If you're going to run one of the world's largest dark web drug marketplace, it's probably a good idea not to have laundered loot delivered to your front door. Read more in my article on the Bitdefender blog: www.bitdefender.com/en-us/blog/h...

Fab to have @dannypalmer.bsky.social back on the podcast. This week: 30 million students log into Canvas mid-finals and find a winky-faced ransom note waiting for them. Canvas initially refused to pay, so the hackers came back through the cat flap - defacing login pages. 1/3

Pay up, or we'll pay someone to pay you a visit. Cybercriminals are increasingly turning to real-world threats - and even hiring local muscle to deliver the message. Read my latest article on the Bitdefender blog. www.bitdefender.com/en-us/blog/h...

Sheesh.... appalling security in robot dogs.

One in eight UK workers admits to selling their company login credentials - or knowing someone who has - in the past 12 months. The really alarming bit? Their bosses are even more relaxed about it. Read more in my article on the Fortra blog: www.fortra.com/blog/one-eig...

What does it take to become a Russian state-sponsored hacker? Apparently, six years at one of Moscow's most prestigious universities, 144 hours of hacking lectures, and an assessment in which you write your own computer virus. Read all about it...

You don't need to live near a scam compound for it to wreck your life. Americans lost $5.8 billion to crypto investment scams last year alone. A raid in Sri Lanka this month shows exactly how the operations behind them keep finding new places to hide. www.bitdefender.com/en-us/blog/h...

On the latest "Smashing Security" podcast I was joined by Paul Ducklin and @jakemooreuk.bsky.social as we discussed: * The latest Meta Smart Glasses horror 🕶️ * Whether the Copy vulnerability Fail really is TEOTWAWKI * How Jake managed to trick a company into hiring his deepfake(!) #podcast

If you're going to extort millions from major retailers, maybe don't pose for Snapchat in a diamond-encrusted "HACK THE PLANET" necklace. A 19-year-old accused of being part of the Scattered Spider cybercrime gang has been arrested at Helsinki Airport. He now faces extradition to the USA.

Always great to have @jamesrball.com as a guest on the "Smashing Security" podcast! This week: we look at SS7 - the ancient phone protocol that lets surveillance companies track anyone, anywhere, via their mobile. Governments know. Telecoms know. Nobody's doing anything about it. 1/3

Imagine you're a US Marine stationed in Bahrain. You pick up your phone and find a WhatsApp message telling you your family's address is known, your movements are being tracked, and you should call home to say your final goodbyes...

We are, collectively, terrible at patching. 1 in 5 breaches now start with a vulnerability that already had a fix sitting there, ignored. No wonder Cyber Essentials has just had its biggest update in years. Join me on 12 May for what you need to know... 👉 grahamcluley.com/essentials

State-sponsored hackers rarely end up in an American courtroom. Their host countries tend not to be in a hurry to put them on a plane. But every so often one of them books a holiday to the wrong place... Read about the extradition of a Chinese suspect in the MS Exchange mega-hack of 2021.

French police have arrested a 21-year-old known as "HexDex". He's suspected of around 100 data breaches in just a few months, including the French Ministry of National Education, and the national firearms registry. Approx four breaches a week. MFA and patching still matters! 1/2

Great to have the BBC's @joetidy.bsky.social join me on this week's "Smashing Security" podcast! * How a firm that ran anonymous tip lines for 35,000 American schools, boasted it had never been breached in over 20 years, only for a hacker called Internet Yiff Machine to put them to the test...

Another great episode of @smashingsecurity.com featuring @shehackspurple.bsky.social!

A fake Ledger Live app sat in Apple's App Store long enough to steal $9.5 million from more than 50 victims - including a certain G. Love of G. Love & Special Sauce, who lost 5.9 Bitcoin he'd held for ten years as his retirement fund. All it took was a seed phrase...

Great to have @shehackspurple.bsky.social join me on the latest episode of "Smashing Security", where we talked about hackers targeting Venice's flood defence systems, Anthropic's latest exploits, and even some of our favourite TV shows.. www.smashingsecurity.com/463

Do you know what Chrome browser extensions you're running right now? 108 malicious Chrome extensions that were quietly stealing Google account data, hijacking Telegram sessions, and injecting gambling ads have just been found. They clocked up around 20,000 installs.

I'm speaking at Rapid7's 2026 Global Cybersecurity Summit, May 12-13. Come hear me chat about how modern attacks actually start, and the reality of running a SOC in 2026 - alongside @racheltobac.bsky.social, @rajsamani.bsky.social, and @brianhonan.bsky.social rapid7.brighttalk.com?utm_source=r...

Season 18 of Doctor Who has always had a special place in my heart...

After almost twenty years on the platform, EFF is logging off of X. This isn’t a decision we made lightly, but it might be overdue. 🧵 (1/5) www.eff.org/deeplinks/2...

Hey BBC, if you're looking for someone new to make Doctor Who, I think you'll find them on YouTube: www.youtube.com/watch?v=ARdZ...

A huge thank you to The Cyberwire's Dave Bittner for joining me on this week's Smashing Security podcast! This week we reveal what LinkedIn really knows about you (it's rather more than you might expect - and rather more than they're letting on). 1/2

Have I missed the statements from all the world readers condemning Trump‘s comments today?

Cambodia has passed a landmark law targeting scam compounds that have enslaved up to 150,000 people... forcing them to run romance scams and fake crypto schemes or be beaten and tortured. Penalties are severe. Up to LIFE IMPRISONMENT for the worst offenders. 1/2

A Nigerian fraudster spent years posing as a woman online, romancing unsuspecting American men out of their savings - until he accidentally tried the same trick on a fellow scammer, who told him to "learn how to do a clean job." The recovered chat logs helped put him behind bars for 15 years.

A huge thank you to @dannypalmer.bsky.social for joining me on this week's Smashing Security podcast! We unravel the tale of an Irish beekeeper and cannabis farmer whose $400 million fortune is locked inside a missing fishing rod. Or is it? Because one of his cryptowallets just woke up...

One of the alleged developers behind the notorious RedLine infostealer, malware which has stolen data from victims in over 150 countries, has been extradited to the US and faces up to 30 years in prison. His alleged co-conspirator remains out of reach in Russia www.bitdefender.com/en-us/blog/h...

When hackers attacked global medtech giant Stryker, they didn't use ransomware. Iran-linked group Handala simply logged into Microsoft Intune, and issued remote wipe commands. 200,000+ devices were wiped. My chat with Rob Edmondson of CoreView about what happened www.youtube.com/watch?v=4Q2h...

It's not every day that you read that the head of America's top law enforcement agency has been hacked, but then - these aren't ordinary times. Iranian hackers have breached FBI director Kash Patel's personal Gmail account, and posted his CV and photos online. www.bitdefender.com/en-us/blog/h...

World Leaks is an extortion gang that doesn't encrypt your data. Just steals your data and threatens to leak it. Over 130 victims, including Nike, Dell, and UBS. They even offer journalists early access to stolen data to crank up the pressure on victims. Charming. www.fortra.com/blog/world-l...

On this week's episode of "Smashing Security": ⊙ a disgruntled contractor steals his ex-employer's payroll database and demands $2.5 million ⊙ two mysterious individuals drive up to a nuclear submarine base and ask to look around open.spotify.com/episode/6Hry... with guest Jenny Radcliffe!

📅 Delighted to announce that I'll be delivering the keynote at Cybercon Staffordshire on Weds 8 April, at the Wade Conference Centre, Stoke-on-Trent. I'll be discussing how your AI workforce might actually be your biggest security risk. Free tickets: www.grahamcluley.com/cybercon

AI-generated songs. Bot-powered streams. $8 million stolen from real artists. A North Carolina man just pleaded guilty. Read the full story about how one man used 10,000 bots to steal $8,000,000 over on the Bitdefender blog: www.bitdefender.com/en-us/blog/h...

A wanted fugitive hides in a kitchen cabinet while police search the house around him - and decides to post about his whereabouts on Snapchat. Twice. 🤦 The lesson? If you don't want people to know where you are, don't post it on social media. Seems obvious, but apparently not to everyone...

"Trump murders children!" Denver's crosswalks hacked to broadcast anti-Trump messages. Read more in my article on the Bitdefender blog: www.bitdefender.com/en-us/blog/h...

A ransomware gang that claims to be a group of "investigative journalists"? Meet LeakNet - the group using fake CAPTCHA pages to trick employees into hacking themselves. Check out my article on the Fortra blog: www.fortra.com/blog/leaknet...

If you think maximum Apple security settings make you untouchable, think again. This week we dig into a genuinely unsettling account takeover attempt against WordPress co-founder Matt Mullenweg - MFA fatigue, real Apple alerts, a convincing impersonation call, and a phishing page.

Equifax got hacked. Nearly 150 million people's data stolen. And the executives' first move was to quietly sell their shares. 🤦 This is The Facepalm Files. Check out my podcast "Smashing Security" for more stories like this. #facepalm #cybersecurity #equifax #databreach #infosec #hacking

Drivers in the Russian city of Perm have been enjoying an unexpected bonus this week: free parking. Thanks hackers! www.bitdefender.com/en-us/blog/h...

Government seizes $5M in crypto 💰 accidentally posts the password online 🤦 someone steals it ✅ thief hands themselves in 😇 coins returned ✅ another thief then steals them AGAIN 😭 If you like stories like this, check out my podcast "Smashing Security".

ZOMFG! They’ve only found some more episodes of the ruddy Daleks’ Master Plan! It’s Christmas for all classic Doctor Who fans this Easter. :)

🎙️ This week in "Smashing Security": 🐦 A Wikipedia security engineer accidentally woke a dormant JavaScript worm that had been sitting silently since 2024 - and for 23 minutes, giant woodpecker images were plastered across the entire Wikimedia ecosystem. Yes, really. 1/3

Your Signal account is probably safe - unless you fall for a trick like this. More information in the links in the comments. 1/2

Elon Musk's social media site says it suspended 800 million accounts in a year for spam and manipulation - but with state-backed campaigns still flooding the platform, the question is how many fake accounts remain. Read more in my article on Bitdefender's blog: www.bitdefender.com/en-us/blog/h...

Two of the world's most wanted men, Daniel and Christy Kinahan, were photographed at an MMA event, Bellingcat and @thetimes.com found — their most recent sighting since the US issued multi-million dollar bounties. www.bellingcat.com/news/2026/03...

How hackers bypassed MFA with a $120 phishing kit - until a global takedown shut it down. Read more in my article on the Bitdefender blog: www.bitdefender.com/en-us/blog/h...

Great to have the Kill List's Carl Miller on "Smashing Security" this week!