Connect with us

Technology

1.7 billion passwords leaked on dark web and why yours is at risk

Published

on

1.7 billion passwords leaked on dark web and why yours is at risk

Cybercriminals aren’t just going after big targets anymore. 

They’re going after everyone, and they’re doing it with infostealer malware. These small, sneaky programs are quietly stealing passwords, browser data and login tokens from everyday devices. 

A new report shows just how out of control the problem has become, with infostealer activity jumping 500% in just one year, harvesting more than 1.7 billion fresh credentials.

Join the FREE “CyberGuy Report”: Get my expert tech tips, critical security alerts and exclusive deals, plus instant access to my free “Ultimate Scam Survival Guide” when you sign up!

A hacker at work (Kurt “CyberGuy” Knutsson)

Advertisement

The industrialization of credential theft

In 2024, cybersecurity researchers at Fortinet observed a staggering surge in stolen login data being traded on the dark web. Over 1.7 billion credentials were harvested not from old breaches but through active infections on users’ devices.

At the heart of this epidemic is a class of malware called infostealers, which are programs designed specifically to extract sensitive information like usernames, passwords, browser cookies, email logins, crypto wallets and session tokens. Unlike large-scale data breaches that target centralized databases, infostealers operate on individual machines. They don’t break into a company’s servers; they compromise the end user, often without the victim ever noticing. 

These logs are then aggregated and sold by initial access brokers, intermediaries who sell compromised credentials and access tokens to other cybercriminal groups, including ransomware operators. The market has matured to the point where access to a corporate VPN, an admin dashboard or even a personal bank account can be purchased at scale, with verified functionality and region-specific pricing.

Fortinet’s 2025 Global Threat Landscape Report identified a 500% increase in credential logs from infostealer infections over the past year. Among the most widespread and dangerous infostealers identified in the report are RedLine, Vidar and Raccoon. 

A hacker at work (Kurt “CyberGuy” Knutsson)

Advertisement

200 MILLION SOCIAL MEDIA RECORDS LEAKED IN MAJOR X DATA BREACH

How infostealers work

Infostealers are typically distributed through phishing emails, malicious browser extensions, fake software installers or cracked applications. Once installed on a device, they scan browser databases, autofill records, saved passwords and local files for any credential-related data. Many also look for digital wallets, FTP credentials and cloud service logins.

Crucially, many infostealers also exfiltrate session tokens and authentication cookies, meaning that even users who rely on multifactor authentication are not entirely safe. With a stolen session token, an attacker can bypass multifactor authentication entirely and assume control of the session without ever needing to log in manually.

Once collected, the data is uploaded to a command and control server. From there, it’s either used directly by attackers or bundled into logs and sold on forums. These logs can include everything from the victim’s IP address and geolocation to their browser fingerprint and full credential list, giving attackers everything they need to carry out further exploitation or impersonation.

WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

Advertisement

A man working on his personal and work laptops (Kurt “CyberGuy” Knutsson)

HR FIRM CONFIRMS 4M RECORDS EXPOSED IN MAJOR HACK

5 ways to stay safe from infostealer malware

With infostealer malware becoming a growing threat, protecting your data requires a mix of smart security habits and reliable tools. Here are five effective ways to keep your information safe.

1. Use a password manager: Many infostealers target saved passwords in web browsers. Instead of relying on your browser to store credentials, use a dedicated password manager. Our No. 1 pick has a built-in Data Breach Scanner that lets you check if your information has been exposed in known breaches. Get more details about my best expert-reviewed Password Managers of 2025 here.

2. Enable two-factor authentication (2FA): Even if your credentials are stolen, 2FA adds an extra layer of security by requiring a second form of verification, such as a code from an authentication app or biometric confirmation. Cybercriminals rely on stolen usernames and passwords to break into accounts, but with 2FA enabled, they cannot gain access without the additional security step. Make sure to enable 2FA on important accounts like email, banking and work-related logins.

Advertisement

3. Use strong antivirus software and be cautious with downloads and links: Infostealer malware often spreads through malicious downloads, phishing emails and fake websites. Avoid downloading software or files from untrusted sources and always double-check links before clicking them. Attackers disguise malware as legitimate software, game cheats or cracked applications, so it is best to stick to official websites and app stores for downloads.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks of the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.

4. Keep software updated: Cybercriminals exploit outdated software to deliver malware. Keeping your operating system, browsers and security software up to date ensures that known vulnerabilities are patched. Enable automatic updates whenever possible and install reputable antivirus or endpoint protection software that can detect and block infostealer threats before they compromise your system.

5. Consider a personal data removal service: These services can help remove your personal information from data broker sites, reducing your risk of identity theft, spam and targeted scams. While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy.

Advertisement

These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you. Check out my top picks for data removal services here.

HOW TO FIGHT BACK AGAINST DEBIT CARD HACKERS WHO ARE AFTER YOUR MONEY

Kurt’s key takeaway

The 1.7 billion passwords leaked in 2024 are not a relic of past breaches. They’re evidence of an evolving, industrialized cybercrime economy built on the backs of unsuspecting users and quietly infected devices. The tools are cheap, the scale is massive and the impact is personal. If you’ve ever saved a password in a browser, downloaded an unofficial app or clicked a link in a sketchy email, your credentials may already be in circulation.

Who do you think should be primarily responsible for protecting personal and organizational data from cyber threats: individual users, companies, software providers or government agencies? Why? Let us know by writing us at Cyberguy.com/Contact.

Advertisement

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Answers to the most-asked CyberGuy questions:

New from Kurt:

Advertisement

Copyright 2025 CyberGuy.com. All rights reserved.

Technology

Google Chrome is coming to Arm-powered Linux devices later this year

Published

on

Google Chrome is coming to Arm-powered Linux devices later this year

Why Arm + Linux now? In a blog post, Google only says that it “addresses the growing demand for a browsing experience that combines the benefits of the open-source Chromium project with the Google ecosystem of apps and features.” What we’re left wondering is whether Google’s talking about existing demand, or demand yet to come.

There’s certainly a growing demand for Linux. Some Verge editors have begun to ditch Windows with varying degrees of success. But those are our x86 desktops — there isn’t a lot of consumer-facing Linux on Arm chips, unless you count all the Linux-based Android phones out there. You can buy Linux on laptops from Dell, Lenovo, Framework, and such, but again, they use x86 chips. (And if you’re not a consumer, there’s already Chromium.)

But three of the companies that actually build Arm processors — Qualcomm, Nvidia, and Mediatek — may look to Linux as they try to compete with the Windows/Intel/AMD incumbents. Qualcomm told me in January that it sees “a lot of interest on other operating systems” beyond Windows for its PC-grade Arm chips. Nvidia could reveal its N1 and N1X processors for Arm laptops as soon as next week at its GTC 2026 developer conference.

While those Nvidia laptops might get announced with Windows, it wouldn’t be surprising if they targeted Linux too, once the basics like Chrome are sorted out. Google’s blog post specifically namedrops Nvidia’s DGX Spark as a target for Chrome — those $4,000+ beefy micro AI desktops, sold by a wide array of the company’s partners, also run Linux on Arm. Google says it’s putting Chrome into Nvidia’s package manager to make installation easier; everyone else will have to go to chrome.com/download when the browser arrives in Q2.

Continue Reading

Technology

Tax scams through the years and what to know this year

Published

on

Tax scams through the years and what to know this year

NEWYou can now listen to Fox News articles!

Tax scams rarely stay the same for long. Each filing season brings new tactics designed to trick taxpayers into revealing personal information or claiming refunds they are not entitled to receive. In recent years, fraud tied to unemployment systems, stimulus payments and identity theft caught many taxpayers by surprise. Some people did not discover the problem until their legitimate tax return was rejected, or unexpected tax forms arrived in the mail.

Two years later, promoters marketed confusing credits such as the Employee Retention Credit to businesses that did not qualify, collecting fees to file improper claims. By 2025, misleading guidance spread widely on social media, encouraging taxpayers to misuse forms like 4136 or modify wage information through consumer tax software.

Each of these scams relies on confusion around tax rules and filing systems. Understanding how they work can help you spot red flags before submitting your return this year.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Advertisement

IRS WARNS TAXPAYERS OF NEW MAILING REFUND SCAM
 

Tax scams have evolved from unemployment fraud to social media “tax hacks,” with the IRS warning of new threats for the 2026 filing season. (Michael Bocchieri/Getty Images)

2021 tax scams: Unemployment fraud and stimulus payment theft

In 2021, identity theft linked to unemployment programs created widespread tax problems. Criminals used stolen Social Security numbers to file benefit claims through state systems. Because unemployment income is taxable, Form 1099-G notices were sent to victims for payments they never received. The IRS advised taxpayers not to report fraudulent income and to contact the issuing state agency to correct the records.

Stimulus payments were also targeted. Scammers filed early tax returns using stolen personal data to claim Recovery Rebate Credits or redirect refunds. When legitimate filers later submitted their returns, some were rejected because a return tied to their Social Security number had already been processed. Federal agencies, including the FBI, warned of high levels of unemployment fraud during this period. The IRS also encouraged taxpayers to sign up for an Identity Protection PIN, which adds an extra layer of verification when filing.

Worried your SSN may have been stolen? Many tax fraud cases begin with data pulled from breaches. You can run a free scan with our top Identity Theft Protection pick to check whether your information appears in known data-leak records. The scan looks for matches tied to your email address and shows the results in real time. See my tips and best picks on Best Identity Theft Protection at Cyberguy.com.

Advertisement

2023 tax scam warning: Ghost preparers filing fraudulent returns

The IRS later flagged a rise in returns prepared by so-called ghost preparers. These individuals charge fees to prepare tax returns but refuse to sign them or include a valid Preparer Tax Identification Number. Under federal tax rules, anyone paid to prepare a return must sign it. When a preparer does not, the taxpayer, not the preparer, remains responsible for the filing.

In many flagged cases, ghost preparers inflated tax credits, fabricated income figures or altered withholding amounts to generate larger refunds. Some charged fees based on the size of the refund, which created an incentive to push questionable claims rather than follow tax rules.

2025 tax scams: Social media tax ‘hacks’ and improper filings

By 2025, misleading tax advice began circulating widely on short-form video platforms and social media. Some posts encouraged people to file Form 4136 to claim a fuel tax credit for gasoline used in personal vehicles. The IRS says this credit applies only to certain business and off-highway uses, not everyday driving. Filing the form improperly can trigger an IRS review.

Other posts instructed taxpayers to modify wage or withholding numbers inside consumer tax software to inflate refund amounts. The IRS has repeatedly warned that taxpayers remain responsible for the accuracy of their returns, regardless of where the advice originated. Filing incorrect income information or claiming unsupported credits can delay refunds and potentially lead to penalties. 

ELON MUSK ALLEGES $50B IN FRAUD AT TREASURY AFTER JUDGE BLOCKS DOGE AUDIT

Advertisement

Identity theft and fraudulent tax filings remain top concerns for the Internal Revenue Service as criminals exploit confusion around credits and filing rules. (Andrew Harrer/Bloomberg via Getty Images)

2026 IRS warning: Tax scams expected this filing season

The IRS recently released its 2026 “Dirty Dozen” list of tax scams it expects to circulate during the filing season. Phishing and text message scams remain among the most common threats. Scammers often impersonate the IRS or tax software companies and claim there is a refund issue or account problem in an attempt to collect Social Security numbers, bank details or login credentials.

The agency emphasizes that it does not initiate contact through email, text messages or social media to request sensitive information. The 2026 list also includes ghost preparers and misleading tax advice shared online, including content that pushes improper credit claims. Identity theft refund fraud remains part of the enforcement picture, with criminals filing returns using stolen data before legitimate taxpayers do.

How to protect yourself from tax scams

A few simple habits can reduce your risk during filing season.

1) Monitor your personal data and credit activity

Identity theft refund fraud remains a major concern. Criminals sometimes file tax returns using stolen personal information before the legitimate taxpayer submits theirs. Because many tax fraud cases begin with personal data exposed in breaches, keeping track of where your information appears online can help you catch warning signs earlier. 

Advertisement

Identity theft services scan known data breach records for matches tied to your email address, Social Security number and other identifiers.

These services also monitor credit files across the three major U.S. credit bureaus and alert you to new accounts, hard inquiries or other changes to your credit report. If suspicious activity appears, members receive real-time alerts as soon as it is detected.

See my tips and best picks on Best Identity Theft Protection at Cyberguy.com.

2) Work only with legitimate tax preparers

Anyone paid to prepare a tax return must sign it and include a valid Preparer Tax Identification Number. Avoid preparers who promise unusually large refunds or refuse to sign your return.

3) Ignore unexpected IRS messages

The IRS does not contact taxpayers through email, text messages or social media to request personal information. Messages claiming to be from the IRS asking for sensitive data are usually scams.

Advertisement

AVERAGE TAX REFUND TOPS $3,700 MIDWAY THROUGH FILING SEASON, TREASURY SAYS
 

From stimulus payment theft to ghost preparers, taxpayers face shifting fraud tactics each year during tax season. (John Moore/Getty Images)

4) File your return early

Identity thieves often attempt to file fraudulent tax returns before the real taxpayer does. Filing earlier in the season can reduce that risk.

5) Consider an IRS Identity Protection PIN

This six-digit code adds an extra layer of security to your tax return. Without it, criminals cannot file a return using your Social Security number.

What to do if someone files a tax return in your name

If the IRS rejects your return because one has already been filed using your Social Security number, you may need to complete IRS Form 14039, Identity Theft Affidavit. The IRS may also require identity verification before processing your return. In some cases, affected taxpayers must submit a paper return while the agency investigates the suspected fraud.

Advertisement

Kurt’s key takeaways

Tax scams change every year, but the pattern stays the same. Criminals look for confusion around tax rules, new programs or trending online advice and use that uncertainty to push fraudulent claims or steal personal information. The best protection is slowing down before you file. Verify tax advice through trusted sources such as the IRS, work only with legitimate tax preparers and keep a close eye on your personal data and credit activity. A little caution during filing season can help prevent months of headaches if your return gets flagged for fraud.

Have you ever received a suspicious tax message, questionable filing advice online or discovered a tax return filed in your name? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2026 CyberGuy.com. All rights reserved.  

Advertisement

Continue Reading

Technology

Gemini’s task automation is here and it’s wild

Published

on

Gemini’s task automation is here and it’s wild

A couple of weeks ago, Google and Samsung announced a big Gemini development coming to their newest devices: task automation. Starting with food delivery and rideshare apps, Gemini would be able to use certain apps on your behalf in a virtual window to take care of things like ordering dinner or getting a car to the airport — all based on simple prompts. You know, all the stuff that we’ve been promised for years AI assistants will be able to do. That feature wasn’t live when I first started testing the S26 Ultra, but it just arrived in beta as part of an update. And boy is it weird watching your phone use itself!

The first prompt I gave it was pretty simple: order an Uber to the airport. Gemini asked for clarification to determine which airport (a good question to ask!), then it went through a couple of steps on its own: adding the destination and opting to skip the step where you specify your airline, which doesn’t really matter at my local airport since it’s all in one terminal. As promised, the system stopped before the final step and prompted me to review the details before putting in the request for a car.

A vague and slightly more complicated request to order a coffee and a croissant required a little more input from me — and a lot of time on Gemini’s part scrolling through Starbucks’ hot drink options — but sure enough, it found the flat white on the menu. It also confronted a crucial decision: order the chocolate croissant warmed, or straight out of the pastry case? Without my input, it specified (correctly) that the pastry should be warmed. Pretty impressive for an assistant that just a year ago would argue with me over the details of a flight on my calendar.

I’ve got much more testing to do with this automation feature and I plan to spend the next few days throwing it some curveballs. Still, it’s impressive to see this feature out in the wild working as intended — so far, at least.

Photography by Allison Johnson / The Verge

Advertisement
Continue Reading

Trending