Happy ceasefire day and welcome to Regulator, a newsletter for Verge subscribers about Big Tech’s rocky journey through the world of politics. If you’re not a subscriber yet, you can do so here, but my only request is that you sign up before Donald Trump decides to revisit his previous threats toward Iran and kickstart World War III.
Technology
America’s most-used password in 2025 revealed
NEWYou can now listen to Fox News articles!
Passwords play a huge role in how you stay safe online. They protect your accounts, devices and money. Still, many people pick logins that criminals can guess in seconds.
The latest NordPass report shows this problem again. This year, “admin” took the top spot as the most common password in the United States.
NordPass and NordStellar, two cybersecurity companies that track leaked credentials and online threats, reviewed millions of exposed passwords to spot trends. They also examined how password habits differ across generations. The pattern is clear: many of us still rely on simple words, easy number strings and familiar keyboard patterns. These choices give attackers a quick path into countless accounts.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.
183 MILLION EMAIL PASSWORDS LEAKED: CHECK YOURS NOW
Weak passwords like “admin” give attackers a quick way into your accounts before you even realize it. (Kurt “CyberGuy” Knutsson)
Most common passwords in the United States
NordPass shared its top 20 list for 2025. “Admin” sits at number one. Variations of the word “password” take up five spots. Number strings appear nine times. One explicit term even made the list.
Here are the 20 most common passwords in the USA this year:
- admin
- password
- 123456
- 12345678
- 123456789
- 12345
- Password
- 12345678910
- Gmail.12345
- Password1
- Aa123456
- f*******t
- 1234567890
- abc123
- Welcome1
- Password1!
- password1
- 1234567
- 111111
- 123123
Weak logins remain a major problem because criminals rely on automated tools. These tools try simple words and common patterns first. When millions of people reuse the same easy passwords, attackers succeed fast.
HOW TO USE PASSKEYS TO KEEP YOUR COMPUTER SAFE
Reusing the same login across sites makes it easy for criminals to jump from one hacked account to another. (Kurt “CyberGuy” Knutsson)
Global trends show the same risky password behavior
The United States is not alone. Globally, “123456” ranks as the most common password. “Admin” and “12345678” follow closely behind. These patterns appear because they are easy to remember. Sadly, they are also easy to crack.
Researchers noticed one shift worth noting: more passwords now include special characters. The increase is sharp. However, most examples remain weak. Strings like P@ssw0rd and Abcd@1234 still follow predictable rules that tools can break with little effort.
The word “password” stays popular around the world. People even use it in local languages. This shows how widespread the problem is.
Why younger generations still make unsafe password choices
Many people assume younger adults understand digital safety. They grew up with phones and social media. Research shows that this assumption is wrong.
NordPass found that an 18-year-old often picks the same weak password patterns as an 80-year-old. Younger users favor long number sequences. Older users lean toward names. Neither group creates secure or random strings. Generations Z and Y tend to avoid names. Generations X and older use them often. Each approach carries risk because attackers expect both patterns.
AI-POWERED SCAMS TARGET KIDS WHILE PARENTS STAY SILENT
Researchers found that weak and predictable passwords still appear in leaked data again and again. (Kurt “CyberGuy” Knutsson)
Why weak passwords remain a big threat
Weak passwords fuel data breaches and account takeovers. Criminals run scripts that check billions of combinations every second. When your password is common, they break in fast.
A single stolen login can expose your email, social accounts, bank information and more. Many attacks start this way. Once criminals get inside one account, they often try the same password on others.
Steps to stay safe with your passwords
You can improve your digital safety with a few simple habits. These steps help block common attacks and protect your accounts.
1) Create strong random passwords
Pick long passwords or short passphrases. Aim for at least 20 characters. Mix letters, numbers and special characters. Avoid patterns.
2) Avoid password reuse
Use a unique password for each account. If one login gets hacked, the others stay safe.
3) Review and update weak passwords
Check your old logins. Replace anything short, predictable or reused. Fresh passwords lower your risk.
4) Use a password manager
A password manager creates secure passwords and stores them safely. It also fills them in for you, so you do not need to remember them.
Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.
Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.
5) Turn on multi-factor authentication (MFA)
MFA adds a second check before you log in. It is one of the easiest ways to block attackers.
6) Keep your software updated
Update your phone, computer browsers and apps on a regular schedule. These updates patch security gaps that criminals try to exploit. When you fall behind on updates, weak passwords become even riskier because attackers can pair old software flaws with easy logins.
Pro Tip: Use a data removal service
Leaked passwords often come from old profiles on data broker sites you forgot about. A data removal service can wipe your personal info from those sites and reduce how much of your data ends up on breach lists. When less of your information is floating around online, your accounts become less tempting targets.
While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.
Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Kurt’s key takeaways
Weak passwords remain a huge issue in 2025, even with new tools and better education. You have the power to improve your security with a few quick changes. When you build strong habits, you make it harder for criminals to get inside your accounts. Small steps add up fast and give you far more protection online.
What do you think keeps people stuck on weak passwords even when the risks are clear? Let us know by writing to us at Cyberguy.com.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.
Copyright 2025 CyberGuy.com. All rights reserved.
YouTube Shorts is rolling out a new AI-powered feature giving creators an easy way to realistically clone themselves on camera. The launch, hinted at earlier this year, reflects the platform’s fraught relationship with AI-generated content, adding more generative features while struggling to contain AI slop, deepfake scams, and impersonations.
YouTube says the new tool will let users create a digital version of themselves, called an avatar, that can be inserted into existing Shorts videos or used to generate entirely new ones. The company said avatars will “look and sound like you,” framing them as a safer and more secure way to use AI to create new content.
Creating an avatar is a bit more involved than simply pressing a button, but it sounds fairly straightforward. In a blog post outlining the process, YouTube said users must first record a “live selfie” capturing their face and voice while following a series of prompts. For the best results, the company recommends good lighting, a quiet area, a background free of other people or images of faces, and holding the phone at eye level.
Once avatars are made, users can select “make a video with my avatar” while creating a video to generate a clip from prompts, which can be up to eight seconds long, according to 9to5google. Users can also add their avatar to “eligible Shorts” in their feed, though YouTube did not specify what makes a Short eligible.
The AI avatar feature comes with fairly tight restrictions. They can only be used in the creator’s own original videos, who also control whether their Shorts can be remixed. The creator can delete their avatar or videos where it appears at any time, YouTube says. Avatars that aren’t used to create new content for three years will be automatically deleted.
Not everyone will be able to use the feature immediately. YouTube says the tool “will be rolling out gradually,” though it did not give a timeline or indication of where it will be available first. Creators must also be at least 18 and own an existing YouTube channel, the company says.
Its arrival comes as one of Google’s main AI rivals, OpenAI, pulls back from video generation. The startup said it was sunsetting its Sora video tool last month after a year of struggling to get the wannabe social platform off the ground. It was costly and faced a parade of copyright challenges, deepfake controversies, and slop that made it an unattractive bet for investors ahead of an anticipated IPO this year.
NEWYou can now listen to Fox News articles!
You see a charge you don’t recognize. It looks like it came from a trusted brand. Your instinct kicks in. You want to fix it quickly and move on. That’s exactly what happened to Dorothy.
After a simple text, she found herself on the phone with someone who sounded official, confident and completely convincing. Here’s how she described it:
“I received a text from APPLE Pay, which I don’t even use… It said an Apple Store in CA wants to charge me $144… If I have questions, I should call. DUH! I called and was speaking with the scammer.”
“I received a text from APPLE Pay, which I don’t even use… It said an Apple Store in CA wants to charge me $144… If I have questions, I should call. DUH! I called and was speaking with the scammer.”
Within minutes, the situation escalated.
“He knew everything about me… He said I should take out $15,000… He said he was working with the FBI and the FDIC.”
That’s when the pressure really started. Dorothy told me this story when she joined me on my Beyond Connected podcast, and what happened next shows just how far these scams can go.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily. Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
10 WAYS TO PROTECT SENIORS FROM EMAIL SCAMS
The text sent to Dorothy shows how a fake Apple Pay alert uses urgency and a phone number to pull you into a scam. (Kurt “CyberGuy” Knutsson)
How this Apple Pay text scam actually works
This scam follows a pattern that is becoming more common. It combines a fake alert with a live phone call designed to build trust fast.
Here’s what is happening behind the scenes:
Step 1: The fake charge alert
You get a text about a suspicious charge. It looks urgent. It often includes a number to call.
Step 2: You call the scammer
The number connects you directly to a criminal. They pose as Apple, your bank or even law enforcement.
Step 3: They build credibility
They may know your name, address or bank. That information often comes from past data breaches.
Step 4: They create fear and urgency
You are told your money is at risk. You need to act immediately.
Step 5: They control your next move
In Dorothy’s case, the scammer told her to withdraw $15,000 and lie to her bank about why.
“He said he would stay on the phone with me while I drove to the bank… If anyone asked, I should say I was buying a car.”
That is a major red flag.
PHISHING SCAM EXPLOITS APPLE MAIL ‘TRUSTED SENDER’ LABEL
Once you call, scammers pose as trusted companies or agencies and pressure you to act quickly. (Kurt “CyberGuy” Knutsson)
The moment everything could have gone wrong
Dorothy drove to the bank with the scammer still on the phone. This is exactly what criminals want. They try to isolate you and keep control of the situation.
But something didn’t feel right.
“When I got to the bank, I recognized one of the employees and told her that I was uncomfortable… She said to hang up immediately.”
That decision changed everything.
The bank confirmed it was a scam. The calls kept coming from different numbers. Dorothy blocked them all. Fortunately, no money was lost.
Why the Apple Pay text scam feels so real
Scammers are getting better at one thing. They make you feel like you are solving a problem, not being scammed.
Here’s why this one works so well:
- It uses a trusted name like Apple Pay
- It creates urgency with a fake charge
- It moves quickly to a live conversation
- It uses real personal details to build trust
- It pressures you to act before you think
They also add authority. Claiming ties to the FBI or FDIC makes people feel like they must comply. In reality, no legitimate agency will ever ask you to move money this way.
The biggest red flags to watch for
If you remember nothing else, remember these:
- A text about a charge that tells you to call a number
- Someone is asking you to withdraw large amounts of cash
- Instructions to lie to your bank or keep a secret
- Claims that your money needs to be “protected”
- Pressure to act immediately
Each one is a warning sign. Together, they confirm it is a scam.
The biggest red flag is being told to move money or keep secrets from your bank or family. (Kurt “CyberGuy” Knutsson)
How to stay safe from Apple Pay text scams
You do not need to outsmart scammers. You just need to slow the situation down.
1) Never trust the number in the message
If you get a suspicious text, do not call the number provided. Look up the official number yourself.
2) Pause before you act
Scammers rely on urgency. Take a moment. Real companies will not rush you like this.
3) Never move money on someone else’s instructions
No bank, tech company or government agency will ask you to withdraw cash to “protect” it.
4) Use strong antivirus software
Strong antivirus software can help detect malicious links, block scam websites and warn you before you engage with risky content. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.
5) Remove your personal data from the web
Scammers often use data from breaches to sound convincing. A data removal service can help reduce your exposure and limit what criminals can find about you online. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.
6) Talk to someone you trust
A quick conversation with a friend, family member or bank employee can stop a scam cold.
7) Add extra protection
Consider identity monitoring services that alert you if your information is being misused. See my tips and best picks on Best Identity Theft Protection at Cyberguy.com.
What to do if this happens to you
Even if you did not lose money, take a few steps right away:
- Contact your bank using the number on your card
- Place a fraud alert on your credit
- Consider freezing your credit
- Monitor your accounts closely
- Block any follow-up calls or texts
These steps help protect you from future attempts.
What this means for you
This scam did not begin with a complex hack. Instead, it started with a simple text. That is what makes it so dangerous. At first, it looks routine. Then urgency takes over. As a result, anyone can feel pressured to act quickly and without thinking.
In many cases, the situation feels real. That is how people get pulled into a conversation that seems legitimate. In Dorothy’s case, she trusted her instincts at the right moment. Because of that decision, fortunately, she did not lose $15,000.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Kurt’s key takeaways
Scammers target more than technology. They focus on human behavior. They create pressure, build trust and keep you engaged long enough to make a mistake. However, you can break the cycle. A single pause can disrupt the scam. Asking one question can expose it. Even a quick conversation with someone you trust can stop it. If you’d like to hear more of Dorothy’s story, you can catch our full conversation on my Beyond Connected podcast at getbeyondconnected.com/
If you got a text like this right now, would you pause or would you call? Let us know by writing to us at Cyberguy.com.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily. Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Copyright 2026 CyberGuy.com. All rights reserved.
I’m back after being waylaid last week by the deadly combo of a moderate cold and the beginning of pollen season. (Twenty-one percent of the District’s acreage is taken up by public green space, and DC is consistently ranked the best city park system in America. Unfortunately, I am allergic to every tree and grass.) If you’ve got tips on anything I may have missed or anything I should know about the upcoming weeks, send ’em to tina.nguyen+tips@theverge.com.
Do you actually believe anything OpenAI says?
On Monday, OpenAI published a 13-page policy paper addressing the impact that artificial intelligence would have on the American workforce. The company also proposed what it believed was the solution: putting higher capital gains taxes on corporations replacing their workers with AI and using that money to create a bigger public safety net. Its solutions included a public wealth fund, a four-day workweek funded by “efficiency dividends,” and government programs to help transition workers into “human-centered” work, all financed by the abundance that artificial intelligence would deliver.
Unfortunately, it was released the day that The New Yorker’s Ronan Farrow and Andrew Marantz published a meticulously reported, 17,000-word-plus article chronicling Sam Altman’s history of lying to everyone around him, including to his Silicon Valley backers, his employees, his board, and — relevant in this case — lawmakers trying to regulate AI. The New Yorker article reinforced a long-standing narrative about Altman, and OpenAI by extension: They may spout idealistic values, but would quickly jettison them for financial and political gains.
On its own, said several people I spoke to, the paper was a net positive to AI governance overall, in that it introduced new ideas into the political discourse around the emerging technology. But unless the company’s policy and political influence made good on those promises, said OpenAI’s critics, it may as well just be a piece of paper.
“My guess is that there are people on the team who care about the stuff, who’ve thought really hard about this document and are proud of it, and did good work, even if it’s not addressing all of the questions that I wish it would address,” Malo Bourgon, the CEO of the Machine Intelligence Research Institute (MIRI), told me. “And there’s still the question of: Are those people gonna find themselves in the position that many previous people at OpenAI have found themselves in, where they thought the company had certain values or aligned with things they cared about, and then ended up finding out that wasn’t the case, becoming disenchanted and leaving?”
With OpenAI proposing policy, it’s worth looking back at its history with the government, which the New Yorker piece details in depth. Altman had been one of the first major CEOs to publicly advocate for federal oversight for AI, going so far as to propose a federal agency to oversee advanced models in 2023 — but privately he worked to suppress the laws containing his own safety proposals. A state legislative aide in California accused OpenAI of engaging in “increasingly cunning, deceptive behavior” to kill a 2023 AI safety bill that it was publicly supporting. In 2025, the company subpoenaed supporters of a California state-level AI bill in an effort to, as one such supporter put it to The New Yorker, “basically scare them into shutting up.” And though Altman had once worked extensively with the Biden administration to build AI safety standards, the moment that Donald Trump became president, Altman successfully persuaded him to kill the initiatives he’d once advocated for.
Nathan Calvin, the general counsel at Encode, an AI policy nonprofit where he focuses on state legislative initiatives, had received one of those subpoenas. “What I’ve seen from their policy and government affairs engagement has just been abysmal,” he told me. While he believed that the team who’d written the OpenAI proposal, primarily from the technical safety research side, was acting with good intentions, he was still reserving judgment. “Will those folks remain engaged as we move from general policy principles towards the many other ways in which lobbying and government influence actually happens? Part of me is hopeful, but a lot of me is also quite skeptical about whether that will happen.” (OpenAI did not return a request for comment.)
A modest, absolutely not craven request:
Next week I plan on running an issue of Regulator cataloging the nerdiest events happening during Nerd Prom, aka the White House Correspondents’ Dinner party circuit. If you’re a tech founder, tech company, or someone that does something related to technology and you’re throwing an event during WHCD week, please let me know what you’re up to! From what I’ve heard so far, the tech world is about to shake up the normal social dynamics of the week — I’ve already caught wind of the Grindr party in Georgetown, and the Substack party, which famed looksmaxxer Clavicular is attending — and I’m so, so excited to pull together the most bonkers “SPOTTED” column that Washington’s ever experienced.
(Again, this is contingent upon whether we’re at war with Iran by the end of April, in which case, I imagine no one will be up for frivolity.)
Speaking of DC reporters, this is very true of all of us:
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.
Business18 seconds ago
In-N-Out owner says no to automated ordering
Entertainment6 minutes ago
On the ‘Laguna Beach’ reunion, this former love triangle is back for nostalgia, not drama
Lifestyle12 minutes ago
From Fergie to Michèle Lamy, here’s how guests showed up for the Fashion Trust U.S. Awards
Politics18 minutes ago
Column: We’re stuck with an unchecked mad king until January
Science24 minutes ago
For 40 minutes, the greatest solitude humans have known
Florida1 year ago
Florida High School Football Rankings: Top 25 teams – Oct. 21
Oregon2 years ago
How old is Bo Nix? What to know about Oregon quarterback ahead of 2024 NFL Draft
Connecticut2 years ago
Cleary's 21 help Le Moyne down Central Connecticut State 69-64 in OT
Virginia2 years ago
99th annual Pony Swim held in Virginia
Indiana2 years ago
Indiana Members Credit Union announced as new anchor tenant at Bottleworks District
World42 minutes ago
Gaza journalists mourn Al Jazeera’s Wishah, killed by Israel
News1 hour ago
Exclusive: Trump weighs pulling some US troops from Europe amid NATO strains, official says
News11 hours ago
Video: The Fragile Cease-Fire in Iran
Politics12 hours ago
Spanberger ripped after taking credit for billions in investments secured under GOP predecessor: ‘Pathetic’
World13 hours ago
Newsletter: NATO holds amid fragile Iran ceasefire
-
Atlanta, GA5 days ago1 teenage girl killed, another injured in shooting at Piedmont Park, police say
-
Movie Reviews1 week agoVaazha 2 first half review: Hashir anchors a lively, chaos-filled teen tale
-
Education1 week agoVideo: We Put Dyson’s $600 Vacuum to the Test
-
Georgia2 days agoGeorgia House Special Runoff Election 2026 Live Results
-
Pennsylvania3 days agoParents charged after toddler injured by wolf at Pennsylvania zoo
-
Milwaukee, WI3 days agoPotawatomi Casino Hotel evacuated after fire breaks out in rooftop HVAC system
-
Education1 week agoVideo: YouTube’s C.E.O. on the Rise of Video and the Decline of Reading
-
Entertainment1 week agoInside Ye’s first comeback show at SoFi Stadium