Connect with us

Technology

Hackers target online stores with new attack

Published

on

Hackers target online stores with new attack

NEWYou can now listen to Fox News articles!

A security researcher found a serious weakness in the software that powers thousands of e-commerce sites. The platform, called Magento, and its paid version Adobe Commerce, has a bug that lets attackers break into active shopping sessions. Some attackers can even take control of the entire store.

The flaw is known as SessionReaper. It allows hackers to pretend they are real customers without needing a password. Once they are inside, they can steal data, make fake orders, or install tools that collect credit card details.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter 

Why is this attack so serious?

The problem starts in the part of the system that handles how a store communicates with other online services. Because the software does not properly check the information it receives, it sometimes trusts data that it should not. Hackers take advantage of this by sending fake session files that the store accepts as real.

Advertisement

Researchers at SecPod warn that successful attacks can lead to stolen customer data, fake purchases and even full control of the store’s server.

Once the attack method was shared publicly, cybercriminals began using it right away. Security experts at Sansec reported that more than 250 online stores were compromised within a single day. This shows how quickly attacks can spread once a vulnerability becomes public.

Hackers are exploiting a new flaw called SessionReaper to hijack active shopping sessions on thousands of e-commerce sites running Adobe Commerce and Magento. (Kurt Knutsson)

Why are many stores still unprotected?

Adobe released a security update on Sept. 9 to fix the issue. Weeks later, about 62% of affected stores still have not installed it. Some store owners are afraid an update might break features on their site. Others simply do not know how serious the risk is.

Every unpatched store remains an open door for attackers who want to steal information or install malicious code.

Advertisement

MAJOR COMPANIES, INCLUDING GOOGLE AND DIOR, HIT BY MASSIVE SALESFORCE DATA BREACH

How can you stay safe when shopping online?

While store owners are responsible for fixing the problem, you can still take smart steps to protect yourself when shopping online. These actions can help you spot danger early and keep your personal information safe.

1) Look for warning signs

Always pay attention to how a website behaves. If a page looks odd, loads slowly or shows error messages, it could mean something is wrong behind the scenes. Check for the small padlock symbol in the address bar that shows the site uses HTTPS encryption. If it is missing or the site redirects you to an unfamiliar page, stop and close the browser tab immediately. Trust your instincts if something feels off.

2) Be careful with email links and use a data removal service 

Cybercriminals often use fake promotional emails or ads that look like real store offers. Instead of clicking links in messages or banners, type the store’s web address directly into your browser to avoid phishing pages designed to steal your login details or card information. Since attacks like SessionReaper can expose your personal data to criminal marketplaces, consider using a reputable data removal service that continuously scans and deletes your private information, such as your address, phone number and email, from data broker sites. This reduces your risk of identity theft if your information has been leaked through a compromised online store.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Advertisement

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

Cybersecurity teams at SecPod and Sansec tracked more than 250 stores breached within 24 hours of the exploit going public, showing how fast these attacks spread. (Kurt “CyberGuy” Knutsson)

3) Use strong antivirus software

Strong antivirus protection is your silent guard online. Choose reputable software that offers real-time protection, safe browsing alerts and automatic updates. A strong antivirus program can detect malicious code that tries to run on your device, block unsafe sites and alert you to potential threats. This adds another crucial layer of defense when visiting online stores that may not be fully secure.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Advertisement

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com 

4) Use safe payment options

Whenever possible, choose payment services that add an extra layer of protection between your bank account and the online store. Platforms like PayPal, Apple Pay or Google Pay do not share your card number with the retailer. This reduces the chance of your information being stolen if the store is compromised. These payment gateways also offer dispute protection if a purchase turns out to be fraudulent.

5) Shop with trusted retailers

Stick to stores with a solid reputation. Well-known brands usually have better security and faster response times when issues arise. Before buying from a new website, check its reviews on trusted consumer sites. Look for signs of credibility such as clear contact information, a professional design and verified payment options. A few minutes of research can save you from weeks of frustration.

TRANSUNION BECOMES LATEST VICTIM IN MAJOR WAVE OF SALESFORCE-LINKED CYBERATTACKS, 4.4M AMERICANS AFFECTED

6) Keep your devices updated

Updates may seem annoying, but they are one of the most effective ways to protect your data. Make sure your computer, smartphone and web browser all have the latest security patches installed. Updates often fix the exact kinds of flaws hackers use to spread attacks like SessionReaper. Enable automatic updates if you can, so your devices stay protected without extra effort.

Advertisement

7) Use unique, strong passwords

If you create accounts on shopping sites, make sure each one has its own strong password. Avoid using the same password across multiple platforms. Consider using a password manager to generate and store long, random passwords. That way, if one account is compromised, your other logins stay safe.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com

8) Turn on two-factor authentication

If a site or payment service offers two-factor authentication, enable it. This adds a second security step, such as a code sent to your phone or generated by an app. Even if hackers steal your password, they will not be able to access your account without that second verification.

Even weeks after Adobe issued a critical patch for the SessionReaper vulnerability, nearly two-thirds of affected online stores remain unprotected, leaving customer data and payment information at high risk of theft. (CyberGuy.com)

Advertisement

9) Avoid public Wi-Fi for purchases

FARMERS INSURANCE DATA BREACH EXPOSES 1.1M AMERICANS

Public Wi-Fi networks in places like cafés, airports and hotels are often unsecured. Avoid entering payment information or logging in to accounts while connected to public networks. If you must make a purchase while away from home, use a mobile data connection or a reliable VPN to encrypt your activity. 

10) Monitor your bank and credit statements

Check your financial statements regularly for any unusual activity. Small, unauthorized charges can be early signs of fraud. Report any suspicious transactions to your bank or credit card company right away so they can freeze your account or issue a new card.

11) Report suspicious activity

If you notice anything strange during or after an online purchase, act quickly. Contact the store’s customer service to report what you saw. You should also inform your payment provider or credit card company so they can block unauthorized transactions. Reporting early can help stop further damage and alert other shoppers to potential risks.

Kurt’s key takeaways

The SessionReaper attack shows how fast online threats can appear and how long they can linger when updates are ignored. Even well-known stores can become unsafe overnight. For retailers, installing patches quickly is critical. For shoppers, staying alert and choosing secure payment methods are the best ways to stay protected.

Advertisement

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Would you still shop online if you knew hackers could be hiding behind a store’s checkout page? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter 

Copyright 2025 CyberGuy.com. All rights reserved.  

Advertisement
Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Technology

Skullcandy’s bass-boosting Crusher headphones now come with Bose’s ANC

Published

on

Skullcandy’s bass-boosting Crusher headphones now come with Bose’s ANC

Skullcandy announced a new version of its Crusher wireless headphones today featuring a few of Bose’s audio technologies including its QuietControl ANC and head-tracking spatial audio. The Crusher headphone line differentiates itself from the competition through the use of both full-range and dedicated bass drivers in each ear cup to boost deeper frequencies. Skullcandy admits that approach can result in a loss of audio quality when the bass is heavily boosted, but its new Crusher 1080 ANC are meant to address and improve that with Bose’s help.

Available starting today for $279.99 in black, candy, primer, and cement color options, the new Crusher 1080 ANC feature redesigned drivers with a stiffer diaphragm material resulting in enhanced clarity and detail with less distortion at higher volume. As with previous models in the Crusher line, the bass boosting is entirely adjustable using Skullcandy’s mobile app or the on-headphone controls that now include a more prominent dial on the outside.

The Crusher 1080 ANC will be the first non-Bose headphones to feature that company’s TrueSpatial audio technology with head tracking that works whether you’re stationary or out for a run and its WaveForm audio engine that “keeps audio full, balanced, and smooth.” Skullcandy’s latest will also offer industry-leading noise cancellation with Bose’s six microphone QuietControl ANC tech that adapts as sounds around you get louder or quieter. The Crusher 1080ANC even features Bose’s SpeechClarity that reduces noise so your voice comes through clearly during a call, but they’re not the first third-party headphones to offer it.

Battery life is estimated to be up to 60 hours with ANC turned off, or 50 hours with it on, while a 10-minute rapid charge will keep the Crusher 1080 ANC going for up to four hours if they die. There’s multipoint pairing for connecting and switching between multiple devices, auto reconnect and wear detection that pauses music when you take the headphones off, and a design that folds flat for easier storage. The Crusher 1080 ANC supports Bluetooth 5.3 with LE Audio, low latency audio, and Auracast.

Continue Reading

Technology

You paid for it. So why is your device showing ads?

Published

on

You paid for it. So why is your device showing ads?

NEWYou can now listen to Fox News articles!

You paid for the product. So why does it feel like the company still controls the screen? That is the question more of us are starting to ask as smart devices get updated long after we bring them home. A refrigerator can show ads in your kitchen. A car can flash offers on the dashboard. Even a Windows 11 computer can surface promotions before you get to work.

The frustrating part is that this often happens through software updates. You tap update because you want your device to stay secure and work properly. Then one day, the product you bought starts acting like a billboard. This is also why it pays to understand the hidden privacy clauses and settings that come with smart products before those screens start doing things you never expected.

GOOGLE TURNS OLD PHONES INTO CLOUD SERVERS

Smart devices from refrigerators to cars and computers can show ads after software updates, raising questions about who controls screens consumers already paid for. (Michele Tantussi/Getty Images)

Advertisement

Free live CyberGuy class: Sick of Spam? Join us July 22.

Join us Wednesday, July 22, at 1 p.m. ET for a free CyberGuy Live class that will help you cut down on robocalls, spam texts, junk email and other unwanted messages. Kurt “CyberGuy” Knutsson will walk you step by step through simple ways to filter spam, clean up your inbox and recognize the messages that could put your personal information at risk. No technical experience is needed. You’ll also receive our spam-stopping checklist, and every registrant will get a link to the class recording afterward.

Reserve your free spot today at CyberGuyLive.com.

Samsung Family Hub refrigerators started showing ads

Samsung Family Hub refrigerators are sold as connected kitchen hubs. You can use the screen for weather, calendars, grocery lists and other household features. But as we discussed on The CyberGuy Report podcast at CyberGuy.com, that same screen can also become a place for ads after a software update. Samsung began showing ads on some Family Hub refrigerator Cover Screens in the U.S. We reached out to Samsung about this, and a spokesperson provided us with this statement:

“Last year, Samsung piloted a new Cover Screen widget on Family Hub refrigerators in the U.S. The widget rotates through useful information like weather, news, calendar events, and curated ads. After the pilot concluded in March, the widget was launched fully with the same user experience.

Advertisement

Users can turn off the Cover Screen widget, including ads, in the Advertisements tab of the Settings menu (Settings > Advertisements > Cover screen Ads) without impacting any other features or functions. Ads can also be dismissed on the Cover Screens where shown, meaning that the dismissed ad will not appear again during that specific ad’s campaign period. Since the start of the pilot program last October, our review has indicated consumers are finding value in this new widget. The percentage of users who have turned off the feature is in the low single-digits.

A Cover Screen appears when the Family Hub screen is idle, and the widget only appears on the Weather, Color, and Daily Board themes. The widget does not appear on the Cover Screen’s Art or Album themes.”

That answer is important because Samsung says you can turn the Cover Screen ads off without losing other features. Still, the larger point remains. You bought a refrigerator, then a later update added an ad experience to the screen in your kitchen.

How to turn off Samsung Family Hub Cover Screen ads

On the Family Hub screen:

  • Tap Settings
  • Tap Advertisements
  • Tap Cover Screen Ads
  • Turn the switch off

You can also change the Cover Screen theme. Samsung says the widget does not appear on Art or Album themes.

Car screen ads appeared in Jeep, Ram and Chrysler vehicles

Now move from the kitchen to the driveway. Some Jeep, Ram and Chrysler drivers previously saw promotional messages on their infotainment screens through Stellantis’ Uconnect system.

Advertisement

Stellantis, the automaker behind Jeep, Ram, Chrysler and Dodge, says its In-Vehicle Message technology, or IVM, is designed to help the company stay in contact with owners at important points during ownership. The company says it uses IVM for important messages, such as vehicle recalls and vehicle health monitor alerts. Stellantis also confirmed that the earlier pop-up promotions were part of its in-vehicle messaging or Uconnect communication system. However, the company says it has not run the promotional in-vehicle messages referenced in those reports since mid-fall 2025 and has nothing planned for future in-vehicle promotional messages.

At the time those promotional messages were active, Stellantis says owners could opt out by calling customer service or by updating their profile or Message Settings on their vehicle brand’s website account, such as a Ram owner account. That update is important. There are no current promotional in-vehicle messages to opt out of, according to Stellantis. Still, the larger concern remains: modern vehicles are software-driven, and the screen in the middle of your dashboard can be changed long after you drive off the lot.

10 SMALL HOME UPGRADES THAT CAN LOWER YOUR MONTHLY BILLS

Some Jeep, Ram and Chrysler drivers previously saw promotional messages on infotainment screens through Stellantis’ Uconnect system. (Kurt “Cyberguy” Knutsson)

Why dashboard messages feel more intrusive

A car screen is different from a phone app or website. You use that display for directions, music, climate controls and vehicle settings. So when a promotional message appears there, it can feel more personal than an ad on a webpage.

Advertisement

To be fair, in-vehicle messaging can serve an important purpose. Recall notices and vehicle health alerts can help owners respond to safety or maintenance issues faster.

However, promotional messages hit differently. You are sitting in a car you paid tens of thousands of dollars for. That screen should help you drive, maintain your vehicle and get where you are going without feeling like another place for a sales pitch.

Windows 11 ads can appear in several places

Then there is your computer. Windows 11 can show promotional content in places that feel like part of the operating system. That includes the lock screen, the Start menu and account-related notifications.

The lock screen can use Windows Spotlight, which displays rotating images along with tips, tricks and notifications. Start menu settings also include areas where Microsoft can show recommendations and account prompts.

Some of these messages may look like helpful notices. Others can feel like upsells. The most annoying ones are the alerts that look urgent, then steer you toward a Microsoft service such as OneDrive backup. Microsoft declined to comment for this story.

Advertisement

How to reduce ads and suggestions in Windows 11

You can cut down on much of this in Settings.

Change the lock screen:

  • Go to Settings
  • Click Personalization
  • Click Lock screen
  • Change Windows Spotlight to Picture
  • Turn off Get fun facts, tips, tricks and more on your lock screen

Reduce Start menu suggestions:

  • Go to Settings
  • Click Personalization
  • Click Start
  • Turn off any available toggles for recommendations, tips, suggestions or personalized offers

FIVE DATA BROKER OPT-OUT MYTHS THAT LEAVE RETIREES EXPOSED

Samsung says Family Hub refrigerator Cover Screen ads can be turned off, but the feature highlights how connected appliances can change after purchase. (SeongJoon Cho/Bloomberg via Getty Images)

Limit account-related prompts:

  • Go to Settings
  • Click Personalization
  • Click Start
  • Turn off Show account-related notifications

Microsoft may change wording over time, so look for anything tied to recommendations, tips, suggestions, offers or account notifications. For more Windows settings help, see these Windows 11 tips.

Device screen ads are spreading after you buy

The real problem isn’t one ad on one screen. It is the fact that software gives companies a way to change products after you buy them. A refrigerator used to stay a refrigerator. A car dashboard used to do what it did on the day you drove off the lot. A computer operating system used to feel like the tool you used to get things done.

Now those screens can change later. A company can add a widget, promote a service or push an offer through an update. That does not mean every update is bad. Security fixes are essential. Bug fixes help. New features can be useful. However, ads feel different when they arrive after you already paid for the product. That is why you should keep your devices updated, but also check what changed after the update installs.

What this means to you

Before you buy a smart appliance, connected car or computer, think beyond the hardware. Ask what kind of software controls the screen. Check whether ads, recommendations or promotional content can be turned off.

Advertisement

After setup, go through the settings before you assume the default experience is the only option. Look for menus labeled ads, recommendations, notifications, tips, offers or personalization. If you are setting up a new device, this new electronics setup guide is a good place to start.

Also, pay attention after updates. If a new widget or pop-up appears, do not assume you have to live with it. There may be a buried toggle that turns it off. Most of all, remember that a screen in your home, car or office has value. Companies know that. You should know it too.

Kurt’s key takeaways

This is exactly why we covered this on The CyberGuy Report podcast at CyberGuy.com. It hits a nerve because you already paid for these products, yet companies can still use software updates to claim space on the screens you see every day. Samsung says Family Hub Cover Screen ads can be turned off. Stellantis says its vehicle promotions stopped in the fall of 2025. Windows 11 gives you some settings that reduce tips, suggestions and account prompts. Still, the pattern is hard to ignore. Companies are learning how to keep making money from a product after the sale. That may be great for them, but it can feel pretty lousy when the screen is inside your kitchen, your car or your computer. When you pay thousands of dollars for a product, that screen should work for you instead of becoming another place for a company to sell to you.

Which screen ad would bother you most: one on your refrigerator, one on your computer or one in your car? Let us know by writing to us at CyberGuy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Advertisement

Sign up for my FREE CyberGuy Report

  • Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
  • For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com trusted by millions who watch CyberGuy on TV daily.
  • Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Copyright 2026 CyberGuy.com. All rights reserved.

Continue Reading

Technology

Lucid’s bankruptcy rumor is a bad sign for the EV future

Published

on

Lucid’s bankruptcy rumor is a bad sign for the EV future

Lucid Motors found itself in a tough bind this week, fending off bankruptcy rumors and watching its stock price plunge as a result. The company quickly denied the report, calling it “completely false” and pointing to its available free cash flow as evidence that it has enough runway to operate into next year.

But despite the swift response, the damage was widespread. The panic immediately bled into competing automakers, pulling down shares of Rivian and Polestar as investors speculated about the long-term survival of EV-only companies in the face of slowing consumer demand and whiplash policy shifts. And it cast a harsh light on the precarity of all three companies and the future of electric vehicles.

The trouble started on Tuesday, when EV trade publication EV reported that restructuring firm AlixPartners had advised Lucid’s board to consider Chapter 11 bankruptcy or a take-private deal. The report also said AlixPartners had encouraged the board to further restructure in the US and Europe and to focus on the Gravity SUV. But while the rest of the media has since reported on Lucid’s denial, no other publication has confirmed EV’s scoop. (For what its worth, EV’s URL is “eletric-vehicle.com,” enshrining the incorrect spelling in its address.)

Lucid confirmed that it had hired AlixPartners, but denied that the firm had made any such recommendations to its board. Instead, AlixPartners would provide advice on “improving execution, strengthening operations and positioning Lucid to realize the full potential of its technology, products and innovation,” Lucid chief communications officer Nick Twork said.

Lucid went a step further, filing a cease and desist order against EV

Advertisement

Lucid went a step further, filing a cease and desist order against EV, claiming that the site’s report directly led to the stock crash. “In short, your actions caused serious injury to a number of investors,” Lucid’s chief legal officer and general counsel, Brian Tomkiel, said in the letter. “And they injured, and continue to injure, Lucid directly.”

Still, the timing was terrible. Lucid is genuinely not in good shape, having lost over $1 billion in the first quarter of the year. The company has also gone through two rounds of layoffs in 2026, having cut 12 percent of staff in February and then 18 percent in June. The company also reduced production at its factory in Arizona in a bid to counteract its high inventory and save money. And there’s been leadership turmoil, with COO Marc Winterhoff departing the company and his position being eliminated entirely in an effort to flatten the structure.

The report sent the stock into freefall, plummeting as much as 50 percent in one of the worst single-day drops in Lucid’s history. And with Polestar and Rivian also catching strays, it’s generally been a glum time for companies not named Tesla trying make a go of exclusively building electric vehicles. Wall Street is panicking because the rumors are aligning with the bad news coming out of these companies’ earnings reports. EV sales are stabilizing, but recovery is still a distant promise. The all-electric future seems further away than ever.

Whether or not Lucid is actually weighing Chapter 11, it’s a sure sign of more turbulent waters ahead. Polestar getting strong-armed out of the US over its Chinese ties has left a lot of EV owners and dealers scratching their heads. Rivian is in an increasingly precarious position thanks to its huge, expensive bet on becoming a mass-market car company with the production of the R2.

All of these companies are increasingly reliant on big stakeholders — Lucid with Saudi Arabia’s Public Investment Fund, Polestar with Geely, and Rivian with Volkswagen — for their future survival. If any of these big backers get cold feet, the future could get really dark really fast.

Advertisement
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

Continue Reading
Advertisement

Trending