty locked down and rarely use, does not appear to have the cloud processing feature enabled. You may not either, but you should know how to turn it off when it does come to your account.

• Open the Facebook app
  • You can find the appropriate settings in the Facebook app.
• Go to Menu - Settings and Privacy
  • Find the hamburger menu with three stacked lines. Once you've clicked that, find the Gear icon for settings.
• Go to Camera roll sharing suggestions
  • This category should be in the Preferences section of the settings menu.
  • If you have the new scanning feature you should see two toggles:
  • Get camara roll suggestions when you're browsing Facebook and Get creative ideas made for you by allowing camera roll cloud processing.
  • If it's on, then the toggle will be blue. Tap it to turn the feature off and it should turn gray.

It's unclear how long Meta's testing is going to take or when the feature will roll out to every Facebook user.

From our understanding, the feature pulls from the last 30 days of images and is only available on the iPhone and Android app versions of Facebook. Meta claims your data is removed from the cloud after 30 days. The company has also said that any AI suggestions are only visible to you.

Still, if you're concerned with data privacy and security, don't let Meta have access in the first place.

More from Tom's Guide

• Meta's new cutting-edge smart glasses tipped to launch in September — here's what we know
• Meta AI chatbots gave false medical advice and flirted with minors — now the company is restructuring its AI division again
• Meta's smartwatch with camera is reportedly being revived — and it could launch this September to work alongside new smart glasses

With over 180.5 million monthly active users and nearly 2.5 billion prompts per day, OpenAI recently revealed it is optimizing ChatGPT to help, not hook.

In a new blog post titled “What we’re optimizing ChatGPT for,” OpenAI revealed it’s moving away from traditional engagement metrics like time spent chatting. Instead, the company says it’s now prioritizing user satisfaction, task completion and overall usefulness.

This is an unconventional stance, as apps like TikTok, Meta, and similar Silicon Valley companies strive to keep users tied to their screens.

“We’re not trying to maximize the time you spend with ChatGPT,” OpenAI wrote. “We want you to use it when it’s helpful, and not use it when it isn’t.”

Less stickiness, more usefulness

While many platforms chase user attention, often with addictive features, OpenAI says it’s focused on building a helpful assistant that respects your time.

That means ChatGPT won’t be trying to keep you talking just for the sake of it. Instead, it’s being shaped into a tool that helps you solve problems, learn something new or complete a task, and then get on with your day.

This approach mirrors recent updates like Study Mode and ChatGPT Agent, both of which are designed to get things done rather than entertain. Together, they reflect OpenAI’s growing focus on goal-oriented AI over engagement-first design.

AI that helps, not hooks

Rather than acting like a social app that wants you to linger, OpenAI says ChatGPT is being tuned to behave more like a true assistant that offers answers, structure and support without dragging you into an endless chat spiral.

Behind the scenes, OpenAI says it’s incorporating feedback from its Superalignment and Preparedness teams, along with trust and safety evaluations, to ensure the assistant is more transparent, less sycophantic and better at knowing when to be concise.

OpenAI also acknowledges that people use ChatGPT in different ways; some want speed, others want depth; some prefer playful conversation, others want straight answers.

The goal is to improve default settings while still allowing user customization, just not at the cost of clarity or mental load.

What it means for you

If you use ChatGPT for studying, writing, planning or productivity, you may soon notice:

• More focused replies
• Less chatty filler or small talk
• Smarter task completion and summaries
• Shorter, more efficient interactions when needed

The takeaway

More from Tom's Guide

• ChatGPT-5 launch live blog: All the big news as it happens
• I tested GPT-5 vs GPT-4 with 7 prompts — here’s which one gave better answers
• Character.AI just launched an AI-powered social feed — and it’s like TikTok meets ChatGPT

Elon Musk’s social media platform X is taking initiative when it comes to fighting misinformation: it’s giving artificial intelligence the power to write Community Notes; those are the fact-checking blurbs that add context to viral posts.

And while humans still get the final say, this shift could change how truth is policed online.

Here’s what’s happening, and why it matters to anyone who scrolls X (formerly Twitter).

What’s actually changing?

X is currently piloting a program that lets AI bots draft Community Notes. Third-party developers can apply to build these bots, and if the AI passes a series of “practice note” tests, it may be allowed to submit real-time fact-checking content to public posts.

Human review isn’t going away. Before a note appears on a post, it still needs to be rated “helpful” by a diverse group of real users and given proper oversight. That’s how X’s Community Notes system has worked from the start, and it remains in place even with bots in the mix (for now).

The goal is speed and scale. Right now, hundreds of human-written notes are published daily.

But AI could push that number much higher, especially during major news events when misleading posts spread faster than humans can keep up.

Why this move matters

Can we trust AI to handle accuracy? Yes, bots can flag misinformation fast, but generative AI is far from perfect. Language models can hallucinate, misinterpret tone, or misquote sources. That’s why the human voting layer is so important. Still, if the volume of AI-drafted notes overwhelms reviewers, bad information could slip through.

X isn’t the only platform using community-based fact-checking. Reddit, Facebook and TikTok have also explored similar systems.

But automating the writing of those notes is a first, opening up a bigger question about whether we are ready to hand over our trust in bots.

Musk has publicly criticized the system when it clashes with his views. Letting AI into the process raises the stakes: it could supercharge the fight against misinformation, or become a new vector for bias and error.

When does this go live and will it actually work?

The AI Notes feature is still in testing mode, but X says it could roll out later this month.

For this to work, transparency is key, with a hybrid approach of human and bot working together. One of the strengths of Community Notes is that they don’t feel condescending or corporate. AI could change that.

Studies show that Community Notes reduce the spread of misinformation by as much as 60%. But speed has always been a challenge. This hybrid approach, AI for scale, humans for oversight, could strike a new balance.

Bottom line

X is trying something no other major platform has attempted: scaling context with AI, without (fully) removing the human element.

If it succeeds, it could become a new model for how truth is maintained online. If it fails, it could flood the platform with confusing or biased notes.

Either way, this is a glimpse into the future of what information looks like in your feed and encourages asking the question of how much you can trust AI.

More from Tom's Guide

• I trust AI with my job, my schedule and my inbox — but I’ll never use it for this
• These 5 prompt upgrades took my AI videos from basic to cinematic
• I used these 5 ChatGPT prompts to uncover early Prime Day deals before everyone else

The news of a massive 16 billion data breach that exposed login credentials from Apple, Google, Facebook has made record as one of the largest data breaches in history.

Cybernews reports that records from over 30 databases have been stolen, with each containing up to 3.5 billion passwords from social media and VPN logins to corporate platforms and developer platforms.

The recent data breach contains a massive amount of information that can affect billions of online account, as cybercriminals now have access to a mass amount of login credentials. This puts users at risk of further malicious behavior from phishing attacks, social engineering and identity theft.

Here are the latest updates on what we know about the data breach, how to find out if you're affected and how to stay safe.

What's exposed?

Currently, nearly all major platforms have been affected by the breach, including Apple accounts (formerly Apple IDs), Gmail, Facebook accounts and GitHub as well as instant messaging platforms like Telegram and both commercial and government platform portals.

The data appears to contain URLs, usernames and passwords. However, with the unfathomable size of the data that's been exposed, there's no way to tell how many accounts are currently under threat.

The stolen data appears to come from several infostealers, and while the datasets are new, the sheer amount of info could also be from a mix of different datasets from previous breaches, including a database containing 184 million records discovered in May this year.

How to stay safe

With the 16 billion login credentials now being exposed, it's important to check if your account has been exposed and to stay safe.

First, the best way to keep your account secure is to enable two-factor authentication (2FA). This will stop threat actors from easily accessing your online accounts, as a second form of authentication through an app, phone, passcode or a physical USB key will need to be approved by you. If you haven't already, find out how to enable 2FA right now.

Second, to find out if your login credentials have been affected, use Have I Been Pwned and check if your email is in the clear. If you are at risk, immediately change your password, delete unused accounts and consider using one of the best password managers to secure your online accounts.

Latest updates

What's happening now

Security researchers have identified what they call "one of the largest data breaches in history", which includes more than 16 billion logins that include Apple credentials. According to a report from Cybernews, the staggering amount of information is contained in numerous datasets that have been uncovered since the start of the year.

So far, the researchers have discovered 30 datasets, each containing up to 3.5 billion records. This includes everything from social media and VPN logins to corporate platforms and developer platforms.

“This is not just a leak — it’s a blueprint for mass exploitation," the researchers told Cybernews.

Find out if you're affected

The easiest way to find out if your email and password are affected in this mass data breach is to use Have I Been Pwned. It's a free service that collates data from hacks and can also send you alerts when your online account is at risk.

The site will notify you if your email is involved in the breach, and you can also check if your password has been exposed through Pwned Passwords.

You can do a manual check right on the site, but we also recommend using the Notify Me service to make sure your accounts aren't affected in the future, too.

Change your passwords

With 16 billion login credentials being exposed, there's a big chance that your account is at risk. If left unchecked, cybercriminals can gain access to your accounts, leading to phishing attacks, identity theft, ransomware and more.

To counter this, change your passwords immediately, especially if you reuse passwords for multiple accounts. It's a good idea to use a strong, complex password with a mix of numbers and symbols, and use PasswordMonster’s Password Strength Meter to see how effective it is.

To manage it all, it's a good idea to use one of the best password managers, as these will store, secure and autofill your passwords, and they also support passkeys across accounts.

Cybersecurity expert weighs in

We reached out to security researcher and owner of SecurityDiscovery.com Volodymyr Diachenko, about the data breach, who explains that it wasn't just from one infostealer malware, but many:

"First things first — it wasn't a single source of exposure. This is not about the number (though it is scary!), but the scale and rise of infostealers infections these days," Diachenko states.

"What this number reflects is the size of different infostealers datasets exposed publicly since the beginning of this year alone. They were observed by me and my team via passwordless repositories left exposed inadvertently."

The data breach is known to have come from various infostealers.

Infostealer malware is to blame

As per reports, infostealers are what caused the exposure of login credentials. This is a form of malware that can secretly steal sensitive data like passwords or chat logs and send them back to hackers.

Cybersecurity expert Diachenko states: "It comes from various infostealers logs. Probably a backend infrastructure left exposed. Elasticsearch is a good environment to query such logs."

Data breach only exposed 'briefly'

While this is named the largest data breach in history, the 16 billion login credentials were only exposed "briefly," according to researchers in the Cybernews report. However, it's still long enough for threat actors to gain information and to put accounts at risk.

"The only silver lining here is that all of the datasets were exposed only briefly: long enough for researchers to uncover them, but not long enough to find who was controlling vast amounts of data," Cybernews states.

Along with this, out of the 30 datasets discovered, the majority of these were temporarily accessible through Elasticsearch, which is a free and open-source search engine, or "object storage instances."

Google warned users to replace passwords

Earlier this month, Google released a survey detailing the growing awareness of the threat from scams in the U.S., stating that over 60% of users in the U.S. have seen an increase in scams over the past year. While many have seen scams through SMS texts, 61% state they have been targeted through emails.

Plus, the survey notes that one-third of those experiencing an increase in scams have "personally experienced a data breach." What's more, the FBI also states that online scams have seen a 33% rise last year, with a total of $16.6 billion being stolen.

In light of this data breach, there could be a major rise in phishing scams or account takeovers. This is why Google has warned users to change their passwords and rely on other forms of authentication, including passkeys.

Were Apple, Google and Facebook passwords leaked?

The datasets with exposed login credentials contained old and recent infostealer logs, and as Diachenko points out: "Credentials we’ve seen in infostealer logs contained login URLs to Apple, Facebook, and Google login pages.”

Many of the data sets contained other specific information. One dataset was named after Telegram with 60 million records, another was labeled with a name relating to the Russian Federation with 455 million records and one with the largest amount of records at 3.5 billion is said to have a connection to a Portuguese-speaking population, as Cybernews reports.

However, many datasets were also simply named "logins" and "credentials" with massive amounts of information. There's no way to tell what services these are for, and considering the billions of credentials leaked, there's reason to believe that accounts for any platform online are at risk.

How to stay safe from infostealing malware

With infostealers being the cause of the mass data breach, it's best to know how to keep your PC secure from the malware.

• Trusted downloads: Only download software through legitimate websites and sources.
• Stay clear of suspicious emails: Never click on unexpected links or attachments. Make sure you know the signs of phishing emails.
• Update your system: Whether it's on your iPhone, Android phone, Windows laptop or MacBook, keep your system up to date with the latest security patches to stay secure.
• Use a VPN: Virtual private networks can mask your identity online, making it harder for threat actors to track you down. Be sure to use one of the best VPNs.
• Download antivirus software: This can keep many forms of malware at bay, including known infostealers. You can check out the best antivirus software for your system.
• Enable 2FA: In case your login credentials are caught in the data breach, enabling two-factor authentication will make it harder for cybercriminals to access your online accounts.

Record-breaking data breach?

We've seen major data breaches before, including the RockYou2024 leak exposing nearly 10 billion passwords with a mix of old and new records, along with the previous RockYou2021, which kicked off with 8.4 billion passwords.

Recently, the largest ever data leak hit China and exposed more than 4 billion user records. This breach included financial data, WeChat and Alipay details as well as sensitive personal info like IDs, birthdates, phone numbers, and residential data.

This 16 billion password data breach is one of the largest in history, but last year we reported on the supermassive Mother of all Breaches (MOAB), which contained 26 billion records or 13 terabytes of data taken from previous leaks, breaches and hacked databases.

Follow these steps to prevent getting hacked

Data breaches aren't anything new, and one of our team has been hacked before. This was due to Adobe being hacked and the attackers getting a list of 153 million usernames and passwords in 2013.

If you're worried about the 16 billion data breach, you can find out the best steps to take to prevent being hacked and improve your online security.

Some essential tips include signing up for Have I Been Pwned, staying clear of reusing passwords, deleting unused accounts and making sure to enable two-factor authentication.

An alternative security option

Many companies, including Google, Apple, and Microsoft, are using passkeys to reduce the growing risk of phishing attempts, as login credentials in data breaches that cybercriminals use can lead to account takeovers. In fact, Microsoft is now making passwordless the default for new users.

Niall McConachie, regional director (UK & Ireland) at Yubico (the company behind the YubiKey), reached out to weigh in on the data breach:

“As this huge data breach shows, passwords are just not good enough to protect our most important personal details and secure our online presence," McConachie states. "By continuing to rely on passwords, huge data breaches like this will persist — and they’ll only get worse.

McConachie continues: "As we rely on the internet more and more for critical services, users should opt for the highest-assurance authentication method to ensure their data is fully protected and not at risk of being accessed by cyber criminals.

“Instead of relying on passwords or legacy MFA to keep accounts safe, users must be encouraged to protect their accounts with device-bound passkey options like physical security keys."

Update: Cybernews shares datasets with Apple, Google, Facebook and more URLs

Since news broke about the data breach, it's been difficult to tell if login credentials included accounts from Apple, Google, Facebook and more. But Cybernews has now shared screenshots of the datasets (not including personal info, of course).

These datasets show that there are URLs to Facebook, Google, Github, Zoom, Twitch, and other login pages. However, with the amount of data that is being exposed, the number of platforms that are affected is uncertain. As previously noted, there's reason to believe that every major platform has been affected by the data breach.

The data breach isn't all "new"

A recent report from cybersecurity site BleepingComputer indicates the 16 billion password data breach actually isn't new, with the data instead likely to have been circulating for years.

The data may have been collected by cybercriminals and researchers and repackaged into the massive database, only for this to be exposed online. The infostealers involved in compiling the login credentials, such as usernames and passwords, may have been collected over time, with different archives being into the massive database.

Cybernews states that the data in the breach is recent and "not merely recycled from old breaches," but some data could be overlapping.

Either way, many credentials were exposed in the breach, so it's a good idea to secure your accounts, change your passwords and stay safe.

NordPass: "Users must be extra careful"

One of the key risks of a data breach this big is how easily cybercriminals will be able to access multiple accounts, especially for those who reuse passwords. A survey from NordPass indicates that as many as 62% of Americans, 60% of Brits and 50% of Germans admit to reusing passwords across multiple online accounts.

Ignas Valancius, head of engineering at cybersecurity company NordPass, had this to say:

“Users must be extra careful because information in the leaked datasets opens the door to pretty much any online service, from Facebook and Google to GitHub and Telegram. Even some government platforms were compromised.

“I recommend changing passwords immediately before the threat actors start poking around in your accounts. You need to act fast because platforms like Google, Apple, or Facebook are the gateways to your entire digital life, especially if you store passwords in browsers and don't use multi-factor authentication (MFA) or passkeys.

“If hackers manage to get their hands on your password for Google, Apple, or Facebook, stealing your money and identity may be easier than taking candy from a three-year-old."

Another data breach confirmed

While not part of the 16 million passwords leaked in the data breach we're covering, BleepingComputer reported on another confirmed data breach, this time from Krispy Kreme.

According to the report, over 160,000 individuals were impacted by a November 2024 cyberattack, with attackers (apparently claimed by the Play ransomware gang) stealing personal information. The U.S. chain sent notifications to the people who were affected.

Data breaches are on the rise, and the recent massive leak of login credentials across multiple platforms shows that now's the time to stay safe online. Make sure you're using one of the best VPNs and best antivirus software to keep your accounts secure.

What to do once your data has been exposed

Though it can be scary to know that your data is out there on the web, circulating amongst hackers, there are steps you can take to protect yourself.

First, as we've mentioned below, make sure you're changing the passwords to your accounts and using unique, strong passwords for each account. When possible, use passkeys instead. Always use two-factor or multi-factor authentication when an account has it available.

As with all data breaches, the biggest threat will be phishing attacks and online fraud. Avoid clicking on links or downloading attachments from unknown senders as hackers often set up fake pages to steal your credentials, credit card data and other sensitive info.

Never click on any unexpected links, attachments, files or QR codes from people you don’t know. You also want to be wary of people on social media who may reach out to you with offers or those who want you to download or click on files or attachments. If you receive something that appears to be from someone you do know, confirm it with them in an independent manner like calling them on the phone, or texting them.

If you haven't signed up for one of the best identity theft protection services, now might be a good time to look into them. You can also consider putting fraud alerts on your files with the Big Three credit-reporting agencies Equifax, Experian and TransUnion, and even instituting a credit freeze (although doing so can complicate getting a loan or opening new payment accounts).

When going online, make sure you have one of the best antivirus software programs installed and up to date since these programs often include a have VPN, password manager, secure browser and other extra security tools to help keep you safe online.

Facebook will soon have a passkey option

As more and more companies realize how easy it is to breach passwords, how frequently users reuse them – or use weak passwords – they have begun moving to a stronger method: passkeys.

Microsoft recently announced that the Authenticator app will shut off the password autofill feature in July, a move that the company is likely making as it moves towards a passwordless future. And Google recently issued a security warning encouraging users to enable two-factor authentication or risk an account lock down; Google's VP of privacy Evan Kotsovinos was quoted as saying another good step to make your account even more secure is to replace your password entirely. Kotsovinos' recommendation is to trade your password in for a passkey, which involves using your biometric information like your fingerprint or facial recognition alongside a trusted device like your smartphone.

To that end, Facebook announced this week that it would soon be rolling out passkey login's for its users, making it both easier and more secure to sign in to its services. Facebook users should soon see the option to enable passkey login's in the Account Center, from the Settings of their Facebook accounts on their mobile devices, and the option will also get rolled out to Messenger, and eventually Meta Pay.

The Facebook passkey will work with the same fingerprint, facial recognition or PIN technology that you use to unlock your device. Because they're stored on your device, they cannot be guessed, cracked or shared. However, if you still wish to use a password, you can.

I've been hacked and this is everything I did to fix it

If, like our own James Frew, you have also committed the security sin of reusing passwords or have used an unsecure Wi-Fi, or some other less-than-safe computer behavior, and wound up getting hacked, you might wonder what you should be doing next. Here's everything James did to re-establish a safe, secure computing environment for himself and make sure he was practicing safe computer habits.

1. Don't reuse passwords

2. Enable Two-Factor Authentication

3. Delete unused accounts

4. Sign up to Have I Been Pwned

5. Start fresh

Context is key

Checking your phone and seeing that 16 billion passwords have been leaked online is enough to give anyone a proper scare. However, when you're dealing with a data breach or data leak as massive as this one, it's important to put things in context before you panic.

Anthony Spadafora here and I've been covering cybersecurity news for over a decade. During that time, I've seen a lot of massive security incidents like this one. However, there's one thing a lot of them have in common.

Given that no brand or company is mentioned outright in our coverage here at Tom's Guide and at other news outlets across the web, this is an easy giveaway that this isn't a new breach or leak but instead a collection-style one. In this case, it's likely not brand new data being exposed online but passwords and other personal info from previous security incidents. This data is then repacked in a way that's easier to search through and simpler for other cybercriminals to use in their attacks.

For instance, similar collections like the RockYou2024 leak with 9 billion records and Collection #1 with more than 22 million unique passwords were distributed this way in the past.

Now this doesn't mean you shouldn't swap out your simple passwords with strong and complex ones or take a hard look at your online security habits. It just means that you shouldn't worry too much as there's a high chance that a lot of these 16 billion credentials were already exposed online and likely for sale on the dark web.

So instead of being scared, let this be the powerful catalyst you need to transform your online security – by changing your passwords (or better yet switching to passkeys), locking down your online accounts with 2FA, deleting unused accounts and apps, and sharpening your ability to spot a phishing scam.

Antivirus vs Identity Theft Protection

With billions of passwords floating around online, you may be wondering what steps you can take to improve your online security. If that's the case, chances are you might be considering investing in antivirus software or even identity theft protection. They're both designed to help keep you safe online but there are some key differences between the two that will help you decide which is right for you.

The best antivirus software (or the best Mac antivirus software for your Apple computer or the best Android antivirus apps for your Android smartphone) is designed to protect you from malware and other threats before they can infect your devices. By using a database of known threats, your antivirus software is able to scan and flag any potentially harmful files or software.

It's worth noting that while paid antivirus software is updated more regularly and comes with plenty of extras like a VPN or a password manager, you likely already have access to built-in antivirus software in the form of Windows Defender on PC, XProtect on Mac and Google Play Protect on Android.

Now the best identity theft protection services often come with an antivirus solution but that's not their main purpose. Instead, they're designed to proactively monitor your banking and other online accounts for signs of fraud or suspicious activity.

They also keep an eye on your Social Security number and other sensitive personal information. The big difference with identity theft protection is that these services include identity theft insurance to help you recover funds lost to fraud in addition to helping you recover your identity. At the same time, you also get access to experts that can walk you through the process of freezing your credit and dealing with the fallout from identity theft. They can help you get new documents too.

One big thing to keep in mind with identity theft protection is that it only works if you sign up before a major security incident takes place.

Signing up for both antivirus software and identity theft protection is the best way to protect yourself and your data online. However, this can get expensive fast. If you're on a tight budget, I'd start with antivirus software first and then sign up for identity theft protection once you have more to lose.

One way to make things more affordable is to look for antivirus and identity theft protection providers that offer family plans. That way, you can spread the cost between multiple people and rest easy knowing that your grandparents, parents, aunts, uncles, your children and yourself are all protected. Likewise, you want to stay up to date on the latest online scams and make sure that you share this knowledge with both your older and younger family members.

Another threat to look out for

Besides having your personal data and passwords exposed online, you also need to be on the lookout for new or upgraded malware. Case in point, the Godfather malware, which was first spotted back in 2021, recently got an upgrade that makes it even more dangerous.

Godfather is a banking malware that targets popular banking and financial apps by using overlay attacks. While you might think you're logging into your banking app once infected, you're actually inputting your username and password onto an overlay that appears over the legitimate app.

Hackers study the look and design of popular banking apps to create these overlays which they use to harvest account credentials. With these in hand, they can log into and drain your financial accounts.

Now though, the Godfather malware is using a new trick to evade detection and steal money from unsuspecting users. Instead of overlays, the malware is now using virtual versions of legitimate apps to commit fraud in real time.

To avoid falling victim to this and other malware strains, you want to avoid sideloading apps, opening attachments or links from unknown senders and it's always a good idea to limit the number of apps on your phone overall as even good apps can go bad when they're injected with malicious code.

Grouping exposed data makes breaches larger – and even more dangerous

Though this breach may be the biggest in terms of numbers it has similarities to a few other recent breaches – for example, like three other recent breaches, this latest massive breach includes older data that has been around for a while and repackages it, then leaves it exposed it an open database making it easily accessible for any threat actor to grab. When it's discovered, it is quickly removed which makes it difficult to determine who owned the database and therefore, who was responsible for breaching the collected information.

The data leak of AT&T data that we reported about earlier this month is similar and involved more than 86 million records that tied AT&T user data to sensitive personal information like Social Security numbers and birth dates. And again, a day earlier in China, more than 4 billion records were compiled that included everything from WeChat transcripts and phone numbers to gambling history. In May of this year, 184 million passwords from companies like Apple, Google, Microsoft, Instagram, Facebook, Snapchat and more were compiled and stored in a plaintext database.

The trend towards larger and larger breaches is clear. At this point it seems inevitable that your passwords and data can, and will, be compromised at some point and it is up to the consumer to protect themselves by using every tool available to protect themselves.

Data breach vs Data Leak

When a large number of passwords or a collection of sensitive personal information is exposed online, people often get hung up on whether it's a data breach or a data leak. Here's the difference between the two.

For a data breach to occur, hackers or other cybercriminals need to gain unauthorized access to a company or even a government's systems. Once inside, they then steal or exfiltrate as much data as they can with the intention to use this info for blackmail, phishing or other cyberattacks.

Now with a data leak, the same types of personal and even financial information from a data breach may be exposed. However, how that data ended up online is the main difference. Data leaks often occur due to human error. For instance, maybe someone forgot to password protect a database and left it open online for anyone to access it. This might sound hard to believe but this happens way more often than you'd think.

Another way that a data leak can occur is through scraping. Just like marketing firms do, hackers often scrape public databases for personal details and other info. All of this data is then put together in a database and if not secured correctly, it too can leak out onto the open web.

Regardless of if you're dealing with a data breach or a data leak, the end result for you as the user is the same. Your information is available online and could be used against you. One way to limit your exposure is by using a data removal tool. There are standalone ones like Incogni or you might find one available as an extra feature with your antivirus software or VPN, like with ExpressVPN's Personal Data Removal service.

If this security incident has made you rethink your cyber hygiene, a data removal service is another tool you should add to your security arsenal along with antivirus software and identity theft protection.

Follow-up attacks to look out for

Now that billions of passwords have been exposed online, hackers and other cybercriminals are probably already thinking about how they'll use this data to their advantage in future attacks. Here are the ways this leaked data will likely be used first:

If a password was leaked alongside a username, then hackers are definitely going to try and see if they can use these credentials to log in. They will likely try the account the password is associated with first and then after that, they might try to log into other popular online services.

What they're hoping for is that the person this username and password belongs to was foolish enough to reuse the same credentials across multiple online accounts. Password reuse is one of the easiest ways you can set yourself up to get hacked, so if you use the same password on multiple sites and services, stop what you're doing and go create a unique and complex password for each of them.

If the leaked username and password work, they'll then take over the account and use it as their own. They could use it in other attacks or even to send out phishing messages to any contacts associated with that account.

The next big thing that we'll likely see are targeted phishing attacks. Unlike your standard phishing attack, these ones go after specific people by using public or stolen info to build trust with potential victims. If a hacker impersonates someone you know or claims to know them too, you're more likely to respond to their messages and you could potentially be swayed by their claims.

Finally, if a username and password combo was leaked for a banking or financial account that contains loads of sensitive personal data, hackers could try to steal your identity.

These are all the main potential threats you're going to want to be on the lookout for but there could be more. My advice, keep your head on a swivel and keep tabs on all of your online accounts just to be safe. Likewise, consider investing in identity theft protection for additional peace of mind.

Another security incident

CNBC is reporting that Aflac has "identified suspicious activity" in its network. This activity could impact Social Security numbers and other information.

“We continue to serve our customers as we respond to this incident and can underwrite policies, review claims, and otherwise service our customers as usual,” Aflac said in a statement.

According to CNBC, the investigation is in its early stages and Aflac does not yet have the total number for potentially affected customers.

Impacted information may include claims information, health info, Social Security numbers and other personal information related to everyone from customers andbeneficiaries to employees, agents and "other individuals."

The insurance company has said that it will offer free credit monitoring and identity theft protection and Medicaid shield for up to 2 years for anyone that reaches out to its call center.

Lockdown your Gmail

Google will reportedly require you to activate 2-step verification to access your Gmail account. Especially as Gmail was one of the affected databases in the big breach.

It's meant to help curb phishing and spam emails that have been on the rise lately.

As part of that you should replace your password with a passkey. You can activate 2SV now if you haven't already to get ahead of it.

Security homework

With this massive data breach on the mind, now is as good a time as any to do some security home work.

We've put together guide to the seven things you should do now to make sure your accounts and devices are safe.

We have more details in the guide but here's a brief rundown what you need to secure.

• Passwords
• Browsers
• Two-factor and Multi-factor authentication
• Update social media settings
• Delete, remove and unsubscribe
• Update software and enable automate updates
• Check and update settings

Password managers can be a life-saver

This record-breaking data breach included URLs, usernames, and, most importantly, passwords, which means you should seriously consider updating yours for Google and Facebook. But creating strong, complex passwords is a tall order, and remembering them is even harder, especially when you should ideally have one for every site you log into.

You could try to keep them all in your head if you have Rain Man-level recall. If you don't, why not offload that process by getting a password manager and free up all that precious memory for more important things? Password managers make it easy to securely store all of your passwords in one place, and most will even autofill them into a website or app when you log in. We dive into the best picks for iPhone, Android, privacy, and more in our guide to the best password managers.

More details on Aflac breach

Aflac released a press release on Friday disclosing that it had suffered a data breach that may have compromised sensitive personal information held by the insurance company. It identified suspicious activity on its networks in the U.S. on June 12.

"This attack, like many insurance companies are currently experiencing, was caused by a sophisticated cybercrime group," Aflac said. As for the extent of the breach, Aflac is still investigating, but it may include social security numbers and other sensitive information.

The infamous hacking group known as Scattered Spider is believed to be behind the attack. According to the Google Threat Intelligence Group, the group is targeting big names in the insurance industry, as we saw with a breach at Erie Insurance earlier this month.

Krispy Kreme offers ID protection for those impacted

Facebook and Google aren't the only companies struggling with cybersecurity headaches right now. Krispy Kreme began notifying over 160,000 people of a data breach in November that compromised personal details primarily for Krispy Kreme employees, former employees and members of their families.

“We are notifying affected individuals and will be providing detailed information specific to their data,” Krispy Kreme told The Charlotte Observer on Thursday. “We have no reports that the criminals have used any information for identity theft or fraud as a result of this incident.”

Hackers gained access to information such as Social Security number, date of birth, driver’s license or state ID number, credit or debit card and financial information, passwords, email addresses, and health info. Krispy Kreme is offering free credit monitoring and identity protection services for those impacted.

Scams to keep an eye out for

With these massive data breaches going on, you'll want to stay on the alert for potential scams to remain safe online. We've put together a guide to the 7 most common online scams to help you spot the telltale signs that something's amiss before it's too late.

Some of these scams may be more involved than others, but all it takes is a moment of impulsive emotion or rash decision-making to jeopardize both your personal data and your hard-earned money.

Essential tips to stay secure

In light of the recent data breach, follow-up scams, phishing attacks and more are far more likely to happen. With the billions of login credentials now being exposed, now is the time to make sure your online accounts are protected and to keep an eye out for any suspicious online behaviour.

You can find out the most common scams happening right now and the best ways to spot them in our Data Breach 101 series. Whether it be deepfake phone calls or fake job offers, stay in the know to keep cybercriminals at bay.

McAfee on the effects of infostealers

The data breach leaves a lot of follow-up attacks not only to companies, but also individuals. While it's best to enable two-factor authentication and change your passwords, it's also a good idea to know how infostealers work.

Steve Grobman, CTO at McAfee, had this to say about the effects of the data breach and how infostealers work:

"Infostealers work in the background to silently siphon off usernames, passwords, browser history, crypto wallets, and other sensitive data from infected devices," Grobman states. "Once cybercriminals have valid account login information, it creates a launchpad for scams and other malicious activity — especially if passwords are reused or haven’t been updated recently.

Grobman continues: "Email and social media logins are particularly valuable, as they allow scammers to reset passwords and dig even deeper into someone’s digital life, even impersonating victims. When a cybercriminal can appear to be you, they can extend their impact by deceiving loved ones and other digital acquaintances.

"With a trove of personal information circulating widely, people should be on high alert for scam emails and texts that look like they’re from trusted brands or known contacts. Now is the time to update passwords — especially for email, banking, and shopping accounts — enable two-factor authentication wherever possible, and use scam detection technology to help flag risky messages before they cause harm."

What can infostealers do?

Since the dataset containing stolen login credentials was largely obtained through various infostealers, a form of malware that steals sensitive data like passwords, personal information, chat logs and more, it's a good idea to know what they can do.

Whether it's on your Windows laptop, Mac, iPhone or Android, infostealers can take any data like passwords, authentication cookies or cryptocurrency and send it straight back to the threat actors. Once obtained, cybercriminals can use the stolen credentials to steal additional information, access sensitive resources or create social engineering attacks.

Some examples of infostealers include Poseidon and Atomic Stealer, which steal cryptocurrency from over 160 different crypto wallets, passwords from web browsers, passwords from password managers like Bitwarden or KeepassXC and VPN configurations including Fortinet and OpenVPN.

Infostealers can sneak onto devices through suspicious links in phishing emails or suspicious apps on different app stores. Both personal and professional devices, which is why it's important to stay alert when receiving an email from an unknown sender and only download apps through official platforms.

As always, enable two-factor authentication (2FA), and it's best to use a password manager or VPN if possible.

Check your email and passwords

The 16 billion login credentials from major platforms such as Apple, Google, Facebook and more exposed may be a mix of older and more recent data, but the chances of many users having their passwords leaked for cybercriminals to utilize are high.

Since news of the data breach broke last week, there's been enough time for threat actors to act upon the information they've gained. To be sure your online accounts are safe, especially your emails and passwords, you'll want to check what's been exposed.

Use Have I Been Pwned to see if your email is part of the data breach, along with Pwned Passwords if your password has shown up, too. Either way, it's a good idea to change your login credentials, considering the scale of the breach.

And, to gain the upper hand in future data breaches, you'll want to sign up for the Notify Me service to be notified when your online accounts are compromised.

Get onboard with passkeys

Passkeys are one of the many alternatives to passwords now, with Microsoft making passwordless the default for new users, Facebook rolling out the security option and it being widely available on Google and Apple accounts.

These offer a unique digital key that can’t be reused and offer an encrypted format on your devices, keeping them safe in the event of a data breach (as with this recent mass leak of login credentials). Think of it like two-factor authentication (2FA), but one that doesn't require you to input or remember a password.

Without a password, there's no chance for cybercriminals to use leaked user credentials and gain access to your account, as the key to your account will be right on your phone, laptop or other devices.

If you haven't already and are looking to set one up, find out how to use passkeys with your Google account. It's easy enough to do, and you can create one now by heading over to Google's Passkey page.

Up for grabs on the dark web

As mentioned, a lot of leaked data from data breaches such as these can end up on the dark web, a way for cybercriminals to buy, sell or exchange stolen information, malicious software or other harmful online tools. With the amount of login credentials that have been exposed (even if only for a brief time), the information from the databases is likely to be sold there.

Whether it's personal online accounts, banking information or corporate details, cybercriminals can make millions selling crucial information. Even an American passport only costs $20 on average.

Many of the best antivirus software and best VPNs come with dark web monitoring tools, which help you find out if your personal information has been illegally published on the internet or, more specifically, the dark web. This can add extra reassurance that your online accounts are protected, as if your credentials do pop up, you can change them as soon as possible before anything happens.

Yet another data breach

If 16 billion passwords being exposed online wasn't bad enough, there's now a new data breach to deal with.

For the second time in two years, McLaren Health Care has been hit by hackers. This time they've managed to steal the full names, Social Security numbers, driver's license numbers, medical records and health insurance details of 743,000 patients.

Given that data breaches like this one have become much more commonplace in recent years, you don't want to just beef up your security after a major incident like this one. Instead, protecting your personal data and the rest of your digital life needs to be something you think about and take steps to improve each day.

Beware of these common online scams

The 16 billion stolen login credentials leave a lot open for cybercriminals to gain, whether it's access to online accounts or a way to take advantage of known personal information.

With this in mind, you'll want to keep a watchful eye for common online scams that can massively impact your privacy, finances and more. Always be on the lookout for anything suspicious, especially when opening emails from unknown senders or downloading an app. However, scams are getting more sophisticated, so it's best to know what to look out for.

Take note of these types of scams:

• Phishing scams
• Verification scams
• Impersonation scams
• Job offer scams
• Holiday scams
• Donation scams
• Romance scams

Switch to passkeys

Passwords will eventually be on their way out, and to make a passwordless future, you'll want to switch to using passkeys. No more remembering complicated login credentials, and they're free from harm after a data breach.

Steve Won from 1Password states that passkeys are preferable because each is made up of two components: a unique public key created and stored on the company’s server, and a private key stored on the user’s device.

“As with all dual systems, the public key is used to create a challenge that can then only be solved if you have access to the private key, which is secret and known only to you," Won states.

"Because of this, passkeys are nearly impossible for hackers to guess or intercept because the keys are randomly generated and never shared during the sign-in process.”

You can get started now by heading to Google's Passkey page.

Not the first data breach for Apple, Google and more passwords this year

Last month, more than 184 million passwords exposed in massive data breach, including from Apple, Google, Microsoft and more — this isn't unlike the 16 billion stolen login credentials we've seen, but just at a smaller scale.

The infostealer usernames and passwords to email and banking accounts, including on platforms such as Snapchat and Instagram. As it was only recent, some of this information may have overlapped with the giant database that was later spotted, as was reported. However, this is also mixed with recently exposed data.

As noted, analysis determined that this data has been captured by some type of infostealer (like the major data breach), meaning the individuals exposed and the accounts involved will be vulnerable to a host of further scams and malicious behavior from threat actors such as phishing attacks.

Just like that data breach, though, you can keep yourself secured by enabling two-factor authentication, checking out the best password managers and start switching to passkeys where available.

Find the best password manager for you

Password managers are one of the best ways to keep your online accounts secure without reusing your passwords, and so you don't have to remember them all. That's why you'll want to use one of the best password managers, and yes, you can even grab one for free.

Here's some of the best we recommend, after testing them ourselves:

• 1Password
• Bitwarden
• Keeper
• Proton Pass
• Dashlane

Set up passkeys on your iPhone, iPad and Mac

As noted, passkeys can enhance the security of your devices, as the new security method makes it extremely hard for cybercriminals to access your accounts — no password required.

Google, Microsoft and Apple all have this option available, and it's easy to set up, and it means you won't have to worry about login credentials being stolen through data breaches. That's because when you generate a passkey, two keys are effectively created. One ends up stored on your device and another is stored by the website or app. The one that is on your device — an iPhone, iPad or Mac — does not leave that device.

For those who own Apple's suite of devices, whether it's an iPhone, iPad or Mac, setting up passkeys is easy and can be done on your device right now. Plus, it makes it very easy to sign in to your acounts accross websites and apps.

Head on over to our guide to find out how to set up passkeys for your iPhone, iPad and Mac.

WhatsApp users will begin seeing advertisements on the app, thanks to a new global update.

As per Meta's Newsroom, advertisements will appear only in the "Updates" tab — a separate tab at the bottom of the app, which showcases both "Channels" and "Status" features. Users can subscribe to friends and other public channels, and post statuses of their own, akin to Instagram's subscription and "Stories" features.

"The Updates tab is where you discover something new on WhatsApp – whether that’s a friend’s status from their wedding day or a creator’s entertaining channel – and it’s now used by 1.5 billion people per day globally," Meta stated.

"Now the Updates tab is going to be able to help Channel admins, organizations and businesses build and grow."

WhatsApp will introduce ads in three ways on the Updates tab: via channel subscriptions, promoted channels and ads in Status. Channel subscriptions will work similarly to paid content on Instagram, allowing users to subscribe to their favorite public channels and receive exclusive updates for a monthly fee. In terms of promoted channels, businesses will be able to pay to boost their visibility to new users.

Businesses can also advertise products and services in Status updates, linking viewers to a chat when clicked.

How will ads actually work on WhatsApp?

WhatsApp will target ads in a similar way to Facebook and Instagram; however, it seems these third-party advertisements will be less intrusive to user experience. Meta notes that users' messages, calls and statuses "remain end-to-end encrypted, meaning no one can see or hear them" — including the platform — and if you don’t use the Updates tab, you won’t even see ads.

WhatsApp ads will be targeted towards users based on their age, country or city that they're located in, and language. Ads will also be targeted based on the channels they're following in the app and how they interact with ads.

Users who have chosen to link their WhatsApp account to Meta's Account Center hub will have their ad preferences and information fed from their Meta accounts.

Meta will be rolling out these features over the coming months and is already calling on businesses and channel admins to become early adopters of the new features. As always, we will keep you updated on how this pans out for WhatsApp users — and whether these ads will remain non-invasive in the long run.

Meta one of the largest tech companies in the world suffered a massive outage that affected most of the company's social platforms.

Facebook and Instagram seemed to struggle the most but Messenger, Threads and Whatsapp were experiencing issues.

Reports started coming in around 9:30 a.m. Pacific and lasted through about 2:30 p.m. Pacific.

Most users were saying that they were getting error messages or that parts of the platforms like Stories and messages weren't appearing or were never sent.

It's unclear why the platforms suffered problems though an outside report suggested it was due to back-end server issues.

Meta released on statement on X fairly soon after issues started saying, "We’re aware that a technical issue is impacting some users’ ability to access our apps. We’re working to get things back to normal as quickly as possible and apologize for any inconvenience."

As of this writing, all of the affected social media platforms appear to be back to normal.

Facebook showing error message

Currently, if you try to access Facebook, this error message appears.

Some platforms seeing bigger outages

Based on Down Detector reporting, not every service appears to be equally affected.

Whatsapp and Facebook reporting are already in decline with Whatsapp nearly back to normal.

Instagram, Messenger and Threads are still high with 1000s saying they can't access those services.

Meta showing "major disruptions"

Meta has a status page for "business products" that is currently showing "Major Disruptions" to Facebook, Messaging, Instagram and Whatsapp.

It's not clear what is affecting those services based on the status bar though.

Meta uses X to respond to outage

Meta has not posted on its official X account since October 7th.

Today, possibly due to the outages, the account posted that the company is aware of the interruption and that they are working on the issue.

Of course, responses to the tweet are roasting the company some cheekily finding it ironic that Meta had to use a competitor to post about the issues.

Down from peak but ongoing

The outage appears down from its initial peak but still ongoing.

Instagram also used X to report the outage.

• Facebook - 107,109 reports
• Instagram - 71,654 reports
• Messenger - 15,025 reports
• Threads - 883 reports
• Whatsapp - 12,334

Facebook sharply declined but appears to be holding steady around 21,000 reports.

Instragram shows similar numbers.

Whatsapp sharply dipped down but has peaked again over 6,000 reports.

Messenger appears to similar to Whatsapp though it hasn't peaked again.

Threads seems fine, but do people use it?

Meta response

Tom's Guide reached out to Meta about the outage.

A spokesperson directed us to the X post the company made about the ongoing outage.

That post reads, "“We’re aware that a technical issue is impacting some users’ ability to access our apps. We’re working to get things back to normal as quickly as possible and apologize for any inconvenience.”

No other comment was made about what could be causing the issue or an estimate of how long it may take to return service to normal.

Meta status page shows more disruptions

The outage has been ongoing for about 2 hours now.

It has not reached out the highs of its initial peak but does appear to be holding steady.

The Meta status page is showing more services disrupted.

Anecdotally, we have successfully been able to access Whatsapp, Facebook and Instagram and scroll through them and send a few messages.

Instragram seemed a little slow. Facebook however, isn't showing stories or recent posts. And it appears to be the hardest hit based on the Meta page.

Users seek info on other platforms

While Down Detector is great for initial outage sighting, it's not always good for ongoing tracking. Their tracking has seen the reports sharply decline.

However, Meta's status pages are all in the red and after our last post, Instagram and Facebook have become much slower and in some cases aren't loading certain parts of the apps.

Meanwhile, concerned users are looking to Reddit, X and Bluesky to get more information.

The Facebook and Instagram subreddits, for example, are filled with people wondering what's going on.

For now, we don't know what is causing the problem, but Meta is going through it today.

Outage hits the three hour mark

Meta's service wide outage has cross the three hour mark and from where we sit, there is no end in sight.

The Meta status page has been fully read for the last 15 minutes.

As of this writing, Meta has not released a follow up statement to the initial X post. Similar statements were posted on the Whatsapp and Instagram X feeds.

Meta's products are global, especially Whatsapp, so we're seeing reports from all over the world come in about the outage.

While we've struggled to use Instagram and Facebook, not seeing a new post newer than 4 hours, we have been able to use Whatsapp for some group chats. So it's not clear if the outage is affecting every region equally or not.

Outage may be to internal server errors

For the most part, Whatsapp, Messenger and Threads seem off the outage train. Facebook and Instagram still appear to be hurting.

ThousandEyes, a security company owned by Cisco, reached out to us sharing their analysis of the outage.

They believe that Meta may be having issues on the back-end, suggesting an internal server problem.

It's not clear from their posting if that suggests a hack like DDoS attack or a failure of some kind on the servers in Meta's systems.

Outage appears to be winding down

While the outage reports on Down Detector are still around 3,000 reports for both Instagram and Facebook, it does appear that the outage is winding down.

Threads, Messenger and Whatsapp have been fairly solid for the last hour or so.

The Meta status page still has everything in the red as of 2:01 pm Pacific.

That said, we're seeing far fewer posts on other platforms about the services being down.

On our end, Instagram appears to be loading again with stories and more recent images starting to appear in the feed. Those things appear to be returned on Facebook as well.

Meta has not officially responded since its initial posting and statement.

Meta says things are 99% back

Within the last hour, Meta released another statement on X.

The post read, "Thanks for bearing with us! We’re 99% of the way there - just doing some last checks. We apologize to those who’ve been affected by the outage."

The Meta Status page still shows mostly red across the board, though a couple of sectors have shifted into yellow or green.

Let's be honest. The Meta Quest 3 and Quest 3S are the best ways to jump into VR, being excellent, affordable standalone VR headsets for gaming, productivity and beyond. Right out of the box, though, even I admit they have their problems. That's why the best Meta Quest accessories have become essential.

In my years of using one, I've learnt that accessories are a must-buy — you need a battery boost to keep you in-game longer, a case to keep it protected when traveling and a comfy fit so you'll actually want to keep it on for hours on end.

More and more, the idea of VR accessories has been evolving into pure overkill in the best way, too. Be it a VR chair that rotates as you look around to increase immersion, or a whole arcade machine setup to bring the 90s back to your home, you're guaranteed something interesting with these. So, if you're looking to upgrade the best VR headsets around, check out the best Meta Quest 3 and Quest 3S accessories we've tested.

The best Meta Quest 3 accessories you can buy today

Best Meta Quest battery strap

Kiwi Design is usually at the top of my recommendation list for battery head straps, but the K4 Duo takes it to the next level by seriously improving the audio with built-in headphones, too.

The cushioned head strap gives this a nice, snug fit and balances out the additional weight of the battery pack, while giving you an additional 3 hours of longevity and providing impressively immersive audio. This one is essential to make the most out of your Meta Quest 3 or Quest 3S.

Best Meta Quest Haptic VR vest

The Woojer Vest 3 is a bit of a mini breakthrough when it comes to haptic VR vests. The next iteration of haptic motors on a vest — six powerful oscillators are placed strategically across the body to deliver a real oomph to whatever you're listening to and any in-game sound effects.

But the real beauty is in the versatility of these haptics, from giving you gentler details all the way up to the big impacts. This is the best vest you can buy.

Best Meta Quest case

This case is an absolute game-changer for anyone who actually takes their Meta Quest 3 or Quest 3S out of the house. For embracing Travel Mode, you're going to need a reliable case, and Aubika’s mini option is my favorite by a mile—it's the perfect sweet spot between protection and portability.

The exterior is incredibly tough, meaning you don't have to worry about bumps and knocks when you're dashing through the airport or stuffing it under a bus seat. But open it up, and the contrast is wonderful: you find soft, plush internal fabrics that cradle your precious VR headset and keep its lenses completely safe from scratches. Best of all, it has a surprisingly small form factor that easily fits right into the bottom of my personal backpack without turning it into a giant, bulky carry-on.

Best Meta Quest charging station

Charging docks are a bit of a minefield when it comes to headset compatibility and price, but Eslick's charging station does it all while costing just $38. The secret sauce is the magnetic charging cable for the headset — just pop the secure USB-C magnet adaptor into the headset's port and link it up with no problem.

Add the included rechargeable controller batteries into the mix with 30W fast charging, and you've got a stylish plinth for your hardware that is also super useful. Suddenly, this dock is solving two major VR frustrations at once, keeping your VR headset and controllers perfectly displayed and always powered up.

Best Meta Quest link cable

VR gaming doesn't have to just be limited to what games you can get on the Quest 3 itself (even though that library is huge). You can connect this to your PC and play a ton of SteamVR titles, too. And the best (and most reliable way) to do so is with the official Meta Quest Link cable.

The price is a little steeper than its competitors at $89. But with this cable, I've not experienced any stuttering in footage or latency at all in my inputs. This is absolutely the way to go for the best gaming experience — especially when sim racing in VR.

Best Meta Quest VR chair

I say "best VR chair," but this is the only VR chair. But don't get it twisted, this is an amazing addition to your VR gaming experience. Put simply, everywhere you look, the Roto VR Explorer chair rotates to that view with you.

As the virtual world moves with you on this chair, not only does it virtually eliminate that awful feeling of motion sickness, but it also drastically increases immersion. This isn't just a gaming chair; it’s a full-body experience that tricks your brain into believing you're truly moving through the virtual space, making your VR gaming feel unbelievably real.

If you can afford the admittedly high price tag ($799 at full price), and you're very serious about upgrading your VR life, this is easily one of the best and most impactful buys you can make.

Best Meta Quest VR arcade stick

Alright, I'll be honest — this is so overkill. But also, it's overkill in the best way possible for those who miss a childhood of going to the arcade.

The Arcade2TV-XR is the bottom portion of an arcade cabinet, which even comes with VR titles, such as Pinball FX VR, for plenty of classic pinball action, and Arcade Ranger, which helps you create your own virtual arcade with the games you want (think Street Fighter II). It takes a lot of setup, but if you're an enthusiast, you can turn your room into the arcade of your dreams.

Does it take up a lot of living room space? Absolutely. Is it worth it for the gamers who miss the good old days? For sure.

How we test the best Meta Quest accessories

Each of these Meta Quest accessories has been tested by me in my day-to-day life. I put each product through hours of testing, including the nephew-proof exam, as he can be a little clumsy — that's a good durability test. So rest assured, each of these accessories has been put through their paces.

You wouldn’t expect to run into password-stealing malware while browsing Facebook but hackers are now using fake ads to target vulnerable Windows PCs on the popular social network.

As reported by BleepingComputer, security researchers at Trustwave have discovered several new campaigns that use fake Windows themes along with fake downloads for pirated games and software as a lure to trick unsuspecting Facebook users into clicking on their malicious ads. This is done by either creating new Facebook business accounts or by hijacking existing ones.

Here’s everything you need to know about this new campaign and how you can keep your own Windows PC safe from malware.

Stealing passwords and Facebook account info

According to Trustwave’s report, the hackers behind this latest round of attacks have taken out thousands of ads for each individual campaign. For instance, the top campaign called “blue-softs” had 8,100 ads while “xtaskbar-themes” had 4,300 ads.

Clicking on one of these fake ads takes potential victims to malicious sites hosted on Google Sites or True Hosting which appear to be download pages for the themes or software advertised on Facebook. These sites have a download button that when clicked, downloads a ZIP file with a name that matches the product advertised online.

As you’d expect, these ZIP files actually contain the SYS01 info-stealing malware which was first discovered by the cybersecurity firm Morphisec back in 2022. The malware itself uses a collection of executables, dynamic-link library (DLL) files, PowerShell scripts and PHP scripts to install itself and steal data from a targeted Windows PC.

SYS01 can steal cookies from your browser along with any passwords stored there and a victim’s browsing history. However, it also includes a task that leverages Facebook cookies on an infected device to extract data from a victim’s profile including their name, email, birthday and more on the social network. 

Even if you’re not on Facebook, you still need to be careful as Trustwave has observed similar malvertising campaigns on both YouTube and LinkedIn.

How to stay safe from malware

To avoid falling victim to this campaign and others like it, the first and most important thing you can do is to avoid clicking on ads. 

Hackers can buy ad space just as easily as legitimate businesses, so to stay safe, you’re better off not clicking on ads at all. In fact, even the FBI recommends you now use an ad-blocker. 

If you do see an ad for something you like, though, you’re better off heading to a search engine or — better yet — to the company’s site directly and shopping for the item you may be interested in. When you do need to interact with an ad online, you’re going to want to make sure that you’re using the best antivirus software to protect yourself from any malware or other viruses that ad could be spreading.

We’ve now seen fake ads on both Google and Facebook, and both companies are trying to crack down on this practice. In the meantime, you just need to be careful where you click and avoid downloading anything from unknown sites and sources online.

More from Tom's Guide

• Apple issues urgent spyware warning for iPhone users in 98 countries
• Hackers using Google Ads to steal your info and drain your accounts 
• NSFW Facebook ads used to spread dangerous malware — don’t click on these

Meta, like the entire tech world, has seen tremendous value in artificial intelligence (AI). The company has invested heavily in its Llama AI model and has now released Llama 3, which is even more powerful than the previous versions. In fact, Meta calls it "the most intelligent AI assistant you can use for free." 

To accompany the release of Llama 3, Meta is integrating it much further than it had previously. The company announced in a blog post that it is integrating the new AI model Facebook, Instagram, and WhatsApp through the Meta AI assistant. It will even start showing up directly in the main Facebook feed, so you won't be able to avoid Meta's ChatGPT competitor. If you want to try it without using one of the company's social media apps, you can go to Meta.ai.

The company said in a blog post that "you can use Meta AI on Facebook, Instagram, WhatsApp and Messenger to get things done, learn, create and connect with the things that matter to you."

Meta is also rolling the AI assistant out in many additional countries. Now, people in Australia, Canada, Ghana, Jamaica, Malawi, New Zealand, Nigeria, Pakistan, Singapore, South Africa, Uganda, Zambia and Zimbabwe will be able to interact with it English. The company says it's "just getting started" so we expect to see more locations added in the future.

What's new with Meta's Llama 3? 

As far as what's new with Meta's new AI model, it seems to be iterative, building on the features used in Llama 2 and making them smarter. 

Meta claims that its AI model is faster at creating images than it was previously. Now, it can produce images as you type. You can even tell it to animate a created image to get cool GIFs. I tried it out, and it was shockingly fast. I had to ask for a couple of edits to get the image I wanted, but it did end up creating some impressive art. In fact, Meta says images generated are also now sharper and higher quality, and I'd have to say the company is right about that based on what I saw.

Outside of image generation, Meta AI can be used to plan a night out, look up information on a topic, help decorate your home, solve math problems, get real-time search information around the web, and all of the other features you'd expect from a well-trained AI model. 

The integration into Facebook proper also sounds intriguing. Meta cites an example of seeing a post with the Northern Lights. "So if you see a photo of the northern lights in Iceland, you can ask Meta AI what time of year is best to check out the aurora borealis," reads the company's blog post.

More from Tom's Guide

• Meta's Llama 3 is coming this summer — but a small version could drop next week for you to try early
• Meta’s Ray-Ban smart glasses are getting a huge AI upgrade — what you need to know
• Meta’s LLaMA AI aims to be more honest than ChatGPT

After being quiet for months, Meta just rolled out a huge update to its Messenger app, focused on sharing and photos — something that’s been much needed.

For some time, sharing on Meta’s Messenger app has been hampered by quality issues. Photos come through scrambled in such a way that they look like they were taken on a flip phone from 2008. 

The most significant update is the ability to send HD photos in Messenger chats. According to Meta, this update is supposed to allow for “clearer, crisper photos” in your conversations. 

Select an image in the chat composer and toggle on the HD option before hitting send. Multiple images can be selected this way and set to send in HD. It’s an extra step, but it will ensure clearer photos are shared each time.

It’s been quite a while since shared albums on Facebook were all the rage, and Meta is bringing that feature to Messenger. 

To create a shared album, you select multiple photos in the chat composer and then tap Create Album. According to Meta, you can also hold down on a photo and then tap Create Album when it pops up. Otherwise, you can select the photos and add them to an existing album.

Once an album is created in a chat, anyone in the group can view, add, delete and download media from that album.

While not available yet, Meta indicated that you will be able to view the album at a later time but tapping the group chat and then hitting Media. Again, this feature is coming but is not available as of this writing.

QR Code Connections and 100 MB File Sharing

The new update allows users to add contacts without typing their number or name. Instead, you can go into Settings and tap the QR code icon to allow them to scan your code. You can also send them a link by tapping Share.

Finally, the other big part of this update is the new ability to send files up to 100 MB. Meta says all major file formats, including Word Docs, PDFs and Excel files, are supported.

Simply tap the + button in a chat and select the file or files you want to send.

Gmail, for example, still only allows for 25 MB files over email, so anything that lets users send a large file without a third party or link is a pretty useful feature.

More from Tom's Guide

• Forge Apple Vision Pro - Meta Quest 3 just got a major update that boosts AR experiences
• Meta's Ray-Ban smart glasses are getting a huge AI upgrade - what you need to know
• Meta Announces flurry of new AI tools - here's what Facebook will do for you

AI tools like Midjourney, ChatGPT-5 and DALL-E can be a game changer when it comes to creating content but unfortunately, many of them are locked behind subscriptions or only available in limited access.

There’s nothing hackers love more than something in short supply and according to a new report from Bitdefender, they’ve devised a complex way to use these tools — and access to them — to infect unsuspecting users with info-stealing malware.

Just like with other online scams, this one starts on Facebook before potential victims are led to a malicious site controlled by the hackers behind this campaign. From there, malicious ads are then used to infect those with an interest in AI with all sorts of dangerous malware.

While this campaign has primarily targeted European users so far, it could be retooled to go after those searching for AI tools on Facebook in other countries too. Here’s everything you need to know about how hackers are leveraging the popularity of AI tools in their attacks along with some tips on how you can stay safe from info-stealing malware.

From account takeover to malvertising

This malicious campaign begins with the hackers behind taking over existing Facebook accounts. This is a common tactic used by cybercriminals since they can use an account or page’s existing reputation and followers for their own gains.

Once an account is compromised, the hackers then give it an AI-themed makeover with new cover and profile photos as well as descriptions to make it appear as if it is run by one of the well-known AI image and video generator companies. From here, they then try to boost the page’s legitimacy with news, AI-generated photos and advertisements to further impersonate whichever AI image generator or video generator service they want to leverage in their attacks. They also add links that unsuspecting users might click on to get free access or a free trial to this particular AI tool. The end goal of all of this is to trick users into clicking on a link to a malicious site where malware will be downloaded onto their devices. 

During their investigation, Bitdefender’s security researchers found that the hackers responsible used a much different approach with Midjourney. For other AI tools, they urged visitors to download the latest versions from Dropbox or Google Drive but with Midjourney, they created more than a dozen malicious sites that impersonated the tool’s actual landing page. These sites then tried to trick visitors into downloading the latest version of the tool via a GoFile link.

Using malicious ads to distribute infostealers

There’s one thing that all of the info-stealing malware distributed in this campaign has in common, they all use a malware-as-a-service business model. For those unfamiliar, these types of malware strains are developed by cybercriminals and then purchased by other hackers to use in their attacks as subscriptions. Yes, even hackers are inundated with subscription services too. In total, we’re dealing with four different info-stealing malware strains here which include Rilide, Vidar, ICERAT and Nova.

Bitdefender’s security researchers observed that a new version of the Rilide Stealer was used in a number of sponsored ad campaigns that impersonated AI tools and photo editors including Sora, CapCut, Gemini AI, Photo Effects Pro and CApCut Pro. This malware is a malicious extension posing as a Google Translate extension that targets Chromium-based browsers like Chrome, Edge, Brave and Opera to monitor a victim’s browsing history, harvest their login credentials and even steal cryptocurrency by getting around two-factor authentication (2FA).

Of these multiple campaigns impersonating AI tools, the one involving Midjourney was the most successful and remained active the longest. As BleepingComputer points out, a Facebook page impersonating Midjourney managed to attract 1.2 million followers and remained active for almost a year before being taken down. This fake page has since been shut down by Meta though.

How to stay safe from info-stealing malware

Just like when downloading free apps on official app stores, you need to be careful when it comes to trying new AI tools. For instance, there isn’t a desktop version of Midjourney yet but that didn’t stop the hackers behind this campaign from advertising one online.

We saw similar tactics used with fake ChatGPT apps back when OpenAI’s chatbot wasn’t open to everyone yet. Hackers would trick unsuspecting users with quick access and a chance to jump the queue, only to infect them with malware.

For this reason, it’s best to go to an AI tools’ official page and do plenty of research before installing anything. A quick online search will let you know whether or not an AI image generator or other tool has a desktop version or a mobile app. Anyone claiming something different is most likely a hacker trying to trick you.

At the same time, you want to avoid clicking on ads no matter how legitimate they may appear at first glance. It’s easy for hackers to buy advertising space and run malicious ads online which is why I personally recommend you don’t click on any ads. If you do see a promotion about a product you’re interested in, just head to that company’s page where you’ll likely find it at the same sale price.

When it comes to protecting yourself, you should be using the best antivirus software with your PC, the best Mac antivirus software with your Apple computer and one of the best Android antivirus apps with your Android phone. There’s no equivalent of the last one for the best iPhones but Intego’s Mac antivirus software can scan an iPhone or iPad for malware but only when it’s connected via USB to a Mac. 

Another helpful tool to identify scams is Bitdefender’s own Scamio. This AI-powered scam detector can tell you everything you need to know about whether an email, message or website is actually a scam and you can upload suspicious links, screenshots or even QR codes to the service for evaluation.

The methods hackers use in their attacks and human nature go hand in hand as they often try to exploit our emotions or desire to be the first to try something new. However, by being patient and careful online, you can avoid having your devices infected with malware and your personal data stolen.

More from Tom's Guide

Are Facebook and Instagram down? If you’re wondering whether both these Meta-owned social media platforms are facing service issues, we’re here with the latest outage update. According to Down Detector, the services went down for many users on Tuesday, March 5 around 10 a.m. ET, but have mostly recovered nearly three hours later.

If you look at each chart on Down Dectector’s site, you’ll see sharp spikes, indicating an influx of user-reported outages. As of about 10:30 a.m. ET, Down Detector says the number of outage reports for Facebook execeed 500,000. At the same time, the number of outage reports for Instagram maxed out past 75,000. 

This is far from the first time both Facebook and Instagram suffered from simultaneous outages. As you might expect, this kind of outage also impacts Facebook Messenger and Threads, subsidiaries of both social media platforms. Sometimes, the outages last several hours, and sometimes they're resolved much more quickly.

Although there's not much else to report now that the services are back online, you can see the timeline of events, as well as statements from Meta, below. 

As of 10:33 a.m. ET, the number of users reporting issues with Facebook has exceeded 350,000.

Looking for more information about the outage, users are turning to X with a good sense of humor. 

It seems like the outage reports are trending downward. This would suggest that the issue that caused both Facebook and Instagram to go down is actively being resolved. 

There seems to be concerns online that Facebook accounts have been hacked, and that's why the platform isn't working properly.

No, your Facebook hasn't been hacked. But if you do ever have an issue with someone else accessing your account, make sure you know what to do if your Facebook account is hacked.

As of 11:30 a.m. ET, outage reports for Facebook and Instagram are both trending downward. The number of reports for Instagram dropped below 30,000, and the number of reports for Facebook dropped below 90,000. That's a big improvement, considering that the number of Facebook reports exceeded 500,000 at the height of the outage about one hour ago.

Although outage numbers are trending downward, I just checked my own Instagram and Facebook accounts, and sure enough, both are still having issues.

Using the mobile app via iOS, on Facebook, I'm unable to log in to my account. On Instagram, I'm logged in, but I can't see any new posts posted within the last few hours. When I try to swipe down to refresh my feed, I get 'Couldn't refresh feed' error message you see above.

Meta provides outage update

What has Meta had to say about today's outage? Andy Stone, the company's communications director, posted on X to address the issue:

"We're aware people are having trouble accessing our services. We are working on this now."

In addition to Instagram, Threads is currently down. The Instagram-based X rival isn't nearly as popular as Facebook or Instagram, so the number of outage reports from users fell under 1,000.

I checked my own Threads app, and sure enough, I can't see anything in my feed. I can still view my account and account activity, but I'm unable to see posts from other users. Weirdly, it seems I'm still able to post a new thread. 

There are reports that Instagram, Facebook, and Threads is back up for some users. We've checked for ourselves and a couple of Tom's Guide editors confirm they are able to get access to their accounts.

Service outage web site Down Detector is showing fewer reported outages with Facebook, which could indicate that the service disruption might be nearing its end.

If you were wondering how these service disruptions are effecting its stock value, Meta's stock was trading for as low as $488.10 a share today, but it has since rebounded.

Meta's comms boss, Andy Stone, posted on X (formerly Twitter) that the technical issue has been resolved and the company apologizes for any inconveniences.

Given that all of Meta's services seem to be back online, we're going to wind down this live blog of the outage. If you're still having issues with Facebook, Instagram or Threads, let us know! You can find us everywhere on social @TomsGuide. 

Having your Facebook hacked can be a real headache due to just how hard it can be to recover your account. But now, users of the social media platform are having their accounts suspended even when they’ve done nothing wrong and have the right security safeguards like two-factor authentication (2FA) in place.

As reported by Cybernews, Vietnamese hackers have begun creating fake Oculus Meta accounts which they then link to real Facebook profiles. However, doing so is registered as unauthorized access — likely since the email addresses don’t match — which then leads to a victim’s Facebook account being suspended. 

In a post on X, Dan Astin-Gregory (whose own account was suspended) explains that more than 1,000 individuals have been affected by this campaign so far and that this issue has yet to be addressed by either Meta or its Facebook social networking service. However, this campaign could expand further and the hackers behind it could even hold suspended Facebook profiles hostage by refusing to unlink these fake Oculus Meta accounts.

Here’s what you need to know about this new campaign and why it’s particularly hard to defend against.

Even 2FA can’t help you

The reason social media sites and security writers like myself encourage you to enable two-factor authentication in the first place is to help protect you from account takeover attempts. This is because once 2FA is enabled, a hacker would need access to your email or phone in order to login to your accounts.

Surprisingly in this case, though, 2FA fails to protect Facebook users from unauthorized account linking. Normally, you would need to verify that you are really you before you could link one account to another.

While a Facebook account used to be required to use the Meta Quest 2, this was scrapped back in 2022. Instead, Facebook’s parent company created brand new Meta Accounts so that users of its VR headset wouldn’t be required to sign up for its social media platforms.

If 2FA not working wasn’t bad enough, Astin-Gregory also points out that both Facebook and Meta’s help centers have been slow to respond when it comes to users having their Facebook suspended due to unauthorized account linking. 

Outlook: Meta needs to take action

Although this issue is plaguing a small number of Facebook users, it still needs to be addressed as the hackers behind this campaign are abusing Meta’s platform to cause chaos or quite possibly for their own gain.

As for protecting your own Facebook account, it seems there isn’t much you can do since even enabling 2FA won’t keep your account safe. That said, the best antivirus software can keep you safe from malware and other cyberthreats that could occur as a result of having a fake Oculus Meta account linked to your Facebook. For instance, the hackers may try to send you malicious documents in a phishing email about unlinking your Facebook from one of these fake accounts.

While there have been plenty of Reddit posts about this issue, now that the news is officially out, let’s hope that Meta takes action soon, especially since doing so will lead to far less support tickets on the company’s end.

More from Tom's Guide

• Hackers are using Facebook Messenger to spread password-stealing malware
• This Facebook scam locks users out of their accounts
• Fake Facebook job ads are using malware to steal credit card data and passwords

Searching for your next job on Facebook could leave you with a nasty malware infection, as cybercriminals have begun using fake advertisements for new positions as a lure to trick job seekers into infecting their PCs with malware.

As reported by The Hacker News, these fake Facebook job ads are used to spread the Windows-based Ov3r_Stealer malware. According to a report (PDF) from Trustwave SpiderLabs, this malware strain can collect a user’s location, hardware info, passwords, cookies, auto-fill data, a list of their browser extensions and antivirus software and even their credit card information.

At the moment, it’s still unclear what this new malware campaign aims to accomplish and whether or not all of this stolen data will end up for sale on the dark web. Likewise, Ov3r_Stealer could be updated to act like a malware loader to download and install additional payloads onto a compromised computer.

Whether you’re searching for a new job yourself or know someone that is, here’s everything you need to know about this dangerous new malware strain along with how to protect yourself online during your next job hunt.

From weaponized PDF to malware infection

Just like with many other cyberattacks, this one begins with a malicious PDF file. The document itself is hosted on OneDrive and if a job seeker does download it, they’re urged to click on an “Access Document” button embedded inside.

Following their investigation, Trustwave’s security researchers believe this weaponized PDF file was shared from a fake Facebook account impersonating Amazon CEO Andy Jassy. However, it’s also being distributed via Facebook ads for digital advertising jobs.

If a potential victim does click on the button embedded in the PDF, they are taken to a DocuSign document that then downloads a control panel file (.CPL) which is executed from the Windows Control Panel process binary (control.exe). From here, this CPL file is used to retrieve a PowerShell loader from a GitHub repository which then launches the Ov3r_Stealer.

Besides the attack methods used, this new campaign shares quite a few similarities with a recent cyberattack disclosed by Trend Micro that drops the Phemedrone Stealer. Trustwave believes that Phemedrone may have recently been re-purposed and given the name Ov3r_Stealer. 

How to stay safe when looking for a new job

Job hunting can be hard enough as it is without having to worry about fake job adverts and malware.

In order to stay safe when looking for your next gig, you need to be extra careful online and while Facebook might seem like a decent enough place to look for jobs, you’re better off sticking to trusted job sites like Indeed or ZipRecruiter. However, if you do want to look for a job on a social network, LinkedIn is a much better option than Facebook.

Even though recruiters and job postings may seem legitimate, you still want to avoid downloading files from unknown senders while not giving any unnecessary information away. This is because in addition to malware, phishing attacks can also be used to syphon off personal and financial information from vulnerable job seekers.

For additional protection though, you should download and install one of the best antivirus software solutions on your PC. The same goes for the best Mac antivirus software on your Apple computer. This way, if you do download a weaponized PDF or some other dangerous file, it will be flagged by your antivirus as malicious before you even have a chance to open it. At the same time, it might be worth investing in one of the best identity theft protection services so that you can be protected from fraud in addition to any attempts to steal your identity.

Job seekers are vulnerable to all types of cyberattacks and online scams but if you exercise caution during your search, you’re likely to get a better position without ending up becoming a victim of cybercrime.

More from Tom's Guide

• Facebook scam locking users out of their accounts — don’t fall for this
• I tested 5 AI resume builders to help get a job — here's what happened
• Hackers are using a fake PDF viewer to infect Macs with malware 

Meta, the company formally known as Facebook, wants to make navigating its mobile app even simpler thanks to a Link History setting for its mobile app. This will create a repository of all the links you have clicked on while using the Facebook mobile app. 

Supposedly the Link history setting will be turned on by default, but an initial pop-up will give users the option to turn it off. It is designed to collect and store the links in a single place which will make it easier for users to find and revisit links that they've been to before. Meta is selling this new setting as a useful tool for consumers. Although Facebook has made it clear that if users allow Link History, then it may use the information to improve the ads seen across the app. 

For the most part, the option to keep track of all the links might appear as a positive, but Facebook has been known to harvest data before and this may be another method to do so while remaining GDPR compliant. There is an interesting parallel between this method and Google's recent drive to remove third-party cookies. 

The question is how both companies could use this data and what threat it may pose to the user. Initially, the main worry will come from the companies selling this data to interested parties, but it is quite strictly regulated under EU law. Facebook has made it clear that it will delete the saved Link History after 30 days, but exactly how that might affect the ads shown has not been mentioned.

Meanwhile, Google has aimed to completely remove the option to choose third-party cookies from any site visited on Chrome as a part of their new privacy sandbox initiative. For those who have not heard the phrase before, cookies are essentially compiled data about you that is designed to improve the experience on each site and create targeted ads based on your preferences.

One of the odd aspects of the Link History setting is that it is not currently on offer for desktop versions of Facebook, and it is not clear if it would still come into effect when using the site through a browser over the official app. However, Facebook and Meta have made it clear that they are aiming to introduce the feature across both iOS and Android in the next few months.

With the current crackdown on data mining and customer protection, it is up to big companies to find new ways to build databases. While Google’s option involves more security, it still puts most of the data in their hands, which is the same as Meta’s new link history. Seeing the end of cookies and being able to revisit links with ease seem like good additions, but it will have to be monitored closely to protect the average user.

More from Tom's Guide

• This thief stole hundreds of iPhones and drained users’ bank accounts — 3 essential tips for staying safe
• Mobile apps have taken a turn for the worse in the past year — here's why
• My favorite 10 iPhone apps to download to your new iPhone

Meta is rolling out new AI tools across its products including an image generator, a new way to collaborate on editing photos, and improved birthday greetings in Facebook.

The social media giant was an early investor in generative AI technology as part of its wider plan to bring about the metaverse. It also made its large language model LlaMA available open-source and contributed to much of the underlying technology.

Over the past year the company has started commercializing this research and its latest offerings will see generative AI embedded across Facebook, WhatsApp, and Instagram.

So, what are they launching?

New AI tools and products are launching in search, social discovery, ads, business messaging as well as the full suite of consumer products. This includes better collaboration, automation, and image generation capabilities.

Many of these are built on the Meta AI virtual assistant, designed to answer questions, generate photorealistic images, and be built into other Meta-owned products. Inside WhatsApp, Instagram messages, or Messenger simply type @MetaAI in a group chat and ask it to make something.

The company has also launched a new Meta-branded, standalone product called Imagine. It is a simple image generator along the same lines as Midjourney, DALL-E, or Stable Diffusion. A text prompt and generate button which, when clicked, creates the image you requested

What are some of the highlights?

Several new generative AI services and features are coming from Meta in addition to Imagine. Most of these are built into existing products. Here are the ones I think stand out from the crowd.

More from Tom's Guide

• Nothing Chats just got pulled from Google Play store over security concerns
• Hackers now spreading Mac malware via fake browser updates — don’t fall for this
• Best Black Friday streaming deals now— Hulu, Paramount Plus, Max and more

Wondering how to change your name on Facebook? Whether you've adopted a new alias, married recently and changed your last name, or just want to update your profile, it’ll help to know how to alter your Facebook name to keep your digital presence accurate. 

Although the process takes just a few steps, it can feel long-winded if you don’t know where the right settings are. In this guide, we’ll show you how to change your Facebook name on both desktop and mobile devices. We also briefly touch on what’s not permitted according to Facebook’s policy.  

And if you want to update your Instagram profile, we’ve covered how to change your name on Instagram.

How to change your name on Facebook using a computer browser

Note: You can change your Facebook name only once every 60 days.

How to change your name on Facebook using the iOS and Android apps

Changing your Facebook name on iOS and Android is quite similar to the process on the computer browser. There may be very slight variations between iOS and Android, but it should be more or less the same. Either way, we'll point out where things differ. We've demonstrated the process below using the iOS app.

What isn’t allowed while setting a name?

According to Facebook, the following aren’t allowed in names: 

a. Unusual capitalization, numbers, symbols, punctuation, or repeating characters.

b. Words or phrases instead of names.

c. Suggestive or offensive words.

d. Characters from multiple languages.

e. Titles of any sort, whether religious, professional, or anything else.

Now that you’ve successfully changed your name on Facebook, your friends and connections will see your updated name on their feeds and in searches. For more on Facebook, explore our guides on how to deactivate Facebook, how to make your own Facebook avatar, and how to sell on Facebook Marketplace.

Meta has revealed a pair of new generative AI tools that will let Instagram and Facebook users make videos from a simple text prompt — or make changes to an image with an equally simple text prompt.

Known as Emu Video and Emu Edit, the new features use the same technology that powers sticker creation in WhatsApp and other image-generation capabilities inside Meta products.

Crafting a video with Emu will be as simple as telling it what you want the video to look like — this could include turning a static image into an animated GIF or short clip for Reels.

How does it work?

Mark Zuckerberg announced the products in a Reels video posted on Facebook — the short clip featured the Meta CEO playing with his dog on a patch of grass slowly turning into a panda, then a panda in the jungle, and finally a pair of dancing pandas in a disco.

Emu is a massive foundation AI model that is being integrated across Meta's social and communications products and services. The latest features add video for the first time — giving users a simple way to craft content without having to open a camera or learn how to animate.

The other exciting development is editing existing images. Emu Edit can be used to add or remove text from a photo you already have in your camera roll, it could allow you to add a new object into the image or change it completely, maybe placing your phone on the Moon.

Why do we need it?

Image generation with AI can be something of a dark art. You enter a prompt and hope it comes out the way you expect but if not you enter further prompts until it is close enough. Emu Edit is more free-form, according to Meta. It works through multiple tasks and instructions.

It can remove or add a background, change colors and the geometry of the whole image or any individual part, it can detect parts of an image and change them. Basically, it has the capacity to give even the least technical the ability to make complex changes to images.

Meta wrote in a blog post: “While certainly no replacement for professional artists and animators, Emu Video, Emu Edit, and new technologies like them could help people express themselves in new ways."

Adding that this could include an "art director working through a new concept or a creator livening up their latest reel" through to "a best friend sharing a unique birthday greeting."

We are starting to see the fruits of years of research into artificial intelligence come to the public sphere. Whether it is Google adding the ability to clone the voices of your favorite musical artists in YouTube, or Meta letting you turn your dog into a dancing panda — this is just the start.

More from Tom's Guide

• OpenAI is building next-generation AI GPT-5 — and CEO claims it could be superintelligent
• Windows 11 Copilot — 7 best things you can do with Microsoft's AI assistant 
• OpenAI launches custom chatbots — this is how they work and what they can do

Hackers have devised a clever new way to trick unsuspecting Facebook users into downloading malware on their computers.

While having your Facebook hacked is bad enough as it is, a new campaign discovered by Bitdefender uses compromised Facebook Business accounts to deliver the NodeStealer malware. 

Just like with other info-stealing malware, NodeStealer targets Windows PCs with the goal of stealing browser cookies as well as saved usernames and passwords which can then be used to compromise a user’s other online accounts. 

According to a blog post from Meta’s engineering team, previous NodeStealer campaigns have used malicious documents to distribute this dangerous malware. However, this time around, hackers are now using malicious ads to do so. 

Here’s everything you need to know about this latest NodeStealer campaign and why you might want to think twice before clicking on any ads you see online.

Duping Facebook users with fake photo albums

During its investigation into this new NodeStealer campaign, Bitdefender found that the hackers behind it have come up with an interesting way to get potential victims to click on their malicious ads.

In a blog post detailing its findings, the firm’s security researchers explained that NSFW ads are the main lure used in this campaign. These ads are for Facebook pages which feature scantily clad women as male users are the targeted demographic.

Bitdefender found a number of fake Facebook profiles using “Album Update”, “Album Girl News Update”, “Private Album Update”, “Hot Album Update Today” or other similar names. These profiles feature one or two photos of young women where their faces or NSFW outfits are censored.

Once these fake profiles are set up, the hackers then begin running ads on Facebook to promote their content with short descriptions like “New stuff is online today” or “Watch now before it’s deleted” to instill a sense of urgency and get unsuspecting users to click on them. 

When a potential victim does click on one of these ads, instead of getting access to an album full of NSFW photos, they instead download a Windows executable. While most people know the dangers of running a “.exe” file downloaded from an untrusted source online, many don’t and the hackers are counting on this.

Instead of a NSFW photo album, the executable installs the NodeStealer malware on their computer and then proceeds to steal any passwords or cookies stored on the device. 

How to stay safe from malware delivered via ads

With this campaign in particular, the victims should have recognized the dangers of downloading NSFW photos from a suspicious-looking Facebook profile they saw in an advertisement. However, there are many other similar campaigns that use malicious ads for legitimate products to infect unsuspecting users with malware.

This is why you always want to be careful when clicking on ads online. Besides on Facebook, malicious ads have also started to appear on Google Search which is why you’re better off avoiding ads altogether. Instead, if you see a deal on a product you’re interested in an ad on a social network or even in a search engine, you’re better off navigating to the retailer’s webpage yourself and manually searching for it.

At the same time, you also want to be using the best antivirus software on your PC, the best Mac antivirus software on your Mac or one of the best Android antivirus apps on your Android smartphone to protect yourself from malware. Likewise, if you’re really worried about hackers, it may also be worth investing in one of the best identity theft protection services as they can help you deal with fraud and getting your identity back if it’s stolen online.

With Black Friday just around the corner, you can bet that hackers are going to capitalize on all of the extra holiday shopping with even more malicious ads. For this reason, you’re better off getting help finding deals from Tom’s Guide or other trusted news sites.

More from Tom's Guide

• These Android adware apps with over 2 million downloads put you at risk
• The FBI now recommends using an ad blocker — here’s why
• Hackers are using Google Ads to steal your info and drain your accounts 

Getting your Facebook hacked can be an absolute nightmare since it’s often quite difficult to restore access to your account—which is why this scam currently making the rounds online is one you want to look out for.

As reported by Cybernews, this particular scam isn’t new as it’s been used by hackers since the beginning of this year. However, it appears to have grown in scale in recent weeks with even more Facebook users reporting that they’ve fallen for it and haven’t been able to recover their accounts on the social media platform.

This particular scam isn’t isolated to Facebook though and we’ve seen Instagram users hit with similar fake copyright infringement notices in the past. With Facebook having been around longer than Instagram though, the platform’s users have a lot more photos, memories and contacts to lose if their accounts are stolen by scammers.

If you’re unfamiliar with copyright infringement scams, they involve someone sending you an email or message saying that they are the rightful owner of a photo or video you posted online. They then threaten to take legal action against you if the photo or video in question isn’t removed. However, as you likely didn’t infringe on their copyright, the message is actually a lure to lead you to a phishing site instead.

Here’s everything you need to know about this Facebook copyright infringement scam and how you can avoid falling victim to it.

Appealing is the last thing you want to do

This copyright infringement scam begins with an email that appears to be from Facebook at first glance. However, upon closer inspection, it’s clear that this message did not originate from the company as the sender’s address is fake. 

The message itself says that a user’s account has been suspended because they didn’t follow the social network’s Community Standards, as a photo was recently uploaded from their account that violates someone else’s copyright.

At the bottom of the email, there’s a link that users can click on to submit an appeal about their account being permanently disabled if they don’t take action within 24 hours. This adds a sense of urgency to the message and could be enough to convince an unsuspecting user to click on it. However, doing so leads to a phishing site designed to harvest their Facebook credentials.

Of those who fell victim to this scam recently, one user had their account renamed to “Meta Copyright Infringement” while others saw explicit or violent content shared from their now hacked accounts. 

How to stay safe from Facebook phishing scams

Besides losing access to the Facebook account they’ve been using for years, many victims have found it to be very frustrating when dealing with Meta while trying to get their accounts reinstated. For instance, one user sent countless emails to the company’s support team and didn’t hear anything back.

For this reason, you need to learn how to identify these kinds of scams and others like them so that you can avoid falling victim to them in the first place. When an email like this lands in your inbox, the first thing you should do is stop and take a moment to think through the situation. If a message claims you posted a photo that was copyrighted, think back to what you’ve posted in the last few days or better yet, open your account and scroll through your recent posts. You likely won’t find anything that fits the description provided in the email, which means you can ignore it entirely.

When it comes to phishing emails like the one described above, you want to avoid replying to them or clicking on any links they contain. Responding lets the scammers know their bait worked while clicking on links in the message could take you to malicious sites known for spreading malware. At the same time, you definitely don’t want to download any attachments as they too can contain malware.

As for keeping your Facebook account safe, you want to ensure you’re using a strong, complex password and not reusing passwords across multiple accounts. Password reuse is a dangerous habit as once hackers get the credentials for one of your accounts, they can then access your other accounts. If you have trouble coming up with passwords or remembering them, then one of the best password managers is worth investing in as they can generate as well as securely store all of your passwords for you. It may also be a good idea to look into the best identity theft protection services as they can help you recover your identity and any funds lost to fraud.

Facebook is one of the largest social networks there is and since it’s been around for so long, scammers will continue to try and trick users into handing over their usernames and passwords. This is why you need to remain vigilant for these kinds of scams and it’s also a good idea to routinely change your password just to be safe.

More from Tom's Guide

• Google makes passkeys the default to get you to ditch passwords 
• ChatGPT now being used in dating apps to catfish users
• FBI warns phantom hacker scams are emptying financial accounts

One of the best and worst things about social media platforms like Facebook is that anyone can send you a message. While most of the time these unsolicited messages will come from old classmates and friends, they can also be sent by hackers.

As reported by BleepingComputer, hackers are using a massive network of fake and hacked Facebook accounts to send out phishing messages with the end goal of tricking people into installing password-stealing malware.

While this new campaign discovered by Guardio Labs is specifically targeting Facebook Business accounts, it still highlights the risk of opening and responding to unsolicited messages on Facebook and other social media platforms.

Using Facebook for phishing

Just like with other phishing campaigns we’ve observed in the past, this one uses copyright violation notices to get the attention of vulnerable business owners. However, information on particular products sold by a business is another lure being used in this campaign.

Following their initial messages, the hackers send over a batch file as a RAR or ZIP attachment with the hope that unsuspecting users may download and launch it. If they do, the batch file then fetches a malware dropper from GitHub to infect their systems with password-stealing malware.

Alongside the payload, the batch file also downloads a standalone Python environment that allows the malware to gain a foothold on an infected computer by executing each time the system starts up. As Guardio Labs points out in a blog post detailing its findings, the payload has five layers of obfuscation which makes it difficult for even the best antivirus software to detect it.

After infecting a vulnerable computer, the malware used in this campaign collects all of the cookies and login data stored in a victim’s browser. This information is then compiled into a ZIP file and sent back to the hackers responsible using Telegram or the Discord bot API. However, the malware goes a step further by wiping all cookies from a victim’s computer to log them out of their accounts. This gives the hackers the time they need to change the passwords to all of a victim’s accounts and take them over.

According to Guardio Labs’ researchers, around 100,000 phishing messages are sent out each week targeting Facebook users in North America, Europe, Australia, Japan and Southeast Asia. To make matters worse, 7% of all Facebook Business accounts have been targeted, though just 0.4% have downloaded the malicious file used to infect their systems with malware.

How to stay safe from phishing campaigns spreading malware

Just like when checking your inbox, you need to be extremely careful when dealing with messages on Facebook and other social media sites from unknown senders.

To determine if a message is genuine or not you should look out for red flags like misspelt words and poor grammar along with a sense of urgency. The last one is the most important as hackers often try to use your emotions against you in order to trick you into clicking on their messages or downloading the attachments they’ve sent you.

In the campaign described above, the hackers responsible used fake copyright violations as a means to create a sense of urgency. Facebook Business users that are worried about being hit with a copyright lawsuit might download and open the attached batch file without thinking, which is an easy way to infect their systems with malware. Even if you’re not a business owner, you shouldn’t open any attachments or even images sent to you from someone you don’t know on social media.

Malware can often evade antivirus software and for this reason, you may also want to invest in one of the best identity theft protection services as they can help you recover from any financial losses suffered as a result of fraud or online scams.

With three billion users worldwide as of August of this year according to Statista, Facebook remains one of the most popular social media platforms. Unfortunately though, its massive size and user base means that it will likely continue to be a treasure trove for hackers. However, it’s up to you to read your messages carefully and avoid opening and responding to any that appear to come from hackers.

More from Tom's Guide

• Urgent Apple zero-day flaws hit iPhones and Macs — update right now
• My wife almost fell for this Facebook Zelle scam — watch out
• Hackers use this clever trick to take you to phishing sites — can you spot it?

Threads has arrived on the social media scene, but if you've downloaded the app and are wondering why your feed is full of people you don't know, then don't worry. Tom's Guide has been using Threads since it launched and we're here to show you how to see Threads from people you follow first with this quick hack.

Threads is Instagram's new rival to Twitter. Created by Meta, which also owns Facebook, the latest social media platform lets you write, share, and respond to posts in up to 500 characters. 

If you're already an Instagram user, then when you sign up to Threads, you're presented with an instant following. 

But users who downloaded the app when it was released earlier this week were in for a bit of a surprise. 

Instead of a feed full of familiar faces, they were met with Threads from total strangers. While this feature is a great way to discover new people to follow and content, for some, it felt like a party where only one or two faces were familiar. 

Unfortunately, there's no way to limit your Threads timeline to just those you're following like there is on rival Twitter. 

While Meta has confirmed that this is a feature they will roll out in the near future, for now, we have a hack that will filter your notifications and threads to just those you follow. 

How to change your Threads to show people you follow first

Read on to see detailed instructions for each step.

Threads may be new on the block, but here at Tom’s Guide, we’ve got you covered with the best advice on how to use it. If you’ve not joined the Threads craze yet, then here’s how to download Threads and sign up for your account. If you love Threads and are done with Twitter, then here’s how to delete your Twitter account. But if you’re done completely, here’s how to deactivate your Threads account without deleting your Instagram. 

Facebook has gone to new lengths in its push to keep users on its platform at all costs. And content publishers are now being treated as if they are peddling malware. 

I recently came across the below warning when trying to click out to an article on Tom's Guide's Facebook page, and the level of warning looks pretty dire. 

If I were an everyday Facebook user, I would immediately question my decision to click that link. The bolded text says "You're going to a link outside Facebook," which to me feels like something you shouldn't do in the context of this warning. 

Then there's the two prominent buttons. One is Go Back, which might as well read Go Back to Safety. And there's Follow Link. At least Facebook highlights that button. But ultimately I would not be shocked if many users just decide to Go Back.

I asked Facebook to comment on this external link alert and have yet to receive a response. 

How do I know people are alarmed by this warning? Lots of publishers are feeling the pain from what appears to be a new algorithm change that is de-prioritizing content publisher links.

A report from Echobox confirms that major publications such as Buzzfeed in the U.S. and Reach in the U.K. have been impacted by falling social page views. The report includes a Social Media Index (SMI) that shows the percentage of traffic that originates from social media platforms. That overall number has dipped from a high of 15% in the middle of 2022 to just 7% to 8% in early June 2023. That's a decline of about 50%.

Echobox notes that these types of patterns tend to be cyclical, but there's something very different about posting this type of alert to those who willfully click on external links. It's a very transparent attempt to scare Facebook users into thinking that going outside of the platform is unsafe.

The background to all of this is that Facebook is rejecting calls from politicians and publishers for parent company Meta to pay for the content that is engaging its users. Meta has gone as far to block news content in Australia, and it has tested doing the same in Canada. Facebook reversed its stance in Australia after the government there made some media code amendments. 

Now Meta says it will block all news articles in California if that state passes a bill designed to funnel money from tech platforms like Facebook to media organizations. The California Journalism Preservation Act would tax advertising profits social platforms make from distributing news articles. The measure stipulates that about 70% of the money collected from the "usage fee" would go to support newsrooms. 

As Echobox also reports, Facebook is also trying to pivot to video by promoting more reels in an effort to better compete with TikTok. 

The editor in chief of Insider shared a pretty blunt assessment of the situation, as reported by Gizmodo, in a company-wide email. "Traffic is down, Subs are down. Video views are down....I'm talking about a changing reading and watching environment where Facebook is no longer sharing links."

Look, Facebook has every right to do what it wants with its platform, including prioritizing video over text links. But installing an additional hurdle like this — one that is explicitly designed to get people to second guess reading an article they find interesting — is a step too far.

More from Tom's Guide

• How to deactivate Facebook
• 'Look who died' scam is making the rounds on Facebook — don’t fall for this
• What to do if your Facebook account Is hacked

Death is a part of life, but the news that someone you know may have died is now being used against you. Scammers have been caught using it as a phishing lure on Facebook to trick users — and get them to hand over their accounts.

According to the cybersecurity company DataProt, the ‘Look who died’ scam is currently making the rounds on Facebook. Like other phishing scams, this one uses a sense of urgency to pique the curiosity of unsuspecting users on the social media platform.

This phishing scam begins with a Facebook message from one of your friends, with the subject line “Look who died.” It then provides a link to a news article supposedly about someone you know. As you may have guessed, the article is fake, and it takes you to a phishing site.

Victims are prompted to enter their Facebook username and password to read the article. While giving up this information freely is an easy way to have your Facebook hacked, the cybercriminals behind this scam could also use it to install malware on your devices.

Another thing worth noting about this scam is that once the hackers have one person’s credentials, they then use them to sign in and lock them out of their accounts. With a brand new account in hand, they then forward the message to the victim’s friends, hoping to get even more people to fall for this scam.

How to stay safe from phishing on social media

Just like when checking emails in your inbox, you need to be careful when opening and responding to messages on Facebook and other social media sites.

Even if a message appears to come from a friend (as it does in this case), you still want to avoid clicking on any links. At the same time, you want to be mindful regarding the last time this person messaged you. If you message each other frequently, everything may be above board but if this is someone you haven’t talked to in a long time, there’s no telling whether or not their account has been compromised. Instead of your friend or family member, you could be talking to a hacker.

To stay safe from malware and other viruses spread through phishing attacks, you want to make sure you have the best antivirus software installed on your PC, the best Mac antivirus software on your Mac and one of the best Android antivirus apps on your Android smartphone. This way, if you do accidentally download malware, your data and devices will be protected. If you’re really worried about being hacked though, investing in one of the best identity theft protection services can help you recover from identity theft and get your life back.

From dead relatives and friends to unpaid invoices and QR codes, scammers have all kinds of tricks up their sleeves to gain access to your accounts and the data they contain. This is why you need to remain vigilant on social media and when responding to messages in general. Clicking on one link and letting your emotions get the best of you is all it can take to fall victim to a phishing scam like this one.

More from Tom's Guide

• 3 ways scammers are trying to trick you on social media
• My wife almost fell for this Facebook Zelle scam
• Gmail adds blue checkmarks to fight phishing and scammers

Following the success of OpenAI’s ChatGPT, Microsoft’s Bing Chat and Google Bard, researchers have created a new AI model with a much darker twist.

While the large language models (LLMs) that power ChatGPT and Google Bard were trained on data from the open web, DarkBERT was trained exclusively on data from the dark web. Yes, you read that correctly, this new AI model was trained using data from hackers, cybercriminals and other scammers.

A team of South Korean researchers have released a paper (PDF) detailing how they made DarkBERT using data from the Tor network, which is often used to access the dark web. By crawling through the dark web and then filtering the raw data, they were able to create a dark web database that they used to train DarkBERT.

Surprisingly, DarkBERT has already managed to outperform other large language models despite being trained on data from a very unlikely place.

Giving an old AI architecture new life

Although DarkBERT is a new AI model, it’s actually based on the RoBERTa architecture, which is an AI approach developed back in 2019 by researchers at Facebook according to our sister site Tom’s Hardware.

In a research paper detailing the inner workings of RoBERTa, Meta AI explains that it is a “robustly optimized method for pretraining natural language processing (NLP) systems” that improves upon BERT (Bidirectional Encoder Representations from Transformers), which was released by Google back in 2018. As the search giant made BERT open source, Facebook’s researchers were able to improve its performance in a replication study.

Thanks to Facebook’s optimized method, it released RoBERTa which was able to produce state-of-the-art results on the General Language Understanding Evaluation (GLUE) NLP benchmark.

Now though, the South Korean researchers behind DarkBERT have shown that RoBERTa is able to do even more as it was undertrained when it was initially released. By feeding RoBERTa data from the dark web over the course of almost 16 days across two data sets (one raw and the other preprocessed) the researchers were able to create DarkBERT.

Fortunately, the researchers don’t have any plans to release DarkBERT to the public. However, they are accepting requests for academic purposes according to Dexerto. Still, DarkBERT will likely provide law enforcement and researchers with a much better understanding of the dark web as a whole.

How to stay safe when using AI chatbots

Just like with any other software or online service, you need to be careful when using AI chatbots as you could get a malware infection from fake ChatGPT apps or even expose sensitive data like employees at Samsung recently did.

This is why you want to ensure you’re actually going to the correct website when using these popular AI chatbots. If you’re looking for a ChatGPT, Bing Chat or Google Bard app, you won’t find one yet as OpenAI, Microsoft and Google have yet to release official apps for their AI chatbots.

Likewise, you don’t want to click on any links in suspicious emails claiming to take you to an AI chatbot or that help you get access right away. Scammers are well aware of the current AI chatbot craze and are taking advantage of it in their attacks right now. At the same time, ads about AI chatbots are also to be avoided as cybercriminals often abuse Google Ads and other ad services to take unsuspecting users to phishing sites.

For extra protection when experimenting with AI chatbots, you should be using the best antivirus software with your PC, the best Mac antivirus software with your Mac and one of the best Android antivirus apps on your smartphone. This way, if a link to an AI chatbot does lead to malware, your antivirus will catch it first before your devices can get infected.

DarkBERT could represent the future of AI models that are trained in one specific area to make them much more specialized. Given its popularity so far, we wouldn’t be surprised if we see similar AI models developed in this way going forward.

More from Tom's Guide

• ChatGPT just got an official iPhone app — how to try it now
• PassGAN AI can crack your passwords in seconds
• These AI-generated YouTube tutorials are spreading dangerous malware

Having a Facebook account is finally going to pay off as the social media site’s parent company, Meta, has agreed to a $725 million settlement in the Cambridge Analytica class-action lawsuit — and you could be owed a cut of the cash. 

If you had a Facebook account between May 24, 2007, and December 22, 2022, and lived in the U.S. during that time, you are eligible to claim a share of the settlement. Even if you deleted your account during that period you are still entitled to a small percentage of the eye-watering settlement. 

In order to request your cut of the settlement, you’ll need to fill in this online claim form. You have until 11.59 p.m. PT on August 25, 2023, to submit your claim. 

The form is pretty comprehensive requiring a full name, current address, email, telephone number and payment details. Considering the reason for the settlement, you might want to pause before handing over so much personal information. 

It’s estimated that around 280 million Facebook users are entitled to a share of the settlement, so some quick napkin math will tell you won’t be getting rich here. 

In fact, considering you may only receive a few dollars for your efforts, you might feel the time required to fill in the form isn’t worth the meager monetary reward.  

However, the fewer people who take the time to fill in the form, the smaller the pool of Facebook users that will split the settlement after the deadline is up. So, if you’re willing to sacrifice some personal data, you could end up getting even a couple dozen dollars. Plus, you'll enjoy the satisfaction that comes with receiving some compensation for Meta’s failure to protect your private details. 

Here's why Facebook owes you money

If you’re out of the loop, the Cambridge Analytica data leak scandal broke five years ago when journalists discovered that the named political research firm had collected and shared the private information of more than 87 million Facebook users and that the social media giant had failed to notify users of the data breach. After several years of litigation, a settlement was reached between Meta and its users, and that’s how we’ve arrived here. 

So, if you feel particularly aggrieved that your personal data may have been harvested and shared without your express consent, then this is your chance to get a little financial compensation. Just don’t expect to receive a sum of money that will be particularly significant.

On paper, a $725 million settlement seems like an almost incomprehensible amount of money, but there are a lot of parties that have been wronged in this case and each individual is owed a share of the agreed-upon sum. 

More from Tom's Guide

• How to deactivate your Facebook account
• iPhone 15 — all the rumors so far
• CatGPT is the best use of AI yet

Knowing how to deactivate Facebook is important if you need to take a break from but not delete your Facebook account. You may decide to go on and get rid of your account (social media can be draining at times and it’s important to look after yourself) but if you just want some breathing room, deactivating can help. 

Deactivated Facebook accounts will hide both your profile and timeline from searches and while you won’t be able to post, you are still able to access Facebook Messenger and old messages will be visible to the recipients. 

If you’re sick of social media, this is a great way to keep in touch with friends but also stay private.

How to deactivate Facebook

1. Select your Profile Picture
2. Select Settings and Srivacy -> Settings
3. Select Your Facebook Information
4. Select Deactivate and Continue to account deactivation
5. Follow the instructions and select Deactivate

Read on to see detailed illustrated instructions for each step.

There you go! Now if you want to reactivate your account, just go to the same menu, click Reactivation, and then select Reactivate. 

If you're looking to become a Facebook expert check out How to make your own Facebook avatar, How to hide Likes on Facebook or How to send a GIF in Facebook Messenger.

More from Tom's Guide

• ChatGPT Explained Everything you need to know about the AI chatbot
• The best phones right now
• How to subscribe to Twitter Blue — get a blue checkmark and exclusive features

ChatGPT's ever-increasing popularity means more and more people want to try out the innovative chatbot. Which, in turn, makes them attractive target for cybercriminals. 

While fake ChatGPT apps were recently used to spread malware and steal passwords, this time around, hackers are using a browser extension called “Quick access to Chat GPT” as a lure to dupe unsuspecting users, according to a new blog post from the online privacy firm Guardio.

Unlike those fake ChatGPT apps though, the extension, which has since been removed from the Chrome Web Store, does actually give users access to the chatbot. However, in doing so the extension also steals all of the cookies stored in your browser, including security and session tokens for services like YouTube, Twitter and even your Google account.

With this information in hand, the hackers behind the extension can steal your passwords and access your online accounts, though Facebook accounts is what the extension is really after.

Targeting high-profile Facebook business accounts

As CyberNews reports, the hackers behind the extension are paying close attention to users that have high-profile Facebook business accounts. This makes sense as attackers often go after both Facebook business and LinkedIn accounts due to how valuable they can be.

Besides having their Facebook hacked, users that download the extension will have their accounts on the social network hijacked by bots who use it to spread “Quick access to Chat GPT” even further.

To make matters worse, the hackers behind this campaign have even found a way to bypass Facebook’s security by renaming requests to its servers made through Meta’s Graph API. This allows them to manage a victim’s “connected WhatsApp and Instagram accounts” according to Guardio’s security researchers.

Since so much of our work and daily lives now takes place within a web browser, you need to be extremely careful when downloading and installing new browser extensions. Just like with malicious apps, bad extensions do manage to slip through the cracks from time to time. This is why you should always look at an extension’s rating and reviews on the Chrome Web Store before downloading it. However, you should also look for external reviews on other sites or even video reviews that show an extension in action before you click “Add to Chrome”.

How to safely and securely access ChatGPT

Hackers are well aware of the latest trends as they use them to create new phishing campaigns and other cyberattacks. Normally, they try to instill a sense of urgency to get you to click or download something but in this case, ChatGPT has done their work for them. 

If you do want to get ahead of the line and get early access to ChatGPT, the only way to do so is by signing up for ChatGPT Plus for $20 a month or by meeting all of the requirements to get early access to Microsoft’s Bing with ChatGPT.

As for browser extensions for ChatGPT, there isn’t an official one yet. In fact, you can currently only access OpenAI’s chatbot online at “chat.openai.com”. This may change in the future but when it does, there will be plenty of announcements and news articles about a new way to access ChatGPT.

If you’re the kind of person who just can’t wait and is looking for quick ways to access ChatGPT, you probably want to make sure that the best antivirus software is installed on your PC or the best Mac antivirus software on your Apple computer. This way, if you come across a scam like the one detailed above, you’ll be safe from malware and other viruses.

Until ChatGPT can be accessed by anyone without having to join a waitlist or wait in a queue, hackers will likely continue to come up with new ways to use the popular chatbot as a lure.

More from Tom's Guide

• Millions under threat from malicious browser extensions — what to do
• 3 Google Chrome features to activate now if you want to stay safe online
• How to run a Safety Check in Google Chrome

Getting your Facebook hacked is bad enough as it is but a newly discovered malware campaign is making the rounds online that not only hijacks your Facebook and YouTube accounts but also steals your passwords.

The malware in question has been dubbed S1deload Stealer by researchers at Bitdefender’s Advanced Threat Control team in a new report after it was detected by the company’s antivirus engine. In order to avoid detection, it uses DLL sideloading to infect a victim’s PC.

A combination of social engineering and comments on Facebook pages are used to spread S1deload Stealer which is distributed through photo archives with adult themes. If a Facebook user downloads one of these archives and unzips the image folder, they are greeted with a signed executable that uses a valid Western Digital signature and a malicious DLL that contains the final payload according to BleepingComputer.

Although an executable file should be a dead giveaway that something is amiss, so far Bitdefender has detected over 600 unique users whose PCs have been infected with the S1deload Stealer malware.

Creating a feedback loop to infect more PCs

Once installed on a victim’s PC, S1deload Stealer then receives instructions from a command and control (C&C) server operated by the cybercriminals behind this campaign.

According to Bitdefender, the malware can download and run a number of additional components including a headless Chrome web browser. This browser runs in the background and is used to boost the view counts of both YouTube videos and Facebook posts.

However, S1deload Stealer can also deploy a stealer that is capable of decrypting and downloading saved credentials and cookies from a victim’s browser. The malware even deploys a cryptojacker that uses the infected PC to mine for cryptocurrency which can seriously slow down a victim’s system.

When S1deload Stealer does manage to steal a victim’s Facebook account, it then uses the Facebook Graph API to determine the value of the account based on whether or not they are an admin of a page or group, if they pay for ads or if their account is linked to a business manager account.

With a user’s Facebook credentials in hand, S1deload Stealer creates a feedback loop by spamming other accounts in order to infect additional PCs almost like a botnet. From here, its creators earn money by selling services to boost other people’s Facebook or YouTube accounts.

How to stay safe from malware in social media posts 

Whether it’s on Facebook, YouTube, Instagram, Twitter or any other social media site, you need to be careful when clicking on links from unknown sources since you don’t know where they’ll take you. This is especially true when the person who created the post uses a URL shortener.

For this reason, you should always inspect links in your browser before clicking on them. On a computer you can do this by hovering over the link and on mobile you can long press on a link to see where it will take you. Still, it’s best to avoid clicking on links in social media posts when you can.

With this new S1deload Stealer campaign though, the victims accidentally downloaded malware onto their own systems. However, they shouldn’t have run the executable file contained in the archives after unzipping them. As a general rule of thumb, you should never run executables from unknown sources as doing so is an easy way to infect your computer with malware or other viruses. If you have to though, you should ensure that you're running one of the best antivirus software solutions on your computer.

While Bitdefender has now brought attention to the S1deload Stealer, the feedback loop this malware creates will likely help it continue to spread on social media.

I frequently write about all the ways scammers are trying to trick you on social media. So imagine my surprise when my wife almost fell victim to an online scam over the holidays. 

As our son is getting older and outgrowing some of his baby toys, my wife thought it would be a good idea to try and sell some of them online to make room for his new presents from Santa. While she’s well aware of phishing emails and how to spot them, she didn’t expect to be scammed when trying to sell a few items on Facebook Marketplace.

Although we typically expect to encounter scams when buying new products, you can also be scammed when trying to sell your old ones on Facebook Marketplace, Craigslist or other online platforms.

Zelle scams on Facebook Marketplace

According to a recent study from BeenVerified, scams on Facebook Marketplace have increased by 184.8% in the past year. Likewise, Zelle scams have seen an 86% increase during that same time period.

The scam my wife encountered leveraged the size of Facebook Marketplace to try and trick her and other sellers into responding to phishing emails impersonating Zelle. This isn’t the first time we’ve seen Zelle scams in the wild, though previous scams have involved users receiving a text message warning about a “fraud alert” on a pending payment made through the mobile banking app.

In my wife’s case though, a buyer quickly responded to her listing about one of my son’s baby toys on Facebook Marketplace. They explained that they really wanted the item and asked if they could pay for it using Zelle. As Zelle has become increasingly popular due to the fact that it’s used by many U.S. banks including Chase, Bank of America, Citi, TD Bank and others, she agreed, as she was in a hurry to sell the old toys before Christmas. 

The scammer capitalized on this and tried to invoke a sense of urgency by repeatedly asking her if she had received the payment yet. She told the scammer she hadn’t received the payment to which they insisted she check her spam folder, a major red flag. Why would an email from a reputable payment service end up in your spam folder and not your inbox? 

Upon checking her spam folder though, my wife found an email that — at first glance — might appear that it had actually come from Zelle. It used Zelle’s logo at the top of the email and a live chat icon at the bottom. The email itself said that the $40 sent by the scammer couldn’t be deposited into her account because it was more than her account limit since she wasn’t a business user.

It was then that my wife realized something phishy was going on and she turned to me for help. After receiving the forwarded email, the first thing I did was check the email address. Sure, it showed up as Zelle Pay at first but upon further inspection, Zelle — or any other company — would never use a personal Gmail address like “zelleonlinetransaction002@gmail.com” for official business. We also checked her online banking app just to be sure and found no sign of the $40.

The email also contained a button that likely led to a phishing page, but my wife knew better than to click on it as I’m constantly warning her about the dangers of clicking on links in emails or text messages.

The scammers kept coming

We blocked the buyer on Facebook and resumed our dinner when messages from other buyers began pouring in. At this point, we thought we were finished with scammers — but boy were we wrong.

One of the potential buyers asked my wife to share her phone number but when she declined, they left the group for the item immediately. Another person asked if an item was still available but when my wife explained that she was just dealing with a scammer, they too immediately left the group.

These scammers likely trick plenty of people on Facebook Marketplace because just as soon as we put up a listing for an item, they messaged us asking for our phone number or if they could pay using Zelle.

Eventually, we ended up selling the rest of our old baby toys to people in our neighborhood together in person, and they paid for them using cash. While my wife avoided getting scammed, I’m sure others clicked on the button in emails similar to the one she received and gave up their personal and perhaps even their financial information trying to sell an item on Facebook Marketplace. Selling your old stuff is great but if you’re not careful, you could potentially fall victim to fraud or even identity theft. 

How to avoid falling victim to scams on Facebook Marketplace

As you can see from the Facebook messages above, scammers often try to get you to move to a different messaging platform to complete a transaction — whether it be selling an item or buying one. However, you want to remain on Facebook when using Facebook Marketplace to avoid getting scammed.

When it comes time to pay or get paid, you should avoid using Venmo, Zelle, Cash App or other payment methods as they don’t offer the same protections that both Facebook Checkout and PayPal do. At the same time, you should never accept payments in the form of gift cards, as this is a clear sign you’re dealing with a scam. Likewise, if someone asks you to pay money in advance to hold an item, you’re also dealing with a scam. 

If you decide to meet a seller or buyer in person, make sure you pick a public location that is well-lit with plenty of security. You also want to arrange for the meeting to take place during the day and it’s always a good idea to bring someone else with you just in case.

Facebook Marketplace can be a great place to buy and sell used items but just like everywhere else online, scammers often use it to their advantage. However, if you’re careful and don’t rush to buy or sell items, you might find a great deal or finally be able to get rid of some of your old junk.

Facebook and Instagram parent company Meta quietly released a new tool earlier this year that allows you to remove your phone number and email address from the tech giant's database.

As reported by Business Insider — which learned about the feature from a tipster — the tool has been available since May 2022, but the social media giant hasn’t really promoted it or said anything publicly about it. Instead, the tool is hidden at the bottom of a support page for non-users. 

If you scroll down the page linked above, you can find the tool in the section titled “How Non-Users can exercise their rights.” At the bottom of this section, you’ll find the following line: “Click here if you have a question about the rights you may have.” Surprisingly, this line doesn’t mention the tool at all but if you click on Click Here link, you’ll be taken to the contact info removal tool.

Although this tool is designed for those that don’t use Facebook or Instagram, anyone can use it to remove their phone number or email address from Meta’s database.

Meta may have your contact info even if you don’t use its services

The reason Meta had to create this tool in the first place is because Facebook and Instagram allow users to sync the contacts from their smartphones with its services. However, when you do so, your contacts haven’t given consent to have their phone number or email address uploaded to the company’s database.

On the page that contains its contact removal tool, Meta provides more information on why someone may want to use it in the first place, saying:

“Someone may have uploaded their address book to Facebook, Messenger or Instagram with your contact information in it. You can ask us to confirm whether we have your phone number or email address. If we do, you can request that we delete it from our address book database. To prevent it from being uploaded to this database again through someone’s address book, we need to keep a copy in our block list.”

Back when Facebook was still growing, the company often asked users of its mobile apps to sync their contacts with the social network in order to help them find friends on its platform. However, this led to Meta having a wealth of contact information including details about people who don’t use any of its services.

How to use Meta’s contact removal tool

Regardless of whether or not you have a Facebook or Instagram account, you may want to use Meta’s new tool to remove your mobile number, landline phone number or email address from the company’s database.

To do so, first you need to click here to access the tool, as it can be difficult to find on your own. With the tool open, you can have Meta search its database to find out if it has your phone number or email address. Pick the one you want to search for and click “Next.”

From here, you need to enter the email address or phone number you want to search for and specify whether you want Meta to check for it on Facebook and Messenger, Instagram or both. Once you’ve entered this information, click "Next."

If someone synced their contacts with Facebook or Instagram and your email address or phone number was uploaded to Meta’s database, you’ll see a page like the picture below. By clicking “Confirm,” you can have Meta delete your contact information from its database and block it so that it won’t be uploaded again.

However, before Meta can remove your contact information, the company will send you a confirmation code via email or text. Enter the confirmation code in the box and click on “Next” to have you contact info removed from the company’s database.

Once Meta removes your contact information from its database, you’ll see a message like the one below confirming the request was successful.

There you have it — your email address and phone number have now been removed from Meta’s database. Keep in mind though that if you change your email address or phone number, you may need to repeat this process as someone you know may end up syncing your new number or email address with Meta’s services once again.

Want to know how to download videos from Facebook? You’re in the right place. Downloading videos from Facebook is useful for a range of reasons, namely so that you can watch them wherever you are — internet or not.

Unfortunately, there’s no official way to download videos from Facebook like there is with some of the best streaming services like YouTube Premium or Netflix. You might have seen the button next to clips on the site that saves “Save video”, but all this does is add the video to a saved videos list, essentially a favorites list, so you can watch it later on the app or website.

Luckily, there's a way to download videos from Facebook, and it works on desktop and mobile. You must ensure, however, that there aren’t any copyright restrictions on the video you’re downloading before you get started. Otherwise, you might land yourself in hot water.

It's also worth bearing in mind that the uploader of private videos may now want you to download them — after all, they are probably private for a reason.

Once you’ve made sure to check both of the above, here’s how to download Facebook videos.

How to download videos from Facebook on desktop 

These steps were tested using Chrome browser and should be the same for Mac and Windows.

1. In your desktop browser, go to the Facebook website and find the video you want to download. For the purposes of this guide, we’ll use a video on the official Tom’s Guide Facebook page.

2. Click Share and then click Copy link.

3. Paste this link into a new browser tab. It may be shortened to an "fb.watch" link. If so, press Enter so it expands and you should be left with a full URL starting with https://www.facebook.com.

4. Now change the URL in the address bar so that “www.” is changed to “mbasic." and press Enter.

5. You’ll now be presented with an ugly mobile view, as seen below. Press the play button to start the video. It should open in a new tab. If it doesn't, right click the video and select Open in a New Tab.

6. Right click on the video and click Save Video As.

7. Choose a location in your file explorer and save the video.

How to download videos from Facebook on mobile (non-Samsung)

Downloading Facebook videos on mobile is a whole different kettle of fish, and while there are apps that claim to do it, a far simpler way is to use the website FBDown.net. This works on Android and iOS, but you'll need to download the Firefox browser on an iPhone or iPad, as the FBDown.net site doesn't load properly in Safari. If you own a Samsung device, skip down to the next section.

Bear in mind that this method only works on publicly shared Facebook videos.

1. Open the Facebook mobile app and log in. 

2. Find the video you want to download, and tap Share underneath. 

3. Swipe across and tap Copy Link. 

4. Open your mobile browser (remember, to use Firefox if you’re on an iPhone) and head to www.fbdown.net. Then, paste the video URL into the box in the middle of the page, and tap Download.

5. On the next page, tap the link to download in either Normal or High Quality. This will impact the file size and how much space the video takes up on your mobile device. 

6. This will open another page showing just the Facebook video. Long-press the clip and then tap Download video when the option appears. 

The video will now be saved to your mobile device, where you can play it offline and keep it for as long as you want.

How to download videos from Facebook on a Samsung device

If you own a Samsung device, you can download videos from Facebook without having to use a separate app or website. We tested this method on a Z Fold 4 and it worked perfectly, although it didn't work on the Google Pixel or OnePlus devices we also tried to test it on.

1. Find a Facebook video in Chrome. You don't need to tap it to open it in full-screen mode, the next step will work either from your feed or in full-screen.

2. Long press the video and tap Download.

Once the Download is complete, your video will be stored in your phone's files. Needless to say, this is our favorite method!

Now you're familiar with how to download videos from Facebook, you may also want to learn how to hide Likes on Facebook or how to make yourself anonymous on Facebook. Or if you think emojis are so last year, check out how to make your own Facebook avatar.

We also have more guides for downloading content. Read how to download YouTube videos, how to download YouTube videos on Chrome and how to download music from YouTube.

A new version of the Ducktail malware is being used in phishing attacks to steal data and take over Facebook accounts.

As reported by BleepingComputer, this new campaign uses an updated version of Ducktail that is written in PHP instead of the older version written in NetCore that was used to target Facebook Business users over the summer.

In addition to your Facebook account and the data it contains, the Ducktail malware can steal other sensitive information stored in your browser like the credentials to your online accounts and even funds from some of the best crypto wallets.

Ducktail malware returns to target regular Facebook users

While the original Ducktail malware campaign was primarily used to target individuals and organizations using Facebook’s Ads and Business platform through social engineering on LinkedIn, this new campaign has a much larger scope and includes regular Facebook users in addition to Facebook Business users.

If the account in question turns out to be a business account instead of an ordinary one, Ducktail collects additional information about a victim’s payment methods, cycles, amounts spent, PayPal address and more.

In a blog post, the cloud security company Zscaler provides further insight on how this new campaign differs from the previous one, saying:

“It seems that the threat actors behind the Ducktail stealer campaign are continuously making changes or enhancement in the delivery mechanisms and approach to steal a wide variety of sensitive user and system information targeting users at large. Zscaler’s ThreatLabz team is continuously monitoring the campaign and will bring to light any new findings that it will come across.”

To infect your computer and steal your Facebook account, the cybercriminals behind this new Ducktail malware campaign use a number of fake lures to trick users into downloading malicious ZIP files. These malicious files pose as cracked or free versions of Microsoft Office and other software, games, subtitle files, adult content and more.

If a user does happen to unzip one of these Zip files, the Ducktail infostealer malware is installed in the background while they see a pop-up which reads “Checking Application Compatibility.” This malware is particularly dangerous, as it is able to achieve persistence and remain on a victim’s machine by adding scheduled tasks that are executed daily at regular intervals.

While the data exfiltrated from a victim’s computer used to be sent to Telegram, it is now stored in a JSON website controlled by the cybercriminals behind this new campaign.

How to protect yourself from Ducktail and other dangerous malware

As is often the case with other malware strains, you can protect yourself from this new version of the Ducktail malware by not downloading pirated software or games. This also includes game mods and cheats designed to give you an edge on the competition.

At the same time, you should remain vigilant when receiving new messages on LinkedIn and avoiding downloading files from sites or people you don’t know. Installing one of the best antivirus software suites can help keep you protected as these programs can flag malware as dangerous before it’s even installed on your system.

When it comes to protecting your credentials, you want to avoid storing your passwords inside your browser and use one of the best password managers instead. Besides storing your credentials securely, most password managers also allow you to create strong, complex passwords for each of your online accounts.

As phishing campaigns using the Ducktail malware have been quite successful and profitable for the cybercriminals who created it, expect to see even more campaigns targeting users in novel, new ways online.

A new report from Meta has found more than 400 malicious applications for both Android and iOS designed to steal users' Facebook credentials. 

From camera editor software to VPN services, these apps managed to evade detection and feature in allegedly secure official app stores. Both Apple and Google reacted to these findings, taking them down from Apple's App Store and Google's Play Store respectively.

However, all this makes it clear how cybercriminals have refined their craft, developing malware applications that more and more closely resemble legit software. 

Even if you are securing your data with tools like the best VPN services, anybody can be tricked into downloading a fake tool and exposing their personal information.

Fake apps to infiltrate people's social media accounts

As the report shows, malware apps operate in a very simple way. Asking for users' Facebook credentials as the only option to start using such tools, hackers can easily steal people's usernames and passwords to then infiltrate into their social media accounts. 

"Our sense here is that this wasn't kind of a specific geographically targeted thing. This was more an attempt to just get access to as many login credentials as possible," said David Agranovich, Meta’s director of threat disruption, during a press briefing, reported by Forbes.

Among these 400+ dangerous apps, the most afflicted (over 42%) were photo editors. These were followed by business and phone utility tools, like some flashlight apps for example, comprising almost 30% of the threats. More than 11% were allegedly secure VPN software claiming to help you bypass online censorship and pump up your browsing speeds. Other fake applications also included games and lifestyle services such as horoscopes and fitness trackers.

Meta suggests that malicious developers might create these fake apps with a "fun or useful functionality" at its core in order to attract more users.  

They may publish fake positive reviews to boost apps' credibility, while trying to hide negative feedback pointing out their harmful nature.  

Even though both Apple and Google have now removed such applications from their online stores, Agranovich assured that Meta would be warn the one million users who had come into contact with the applications in case their information had been compromised.

Facebook’s parent company Meta has reported that the login information of up to a million users may have been compromised and made available to hackers. If you think you have been hit, reset your passwords now.  

Scanning both the Google Play store and Apple's App Store Meta previously announced it has found 400 apps designed specifically to harvest users' personal information. Posing across a range of genres these apps include games, VPNs, health services, and photo editing tools. All the apps are designed to ‘phish’ for users Facebook login information, which could lead to compromised accounts. 

These apps have been removed from their respective stores but users should check that they haven’t already got one installed. Meta has listed the apps in full in a blog post for users to cross-reference with their Android or iPhone and is reaching out to those affected.  According to the Washington Post, a Meta spokespersons has said that one million Facebook users may have been affected by these malicious apps.  

Worryingly, many of these dangerous apps were targeted toward children with Meta finding that 11.7% of them were masquerading as games. Most disturbing of all, 42.6% of the apps were claiming to be photo editing apps, with any pictures taken using them likely compromised too. 

The trick to the phishing attack here was to get users to log into the app using the “login with Facebook” service that the social network offers and often makes it trivially easy to log into service when using a mobile device. But in the case of the malicious apps, they'd quietly steal the user's login credentials, no doubt for later unscrupulous use. 

Change your password now

If you suspect you may have fallen foul of such phishing attacks, then we suggest you go and change your Facebook password right away. This should curtail any malicious use of your account.

And when it comes to logging into apps with a Facebook (or other social media) account be aware that just because something is on Google or Apple’s official app store does not mean it is safe. Both companies do have stringent measures against this kind of fraud but something will always slip through the cracks. 

Meta has laid out some guidelines to follow when deciding whether to trust an app, which include checking reviews and guidance for an app and whether it only offers users the chance to log in via social media (a gigantic red flag). This is a start, but there are plenty of ways to further increase your security online. 

First and foremost using one of the best password managers available will improve your safety no end and will greatly reduce the damage any leaked information can do. This is especially true if you use the same password on several platforms. Our senior security and networking editor Anthony Spadafora recommends LastPass, “because of its ease of use, its support for all major platforms and its wide range of features.”

To spot a malicious app, Anthony suggests users stay aware of what their apps require permission to do. Does a flashlight app need access to your contacts or address for example? For Android in particular this can be a problem and it is well worth checking out the best Android antivirus apps.

Two-factor authentication (2FA) is another great tool to protect your login credentials, it can be installed on most large online services such as Amazon, Facebook and Twitter and even Fortnite. In this day and age, it is up to us as users to protect our own data. Make sure you don’t get caught out.

Update: Over 1 million Facebook users' passwords compromised — what to do now.

Having your Facebook account hacked can throw your social life into turmoil, which is why you need to be extra careful online to avoid falling victim to phishing attacks. However, phishing isn’t the only way that hackers can gain access to your credentials and steal your accounts.

Malicious apps posing as legitimate apps are another threat to watch out for. In fact, new research from Facebook’s parent company Meta has revealed that its security researchers have identified more than 400 malicious Android and iOS apps on the Google Play Store and Apple App Store in this year alone.

While malicious apps often find their way onto third-party app stores since they have less restrictions in place, sometimes these bad apps slip past Google and even Apple’s defenses which is why you should always exercise caution when downloading any new app.

Malicious apps hiding in plain sight

According to a new Meta blog post, the 400 malicious apps discovered by its security researchers were disguised as photo editors, games, VPN services, business apps and other utilities. 

Photo editing apps were the most dangerous as they made up 42.6% of the 400 malicious apps followed by business apps (15.4%) and utilities (14.1%). 

In order to increase how many people download their malicious apps, the cybercriminals behind them publish fake reviews on the Play Store and App Store to help boost their ratings. When someone discovers one of these apps is actually malicious, their creators flood the app’s listing page with fake reviews in an attempt to hide the negative reviews.

Delete these apps now

Fortunately, all of the apps in question have since been removed from both the Play Store and App Store. After discovering them, Meta’s researchers reached out to Google and Apple to have them taken down so that more users wouldn’t be tricked into downloading them and having their Facebook accounts stolen.

Still though, if you have any of the apps listed below installed on your devices, you will need to manually delete them. These are just a few of the 400 malicious apps and you can find the full list on Meta’s blog post.

Android apps

• Apex Race Game
• Video Converter Master
• Acetoon Photo Cartoon
• ZodiHoroscope – Fortune Finder
• Unblocked Website
• Cool Photo Editor
• Cool Filter Editor
• Text Camera
• Perfect Photo Effects | Loop Photo
• Beauty Camera
• Beauty Camera Plus
• Bamboo VPN
• Candles VPN
• Fast VPN Proxy
• Speedy Vpn Tunnel
• YouToon – AI Cartoon Effect
• Videolancer – Pro Video Maker
• All in one Doc Editor & Viewer
• Instant Translator
• Meta Optimizer – Ads Analysis
• Astro Horoscope Guide 2022
• Tower Defense Zone – Batmen Rush
• Smart AppLock
• Pulse Music Player
• Rush Car 3D

iOS apps

• Business ADS Manager
• Ads Analytics
• FB Adverts Optimization
• FB Analytic
• FB Adverts Community
• Adverts Ai Optimize
• Very Business Manager
• FB Business Support
• Fb Ads
• Meta Optimizer
• Business Manager Pages
• Adverts Manager
• Meta Adverts Manager
• Ad Optimization Meta
• FB Pages Manager
• Business Ads
• Meta Business
• Business Suite Manager
• FB Ads Cost
• Business Ads Clock

How to protect your Facebook account from malicious apps

When it comes to staying safe from malicious apps, the first thing you should do is ask yourself whether or not you really need the app. From there, keep in mind that if an app seems too good to be true, it probably is.

If you do decide to download a new app, you should look for external reviews that aren’t on the Play Store or App Store as they can be easily faked. Video reviews can be a great resource as they can show you whether or not an app does what it claims. 

For those with one of the best Android phones, you also need to look out for the types of permissions an app requests. For instance, does that flashlight app really need access to your contacts in order to work? Most likely not. At the same time, you should also ensure Google Play Protect is enabled on your devices as it can help protect against malware and other threats. Installing one of the best Android antivirus apps is also a good idea, especially if you frequently install new apps.

As Meta points out, you should also be wary of an app that asks you to login with your Facebook credentials in order to work. This is a major red flag, and in this case, you should delete the app immediately. It’s true that many legitimate apps and websites offer single sign-on by letting you log on with your Facebook account, but sometimes the risk outweighs the convenience. It may be worth creating a new account for an app when possible instead of logging in with your Facebook credentials. (And if Facebook is the only way you can sign in, don’t walk away  —  run.)

What to do if you've downloaded a malicious app

If you’ve downloaded one of the apps in question and have since logged in with your social media or other account credentials, you will need to delete the app as well as take several steps to help secure your accounts.

First off, you should reset all of your passwords, especially if you reuse the same password across multiple accounts (something you absolutely shouldn’t be doing in the first place). You can then use one of the best password managers to create strong and unique new passwords for all of your accounts and store them securely.

Enabling two-factor authentication (2FA) is also recommended as doing so adds an extra layer of security to your accounts and makes it harder for hackers to take them over. At the same time, you should enable log-in alerts so that you’ll get a notification when someone tries to access your accounts. Signing up for one of the best identity theft protection services can also help you quickly recover from having your identity stolen after installing a malicious app.

Finally, Meta has its own Security Checkup Tool that you can use to help further secure your Facebook account. However, you will need to login to your Facebook account in order to use it.

Malicious apps continue to be a major problem on Android but they can also affect iPhone users as well. If you really want an app, paying for it makes more sense than searching for a free alternative since the consequences of downloading a malicious app can be quite devastating.

In a world where ChatGPT exists, and the rise of AI chatbots and thus machines seems inevitable, you might be wondering how you can adapt to an age where you may need to be fully digitalized. This dystopian Matrix-like future has yet to come to pass, but you can prepare for it thanks to Facebook Avatars. 

While you can't yet upload your consciousness into the house that Zuckerberg built, you can use the Avatars option on Facebook to create a cartoon-like version of your visage. Or you can fully reimagine yourself as a scion of beauty or a creature with a face only a mother could love. The (virtual) world is your metaphorical oyster. 

Making a Facebook Avatar is pretty easy and once done, you can use it in all manner of Facebook functions, such as reacting to posts or expressing your feelings via custom stickers on the social network, So to that end, read on to learn how to make a Facebook Avatar. 

How to make a Facebook Avatar  

1.  Login or set up a Facebook account  

The first thing you’ll need to do to get on your way towards having a Facebook Avatar is to log into your Facebook account via the Android or iOS app. If you don’t have the app, it’s easily downloaded from the Google Play Store or Apple’s App Store. 

2. Open the Facebook app menu 

You’ll need to either tap on the three lines that represent the menu options in the Facebook app or swipe right a few times to access the menu option. 

3. Select 'Avatars'

Once you're in the app menu, you’ll be shown a suite of options. Tap the ‘see more’ button, and you’ll see an ‘Avatars’ option. Tap on that.  

4.  Start creating your Facebook Avatar  

Once you’re in the Avatars section, the rest of the process to create your Facebook Avatar is a simple case of following the on-screen instructions. 

These will prompt you to start with your avatar’s skin tone, then will move onto hairstyle selection.

After that, you'll then be able to choose your eye color, eyebrows shape, face shape, facial hair and other attributes that define one's face. You can also select whether you want your avatar to wear glasses or lipstick. 

And once you're done with creating your avatars head and face, you then have the option to choose your body shape and clothing style. And finally, you'll be able to select some form of headwear if you're feeling hat inclined. 

Once you’re done, hit next and your avatar will be ready for use. It’s really that simple; there’s no need to upload photos or give Facebook any access to your data.

And you should then end up with an Avatar that's a rough approximation of yourself if that's what you're after; you can create any Avatar you like after all. 

How to use your Facebook Avatar  

Okay, you've created a Facebook Avatar and it's grinning at you proudly, whether you've made an approximation of your corporeal self or some grotesque abomination. Or perhaps you've simply made the person you want to be in the waking world. Regardless, now is the time to use it. If you've got bored of using words to communicate, you'll be pleased to know that making use of your Facebook Avatar is petty easy. 

Initially, you can spread your Facebook Avatar far and wide by sharing it on Facebook where it'll appear in your friends' News Feed. 

However, that's not all as the social network will create a set of digital stickers for you. These come in the form of pre-determined reaction stickers sets. You can use these to used to express your thoughts and sentiments towards a post or something in your Facebook feed or a chat with a Facebook compadre. From a simple thumbs up to popping a champagne cork or lying coquettishly by an open fireplace with a rose between your Avatar’s teeth, these stickers offer a variety of ways to express yourself in quiet digital form. 

1. Use your Facebook Avatar in comments

When you want to use your Avatar to express your thoughts on a post, simply tap the comment button and then the emoji button where you’ll be presented with your own avatar stickers, as well as the option to use standard emojis as well. 

In the web version of Facebook, you’ll be able to do this a little more succinctly by clicking on the sticker button, where you’ll then be presented with your Avatar stickers as well as other more generic stickers.

2. Use Facebook Avatars in Messenger chats 

You can also do the same for chat messages on the web version of Facebook. When you have a chat window open, click on the stickers button, which will present a suite of stickers to use. Then click on the icon that shows your Facebook Avatar, which will serve up a menu of custom Avatar stickers to use. 

And the Avatar reaction stickers also work in the Messenger app. Simply tap on the emoji button in the chat bar, then tap on the stickers menu and swipe right to access your Avatar stickers, and you'll have a whole load of them to use to your heart's content. 

That's about it. Facebook Avatars is still rolling out across the world, and there's a good chance the Avatars and the reaction stickers could be used in other Facebook-owned services. But we'll need to wait and see what Facebook does next. 

More Facebook tips

How to download Facebook | How to use Facebook Dark Mode on Android, iPhone and desktop | How to send a GIF in Facebook Messenger | How to change password on Facebook

“Why would someone want to hack my Facebook account?” may be the first thing that comes to mind for those who aren’t celebrities but have had their Facebook account taken over by cybercriminals.

However, having your Facebook account hacked is actually not that uncommon. There are many reasons why someone might want to gain access to your Facebook account. While stealing your personal information like your passwords and other credentials is one major motivation, forcing your Facebook account to share spam with your friends online is another.

Whatever the reason may be, hacked social media accounts have become a part of life. This is why it’s important to know the steps you can take to recover your Facebook account once you’ve discovered it’s been hacked.

This is a step-by-step guide on recovering a hacked Facebook account along with next steps you should take to ensure it doesn’t happen again with input from several cybersecurity experts. (And don't miss our guides to how to make yourself anonymous on Facebook, how to block and unfriend someone on Facebook, and how to protect your identity, personal data and property.)

1. Check to make sure your account really has been hacked

If you notice suspicious activity on your Facebook account including changes to your name, birthday, email address or password, new sent messages or friend requests to people you don’t know or posts appearing on your timeline you didn’t post – then go to the upper right-hand corner of your Facebook page and click on the arrow there which will reveal a drop-down menu.

Click Settings and Privacy > Settings and a new menu will pop up. Choose the Security and Login option and then Where You’re Logged In. If there is a login from a device or place you don’t recognize, then your account may have been hacked. 

2. End the intruder's session

Click the three vertical dots next to the device login that you don't recognize, then Not You? or Log Out. This logs the intruder out of your account, at least temporarily. This limits the damage the intruder can do and allows you to continue regaining and securing control of your account.

3. Alert your contacts

If your account has been compromised, it likely has already been used to contact people from your friends list. You'll need to tell them not to trust any links or install any apps that you had sent them — via wall postings, Facebook messages or Facebook email — while the intruder had control of your account.

4. Change your Facebook password

If the intruder has not changed your password, then changing it is easy. Click Security and Login again, then scroll down to Login and then click Change Password.

"If you use the same password for multiple sites, it is best to change your passwords there as well," said Cosette Jarrett, a web-marketing specialist based in Salt Lake City. "If your password has been compromised on one site, chances are your accounts at other sites are in danger, too." 

This is why password reuse is such a big problem. Fortunately, you can nip it in the bud for good by using one of the best password managers to generate strong, complex and unique passwords for each of your online accounts. You can also follow these tips to create a secure password.

5. Reset your password if the intruder has changed it

Often, hackers will change your password once they have gotten control of your account, so it's not as simple as just going into your account settings and changing your password.

You'll have to reset your password by clicking the Forgot Your Password link underneath the Facebook login. You will need to provide information to identify yourself, such as the email address you used to register with Facebook, the phone number associated with your account, your Facebook username, or your name and the name of one of your Facebook friends. 

The last option may be best if you believe the person who hacked your account has changed any of your profile information.

6. Report your compromised account

If ads or spam are being sent from your hacked account, you must report it as compromised, which you can do at this link. After reporting, you will receive further instructions from Facebook to resolve the issue.

7. Check for malicious apps

Once you have control of your account again, go to the same Settings menu where you checked for suspicious logins or changed your password, and click on the Apps option in the left-hand menu. Go through the list and check for any apps you did not add yourself, and click the X next to them to remove them. It's worth noting that if you don't use an app for some time, it will expire automatically.

8. Secure your Facebook account

Getting your Facebook account hijacked is not the end of the world. Having it happen to you, though, can be a good reminder to make sure your account is as secure as it can be.

Facebook itself offers a number of security tips. You should use a unique password for Facebook, one that you do not use on any other sites; you should log out of Facebook when using a computer you share with other people; you should run the best antivirus software on your computer (or the best Mac antivirus software if your using an Apple computer); and you should be careful about the links you click on and the apps and files you download. You can also run a Security Checkup while logged in to your Facebook account.

Even if you have not been hacked, shoring up your Facebook security is a good idea. Since many Facebook account compromises are caused by external apps, consider limiting the number of apps you use in general, both on your computer and your smartphone.

Do not click on suspicious links or ads shared in your news feed, even when you trust the people who are doing the sharing — it's possible they themselves have been hacked. Always make sure your desktop web browsers and mobile operating systems are up to date. And be sure to sign out when you're done using Facebook for the day.

The same goes for other social networks. Twitter, Instagram, LinkedIn and others have all had user accounts compromised in various ways. As always, remain vigilant and be smart about what you do online, and you'll be just fine.

Update: Meta Quest Pro hands-on: The future of the metaverse is here for $1,500.

The next few generations of Meta Quest hardware will continue to use Qualcomm chipsets, the companies have formally announced.

The “multi-year agreement” will see Qualcomm — which makes the chips that power the vast majority of the best Android phones — continue to develop custom Snapdragon XR hardware for Meta. 

“We're working with Qualcomm Technologies on customized virtual reality chipsets — powered by Snapdragon XR platforms and technology — for our future roadmap of Quest products,” Meta CEO Mark Zuckerberg said. 

On one level, this isn’t hugely surprising. As the press release mentions, the companies have seven years of history, including with the breakthrough Oculus Quest 2 headset (now officially the Meta Quest), which uses the Snapdragon XR2 chipset. There’s a very sound business case for not breaking up a winning partnership. 

Yet this is apparently exactly what Meta was looking at doing at one point. Earlier this year, The Information reported that the company had been developing its own chips, but reverted to Qualcomm due to the slow progress of starting from scratch. This, along with reports that Meta has backed away from making its own VR OS, suggests that the company could be cutting back costs in the face of its first quarterly revenue decline in over a decade. 

Meta apparently hopes that by working with Qualcomm it can save R&D costs and still get something customized for its ambitious metaverse plans. 

“As we continue to build more advanced capabilities and experiences for virtual and augmented reality, it has become more important to build specialized technologies to power our future VR headsets and other devices,” Zuckerberg continued. “Unlike mobile phones, building virtual reality brings novel, multi-dimensional challenges in spatial computing, cost, and form factor.”

At the moment, Meta has the lion’s share of the all-in-one VR headset market, but one upcoming opponent with extremely deep pockets is Apple, which is likely to release its first VR/AR headset in 2023. 

A trademark for something called the Reality Processor suggests the company will continue to make its own chips to meet the challenge of delivering smooth footage to both eyes simultaneously. That is likely to be a lot more expensive than Meta’s current Quest offering, however — even with the latter’s recent price hike. 

But Meta has one eye on a higher-end offering with Project Cambria (which could well be the Meta Quest Pro), a headset that the company has promised will arrive next month. Possible on October 25, according to one tipster.

It will be interesting to see what this presumably Qualcomm-powered device can do. The current Quest 2 uses a chipset of roughly the same power as the Snapdragon 865 used in the Samsung Galaxy S20 and others, so hopefully the new headset will give us a sizable leap in graphical fidelity along with the promised new experiences.

Read next: This video might have just leaked the final Meta Quest Pro design 

Updated: Finally, you can ditch the Facebook account login for the Meta Quest (aka Oculus Quest 2), and use a new Met account instead, untethering your virtual reality experience from any social media networks. 

Meta previously announced it will be introducing a new account system for its virtual reality headsets that will start rolling out. And now that rollout has begun, meaning Facebook will no longer be needed in any form while logging into our pick for the best VR headset. 

Don’t worry this doesn’t mean you will be locked out of your headset or lose your apps. If you have been using a Facebook account for your Quest headset, you will need to make a new Meta account. If you have been using an Oculus account, you can keep using that till January 1 2023. Once you migrate your account from either Facebook or Oculus, Meta says you should be able to see the VR apps you previously purchased.

Annoyingly, one of the only ways to log into the Quest headsets before this was to use a Facebook login. Scores of people raised complaints against this citing that they did not want to link their social media accounts to the platform. Many people also refrained from getting a Quest headset primarily for this reason. 

“Our new Meta account structure gives you more flexibility and control, letting you choose how you do and don’t show up—and whether Facebook and / or Instagram is part of your experience in VR and other surfaces where you use your Meta Horizon profile,” Meta said in a blog post.

Interestingly, a new Meta still requires quite a bit of information like address, email, date of birth and payment details. Meta does say this is not a social profile, but with Meta moving more towards metaverse environments, it does need you to create a Meta Horizon profile. 

After renaming the Oculus Quest 2 headset to Meta Quest, the company is now focussing on its Metaverse pursuits and seems to be creating an ecosystem for it. This includes the Horizon social profiles and it also gives Meta a chance to go beyond its old name.

Updated: Facebook has squashed a bug that bizarrely caused people's news feeds to be filled with celebrity spam. 

As suite of people has flagged this strange problem with the likes of DownDetector, noting the problems started at around 1.30 a.m. ET / 6.30 a.m. BST.  Multiple users complained that their main News Feed was suddenly overrun by posts sent to pages for artists including Eminem, Lady Gaga, Gorillaz, Nirvana, and The Beatles.

Twitter, in particular, received plenty of attention to the hashtags #facebookhacked and #facebookdown, with the latter trending high up in many countries today.

A spokesperson for Meta, Facebook's parent company, told the Metro UK that the problem was down to a "configuration change." The spokesperson added:  "We resolved the issue as quickly as possible for everyone who was impacted, and we apologize for any inconvenience."

 While this bug was rather short-lived and not something that any members of Tom’s Guide experienced when we checked our respective Facebook feeds and mobile apps, it’s rather embarrassing for the giant social network. 

Though with things like the Cambridge Analytica data harvesting scandal still holding somewhat of a specter over Facebook and trust in it, this rather ridiculous bug isn’t the worst thing Facebook has fallen foul of in recent years. 

Nor is this a serious issue such as how Facebook Business accounts got hijacked by malware recently. 

Do bear in mind that if you have any worries over Facebook security or bug causing data leaks, then check out our guide on what to do if your Facebook account Is hacked and how to change your Facebook password. 

Of course, you may indeed be a happy Facebook user. If so, check out our guides on how to make your own Facebook avatar and how to download videos from Facebook to get the most of out the social network. 

WARNING! Over 1 million Facebook users' passwords compromised — what to do now.

Both individuals and organizations operating on Facebook’s Ads and Business platform are being targeted by a new malware strain that can take over their Facebook accounts.

Discovered by security researchers from WithSecure, the enterprise spin-off of the cybersecurity firm F-Secure, this new malware has been dubbed DUCKTAIL.

While it was initially discovered as an unknown malware earlier this year, WithSecure began tracking and analyzing the operation to find that DUCKTAIL has been used in the wild since the second half of 2021. 

DUCKTAIL’s operations make use of an infostealer malware component that was specifically designed to hijack Facebook Business accounts. According to WithSecure, this is the first instance of such functionality and it separates DUCKTAIL from other malware strains designed to target regular Facebook users.

The malware itself was designed to steal browser cookies and use authenticated Facebook sessions to steal information from victims’ Facebook accounts in order to hijack any Facebook Business account that targeted individuals have access to.

Finding potential targets on LinkedIn

As is the case with other cyberattacks primarily targeting business users, DUCKTAIL’s operators use the professional social networking site LinkedIn to scout for potential victims.

LinkedIn users likely to have high-level access to a Facebook Business account and especially those with admin privileges are selected. From here, the attackers use social engineering to convince potential victims to download a file hosted on a cloud storage service like Dropbox, according to a report from TechCrunch.

Besides keywords related to brands, products and project planning, these files also contain malware and when downloaded, DUCKTAIL is able to use saved browser cookies to take over a victim’s (or their organization’s) Facebook Business account.

Malware analyst and researcher at WithSecure, Mohammad Kazem Hassan Nejad provided further insight in a press release on how DUCKTAIL’s operators have been selecting targets, saying:

"We believe that the DUCKTAIL operators carefully select a small number of targets to increase their chances of success and remain unnoticed. We have observed individuals with managerial, digital marketing, digital media, and human resources roles in companies to have been targeted."

How to protect yourself and your business

If having your personal Facebook account hacked seems troubling, imagine what it’s like to lose access to your Facebook Business account. Many small business owners depend on Meta’s social network to reach their customers which is why the DUCKTAIL malware is so concerning.

Just like with other cyberattacks, WithSecure’s Nejad recommends exercising caution “when dealing with attachments or links sent from individuals you are unfamiliar with” on LinkedIn since DUCKTAIL’s operators use the platform to find new targets.

In a blog post, the cybersecurity firm Avast recommends using one of the best password managers to improve the strength of your passwords and enabling two-factor authentication (2FA) to help keep your Facebook Business account more secure. At the same time, you should also grant administrator permissions to more than one user as having another account with admin authority will prevent you from being locked out.

Finally, you should review which third-party apps are connected to your Facebook Business account and ensure that you are only allowing access to well-known applications. Likewise, it's also worth taking a look at the apps installed on your smartphone as many malicious apps are designed to steal the data necessary to take over your Facebook account.

Knowing how to change your Facebook password is incredibly important for users of the world’s largest social network. As your account serves as a repository of your interests, photos, contacts and all manner of other personally identifiable information, keeping it secure is incredibly important.

Ideally, you’ll want to use a strong, complex password for your Facebook though you should also be ready to update it in the event that your account, your email or the service itself is maliciously compromised.

In this step-by-step guide, we’ll show you exactly how to change your password on Facebook, using either the desktop site or the mobile app.

How to change your Facebook password on PC and Mac

1. Click the “Account” icon in the top-right corner of Facebook. It’s a small downwards-pointing arrow.

2. Click “Settings & privacy,” then “Settings.” This will take you to the General Account Settings page.

3. Click “Security and login” in the left sidebar. Then, under “Login,” click “Change password.”

4. Type in your current password, then type the new password you want in the “New” and “Retype new” fields. Depending on your cookies and auto-save settings, your current password may already be filled in.

5. Click “Save Changes” to save your new password, which you can use from now on.

How to change your Facebook password on Android and iOS

1. In the Facebook app, open the main menu by tapping the icon on the far right of the toolbar.

2. Scroll down and tap on “Settings & Privacy,” then tap “Settings.”

3. In the Security section, tap “Security and login.” This will open up a new sub-menu. Under “Login,” tap “Change password.”

4. Enter your current password, type your new password, then retype your new password in the respective fields.

5. Tap “Update Password” to save your new password. And with that you're done: you now know how to change password on Facebook on desktop and mobile.

What if I’ve forgotten my current Facebook password?

If you can’t remember your current Facebook password, and your computer doesn’t auto-fill it for you, an alternative way to change your password is to go through the password reset process. Here’s how:

1. On PC and Mac, follow steps 1 though 3 as they’re given above. On Android and iOS, again follow steps 1 through 3. You’ll need to be on the settings page on which you’d enter and retype a new password.

2. Click “Forgotten your password?” on PC/Mac, or “Forgotten password?” on Android/iOS. You’ll be prompted to send a code to reset your password to the email account associated with your account.

3. Click “Continue” or “Next” to send the code to your email address. Without closing Facebook, retrieve the code from your inbox. It may take a few minutes to arrive.

4. Back in Facebook, enter the code and hit “Continue” or “Next.” You can now enter your new password. Click or tap “Continue” or “Next” to finalize the reset and start using your new password.

More Facebook tips

How to make your own Facebook avatar | How to download Facebook | How to use Facebook Dark Mode on Android, iPhone and desktop | How to send a GIF in Facebook Messenger | How to hide Likes on Facebook | How to set up two-factor authentication on Facebook

Update: Job listings suggest Amazon may also be working on an AR device - could it be AR Echo Frames?

AR glasses are hard work, and so far the best efforts of Silicon Valley have come up short. Whether it’s limited functionality, required smartphone connections or bulky bug-eyed designs, this is a category that has yet to take off. Facebook / Meta is undeterred, though, and a new report claims the company is pushing to get its own AR glasses launched by 2024.

That’s according to one former Meta employee who told The Verge that “Zuck’s ego is intertwined with [the glasses]. He wants it to be an iPhone moment”. Here’s what we know so far.

Meta AR Glasses: Rumored price and availability 

According to The Verge, Facebook’s plan is to start selling AR glasses, currently named Project Nazare, in 2024. A smartphone-connected version of the glasses, codenamed Hypernova, might arrive in 2024 for a lower price point.

While pricing for the Meta AR glasses is still unknown, the Verge report says the device will cost more than the Oculus Quest 2 VR headset, given "that the AR glasses bill of materials is multiple thousands of dollars." The sales expectations are low, at least initially. 

Facebook/Meta is reportedly expecting first generation glasses to appeal to developers and early adopters, rather than mainstream consumers. That means it only expects to sell “tens of thousands” of the first-gen glasses, but aims to be selling “tens of millions” of smart glasses by the end of the decade.

As is the way with these things, the plan is to offer lighter and more advanced models around two years later. If the current launch plans are on schedule, it means they would likely arrive sometime in 2026. The third version is then likely to arrive in 2028.

Meta AR Glasses: Design and features 

The idea behind the Meta Glasses is to offer a standalone device, though the first generation glasses are said to have a wireless “phone-shaped” device that can handle some of the computing power.

The standalone model is said to feature a “socially acceptable design," whatever that means, and weighs 100 grams/3.5 ounces. The design is said to look similar to the glasses worn by Clark Kent (Christopher Reeve) in the original Superman movies. 

As for the displays themselves, Facebook has apparently gone all in. Each display is powered by an expensive custom waveguide, with microLED projectors, and stereo audio in the frame. The glasses are also said to feature eye tracking and outward facing cameras — which isn’t going to please a lot of people given Facebook’s patchy track record with privacy. 

The glasses don’t have such a great field of view (FOV), however, and reportedly have less than 70 degrees. For reference the Oculus Quest 2 has a FOV of around 89 degrees, while some of the best VR headsets like the Valve Index offer up to 130 degrees. Battery life is reportedly just four hours, and they’re supposedly designed for indoor use only.

The glasses may also be bundled with controlling wristbands, which Facebook unveiled last year.

As to what the glasses can do, it seems like very little is off limits. For starters, Mark Zuckerberg apparently wants the glasses to offer a sort of holographic video calling feature. That means users will see the person they’re talking to, or their avatar at least, projected in front of them in augmented reality. More immersive than FaceTime is apparently the aim.

Meta AR Glasses: Development 

Zuckerberg sees the glasses as a way to leave the shadow of smartphone giants Apple and Google — both of whom have varying augmented reality ambitions of their own. 

Given the conflict between Apple and Facebook/Meta over ad-tracking, this is not surprising to hear. Especially since a move towards independence would free the company to operate under its own rules — rather than those of a different platform. For better or worse.

It may also explain reports of his overenthusiasm for the project, with Zuckerberg himself admitting that employees refer to him as the “Eye of Sauron”. Though the CEO mustn't have understood Lord of the Rings, since he claimed it came from a place of love.

The launch of independent glasses would similarly be a huge step forward for the company’s metaverse goals, since AR glasses wouldn’t require users to wear comparatively bulky headsets that seal them off from the world. 

Of course, this isn’t the first time we’ve heard about Facebook’s smart glasses ambitions. Last year Facebook launched a set of smart sunglasses made in conjunction with Ray Ban, though these skipped over any AR or VR capabilities.

Meta AR Glasses vs Apple Glasses 

The Facebook glasses will apparently have stiff competition. Apple has already made a big deal out of augmented reality, and there have been dozens of rumors discussing the future launch of Apple Glasses.

While Apple’s AR specs are reportedly designed to look and feel like ordinary glasses, they aren’t likely to be a standalone device. Instead the rumors claim they’ll wirelessly link to an iPhone or some other Apple device.

But the Apple Glasses development has been slow, from what we’ve heard. Apple is reportedly launching an Apple AR/VR headset ahead of Apple Glasses, to give developers and customers more time to adjust to AR as a medium. 

However, supply chain and development issues are reportedly causing delays, with the latest rumors claiming the headset won’t arrive until 2023. The Apple Glasses, assuming Apple can deal with the technological hurdles, won’t be arriving until sometime later. 

Alongside the obvious issues surrounding brand recognition for Meta. Apple is a big popular company, selling millions of devices each year, and with a public dedication to user privacy. More to the point, the Apple Glasses will likely add extra functionality to devices people already own — offering them an extra incentive to check them out.

Facebook, or Meta, is not Apple. Its reputation has taken a spiral the past few years, especially concerning various privacy scandals. That’s important to consider if you're going to wander around with a device covered in cameras. 

Of course, Facebook has extensive experience with VR, thanks to its ownership of Oculus, which can be adapted for augmented reality. That gives it a huge advantage compared to Apple — even if Oculus headsets are significantly more niche products than the iPhone.

Meta AR Glasses: Outlook 

After some misses with the likes of Google Glass, tech companies are down to give AR glasses another try. But this time it seems there’s actually a plan, and the specs will do more than just beam notifications in front of your face. The only question is if and when companies like Facebook/Meta can make it happen.

2024 seems rather optimistic, since it’s only two years away, but Facebook does have extensive experience at putting content directly in front of peoples’ eyes. Coupled with Mark Zuckerberg’s unbridled enthusiasm for the project, it gives the company a fighting chance at succeeding.

The only question is whether consumers will care. It’s all well and good anticipating slow adoption, but people will need a very good reason to pick up something new and wear it — especially if it’s expensive. Facebook doesn’t have the same advantages as Apple, with no widespread ecosystem to fall back on, and getting people on board will be an uphill challenge.

We’ll be bringing you updates as we get them. In the meantime, check out the best VR headsets and the best Oculus Quest 2 games and experiences.