Hackers are once again targeting gamers on Steam, but this time, instead of using malware-filled games to do so, they’ve switched to hiding malicious code in desktop wallpapers.

As reported by BleepingComputer, these infected wallpapers can prove quite dangerous for unsuspecting gamers as they can provide an easy way to install a backdoor on one of the best gaming PCs or even to hijack their Steam accounts.

Any image you download online could contain malware. However, the hackers behind this campaign are leveraging an incredibly popular Steam app to do so instead. With 20 to 50 million installs according to SteamSpy, Wallpaper Engine is one of the most downloaded apps on the platform.

What makes Wallpaper Engine so popular, though, is that users can download hundreds of thousands of desktop wallpapers made by other users through Valve’s community hub, Steam Workshop. By abusing this feature, the hackers are easily able to disseminate their infected wallpapers.

Here’s everything you need to know about the latest malware threat on Steam and how you can keep your account — and your gaming PC — safe from hackers.

Malicious application wallpapers

For those unfamiliar, in addition to static wallpapers, Wallpaper Engine also supports four dynamic wallpaper types that can render videos, interactive scenes, webpages with audio and video, and applications. That last one is incredibly important in this campaign.

Unlike a JPEG or PNG file, Wallpaper Engine’s application wallpapers are full-on Windows executables that run like any other program on your PC. According to researchers at the cybersecurity firm Kaspersky, not only do they pose a built-in security risk, but they’re also currently being used by hackers to deliver malware to unsuspecting Steam users.

In a blog post, Kaspersky’s researchers explained how they discovered dozens of malicious application wallpapers on Steam Workshop, many of which had been downloaded thousands or even tens of thousands of times. By analyzing the application wallpapers in question, the researchers found that the malware is either bundled directly into their installation packages or hidden inside password-protected archives that users are then tricked into opening. Unfortunately, the damage is done immediately after one of these compromised wallpapers is installed.

After a user installs one such asset posing as a game called NTRaholic, the wallpaper launches as expected. However, in the process, a backdoor file belonging to the DarkKomet malware is also installed in the background. In order to search for and steal Steam credentials, a custom version of a system library called ‘AggregatorHost.dll’ is installed as well.

In addition to DarkKomet, Kaspersky’s researchers also found other malware families installed in these malicious wallpapers, like the Lumma and Vidar infostealers. They were even used to spread ransomware, too.

How to stay safe from malware

Fortunately, after Kaspersky alerted Valve about this campaign, all of the infected wallpapers in question were removed from the Steam Workshop. Still, this is an excellent reminder to always be careful when downloading files online, even if they come from a trusted platform.

In order to stay safe from any malware contained within desktop wallpapers, game mods, or games themselves, you definitely want to make sure your gaming PC is protected with the best antivirus software. If you want to be extra careful, you might also consider investing in one of the best identity theft protection services. That way, if your credentials are compromised as a result of what you download online, you have a safety net to help monitor your data and recover financial losses from fraud.

When in doubt, stick to trusted creators when downloading new wallpapers and be extra cautious before running any executable on your gaming PC. This likely won’t be the last time hackers target Steam in their attacks, but Valve has an excellent track record of quickly responding to and dealing with malicious activity on its platform.

More from Tom's Guide

• I just got hit by the Ultrahuman data breach — here's what hackers stole from my account
• Update your Nvidia GPU drivers now to protect your PC from 9 "high-severity" vulnerabilities — here's what's at risk
• I just tried Asus’ upgraded Xbox Ally X20 for ROG’s 20th anniversary — and it isn’t just another special edition handheld

Cybersecurity researchers have discovered a new version of the Mandrake Android spyware hiding in apps on the Google Play Store.

As reported by BleepingComputer, Mandrake was first discovered by Bitdefender in 2020, but before then, it had been operating in the wild since at least 2016. Since then, Kaspersky has discovered a new variant of the Android spyware that’s better at remaining undetected.

In a new report, the cybersecurity firm’s researchers explain that this new version of Mandrake managed to sneak onto the Play Store in five apps submitted back in 2022. Surprisingly, most apps remained available for at least a year, while one held out for two years before it was eventually discovered.

If you own one of the best Android phones and are worried about this resurfaced threat, here’s everything you need to know about the Mandrake spyware and how to stay safe from malware.

Delete these apps right now

At the time of writing, all malicious apps found to contain this new version of the Mandrake spyware have been removed from the Google Play Store. However, if you have any of them installed on your smartphone or one of the best Android tablets, you must manually delete them. 

Here are the apps in question, along with how many times unsuspecting Android users have downloaded them:

• AirFS - 30,305 downloads
• Astro Explorer - 718 downloads
• Amber - 19 downloads
• CryptoPulsing - 790 downloads
• Brain Matrix - 259 downloads

Of these malicious apps, AirFS is the one that managed to evade detection the longest, and it was up on the Play Store for two years before eventually being taken down back in March of this year. According to Kaspersky, Android users mainly downloaded these apps in the U.K., Canada, Germany, Italy, Mexico, Spain and Peru.

Hiding in plain sight

The malicious apps spreading the Mandrake spyware do things a bit differently than your typical Android malware. Instead of putting malicious logic in an app’s DEX file, Mandrake hides its first stage in a native library called “libopencv_dnn.so” which is obfuscated using OOLVM.

Once installed on a potential victim’s Android phone, this library then exports functions that are used to decrypt the second-stage loader DEx from its assets folder and load it into memory. 

This second stage also requests to draw overlays often used in overlay attacks. However, it also loads a second native library (called “libopencv_java3.so”), which decrypts a certificate that is used for secure communications with a hacker-controlled command and control (C2) server.

Once the malicious app is connected to the hacker’s C2 server, it sends a device profile and receives its third stage, which is actually the Mandrake spyware. The spyware can perform a wide range of malicious actions such as collecting data, screen recording and monitoring, command execution, simulating swipes and taps, managing files, and even installing additional malicious apps.

The hackers behind this spyware have also devised a way to display notifications that impersonate real ones from the Play Store to trick users into side-loading additional malware through APK files. 

Just like with other dangerous Android malware strains, Mandrake abuses Android permissions to run in the background and to hide app icons so that it can sneakily operate in the background unnoticed.

How to stay safe from Android malware

While all five malicious apps in question have since been removed from the Play Store, cybercriminals could use new, harder-to-detect apps to continue spreading the spyware from Google’s official app store going forward.

For this reason, you always need to be careful when downloading and installing new apps on your Android devices. You want to look at reviews and ratings carefully before downloading anything. Still, as these can be faked, you should also look for external third-party reviews and video reviews that show a particular app in action before you download it.

At the same time, you also want to ensure that Google Play Protect is enabled on your smartphone or tablet since it can scan all your existing apps and any new ones you download for malware. For additional protection, though, you should also consider using one of the best Android antivirus apps alongside it.

Malicious apps have been very successful for hackers and other cybercriminals in the past, which is why this threat likely won’t be going away anytime soon despite Google’s best efforts to prevent them from ending up on the Play Store. This is why you need to be careful and do your research first before installing any new apps on your Android smartphone or tablet.

More from Tom's Guide

• Rite Aid hit in major data breach with 2.2 million customers affected
• Google is giving Chrome a major upgrade to keep you safe from dangerous downloads
• 4.3 million people hit in massive healthcare data breach with full names, addresses and SSNs exposed online

The U.S. government has announced an upcoming ban of Kaspersky’s antivirus software that will go into effect next month.

As reported by The Hacker News, this “first of its kind” ban will prohibit the Russian company from directly or even indirectly selling its security software in the country. However, it also extends to Kaspersky’s affiliates, subsidiaries and parent companies.

In a press release announcing the ban, the U.S Commerce Department’s Bureau of Industry & Security explained that the company’s “continued operations in the United States presented a national security risk-due to the Russian Government’s offensive cyber capabilities and capacity to influence or direct Kaspersky’s operations.”

At the same time, Kaspersky has been added to the U.S. government’s Entity List as a result of its "cooperation with Russian military and intelligence authorities in support of the Russian Government's cyber intelligence objectives." Other companies on this list include Huawei and DJI; the former's products are banned for sale in the U.S., while a ban on DJI drones recently passed the House.

This isn’t the first time the U.S. government has gone after the 26-year-old cybersecurity firm. Back in 2017, Kaspersky’s security software was banned from being used by government employees on federal networks, once again over national security concerns. Then almost five years later, the company was added to the FCC’s “Covered List” of companies that pose an “unacceptable risk to the national security” of the United States.

In response, a Kaspersky spokesperson provided the following statement to Tom's Guide:

“Kaspersky believes that the Department of Commerce made its decision based on the present geopolitical climate and theoretical concerns, rather than on a comprehensive evaluation of the integrity of Kaspersky’s products and services. Kaspersky does not engage in activities which threaten U.S. national security and, in fact, has made significant contributions with its reporting and protection from a variety of threat actors that targeted U.S. interests and allies. The company intends to pursue all legally available options to preserve its current operations and relationships.” 

What does this mean for Kaspersky customers

Beginning on July 20, American businesses and consumers will no longer be able to purchase Kaspersky’s antivirus and other security software. However, existing customers will still be able to receive updates until September 29.

If you’re a Kaspersky customer, you have 100 days to find a suitable alternative. We haven’t heard anything yet about refunds for those with annual plans but if the ban does go into effect, it’s likely the company will announce something along these lines.

Kaspersky’s antivirus has long been considered some of the best antivirus software due to its excellent malware protection, light system impact and included extras. If this ban does go into effect, we’ll be updating all of our antivirus and security software guides accordingly.

For now though, Kaspersky users should be looking for alternatives just in case. While we highly recommend Norton 360 and Bitdefender Antivirus Plus, there are plenty of other antivirus software suites to consider. 

If you use Windows, Microsoft’s built-in Windows Defender antivirus is a great free option and if you use Mac, Apple also includes its own XProtect antivirus software with macOS. 

On mobile, Google Play Protect can help secure the best Android phones but there aren’t any iPhone antivirus apps due to Apple’s malware scanning restrictions. However, Intego Mac Internet Security X9 and Intego Mac Premium Bundle X9 (both featured in our best Mac antivirus software guide) can scan an iPhone or iPad for malware when either device is connected to a Mac with a USB cable.

We’ll be following the Kaspersky ban closely, so stay tuned for the latest updates.

More from Tom's Guide

• Urgent Windows security flaw lets hackers infect your PC over Wi-Fi
• Hackers are now using emoji to speed up their cyberattacks
• Chrome security alert — clicking this error will open the malware floodgates on your PC

When you choose an iPhone over one of the best Android phones, chances are you’re doing so for iMessage, FaceTime and all of Apple’s other apps and features. However, security and privacy are another one of the main reasons many people pick up an iPhone over an Android smartphone.

As the best iPhones and the best MacBooks have become more popular in recent years, they’ve also become a much bigger target for hackers. While you won’t find nearly as much malware on iPhones as on Android devices, there is one big threat you need to look out for: spyware.

From Pegasus to Predator, there are a number of different types of spyware that have been designed to target iPhones. Since Apple’s smartphones are used by everyone from celebrities to politicians, there’s all sorts of valuable financial and personal data that can be stolen by hackers and other cybercriminals.

Although Apple has added new features like Lockdown Mode to better secure its devices, determining whether or not an iPhone had been infected with spyware was quite difficult. Fortunately, security researchers at Kaspersky have developed a new way to determine whether or not spyware is currently present on an iPhone.

Finding traces of spyware with iShutdown

As reported by BleepingComputer, security researchers have now learned that traces of high-profile spyware like Pegasus, Reign and Predator on a compromised iPhone can be discovered by checking the device’s Shutdown.log file. This file logs and stores data every time an iPhone is rebooted.

Checking an iPhone’s Shutdown.log file can be tedious though, which is why Kaspersky has released several Python scripts to help automate the process of analyzing it. At the same time, when compared to other techniques like examining an encrypted iOS backup or network traffic, looking at the Shutdown.log file is much easier.

To this end, Kaspersky has published three Python scripts that the company is calling iShutdown on GitHub. There are also instructions on how to use these scripts along with example outputs.

While this method certainly won’t be for everyone, if you have experience with Python, iOS, terminal output and malware indicators, you might be able to use iShutdown to diagnose your iPhone for any signs of spyware or malware. However, this method will fail if the compromised iPhone in question isn’t rebooted on the day it becomes infected. 

Still, this is quite the breakthrough and should make it easier for security researchers to determine when high-profile targets have had spyware installed on their iPhones.

How to keep your iPhone safe from spyware and malware

Even though you may not have the skills nor experience necessary to run these iShutdown scripts on your own, there are still plenty of steps you can take to help keep your iPhone safe from hackers.

For starters, you want to download and install the latest updates from Apple as soon as they become available. The iPhone maker often patches zero-day vulnerabilities and other bugs when it releases an update. By waiting to install these updates though, you’re putting your iPhone and yourself at risk since hackers love to target users that have yet to update their devices.

While there isn’t an iOS equivalent of the best Android antivirus apps due to Apple’s own restrictions, one of the best Mac antivirus software solutions is able to keep both your iPhone and iPad safe from malware. With Intego Mac Internet Security X9 or Intego Mac Premium Bundle X9 you can scan an iPhone or iPad for malware by connecting it to your Mac using a USB cable.

Besides installing updates and scanning for malware, you also want to avoid opening messages and downloading attachments from unknown senders both in your email and on messaging apps. Infecting an iPhone with malware or spyware is difficult but hackers are quite resourceful and as soon as a bug is fixed, they’re looking for a new one to exploit in their attacks.

We’ll have to wait and see if Kaspersky decides to develop its iShutdown scripts further but for the moment, they are free to download and use to find traces of spyware on a compromised iPhone, granted you have the necessary skills to do so.

More from Tom's Guide

• Hackers have found a sneaky new way to spy on your iPhone — here’s how
• Cyberstalkers are using this Windows 11 tool to track iPhone users
• Fake Lockdown Mode attack can fool you into thinking your iPhone is protected

Although malicious apps normally try to install malware or adware on your smartphone, a new batch of bad apps has been discovered that's actually signing users up for premium subscription services instead.

According to a new report from the cybersecurity firm Kaspersky, subscription trojans are being added to seemingly harmless Android apps in an attempt to defraud unsuspecting users.

We've seen this before with the infamous Joker and Harly malware, both of which used similar tactics to secretly subscribe users to paid services. This new subscription trojan has been dubbed “Fleckpe” by Kaspersky’s researchers and it's currently being spread through photo editing apps, smartphone wallpaper packs and other utilities for the best Android phones.

According to Kaspersky, this subscription trojan has been active since last year and so far, it has been installed on over 620,000 devices. What makes Fleckpe and other subscription trojans so dangerous though is that you might not even realize your smartphone has been infected and that you’ve been subscribed to a paid service without your knowledge. 

Delete these apps right now

Fortunately, all of the apps listed below have since been removed from the Google Play Store. However, if you have one of them installed on your smartphone, you will need to manually delete it. Here are all of the Fleckpe-infected apps that have been discovered so far:

• Beauty Camera Plus
• Beauty Photo Camera 
• Beauty Slimming Photo Editor
• Fingertip Graffiti 
• GIF Camera Editor 
• HD 4K Wallpaper
• Impressionism Pro Camera
• Microclip Video Editor 
• Night Mode Camera Pro
• Photo Camera Editor
• Photo Effect Editor

Keep in mind though that there could be other apps infected with the Fleckpe subscription trojan out there. We'll update this story if more are discovered but in the meantime, you want to make sure that none of the apps above are installed on your smartphone.

Secretly signing users up paid subscriptions

Once a user downloads a Fleckpe-infected app onto their smartphone, the trojan loads a heavily obfuscated native library that contains “a malicious dropper that decrypts and runs a payload from the app assets”.

From here, the payload contacts a command and control (C&C) server controlled by the hackers behind this campaign to send over a device’s Mobile Country Code (MCC) and Mobile Network Code (MNC), which are used to identify where the victim lives along with their mobile carrier.

The C&C server sends over a paid subscription page that is opened by the trojan in an invisible web browser. It then tries to sign the user up for a paid subscription which requires a confirmation code. As Fleckpe-infected apps ask for permission to access a user’s notifications, the trojan is able to get this confirmation code and enter it to confirm the subscription.

All of this occurs in the background and for the end user whose device is infected, the apps themselves work as they normally should to avoid giving away the trojan’s presence.

How to stay safe from malicious apps

Subscription trojans have become increasingly popular with scammers as they are comparatively easy to get onto Google Play and other official Android app stores. This is why you always need to be cautious when installing new apps.

Even if an app has a high rating and a lot of downloads, as was the case here, it could still be malicious. This is why you want to avoid installing unnecessary apps onto your devices. Before installing any new app, ask yourself first if you really need it. Paid apps are much less likely to be malicious when compared to free ones, so paying a few dollars here and there can help keep you safe.

To protect your devices further, you should ensure that Google Play Protect is enabled on your smartphone as it continually scans both new and existing apps for malware. At the same time, you may also want to install one of the best Android antivirus apps for additional protection.

In a statement to Tom's Guide, a Google spokesperson provided further details on how the search giant handles malicious apps like the ones detailed above, saying:

 "When we find apps that violate our policies, we take appropriate action. Users are also protected by Google Play Protect, which can warn users or block identified malicious apps on Android devices.”

Subscription trojans likely aren’t going anywhere anytime soon though as they can be quite profitable for scammers since most users fail to discover unwanted subscriptions right away. This is why you should regularly check for subscriptions on the Play Store by tapping your profile icon and heading to the Payments & subscriptions tab. Here you’ll find all of your subscriptions along with any you might have been subscribed to against your will.

More from Tom's Guide

• 35 million Android users hit with adware — delete these apps now
• Daam Android malware can hold your phone hostage
• Gmail adds blue checkmarks to fight phishing and scammers

Paying for goods at checkout has never been easier thanks to mobile wallets and contactless credit cards but hackers have devised a new way to use the payment systems that enable these features against unsuspecting shoppers.

According to a new press release from the cybersecurity firm Kaspersky, its researchers have discovered new variants of the point-of-sale (PoS) malware Prilex that enables it to block contactless near-field communication (NFC) transactions.

While the cybercriminals behind Prilex started off by targeting ATM machines, they’ve now upgraded their malware to launch attacks against PoS systems like the ones you see at checkout at coffee shops, gas stations, convenience stores and other businesses.

Unlike other malware strains that infect users online, Prilex can now steal your credit card details in the real world where people rarely expect to fall victim to cybercrime.

GHOST attacks

With their malware deployed on a vulnerable PoS system, the cybercriminals behind Prilex are able to conduct “GHOST” attacks where they perform credit card fraud. Unfortunately, even credit cards protected by CHIP and PIN technology which was thought to be unhackable are at risk.

After responding to an incident involving one of its customers, Kaspersy’s researchers uncovered three new modifications to the Prilex malware that enable it to block contactless payment transactions.

Normally with a contactless credit card, you just tap it to pay but Prilex now has a way to block these transactions using a rule-based file that lets the malware know whether or not to capture credit card information. Since NFC-based transactions create a unique card number that’s only valid for one transaction, Prilex detects this and blocks it. When this happens, a message indicating there was a “contactless error” appears on a PoS system and shoppers are then prompted to insert or swipe their credit card instead.

Once a potential victim is forced to use their card, Prilex is able to capture all of the data from the transaction. However, the malware can also filter credit cards based on their type. This allows it to capture black or corporate credit cards with a higher transaction limit while ignoring cards with lower limits.

With a victim’s credit card details in hand, the cybercriminals behind Prilex can commit credit card fraud or even try to steal their identity.

How to stay safe from credit card fraud

While the best antivirus software can help keep you safe from online threats, protecting yourself in the real world is a bit different. Especially when you’re used to being able to securely use your credit card at checkout.

To stay safe from the Prilex malware, you want to be extra careful when you see a “contactless error” after trying to use your credit card to tap to pay. When this happens, you’re better off trying to use cash if you have it but if you want to be extra careful, you can cancel the transaction altogether. It's also worth noting that this malware doesn't affect mobile wallets which is why you're better off using Apple Pay, Google Pay or Samsung Pay instead of your physical credit card.

In a blog post, the identity theft protection provider Aura recommends using a chip reader when possible as they’re more secure than tap to pay. At the same time, you should consider using one card for paying bills and another for everyday transactions. This way, you’ll know if your credit card information was stolen at a physical location instead of online.

The cybercriminals behind Prilex have been operating since at least 2014 and unless they’re apprehended by law enforcement, they and their PoS malware will likely remain a threat to watch out for.

Ahead of the release of HBO’s new series based on the hit video game The Last of US, cybercriminals have already concocted several new scams designed to steal financial data and infect vulnerable PCs with malware.

Once the new show releases on January 13, new fans of the series will likely want to go back and play the games it’s based on. To capitalize on this, cybercriminals are already offering downloads for The Last of Us on PC even though the PC port of the game won’t arrive until March.

According to a new report from the cybersecurity firm Kaspersky, its researchers discovered a site that’s offering downloads of The Last of Us Part II for PC. However, the problem here is that – like its predecessor – the game’s sequel isn’t available yet nor has it even been announced for PC.

If an unsuspecting user does land on the site offering the game for free, malicious files are downloaded onto their PC instead of the real game. In an email to Tom's Guide, web content analyst at Kaspersky, Olga Svistunova provided further insight on the damage these malicious files can do, saying:

"The malicious files distributed can range from Trojans, which can collect your personal data, passwords, and your bank card details without you even knowing it, to ransomware, after which all the files on your device will be encrypted and cybercriminals will demand a ransom within a few hours to get access to them again."

Activation codes and ‘free’ gifts

In addition to sites with downloads for The Last of Us Part II, Kaspersky’s researchers also found a phishing site that provides activation codes for The Last of Us. However, to download the game’s installation file with the activation code, they first have to choose from several “gifts” like a brand-new Playstation 5 or $100 Roblox Gift Card they will receive with the game.

After choosing their free gifts, users are then told to enter their credentials and banking information in order to pay a commission fee. Not only will you not get the game but you will have also freely given your financial details to cybercriminals who could use it to commit fraud or even identity theft.

Kaspersky also points out the fact that cybercriminals have taken a different approach with The Last of US. While they’d normally try to trick potential victims by offering them early access to the HBO series, this time they’re distributing malicious files and stealing data using the games that are already available. This might indicate that they’re targeting younger gamers who are old enough to watch the show and may want to play the games but don’t yet know a lot about cybersecurity.

How to stay safe from malicious software and scams

When it comes to staying safe from scams like the two detailed above, you first want to check to make sure the game is actually available on the platform an ad or website may be suggesting it is. A quick web search would show that The Last of Us Part I comes out in March on PC and The Last of Us Part II has yet to be announced for the platform. 

From here, just like with apps on your smartphone, you only want to download games from official app stores like Steam, the Epic Games Store, Origin, the Microsoft Store, etc. Any game you download from a random website could contain malware or other viruses which is why you should be using the best antivirus software on your gaming PC. Likewise, you also want to look out for ads, emails or links that promise they can let you watch a TV series or film early. 

In his The Last of Us Review, our streaming editor Henry Casey gave the film a coveted 5-star rating and fans of the games on PlayStation will surely want to tune in on January 13. However, you should know that there’s a major timeline change from the video game you’re going to want to look out for. Excited to watch HBO's new series, here's how to watch The Last of Us online.

Even the most benign looking Android apps on the Google Play Store can be dangerous as cybercriminals continue to devise clever ways to bundle malware with popular apps.

In fact, a 2020 study (PDF) from NortonLifeLock found that two thirds of Android malware comes through Google Play. This makes sense as it is the largest official Android app store and comes pre-installed on the best Android phones.

The infamous Joker malware has made headlines in the past but a new blog post from Kaspersky has shed light on a similar malware strain called Harly, named after the DC villain’s on-again, off-again girlfriend.

Since 2020, more than 190 malicious apps infected with the Harly malware have been discovered on the Play Store. While a conservative estimate of the number of times these bad apps have been downloaded is 4.8 million, the actual figure could be even higher.

Joker malware vs Harly malware

Just like with Joker malware, the cybercriminals using the Harly malware to infect Android devices download regular apps from the Play Store, insert malicious code into them and then upload these new apps under a different name. 

Since the now altered apps still include the features listed on their Play Store pages, most users don’t suspect a thing.

Apps containing the Joker malware use multi-stage downloaders to receive their malicious payloads from command and control (C&C) servers controlled by an attacker. With the Harly malware though, the apps themselves contain the entire malicious payload and use different methods to decrypt and launch it.

Delete these apps now

Even though all of the apps listed below have since been removed from the Play Store, you will still need to delete them manually if any of them have been installed on your devices. Here's a list of all of the affected apps along with how many times they've been downloaded from the Play Store:

• Pony Camera - 500,000+ downloads
• Live Wallpaper&Themes Launcher - 100,000+ downloads
• Action Launcher & Wallpapers - 100,000+ downloads
• Color Call - 100,000+ downloads
• Good Launcher - 100,000+ downloads
• Mondy Widgets - 100,000+ downloads
• Funcalls-Voice Changer - 100,000+ downloads
• Eva Launcher - 100,000+ downloads
• Newlook Launcher - 100,000+ downloads
• Pixel Screen Wallpaper - 100,000+ downloads

Signing victims up for subscription services

Although Joker and Harly work a bit differently under the hood, both malware strains are used to sign up users whose devices have been infected for expensive subscription services without their knowledge.

Once installed, Harly collects information about a user’s device along with details about the mobile network they’re using. The phone then switches from Wi-Fi to a mobile network and the malware contacts the C&C server to put together a list of subscriptions to sign up for.

From here, Harly opens the subscription sites in an invisible window, enters a victim’s phone number, presses the required button and even enters any confirmation codes sent via text. The end result is that the victim is signed up for a subscription service without realizing it.

Surprisingly, Harly is even capable of calling specific phone numbers when necessary and confirming subscriptions.

How to stay safe from malicious Android apps

Despite Google’s best efforts, malicious apps often end up on the Play Store. This is why you should carefully check the reviews and ratings of each app you download. As reviews on the Play Store can be faked, it’s also worth checking online to find written or video reviews of any app you’re thinking about installing on your Android phone.

Likewise, you should ensure that Google Play Protect is enabled on your device as it scans all of your apps as well as new ones for any signs of malware. For additional protection though, you may want to install one of the best Android antivirus apps as well.

Just like with anything else you download online, you need to be careful when adding new apps to your devices. Before installing a simple flashlight, address book or translation app, it’s always worth it to ask yourself if you really need this app in the first place.

As cars have become more intelligent, more users are turning to third-party connected car apps to access a wider range of functions compared to first-party offerings. But new research warns they can put your privacy and the security of your vehicle at risk.

To compile its new report on automotive mobile apps, researchers at the cybersecurity firm Kaspersky analyzed 69 popular third-party apps designed to control connected cars to find that more than half (58%) of these applications use a vehicle owners’ credentials without first asking for their consent. Even worse, 14 percent of the apps tested had no contact information, which makes reporting a problem near impossible.

These third-party connected car apps cover almost all major vehicle brands, including Tesla, Nissan, Ford and Volkswagen. But Kaspersky’s researchers claim that they are often not entirely safe to use. Of the key privacy risks drivers might face while using these apps, over half don’t warn them regarding the risks of using the owner’s account from the original automaker’s service.

You may be wondering why some connected vehicle owners turn to third-party instead of first-party apps to control their cars. The reason for this is that they offer unique features that have not yet been introduced by the vehicle manufacturer like being able to see fuel/energy consumption charges depending on the route they take or allowing a user to manage several different car brands all from within one app.

Using authorization tokens instead of a username and password

Some of the developers of third-party connected car apps use an authorization token instead of a username and password in an attempt to appear more credible. However, if a token is compromised, an attacker could get access to your connected car in the same way they could do so with your credentials.

Using authorization tokens doesn’t ensure total safety according to Kaspersky and despite this, only 19 percent of developers mention that they use tokens instead of credentials and warn their users about the potential dangers.

Head of transportation security at Kaspersky, Sergey Zorin, provided further insight on the firm’s new report in a press release while warning users that using third-party connected car apps could put their private information at risk, saying:

“The benefits of a connected world are countless. However, it is important to note that this is still a developing industry, which carries certain risks. When downloading a third-party application to control your car remotely, users should be aware of possible threats. We entrust a lot of private information and personal data to connected technology. 

Unfortunately, not all developers take a responsible approach when it comes to data storage and collection, which results in users exposing their personal information. This data may further be sold on the dark web and end up in untrustful hands. Moreover, cybercriminals might not only steal your data and personal credentials but also gain access to your vehicle – and that might lead to physical threats. For these reasons, we urge application developers to make user protection a priority and take precautionary measures to avoid compromising their customers and themselves.”

How to safely use third-party connected car apps

If you do want to use a third-party app with your connected car, Kaspersky has several recommendations to help you stay safe while doing so.

First off, you should only download apps from official stores like the Apple App Store or Google Play Store. While there could be dangerous apps on either store, at least they are checked by Apple and Google and there is an approval system in place.

Next up, you should check the permissions of the apps you use and carefully consider before giving them access to high-risk permissions like Accessibility Services. The less data an app can collect on you the better as it could be exposed online accidentally or disclosed following a data breach.

In terms of keeping your device secure, you should consider installing a mobile antivirus while keeping both your operating system and apps regularly updated.

When in doubt though, it’s always better to rely on first-party connected car apps from your vehicle’s manufacturer as opposed to trying to use third-party ones to add new features. If you want a feature added to a first-party app, you can always reach out to your vehicle maker or the app’s developer instead, though this may take some time.

Cybercriminals are always looking for new ways to help their phishing attempts get past antivirus engines and attaching HTML documents to an email is an increasingly common technique used to do so.

Instead of inserting links to a phishing page in the body of an email where they’ll likely be found by email filters, malicious HTML attachments make it easier to camouflage phishing content. 

According to Kaspersky, there are two main types of HTML attachments used by cybercriminals: HTML files with a link to a fake website or a full-fledged phishing page. The first type allows an attacker to hide a link in the attached file as well as to automatically redirect a potential victim to a fraudulent site while the second type of HTML attachment allows an attacker to skip creating a fake website while saving on web hosting costs.

Malicious HTML attachments are a growing threat and in the first four months of this year alone, Kaspersky detected nearly 2 million emails that contained them.

FYI: Planning your next big summer trip? Watch out for these scams. 

Hiding phishing pages in attachments

The phishing content found in HTML attachments is usually written in JavaScript in order to handle redirecting users to phishing sites or to harvest their credentials. Typically the HTML page sends data to a malicious URL that is specified in the script itself. However, if an attachment contains malicious scripts or links in plaintext, antivirus and other security software can block it — that's why cybercriminals use JavaScript obfuscation instead.

This technique involves moving code around in such a way that it’s difficult to read and make sense of. While some cybercriminals do this manually to make the original code harder to restore, others rely on any number of ready-made tools to do so.

Another tactic used to hide phishing content in email attachments is encoding or compressing their code so that it appears much smaller than it really is. In one recent instance, Kaspersky came across an email with a malicious HTML attachment that contained a full-fledged phishing page encoded in a tiny, two-line script.

How to spot a phishing site or email

Phishing sites come in all shapes and sizes but they are often designed in such a way that they mimic legitimate web pages so that users don’t think twice when entering their credentials. Even if a cybercriminal makes an almost identical copy of a business’ webpage, looking for spelling errors on the page itself or checking its URL in your browser’s address bar can be a dead giveaway that it’s a fake site.

To avoid having the credentials to your online accounts stolen by cybercriminals, you should always head to a business’ login page via its website or through a search engine as opposed to through your email. This way you’ll know that you’re going to the actual site instead of to a fake one impersonating a brand or business.

When it comes to phishing emails, you should always avoid opening emails from unknown senders. Another trick cybercriminals use to lure you in is instilling a sense of urgency in their messages. Businesses and even the government will rarely if ever ask you to respond to one of their messages in a timely manner. At the same time, it’s worth noting that certain government organizations like the IRS will never contact you by email and any problems with your taxes will be communicated to you via the mail instead.

To avoid falling victim to phishing scams, you should avoid opening emails from unknown senders and this also holds true for any attachments they contain. Although Word files, PDFs and other office documents are commonly attached to emails, very few people send over websites as HTML attachments and if you see an email with one in your inbox, you can be almost certain it’s a phishing email.

As phishing is often used to steal the credentials to commit fraud or even identity theft, you can use a password manager to securely store your passwords and even generate strong and complex passwords for each of your accounts to make them harder to crack or guess.

The cybersecurity company Kaspersky Labs has become the first Russian company to make the U.S. Federal Communications Commission (FCC) list of entities that present an “unacceptable risk to US national security.” 

The list is dominated by Chinese companies, including the likes of Huawei and ZTE, and indeed Kaspersky was accompanied by two more from the country: China Mobile and China Telecom International. 

“I am pleased that our national security agencies agreed with my assessment that China Mobile and China Telecom appeared to meet the threshold necessary to add these entities to our list,” said FCC Commissioner Brendan Carr in a press release announcing the trio of additions. 

“Their addition, as well as Kaspersky Labs, will help secure our networks from threats posed by Chinese and Russian state backed entities seeking to engage in espionage and otherwise harm America’s interests.”

What this means in practice is that US businesses are forbidden from using federal subsidies to purchase equipment or services, which is obviously some distance from an outright ban or the trade embargo that crippled Huawei’s ability to use Android back in 2019.

Nonetheless, Kaspersky is understandably affronted by the decision, and put out a  press release claiming that the move “is a response to the geopolitical climate” rather than being based on any concerns about the quality or otherwise of the company’s products.

MORE: Almost all Android smartphones at risk of attack — what to do

“This decision is not based on any technical assessment of Kaspersky products – that the company continuously advocates for – but instead is being made on political grounds,” the release reads. It also took aim at the continuing ban on Kaspersky products by government agencies, signed into law back in 2017 on similar grounds.  

Nonetheless, this isn’t the first national information-security agency to nudge users away from the company’s products. Earlier this month, the German Federal Office for Information Security ran a public advisory suggesting users replace Kaspersky anti-virus with an alternative. 

“The warlike actions of Russia as well as the threats made against the EU, NATO and the Federal Republic of Germany harbor a considerable risk of a successful IT attack, which could have far-reaching consequences,” the BSI explained in its reasoning (via Google Translate.)

Editor's note: Future, the parent company of Tom's Guide, has chosen to stop doing business with Russian companies, including Kaspersky, which was on our list of the best antivirus software. We remain committed to helping our readers to source and find the best products and will offer multiple alternatives in the categories affected. 

Germany's national information-security agency yesterday (March 15) advised the country's citizens to remove Kaspersky antivirus software from their computers, warning that the Russian-made programs might be used as weapons by the Russian government as tensions with the West rise following the invasion of Ukraine.

"The BSI recommends replacing applications from Kaspersky's virus-protection software portfolio with alternative products," said the German Federal Office for Information Security, or BSI, in a public advisory that we ran through Google Translate. 

"The warlike actions of Russia as well as the threats made against the EU, NATO and the Federal Republic of Germany harbor a considerable risk of a successful IT attack, which could have far-reaching consequences," said a BSI FAQ (in German) linked to from the advisory.

How antivirus software could be used against you

"Antivirus software ... has extensive system authorizations and ... must maintain a permanent, encrypted and non-verifiable connection to the manufacturer's servers," the BSI's advisory explained. "If there are doubts about the reliability of the manufacturer, virus protection software poses a particular risk for the IT infrastructure to be protected."

The FAQ took pains to make clear that Germany is not banning Kaspersky software, just "raising awareness of possible dangers." It added that "the decision on whether to continue using the software must be made individually by the users."

The German warning generally falls in line with our own 2017 advisory about not using Kaspersky software for machines involved with national security or critical infrastructure. But it goes further than our own in recommending that ordinary citizens consider removing Kaspersky software as well.

"All users of antivirus software can be affected by such operations," said the advisory, while the FAQ said, "Consumers may be the least targeted, but in the event of a successful attack, could also be victims of collateral effects."

Tom's Guide and its parent company Future have "de-monetized" our reviews of Kaspersky products, removing links to websites where you can buy Kaspersky software and foregoing the affiliate revenue that comes from those sales.

Kaspersky might have to do what Putin says

The German authority stopped short of accusing Kaspersky of actively colluding with Russian security agencies. American and Israeli government agencies have tried to make that case in recent years, but the evidence has been largely lacking.

Instead, the BSI hypothesized that Kaspersky might not have a choice but to do the Kremlin's bidding.

"A Russian IT manufacturer can carry out offensive operations itself, be forced to attack target systems against its will, or be spied on without its knowledge as a victim of a cyber operation, or be misused as a tool for attacks against its own customers," said the BSI advisory.

For consumers, this might mean that "data will be deleted or encrypted," according to the BSI's FAQ. "The data that Kaspersky has stored about [consumers] could leak if Kaspersky itself becomes a victim of a cyber operation."

Kaspersky responds to the German warning

The Kaspersky company responded to the BSI advisory with an English-language statement of its own, arguing that the BSI warning was "made on political grounds" and that Kaspersky "does not have ties to the Russian or any other government."

"We believe that peaceful dialogue is the only possible instrument for resolving conflicts," the Kaspersky statement added. "War isn't good for anyone."

That last bit repeats a statement that company co-founder and CEO Eugene Kaspersky tweeted on March 1.

Such words might be charitably viewed as the most a Russian company or individual can say while still staying on the good side of an increasingly repressive and punitive government. 

It's nonetheless noteworthy that Eugene Kaspersky uses the "war" even as Russia has banned public statements using the word when referring to Russia's "special operation" in Ukraine.

The company co-founder put up an angry blog post today (March 16) addressing the BSI advisory.

"Kaspersky, the long-time partner and contributor of BSI and German cybersecurity industry, was given mere hours to address these bogus and unfounded allegations," Eugene Kaspersky wrote. "This is not an invitation for dialogue — it is an insult."

"Not having Kaspersky in Germany will not make Germany or Europe safer," he added. "We consider this decision to be unfair and outright wrong."

"This war is a tragedy that has already brought suffering to innocent people and repercussions across our hyper-connected world," Eugene Kaspersky concluded. "The global cybersecurity industry that has been built on the basis of trust and cooperation to protect the digital links connecting us with each other may well be its collateral damage — and thus leave everyone even less safe."

It's up to you to decide

Kaspersky the company has been trying to evade Russian-Western conflicts for some time, legally domiciling the company in London, offering to privately disclose its source code and moving many of its servers and operations to Switzerland. Meanwhile, Kaspersky the man has, to our knowledge, not set foot on U.S. soil for several years.

We still think that Kaspersky makes some of the best antivirus software, and is one of the top information-security companies overall. Its researchers are among the best in the world, and the company exposes Russian state-sponsored hacking campaigns as often as it does American ones.

Yet the reality is that Kaspersky still has most of its operations in Moscow and has numerous Russian government agencies as clients. Installing Kaspersky software creates an unnecessary risk for any Westerner involved in highly sensitive matters, and, now that war has come to Ukraine, perhaps for everyone else too.

"Manipulation of the virus-protection software from the manufacturer Kaspersky cannot be ruled out," read the BSI's FAQ. "So if you want to be on the safe side, you should use other antivirus software for the time being."

Editor's note: Due to the invasion of Ukraine, Tom's Guide and its parent company Future have chosen to stop doing affiliate-link business with Russian companies, including Kaspersky. We remain committed to helping our readers to source and find the best products and will offer multiple alternatives in the categories affected.

From the entry-level Kaspersky Anti-Virus to the top shelf Kaspersky Total Security, Kaspersky's Windows antivirus programs protect you from online dangers with local scanning and cloud-based machine-learning.

The top-tier program, Kaspersky Total Security, has a password manager, great parental controls, a hardened browser for online transactions and innovative stalkerware protection. 

While its malware scanner did let a few potential threats through, it’s a step ahead of the pack with fast speeds that have only minimal impact on your computer's operation.The only downside is that unlimited access to Kaspersky's Secure Connection VPN service costs an extra $30 a year.

Nonetheless, we think Kaspersky Total Security is the best antivirus program you can buy right now, although not everyone needs all its features. Read on for the rest of our Kaspersky review to see if it’s right for you.

We must mention that Kaspersky is a Russian company with many operations around the world. We don't yet know whether the Russian invasion of Ukraine and the resulting economic sanctions on Russia will affect the operations of Kaspersky software. 

We still think Kaspersky software is safe for general consumer use, although it would create an unnecessary risk for persons or organizations involved with national security or critical infrastructure.

Kaspersky: Costs and what's covered

Kaspersky's Windows lineup offers the traditional Kaspersky Anti-Virus, Kaspersky Internet Security and Kaspersky Total Security programs, plus three Security Cloud services, one of them free. They all use the same malware-scanning engine but differ on extra features.

Kaspersky Anti-Virus is for Windows only, and its password manager is limited to 15 sets of credentials. It also protects against stalkerware, quasi-legal spyware that business partners or jealous lovers can use to monitor you. It costs $60 per year for  three PCs or $80 for five, a bit more than Bitdefender's comparable Antivirus Plus. Nonetheless, we reckon it's the best Windows 10 antivirus software out there.

Kaspersky Internet Security covers three devices for $80 per year or five for $90. It adds a two-way firewall, anti-tracking defenses, webcam protection and the Safe Money hardened browser. We've done separate reviews for Kaspersky Internet Security for Mac and Kaspersky Mobile Antivirus for Android, but you also get them with Internet Security and Kaspersky's other multi-platform packages.

Kaspersky Total Security adds file encryption, file shredding and file protection in case of from ransomware attack. It includes Kaspersky Safe Kids Premium (we've reviewed that separately) and an unlimited password manager, and costs $100 per year for five devices or $150 for 10.

Most of Kaspersky's antivirus products limit use of the company's Secure Connection VPN service to 300MB a day. For unlimited VPN data, you'll have to pay an extra $30 per year (inexpensive compared to stand-alone VPN services).

Kaspersky Security Cloud is a server-based option that mates regular antivirus protection with online privacy protections. Overall, its features are not too different from those of Kaspersky Total Security, but Security Cloud may appeal to individuals or families with multiple devices.

Kaspersky Security Cloud Free (also reviewed separately) replaces and improves upon the old Kaspersky Free Antivirus. We think it's the best free antivirus program you can use.

Kaspersky Security Cloud Personal covers three PCs, Macs or Android or iOS devices for $90 per year or five devices for $100, but all must be linked to a single Kaspersky online account. It warns of new devices added to a home network and monitors email addresses for involvement in data breaches. It has an unlimited password manager and ups the VPN data to 500MB per day.

Finally, Kaspersky Security Cloud Family adds parental controls, covers up to 10 devices and lets 10 family members have their own Kaspersky accounts. However, only five of them can have unlimited password managers. It costs $150 per year.

Kaspersky software works with Windows 7 with Service Pack 1 and later or macOS 10.14 Mojave and newer. For phones and tablets, the apps can protect devices with Android 4.4 KitKat or iOS Version 12 or higher.

Allegations that Kaspersky is an arm of the Russian intelligence services have quieted since 2018. None of the claims have been proven and we have yet to see convincing evidence of backdoors or intentional security holes in Kaspersky products. Although Kaspersky's headquarters are still in Moscow, it has moved some online infrastructure to Switzerland.

Kaspersky: Antivirus protection

When a Kaspersky program finds something new and potentially dangerous, the item is uploaded to the Kaspersky Security Network lab for assessment. New malware definitions are sent to the company's 400 million users several times per day. If you don't want your system uploading data to Kaspersky, you can opt out while installing the software or in the program's settings.

All Kaspersky paid apps defend Windows' Unified Extensible Firmware Interface (UEFI) from bootkit malware and also guard against fileless attacks. The program's Application Control lets you choose which programs to allow.

Kaspersky's Gaming mode silences security warnings and updates during games or movies and can automatically start up when a full-screen app is launched.

For a seriously infected system that doesn't respond to the traditional malware tools, Kaspersky's Rescue Disk can reboot the system in Linux to give it a thorough cleaning. You have to download the software and install it on a USB flash drive.

Kaspersky: Antivirus performance

Kaspersky's malware scanner continues to provide excellent protection from a variety of attacks, new and old.

In the November-December 2020 round of testing by Germany's AV-Test lab, Kaspersky detected 100 percent of both new "zero-day" and well-known "widespread" malware and had just one "false positive" detection of benign software. Most of the other antivirus brands we review, including Bitdefender, Norton and Microsoft, also had clean sweeps.

Overall, Kaspersky's track record in AV-Test's monthly evaluations is exemplary. Since January 2017, it has failed to detect 100% of zero-day malware only twice and has never missed any widespread malware. Only Norton beat that record, with a single miss on zero-day malware, but Norton tended to have more false positives.

In evaluations conducted between July and October 2020 by the Austrian lab AV-Comparatives, Kaspersky was 99.7% effective against "real-world" malware (a mix of new and old malware found online) with two false positives.

Bitdefender had a 99.6% percent score and four false positives. Trend Micro had a perfect 100% detection rate but at a cost of a whopping 63 false positives.

London-based SE Labs digs a bit deeper, checking whether antivirus software blocks malware from being installed or merely neutralizes it after installation, and scoring accordingly.  

That wasn't a problem for Kaspersky, which got perfect 100% scores in each of SE Labs' quarterly rounds of tests in 2020, the only antivirus brand to do so.

In the October-December 2020 SE Labs round, McAfee also got a perfect score, offsetting a couple of less-than-stellar results earlier in the year. Norton detected 100% of malware but neutralized rather than blocked 1%. 

Trend Micro, which consistently does well on the AV-Test and AV-Comparatives tests, let through two pieces of malware to infect the system; Sophos let through a whopping eight. Bitdefender and ESET were not tested.

Kaspersky: Security and privacy features

Each Kaspersky Windows antivirus product has browser extensions for Google Chrome, Mozilla Firefox, Microsoft Edge and Microsoft Internet Explorer to safeguard data typed into websites, warn of phishing attempts and block pop-up ads. Mac users get an extension for Safari as well.

The two-way firewall in Kaspersky Internet Security and Kaspersky Total Security lets you create separate rules for different networking hardware. But the audio portion of their webcam protection must be manually managed through Kaspersky's Application Control feature; by contrast, Bitdefender's webcam protection does this automatically. 

The Safe Money hardened web browser, best for online shopping and banking, is also part of Internet Security and Total Security. It provides an on-screen keyboard, uses HTTPS website encryption wherever possible and blocks extensions. Bitdefender provides a similar feature with its Safepay browser.

Kaspersky Total Security includes the unlimited Password Manager, which otherwise costs $15 per year. Total Security's Safe Kids parental controls let parents limit a child's screen time, locate mobile phones via GPS, monitors Facebook actions and lets you see in-depth reports on online activities.

Although it falls short of a true backup program, Kaspersky Total Security's Backup and Restore can copy of your system's documents, photos, videos and music and any other files, and can back this data up via FTP.

Kaspersky Total Security's Data Vault uses 56-bit AES encryption to scramble any file so that only a password can open it. Other AV brands are phasing out encryption software, and Kaspersky is one of the last remaining to offer it.

The program's File Shredder can eradicate sensitive or embarrassing material forever. You have the choice of seven erasing techniques, including several used by the U.S. military. Most other antivirus brands that include file shredders don't give you so many options.

The Clean and Optimize features are included in Kaspersky Internet Security and Kaspersky Total Security to get rid of unnecessary apps, delete duplicate and temporary files and clear browser histories.

Kaspersky: Performance and system impact

Kaspersky software has full and quick scans, a customizable selective scan, an external-drive scan and a vulnerability scan to find system weaknesses.

To measure the effect Kaspersky Total Security had on system performance, we used our custom Excel benchmark test, which clocks how long a PC takes to match 20,000 names and addresses in a spreadsheet. Our Lenovo ThinkPad T470 test machine had a 2.5GHz Core i5-7200U processor, 8GB of RAM and 256GB of solid-state storage with 61.2GB of files.

Before we installed the Kaspersky software, the ThinkPad T470 took an average of 10.2 seconds to complete the Excel benchmark. The completion time rose to 11.4 seconds after Kaspersky Total Security was installed. 

This 12% slowdown is much less than the 19% slowdown Bitdefender Total Security encountered under the same conditions, showing Kaspersky's light touch.

Kaspersky Total Security imposed a small-to-moderate performance hit on our test system. During full scans, the benchmark time rose to an average of 12.9 seconds, 13% slower than the post-installation completion time and 26% slower than the pre-installation baseline.

This was reflected in quick scans as well, with the average benchmark completion time rising to 12.4 seconds, a drop in performance of 9% from the passive score and a 22% performance drop from the baseline.

Those were on a par with Bitdefender Total Security's slowdowns from the post-installation completion time, which were 11% and 10%, respectively. But Bitdefender had a higher slowdown overall; both its full and quick scans had performance drops of more than 30% from the baseline.

Kaspersky Total Security's first full scan took 17 minutes and 34 seconds and looked at 400,571 files, half as long as Bitdefender Total Security's took to examine 1.2 million files. The second time around, Kaspersky Total Security's full scan was very quick, taking just 1 minute and 49 seconds to look at 309,525 files.

Kaspersky's first quick scan took 1:26 to scan 3,381 files, less than half the time Bitdefender's quick scan took. A subsequent Kaspersky quick scan took 1:12 to look at the same number of files.

Kaspersky: Interface

Kaspersky's interface hasn't changed much since the 2020 edition. The eight boxes on the home screen provide access scans, updates, the hardened browser, the password manager, privacy settings and parental controls.

The interface can be confusing, with at least three ways to update Kaspersky's malware definitions. Many pages may not fit your screen and will require scrolling up and down. But the scan severity can be set to Low, Recommended or High, and scans can be easily scheduled for a set time or for every minute, hour, day, week or month.

Kaspersky's Windows Taskbar icon, viewable at the bottom right of your screen, can open the hardened browser. Kaspersky's online My Kaspersky account lets you protect other devices, renew your coverage subscription or read news about computer security. You can set up your Kaspersky account with two-factor-authentication for an extra level of security.

Kaspersky: Installation and support

It took us a little less than seven minutes to install Kaspersky Total Security. The beachhead installer asked for our name, email address and preferred language and whether Kaspersky could send us promotional email messages or collect information about our computer.

Thanks to California's new data-privacy law, its residents must agree to a different Terms of Service than other U.S. residents.

Total Security then downloaded the 215MB main installer and set up the full program. At this point, you'll need to pay or enter a promotional code, then create a Kaspersky Security Network online account.

The installer ran a quick scan of my system and made recommendations such as picking which sensitive files to back up.

Kaspersky's paid antivirus software includes 24/7 technical support via telephone, email or online chat. Online self-help materials include articles and decryption tools for several ransomware strains.

Kaspersky review: Bottom line

While Kaspersky Total Security remains our top choice for the best antivirus program, Norton and Bitdefender's premium programs have caught up in terms of protection and features. All three bring together fast local scans with online malware analysis while not consuming too many system resources.

The only major item Kaspersky Total Security is missing is an unlimited VPN service, something that Bitdefender Premium Security and all Norton 360 packages include.

Those on a budget or who don't have kids may prefer the value-packed Bitdefender Antivirus Plus. If money is no objection, and you need identity-theft protection and unlimited VPN service as well as antivirus software, consider Norton 360 with LifeLock.

With five paid programs — from the minimalist Kaspersky Anti-Virus to the online Kaspersky Security Cloud to the flagship Kaspersky Total Security — you can decide what protection and features you need. Think of Kaspersky antivirus software as the best of both worlds: top protection that quietly operates behind the scenes and only alerts you when there's a problem.

UPDATED to reflect Russian invasion of Ukraine. This review was originally published in October 2020.

• The best internet security suites
• Best Android antivirus apps

Kaspersky is a large antivirus company that offers parental control software, so you can be assured that the company isn't going away anytime soon. Kaspersky Safe Kids is most notable for the incredible value that it offers for a quite broad feature set.

Both the free tier of Kaspersky Safe Kids, which supports unlimited child profiles and devices, as well as its premium offering that costs just $14.99 a year to unlock the full feature set, blow away the competition from a value perspective.

While both the Kaspersky web portal and its mobile apps have undergone redesigns since I last reviewed the app, the makeovers have not really improved things. The web portal remains exceedingly slow and the mobile apps, while aesthetically improved, are still poorly organized.

As is the case with many of the best parental-control apps that I tested, Kaspersky Safe Kids' functionality on iOS is dramatically limited compared to Android.

Android users on a budget who want a bit more than what Google Family Link can offer should give Kaspersky Safe Kids a shot. With its excellent free tier and a free trial of the premium tier available, there is no reason to skip Kaspersky. The web portal can be frustratingly slow, but if you can live with that, then Kaspersky Safe Kids is a fantastic value. Read on for the rest of our Kaspersky Safe Kids review.

Kaspersky Safe Kids: Costs and what's covered

Kaspersky Safe Kids uses a freemium model. You can use some features completely free or pay a yearly subscription to unlock the app's full functionality. Kaspersky has kept the price for its premium tier astoundingly low for years at just $14.99 a year for an unlimited number of child profiles and devices on all major platforms.

No other paid service that I tested is even vaguely close. ESET Parental Control for Android is $30 and covers only one platform; Norton covers three (Windows, Android and iOS) at $50 per year. As with those apps, Kaspersky Safe Kids is also bundled with the parent company's antivirus software.

Kaspersky also offers one of the most feature-complete free options on the market. It includes web filtering, app management, basic screen-time management and a new safe search in YouTube feature.

Other freemium options like Qustodio and OurPact offer somewhat comparable features for free, but Kaspersky outdoes them by covering an unlimited number of child accounts and devices, while the others limit monitoring to just a single child and device.

Upgrading to the Kaspersky paid tier gets you additional features, and given the low yearly cost of $15, the paid option is certainly worth considering. The paid features include advanced screen-time management, a child locator, a battery tracker, social-network monitoring, YouTube search history and real-time alerts so you know the instant something is wrong.

Kaspersky Safe Kids supports virtually all the major platforms with Android, iOS, Windows and macOS. If you need Kindle Fire support, you'll need to look to either Net Nanny or Qustodio.

Kaspersky Safe Kids: Setup

As with most of these services, you should first create your own Kaspersky account. Once you've logged into your My Kaspersky using either the web portal or the mobile app, you can then create child accounts by adding a name, year of birth and either an avatar or photo for each child. 

Kaspersky gives parents some dialogue cues or talking points for explaining to a child why you are installing a parental control app on their device.  Differing phrases are offered depending on the age of the child.

This kind of thing is present throughout the Kaspersky app, and while it doesn't rise to the level of guidance that Net Nanny offers, I do think it's a nice touch. You can easily dismiss these suggestions if you don't find them helpful.

From there you simply install the app on your kid(s) device(s). Kaspersky doesn't handle this process quite as adeptly as Norton Family, my gold standard on the Android side, but it does ensure that you get all the necessary permissions checked. 

Recent versions of both Android and iOS don't let you grant permanent location privileges to an app during installation.  You'll need to go into the operating system's settings menu and toggle the Kaspersky app's location privileges to "always" if you want location tracking to work.

Kaspersky Safe Kids: App management

Kaspersky goes about app management in a slightly different way than other parental-control apps. It treats app management like web filtering, with category-based blocking on Android. On iOS, your only option is to block apps that have age restrictions of any kind. 

Simplistic though it may be, the iOS app blocking does work. It immediately removed all the apps on my test device that had a rating above the stated age of my child. However, this does call into question the validity of some of the app ratings, as while YouTube carries a 17+ rating in the App Store, Tik Tok gets a 12+ rating. 

Android users get a much more extensive feature set, beginning with that category-based blocking. There are a total of 17 categories, and you can toggle each one as either "allowed" or "forbidden."

This doesn't delete or hide the apps — it simply triggers a pop-up indicating "Using this app is not allowed." The child can ask for permission to use the app, although Kaspersky doesn't give them a text box to make an argument as Norton does.

While this is obviously a big step up from what's available on the iOS side, if this were all that was available for app management on Android, I'd be pretty disappointed.

Fortunately, there is more to it. If you scroll to the bottom of the Apps page you will see "Exclusions." Tap there and you will see the full list of apps installed on your child's device, with the ability to make determinations about apps one by one.

Your choices for each app include "Allowed," "Blocked" or "Limited." The first two are what you would expect; the third lets you set daily time limits (or splits between weekday and weekends) for individual apps. It lets you get as granular as you want, with a full 24-hour setting broken down to the minute.

Kaspersky Safe Kids: Web filtering

Kaspersky Safe Kids identifies this section as simply "Internet."  It offers you some general settings, such as like toggling on Safe Search to block inappropriate content when using Bing, Google, Yahoo!, Mail.ru or Yandex. (The last two are popular in Russia, Kaspersky's home country.) Safe Search can also be applied to YouTube. Finally, you can choose to be notified in the event of any searches for restricted content. 

There are 14 different categories that can be filtered, and each can be set as "Allowed," "Forbidden" or "Warning." Warning brings up a full splash screen if your child tries to visit that site, telling them visiting it isn't advised and that the child will need to click "go there anyway" to proceed.

You can also create exclusions to either block or allow specific sites, and you can choose to block all websites outside of your specific exclusions. While Kaspersky Safe Kids can filter most major browsers (Chrome, Edge, Firefox, Safari), it doesn't work with some others, so if web filtering is important to you then consider blocking alternative browsers in the app-management system.

Kaspersky Safe Kids: Time management

Device use is Kaspersky's name for its time-management features. It's reasonably full featured, but more convoluted and cumbersome to set up than it should be. 

First you need to determine the type of monitoring you would like to have. iOS and Android both support "Statistics only" and "Show warning," while Android alone gets the option to "Block device."

Statistics will just display usage. Show warning will create a pop-up letting the child know they have reached their time limit for the day.  On Android, the device or apps can be blocked completely, leaving open only calls and SMS messaging.

While the Kaspersky app interface is painfully dated, you can get incredibly granular with the settings. You can choose a daily limit for weekdays versus the weekend, or for each day of the week, from no time at all up to 24 hours, down to the minute.

Downtime lets you set intervals of managed time, and you can set as many as you like, again down to the minute. As I mentioned in the app-management section, on Android you can also set separate time limits for specific apps.

Kaspersky Safe Kids does let children request more time when they have run out for the day. Requests will prompt you with a notification, and you can determine if you'd like to grant the kids more time. Because Kaspersky can't actually stop them from continuing to use their device past the cutoff time on iOS, it will simply notify you about that.

Kaspersky Safe Kids: Location tracking

Kaspersky calls this "Where is my child?" and it is the most fully featured implementation of location tracking that I've seen. It gives you a lot of data regarding a child's present location beyond just the pinpoint on a Google Map.

Kaspersky Safe Kids tells you how long ago it received the coordinates, how accurate it believes the coordinates to be and what the coordinates are based on (GPS, Wi-Fi, cell-tower triangulation or some combination). It also shows you how much battery life your child has left on their device, which can be critically important.

Kaspersky also offers geofencing, referred to as "allowed areas." You can define as many locations as you like, with not only where the child should be but when and how long you expect them to be there. You can set the size of these circular areas from around 600 feet across to more than 124 miles across, which is almost comically large.

Kaspersky Safe Kids: Extras

Social networks
This specifically allows for monitoring of activity on Facebook and the Russian social-media site VK. Setting up social-media monitoring involves sending a link to your child, who then needs to use it to log into the relevant social network.

If either network is a major portion of your child's social media life, then this feature might be valuable, but given the abundance of other social networks it seems a bit meaningless to monitor just one or two.

Kaspersky Safe Kids review: Verdict

Kaspersky Safe Kids blows me away in terms of value. Given what the rest of the market is charging, it could double its price and still represent a solid buy. At $14.99 per year, if you can deal with its little quirks and irritations, Kaspersky Safe Kids is hard to pass up.

If you want to check up on your kids' activities all the time and keep very close tabs on them, I might suggest looking elsewhere as Kaspersky's web portal and parental app can be frustrating to use multiple times a day. But for parents who want to set up some blocks, filters and scheduling and then just look at the reports every day or two, then Kaspersky Safe Kids is an excellent choice, particularly for Android users.

At first glance, Kaspersky Internet Security for Mac feels like it will be an easy recommendation, thanks to its perfect malware performance, extensive features and affordable pricing. But as you dig deeper, you start to uncover some flaws.

The extensive feature set is filled out with some extremely limited extras, such as a built-in VPN, password manager and parental controls, the latter two being trial versions that aren't worth your time. All these features are jammed into a user interface that gets confusing to navigate at times.

The good still outweighs the bad, so if you are a fan of Kaspersky, I wouldn't specifically tell you to avoid this app. But other options, like Bitdefender Antivirus for Mac or Norton 360 Standard, offer better overall packages among the best Mac antivirus programs.

Read on for the rest of our Kaspersky Internet Security for Mac review.

Kaspersky Internet Security for Mac: Costs and what's covered

Kaspersky Internet Security for Mac offers basic antivirus protection, phishing protection, privacy features and encrypted browsing for online purchases. It starts at $40 for a single device for one year; you can also cover up to three Macs for $60 per year. Unlike most of its competitors, Kaspersky does not offer discount for purchasing multiple years of service. (Most of these plans give you a big discount for the first year of a subscription.)

If you need to cover a wider variety of devices, Kaspersky Internet Security adds support for Windows and mobile devices but otherwise offers identical features. That package starts at $80 per year for three devices or $90 per year for five devices.

Kaspersky Total Security adds the full versions of Kaspersky Safe Kids and Kaspersky Password Manager along with file backup for Windows users. These plans start at $100 per year for up to five devices or $150 per year for up to 10 devices.

Kaspersky Internet Security for Mac will run on any Mac with macOS 10.12 (Sierra) or later.

Kaspersky Internet Security for Mac: Antivirus protection

Kaspersky offers excellent real-time protection against malware. Like most of its competitors, it relies on both machine learning as well as its network of more than 400 million computers running Kaspersky antivirus software to detect both known and new malware.

Customers can choose whether to upload anything detected as potentially dangerous to the Kaspersky Security Network, but regardless of whether or not you participate, you benefit from the malware database, which is updated daily.

Kaspersky Internet Security for Mac: Antivirus performance

In order to determine the overall efficacy of Kaspersky Internet Security for Mac's malware scanning, we relied on the Germany-based AV-Test lab and Austria-based AV-Comparatives lab, which conduct regular evaluations of major antivirus apps and services.

During the May-June 2020 round of testing by AV-Test, the most recent time it was evaluated, Kaspersky Internet Security for Mac detected 100% of Mac malware as well as more than 99% of potentially unwanted programs for Mac and more than 99% of Windows malware, which sometimes lurks on Macs.

During that same round of testing, Avast Free Mac Security (100%), Bitdefender Antivirus for Mac (98.8%), Norton 360 Standard (100%) and Trend Micro Antivirus for Mac (100%) at best matched Kaspersky's perfect performance.

Intego Mac Internet Security X9 was not tested at that time but achieved a Mac malware-detection rate of 98.5% in AV-Test's November-December 2020 round. Avast, Bitdefender, Norton and Trend Micro all scored 100% in AV-Test's March-April 2021 evaluations.

Kaspersky Internet Security for Mac avoid registering any false positives, meaning all its malware detections were accurate, but this was true of its competitors as well.

This was not a shocking result for Kaspersky Internet Security for Mac, which has managed a perfect 100% detection rate each time it has been part of AV-Test's evaluations since April of 2017. 

Turning to the AV-Comparatives testing, Kaspersky Internet Security for Mac identified 100% of the Mac malware threats, 96% of the Mac potentially unwanted programs, and 100% of the Windows malware.

It has had perfect Mac-malware detection rates on each of the annual AV-Comparatives tests going back through July 2017. Avast, Bitdefender, Intego and Trend Micro were all part of the June 2021 test as well; the first three also received perfect 100% detection rates, while Trend Micro detected 99.6% of Mac malware. Norton was not tested.

Kaspersky Internet Security for Mac: Security and privacy features

Kaspersky Internet Security for Mac has an extensive feature set, but as you'll see, in some cases you just get access to the free limited versions of some of Kasperky's apps, which aren't necessarily worth your time or drive space.

Kaspersky offers its web protection via browser extensions that are available for Google Chrome, Safari and Firefox. This provides a variety of protections including basic monitoring for malicious content, tracking blockers and a URL advisor to help you steer clear of dangerous sites before you visit them. 

Kaspersky also has one fairly unique tool as part of its browser extensions. Safe Money defaults you to HTTPS securely encrypted sites when possible, blocks other extensions, will detect when you are going to make a payment online and gives you an onscreen keyboard to enter your payment information to avoid keyloggers. 

Kaspersky Internet Security for Mac also allows you to block your webcam at a software level to ensure it can't be accessed by another application. With our increased reliance on video conferencing, it's particularly nice to have additional reassurance that you aren't being spied on.

Kaspersky Password Manager is included, but it is merely the free version, which is limited to just 15 passwords, and the link to the password manager just serves as a launcher for the standalone app. You can unlock the full version of the password manager for $15 a year, but you are going to be much better served by one of the best password managers.

Kaspersky's Secure Connection VPN is somewhat similar in that it is merely a launcher for the standalone app and is restricted to 300MB of data traffic per day. If you are just looking for something to use when banking or performing some other very minimally data-intensive task, then that small amount of data might work.

But otherwise, you would need to pay an extra $30 per year to unlock the unlimited version of Kaspersky Secure Connection, which also gives you the option to select different server locations. That is pretty reasonable pricing and on par with our value choice for the best VPN, Surfshark.

The last of these add-on apps is the Safe Kids parental controls. Once again, this is a free version of that service, which limits you to monitoring a single child device and lacks premium features such as location tracking and real-time alerts. The paid version is just $15 a year, so if you are in the market for an affordable parental-control app, you can take a look at our review of Kaspersky Safe Kids to see if it's right for you.

Kaspersky Internet Security for Mac: Performance and system impact

In order to measure the performance impact of Kaspersky Internet Security for Mac, we ran the Geekbench 5 benchmarking test prior to installing the app and then ran a series of tests with the tool after installation. The 2016 MacBook Pro 13-inch laptop that we used for the review had a 2.9Ghz Intel Core i5-6267U processor, 8GB of LPDDR3 RAM and a 256GB SSD with 42.18GB of files installed.

Before we installed Kaspersky Internet Security for Mac, the MacBook Pro achieved a Geekbench 5 score of 1,868, which dropped to 1,816 following the installation of the app.

While not terribly significant by Windows antivirus standards, this was the largest performance hit we saw after installation of any Mac antivirus program, with Trend Micro (1%) the only other Mac antivirus app that generated any perceptible background slowdown.

The full scan went much better for Kaspersky's performance impact, with a mere 12% drop-off, tied with Norton for the most minimal slowdown during a full scan. Bitdefender (19%) wasn't too far behind, but from there Avast (27%), Intego (34%) and Trend Micro (46%) were all far from challenging Kaspersky.

A quick scan saw a return to the bottom of the pile with a 4% drop, which was just behind Avast (3%) and Intego (3%). Bitdefender (1%) and Trend Micro (1%) were almost perfect on this test, with Norton (0%) crowned the champ.

Kaspersky Internet Security for Mac's first full scan took 39 minutes and 5 seconds and scanned 808,142 files. This was easily the slowest full scan of any Mac antivirus app that I reviewed, with Bitdefender (27:55) next up. The rest of the group was notably faster with Trend Micro (12:03), Norton (11:45) and Avast (10:25) in a cluster and Intego (6:22) in a commanding first place position. Fortunately, Kaspersky's full-scan system impact is so light that you probably won't notice any slowdown.

Kaspersky's quick scan looks at the most common areas for viruses or malware. For my system, this scanned 13,339 files in 53 seconds. It avoided another last-place finish here with Trend Micro (1:06) sparing it. The rest barely crossed into double digits, including Avast (00:18), Bitdefender (00:16), Norton (00:13) and Intego (00:11).

Kaspersky Internet Security for Mac: Interface

In the battle for the most stripped-down and streamlined dashboard interface, Kaspersky almost unquestionably comes out on top, particularly when you consider the number of features it actually offers. This holds true throughout the app with a very minimal look to every screen. However, as you'll see, things can still get a little confusing as you try to navigate its full feature set.

That main dashboard includes an image of a MacBook with a green screen and a check alongside the text "Your Mac is protected," assuming everything is running as expected. Immediately below that is a button to "Open Protection Center," but despite its prominent placement and important-sounding name, this isn't something you'll regularly use. That screen just confirms whether your virus databases are up to date, shows your recommendations and displays app news.

Recommendations are indeed important, but if you have any, they will show up in the center of the dashboard with a link taking you to the recommendations screen anyway.

Across the bottom of the dashboard are four additional icons that take you to the other major features of Kaspersky Internet Security: Scan, Update, Privacy and Safe Kids.

Scan gives you a pretty typical array of virus scans, and this feature specifically is one of the clearest and well laid out implementations of any Mac antivirus app that I reviewed.

If you have a specific folder or set of files you want to scan, you can just drag and drop them into the box at the top of the Kaspersky scan screen. Or you can browse for them using the "Choose" button and it will immediately scan them. Below the drop box is a trio of buttons to run a full scan, quick scan or set up scheduled full or quick scans to run as frequently as daily or just once a week.

Update confirms that your virus databases are up-to-date. This happens automatically in the background, but you can force it to check for an update manually as well. Privacy houses a few features including webcam blocking, web-tracker blocking and a launcher for both Kaspersky Password Manager and Kaspersky Secure Connection VPN. Finally, the Safe Kids icon naturally will take you to the parental-control app, although you need to click on the launcher on the next screen to get there. 

Kaspersky Internet Security for Mac: Installation and support

Kaspersky Internet Security for Mac can be downloaded directly from the Kaspersky website. The beachhead installation file is a small 4.1MB, but that simply connects you to download the full 480MB installer app. After you accept Kaspersky's privacy policies, the installer app will be downloaded and run. This part of the process took approximately 5 minutes as Kaspersky's download speeds were relatively slow.

Setup with Kaspersky was the best that I encountered doing this round of Mac antivirus reviews. It gave a very specific, guided view of what you need to do to grant the appropriate permissions for the Kaspersky antivirus software and its components to run properly.

The only thing that took a bit longer was installing the separate standalone apps for the password manager, VPN and parental controls. All three are bundled with Kaspersky Internet Security for Mac but aren't integrated into the app If you don’t plan on using any or all of them, you can skip the installation. The App Store has iOS versions of all three, and Mac apps for the password manager and the VPN; you can also find them on Kaspersky's website. 

Kaspersky offers 24/7 technical support via telephone, online chat or email. The online knowledge base and articles prepared by the Kaspersky team are excellent resources as well.

Kaspersky Internet Security for Mac review: Bottom line

Kaspersky Internet Security for Mac is a solid antivirus app that is slightly held back by its bloatware, slow scans and relatively confusing user interface.

With that said, while I don't consider it the best choice, Kaspersky Internet Security isn't a bad option, particularly for those who are willing to pay the extra $30 to unlock the premium VPN. Seventy dollars a year for both your malware protection and your VPN needs is a good value. 

If the VPN component is less critical to you, look to Bitdefender Antivirus for Mac. If you want a better example of a Mac antivirus app with a lot of extra features, including a VPN and a password manager that are unlimited right out of the box, then consider Norton 360 Standard.

Microsoft is pushing ahead with its plans to acquire some of the assets of video-sharing app TikTok after President Donald J. Trump agreed to Microsoft's proposal -- but with a caveat. 

According to Reuters, Trump wants to reach a deal with the Chinese owned social media network within 45 days, or the ban will be back on.

• Best antivirus: keep your data and devices safe from hackers
• TikTok to stop spying on iPhone users after iOS14 exposes huge flaw
• Latest: 10 ways to get the most out of your VPN

Back tracking

This story developed rapidly over the weekend, as rumors of Microsoft's intentions regarding TikTok Friday (July 31) were quickly followed by Trump telling reporters that he planned to ban TikTok from the United States due to fears that the app was sharing user data with the Chinese government. 

On Friday, Trump criticized the possibility of Microsoft acquiring the U.S. arm of TikTok. 

But Microsoft CEO Satya Nadella then reached out to Trump and discussed the company's plans with him. Combined with input from some White House advisors who urged him to reconsider his earlier decision, Trump backtracked on the ban.

“Following a conversation between Microsoft CEO Satya Nadella and President Donald J. Trump, Microsoft is prepared to continue discussions to explore a purchase of TikTok in the United States,” said the firm in a Microsoft blog post on Sunday (Aug. 2). 

“Microsoft fully appreciates the importance of addressing the President’s concerns," it added. "It is committed to acquiring TikTok subject to a complete security review and providing proper economic benefits to the United States, including the United States Treasury.”

Tight deadline

Microsoft hopes to negotiate and finalize a deal with ByteDance, the Beijing-based owner of TikTok, within just a few weeks. The firms have been given a deadline by the Committee on Foreign Investment in the United States (CFIUS).

“Microsoft will move quickly to pursue discussions with TikTok’s parent company, ByteDance, in a matter of weeks, and in any event completing these discussions no later than September 15, 2020,” it confirmed. “The discussions with ByteDance will build upon a notification made by Microsoft and ByteDance to the Committee on Foreign Investment in the United States (CFIUS).”

Big plans

Through the deal, Microsoft hopes to take ownership of TikTok's assets in the U.S., Canada, Australia and New Zealand, Microsoft said in its blog post. Microsoft said a deal would result in it “owning and operating TikTok in these markets.”

It added: “This new structure would build on the experience TikTok users currently love, while adding world-class security, privacy, and digital safety protections. The operating model for the service would be built to ensure transparency to users as well as appropriate security oversight by governments in these countries.

“Among other measures, Microsoft would ensure that all private data of TikTok’s American users is transferred to and remains in the United States. To the extent that any such data is currently stored or backed-up outside the United States, Microsoft would ensure that this data is deleted from servers outside the country after it is transferred.”

• More: Stay anonymous and safer online with the best VPN

The Lazarus Group, the infamous North Korean hacking crew, is now targeting victims with its own home-grown ransomware as it looks to enter “big-game hunting”.

That's according to an investigation by Russian cybersecurity company Kaspersky, which in a new report unmasks the Lazarus Group as the threat actor behind the VHD ransomware.

• Best antivirus: keep your data and devices safe from hackers
• What to do after a data breach: here are the steps you should take
• Latest: 10 ways to get the most out of your VPN

Extorting victims 

First reported by Russian security researchers in the spring of 2020, the VHD ransomware is used for extracting money from victims and differs from other forms of ransomware as it utilizes a "self-replication method" not commonly seen in regular cybercrime-oriented malware.

“This malware’s use of a spreading utility compiled with victim-specific credentials was reminiscent of APT campaigns,” said the Kaspersky researchers in a media release. 

APT is short for "advanced persistent threat" and generally means that the attacker is sponsored or backed by a nation-state with political or strategic motives, instead of being part of a criminal group out to make money.

Kaspersky suggested that “the move by Lazarus to create and distribute ransomware signifies a change of strategy and indicates a readiness to enter the big hunt for financial gain”.

The Lazarus Group is one of the most reckless and destructive hacking groups in existence. It created the 2017 WannaCry worm, which brought the U.K.'s National Health Service to a standstill and destroyed data on thousands of computers worldwide.

The Lazarus Group also attacked Sony Pictures in 2014 in retaliation for a comedy satirizing North Korean leader Kim Jong Un and tried to steal $1 billion from the Bank of Bangladesh in 2016.

"Lazarus has always existed at a special crossroads between APT and financial crime," says the Kaspersky report. "We can only speculate about the reason why they are now running solo ops: maybe they find it difficult to interact with the cybercrime underworld, or maybe they felt they could no longer afford to share their profits with third parties."

To make sure you're not hit by ransomware, North Korean or otherwise, make sure you use one of the best antivirus programs and save your data to one of the best cloud-backup services.

Unmasking the hackers

Initially, the creator behind VHD wasn’t known, but Kaspersky researchers have determined with “high confidence” that it is indeed the Lazarus Group “following analysis of an incident where it was used in close conjunction with known Lazarus tools against businesses in France and Asia”.

It’s believed that two incidents have taken place where this ransomware was used against targets. The first happened in Europe, and according to Kaspersky, it “did not give many hints as to who was behind it.”

However, the research team was determined to get to the bottom of the unknown creator as they had used “spreading techniques similar to those used by APT groups.”

“The attack did not fit the usual modus operandi of known big-game hunting groups," Kaspersky said. "The fact that a very limited number of VHD ransomware samples were available -- coupled with very few public references -- indicated that this ransomware family might not be traded widely on dark market forums, as would usually be the case.”

But when a second incident happened, the researchers started to join the dots and had a better understanding who was behind the ransomware.

“Among other things -- and most importantly -- the attackers used a backdoor, which was a part of a multiplatform framework called MATA, which Kaspersky recently reported on in-depth and is linked to the aforementioned threat actor due to a number of code and utility similarities,” they said. 

“The established connection indicated that Lazarus was behind the VHD ransomware campaigns that have been documented so far.”

Big aims

What’s particularly interesting about these incidents is they suggest that Lazarus has even bigger ambitions.

Kaspersky said: “This is also the first time it has been established that the Lazarus group has resorted to targeted ransomware attacks for financial gain, having created and solely operated its own ransomware, which is not typical in the cybercrime ecosystem.”

Ivan Kwiatkowski, senior security researcher at Kaspersky’s Global Research Analysis Team, warned: "The global ransomware threat is big enough as it is, and often has significant financial implications for victim organisations up to the point of rendering them bankrupt. 

“The question we have to ask ourselves is whether these attacks are an isolated experiment or part of a new trend and, consequently, whether private companies have to worry about becoming victims of state-sponsored threat actors.

“Regardless, organizations need to remember that data protection remains important as never before -- creating isolated back-ups of essential data and investing in reactive defenses are absolute must-dos”.

• More: Stay anonymous and safer online with the best VPN

We live in an era of unprecedented technological advancement. From smartphones to the Internet of Things, our lives have never been more connected, our world has never been more convenient. Yet this convenience and connectivity come at a cost, says Brian Anderson, Head of Digital Sales NA at cybersecurity agency Kaspersky.

“The Internet has become almost like an extension of our brains, but what we’re learning is that this is resulting in a couple of different problems,” Anderson told Future US Inc. in an interview at this year’s Consumer Electronic’s Show. “One is digital amnesia - the idea that we rely so heavily on our phones we can no longer remember basic information. The other is cyber-stress, which is how we refer to the anxiety that many people feel about cybersecurity and the fear that they might be victimized.”

There’s certainly a precedent for both. 

At our fingertips is access to an unprecedented volume of information. And everywhere we look, be it online or off, we’re bombarded with marketing from countless businesses and brands. One can hardly blame a person for starting to tune out.

Meanwhile, it’s become increasingly impossible to even read the news without worrying about cybersecurity. It seems as though every day, there’s a new crisis come to light, some new data breach, cyber incident, or digital threat.  As a result, we operate under the perpetual anxiety that comes with never knowing if our data is secure.

For the past several years, Kaspersky has been researching both issues with the hope that through better understanding, we can move towards a future where digital technology is no longer a double-edged sword. 

“Our goal is to work to bring on a future where people feel safer, and where technology is a source of opportunity, rather than fear and stress,” says Anderson. “We want to help people learn about cyber-issues so they can have a healthy level of stress about it. Psychologists tell us that there is such a thing as “good stress,” which can help motivate, build resilience, and encourage growth.”

Anderson concluded by advising that people manage their cyber-stress by channeling it into good security practices.

You can watch the full interview below.