Technology
Thousands of iPhone apps expose data inside Apple App Store
NEWYou can now listen to Fox News articles!
Apple often promotes the App Store as a secure place to download apps. The company highlights strict reviews and a closed system as key protections for iPhone users. That reputation now faces serious questions.
New research shows that thousands of iOS apps approved by Apple contain hidden security flaws. These flaws can expose user data, cloud storage and even payment systems.
The issue is not malware; it’s poor security practices baked directly into the app code.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
APPLE WARNS MILLIONS OF IPHONES ARE EXPOSED TO ATTACK
Cybernews researchers found that many iOS apps store sensitive secrets directly inside app files, where they can be easily extracted. (Kurt “CyberGuy” Knutsson)
What researchers discovered inside iOS apps
Security researchers at Cybernews, a cybersecurity research firm, analyzed the code of more than 156,000 iPhone apps. That represents about 8% of all apps available worldwide.
Here is what they found:
- Over 815,000 hidden secrets inside app code
- An average of five secrets per app
- 71% of apps leaked at least one secret
These secrets include passwords, API keys and access tokens. Developers place them directly inside apps, where anyone can extract them. According to Cybernews researcher Aras Nazarovas, this makes attackers’ jobs much easier than most users realize.
What are hardcoded secrets in simple terms?
A hardcoded secret is sensitive information saved directly inside an app instead of being protected on a secure server. Think of it like writing your bank PIN on the back of your debit card. Once someone downloads the app, they can inspect its files and pull out those secrets. Attackers do not need special access or advanced hacking tools. Both the Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation warn developers not to do this. Yet it is happening at a massive scale.
Cloud storage leaks exposed huge amounts of data
One of the most serious problems involves cloud storage. More than 78,000 iOS apps contained direct links to cloud storage buckets. These buckets store files such as photos, documents, receipts and backups. In some cases, no password was required at all. Researchers found:
- 836 storage buckets are fully open to the public
- Over 76 billion exposed files
- More than 406 terabytes of leaked data
This data included user uploads, registration details, app logs and private records. Anyone who knew where to look could view or download it.
APPLE PATCHES TWO ZERO-DAY FLAWS USED IN TARGETED ATTACKS
This chart shows the most common types of hardcoded secrets found inside iOS apps, with Google-related keys appearing most often, according to Cybernews research. (Cybernews)
Firebase databases were also left open
Many iOS apps rely on Google Firebase to store user data. Cybernews found more than 51,000 Firebase database links hidden in app code. While some were protected, over 2,200 had no authentication. That exposed:
- Nearly 20 million user records
- Messages, profiles, and activity logs
- Databases that are mostly hosted in the U.S.
If a Firebase database is not locked down, attackers can browse user data like a public website.
Payment and login systems were at risk too
Some of the leaked secrets were far more dangerous than analytics or ads. Researchers discovered secret keys for:
- Stripe, which handles payments and refunds
- JWT authentication systems that control logins
- Order management tools used by shopping apps
A leaked Stripe secret key can allow attackers to issue refunds, move money or access billing details. Leaked login keys can let attackers impersonate users or take over accounts.
AI and social apps were among the worst offenders
Some of the apps with the largest leaks were related to artificial intelligence. According to VX Underground, security firm CovertLabs identified 198 iOS apps leaking user data. The worst known case was Chat & Ask AI by Codeway. Researchers say it exposed chat histories, phone numbers and email addresses tied to millions of users. Another app, YPT – Study Group, reportedly leaked messages, user IDs and access tokens. CovertLabs tracks these incidents in a restricted repository called Firehound. The full list of affected apps has not been publicly released, and researchers say the data is limited to prevent further exposure and to give developers time to fix security flaws.
MALICIOUS GOOGLE CHROME EXTENSIONS HIJACK ACCOUNTS
This example shows how sensitive keys like Google API credentials and Stripe payment secrets can be stored directly inside an iOS app’s files, where they are easy to extract. (Cybernews)
Why Apple’s App review can miss hidden security risks
Apple reviews apps before they appear in the App Store. However, the review process does not scan app code for hidden secrets. If an app behaves normally during testing, it can pass review even if sensitive keys are buried inside its files. This creates a gap between Apple’s security claims and real-world risks. Removing leaked secrets is not simple for developers. They must revoke old keys, create new ones and rebuild parts of their apps. That can break features and delay updates. Even though Apple says most app updates are reviewed within 24 hours, some updates take weeks. During that time, vulnerable apps can remain available.
CyberGuy contacted Apple for comment, but did not receive a response before publication.
Ways to stay safe right now
You cannot easily inspect an app for hidden secrets. Apple does not provide tools for that. Still, you can reduce your risk and limit exposure by being selective and cautious. These steps help reduce the risk if an app leaks data behind the scenes.
1) Stick to established app developers
Well-known developers tend to have stronger security teams and better update practices. Smaller or unknown apps may rush features to market and overlook security basics. Before downloading, check how long the developer has been active and how often the app is updated.
2) Review and limit app permissions
Many apps ask for more access than they need. Location, contacts, photos and microphone access all increase the risk of data leaks. Go into your iPhone settings and remove permissions that are not essential for the app to work.
3) Delete apps you no longer use
Unused apps still retain access to data you shared in the past. They may also store information on remote servers long after you stop opening them. If you have not used an app in months, remove it. Here’s how: Open Settings, tap General, select iPhone Storage, and scroll through the list of apps to see when each one was last used. Tap any app you no longer need and select Delete App to remove it and reduce ongoing data exposure.
4) Be cautious with personal and financial details
Avoid entering sensitive information unless it is absolutely necessary. This includes full names, addresses, payment details and private conversations. AI apps are especially risky if you share deeply personal content.
5) Use a password manager for every account
A password manager creates strong, unique passwords for each app and service. This prevents attackers from accessing multiple accounts if one app leaks data. Never reuse passwords tied to your email address.
Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.
Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.
6) Change passwords tied to exposed apps
If an app uses your email address for login, change that password immediately. Do this even if there is no confirmation of a breach. Attackers often test leaked credentials across other services.
7) Consider using a data removal service
Some leaked data ends up with data brokers that sell personal information online. A data removal service can help find and remove your details from these databases. This reduces the chance that exposed app data gets reused for scams or identity theft.
While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.
Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.
8) Monitor your accounts for unusual activity
Watch for unexpected emails, password reset notices, login alerts, or payment confirmations. These can signal that leaked data is already being abused. Act quickly if something looks off.
9) Pause use of risky AI and chat apps
If you use AI apps for private conversations, consider stopping until the developer confirms security fixes. Once data is exposed, it cannot be pulled back. Avoid sharing sensitive details with apps that store conversations remotely.
Kurt’s key takeaways
Apple’s App Store still offers important protections, but this research shows it is not foolproof. Many trusted iPhone apps quietly expose data due to basic security mistakes. Until app reviews improve, you need to stay alert and limit how much data you share.
How many apps on your iPhone have access to information you would not want exposed? Let us know by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
Copyright 2026 CyberGuy.com. All rights reserved.
Technology
Crimson Desert dev apologizes for use of AI art
Reviews of Crimson Desert have been mixed, but the bigger issue for the game has been the discovery of what appeared to be AI-generated assets in the final release. Now the developer has acknowledged that AI art was indeed used during the game’s creation, but says that it was intended to be replaced before release. In a statement on X, the company said it was conducting a “comprehensive audit” to identify and replace any AI-generated content.
The company apologized for both its inclusion in the final release and for not being more transparent about its use during development. “We should have clearly disclosed our use of AI,” it said.
The use of generative AI in gaming has become a hot-button issue of the last couple of years as it’s made its way into several high-profile titles. While some large studios have embraced it, many smaller developers have revolted against the trend, proudly proclaiming their games to be “AI free.”
Technology
YouTube job scam text: How to spot it fast
NEWYou can now listen to Fox News articles!
Most of us have received a random text that makes us pause for a second. Maybe it promises a prize. Maybe it claims to be from a delivery company. Lately, another type of message is spreading quickly: the remote job scam.
That is exactly what happened to Peter from New York. He wrote in after receiving a suspicious message about a high-paying YouTube job.
Here is what he sent:
“I received this text today, and I think it’s a scam. How can I tell for sure, and what do I do next?”
Below is the message Peter received. At first glance, it looks like a job opportunity. However, when you break it down line by line, several warning signs appear. Let’s walk through them.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.
FAKE GOOGLE SECURITY PAGE CAN TURN YOUR BROWSER INTO A SPYING TOOL
A suspicious text message promises up to $10,000 a month for boosting YouTube video views. Offers like this are a common sign of a job scam. (Kurt “CyberGuy” Knutsson)
Red flag 1: A random job offer from a stranger
The text comes from an unknown international phone number starting with +63, which is the country code for the Philippines. Legitimate companies rarely recruit through random text messages from unknown numbers. Real employers usually contact candidates through job platforms, email or professional networks like LinkedIn. When a job appears out of nowhere and promises high pay, it should immediately raise suspicion.
Red flag 2: The pay is wildly unrealistic
The message claims:
- $200 to $600 per day
- $10,000 or more per month
Those numbers are a major warning sign. Entry-level remote work, such as “boosting video views” or “YouTube optimization,” does not pay anywhere near that range. Scammers often use unusually high pay to trigger excitement and urgency. When money sounds too good to be true, it usually is.
Red flag 3: No experience required but huge income
The text says “no experience required, free paid training provided.” Scammers often combine high income with zero qualifications. That combination is designed to attract as many people as possible.
Real digital marketing jobs usually require:
- SEO or marketing experience
- Analytics knowledge
- Platform expertise
A company offering $10K per month with no requirements is not realistic.
BE AWARE OF EXTORTION SCAM EMAILS CLAIMING YOUR DATA IS STOLEN
Scammers often claim no experience is required and that training is provided. The goal is to lure you in quickly before you start asking questions. (Kurt “CyberGuy” Knutsson)
Red flag 4: The job description is vague
The text claims the job is to “increase video exposure and view count.”
That description is extremely vague. It does not explain:
- What tools you would use
- What company you would work for
- How the work is measured
Scam job offers often stay vague so they can adapt the story later.
Red flag 5: Pressure to respond immediately
The message says: “5 urgent openings available, first come first served.” This is a classic scam tactic. Urgency pushes people to respond quickly before they have time to research the offer. Real companies rarely hire qualified candidates on a first-come basis through text messages.
Red flag 6: The strange reply instructions
The message tells recipients to reply “OK” and then send a numeric code. This step is often used to move the conversation to another messaging platform, such as Telegram or WhatsApp, where scammers continue the scheme. Once the conversation moves there, victims may be asked to:
- Complete fake tasks
- Send cryptocurrency
- Pay deposits for “training”
These scams are often called task scams, where victims complete simple online tasks and may even receive small payments at first before scammers demand larger deposits for payouts that never come. They have exploded worldwide over the past few years.
Red flag 7: No company information
The message never names a real company. It mentions a “manager” named Goldie but provides:
- No company website
- No corporate email
- No office address
Legitimate employers want applicants to know who they are. Scammers avoid details that can be verified.
How these YouTube job scams usually work
Many of these scams follow the same pattern. First, scammers promise easy money for simple tasks lsuch as liking videos or boosting views. At the beginning, they may even send a small payment to build trust. Then things change. Victims are asked to deposit money to unlock larger payouts or complete “premium tasks.” Once payments are sent, the scammers disappear. The Federal Trade Commission says Americans lost hundreds of millions of dollars to job scams in recent years, and text message recruitment scams are rising fast.
Google warns about growing job scams and how to verify recruiters
We reached out to Google, and a spokesperson provided the following statement to CyberGuy:
“Google is aware of these job scams happening across the industry and believes they’re growing around the world. We strongly encourage any candidate, or individual receiving them, to exercise caution and report it to the platform you received it on as a phishing attempt and/or spam. Our recruiting team focuses on contacting candidates in official capacities and are very clear about who we are, why we’re reaching out, and do so from legitimate emails or profiles on job sites. Jobseekers should verify anyone contacting them by email addresses, looking up the person online, such as on LinkedIn, and if something does seem suspicious, flag it to the outlet where it was received. Folks can also vet and report these scams to Google at support.google.com. Our Google careers page reflects all of our current job postings, so candidates should check offers against those. Generally speaking, Google also continues to offer a range of tools and insights that help people automatically spot and avoid scams like these whether they receive them via email, search results, text messages, etc.”
FAKE GOOGLE GEMINI AI PUSHES ‘GOOGLE COIN’ CRYPTO SCAM
Messages that push you to reply immediately or move the conversation to apps like Telegram or WhatsApp are a major red flag. (Kurt “CyberGuy” Knutsson)
Ways to stay safe from job text scams
If you receive a message like Peter’s, here are some smart steps to take.
1) Never respond to unknown job texts
Replying confirms your number is active. That can lead to more scam messages.
2) Do not click links or download attachments
Scam texts sometimes include links that lead to phishing pages designed to steal login credentials or financial information. Install strong antivirus software on your devices, which can help detect malicious links, block dangerous websites and warn you before you open something risky. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.
3) Reduce how easily scammers can find your information
Scammers often harvest phone numbers and personal details from data broker sites and public profiles. Using a data removal service to remove your information from these sites can make it harder for criminals to target you with job scams and other fraud. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.
4) Research the company independently
Search for the company name online. Look for an official website, verified social media or job listings.
5) Avoid jobs that ask for money
Legitimate employers never require deposits for training, equipment or task access.
6) Block and report the number
You can report scam texts directly from your phone.
On iPhone:
Open the message, tap the phone number at the top of the screen, scroll down and select Block Contact. You can also tap Report Spam under the message. If the option appears, then click Delete and Report Spam, which sends the report to Apple and deletes the message.
On Samsung Galaxy phones:
Steps may vary slightly depending on your Samsung model and software version.
Open the Messages app and select the conversation. Tap the three-dot menu in the upper right corner, then tap Block and report spam, then confirm by tapping Yes. This blocks the number and helps Samsung identify and filter future scam messages.
7) Report it to the FTC
In the United States, you can report scams at reportfraud.ftc.gov. Reports help investigators track large scam networks.
So what should Peter do next?
The safest move is simple. Peter should not reply to the message. Instead, he should block the number and report it as spam. If he has already responded, he should stop communicating immediately and avoid clicking any links or sending money. If he shared personal information such as his phone number, email address or financial details, it may also be wise to monitor his accounts closely and consider signing up for an identity theft protection service. The good news is that spotting the red flags early can prevent a much bigger problem later. See my tips and best picks on Best Identity Theft Protection at Cyberguy.com.
Kurt’s key takeaways
Scammers constantly adapt their tactics. Today, it might be a fake delivery notice. Tomorrow, it might be a high-paying remote job. The message Peter received hits many of the classic warning signs: unrealistic pay, vague job duties, urgent language and a request to reply quickly. When a stranger promises easy money through a random text message, pause for a moment. That short pause can save you a lot of trouble.
Now I am curious. If a text suddenly promised you $10,000 a month for simple online tasks, would you recognize the warning signs before replying? Let us know by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.
Copyright 2026 CyberGuy.com. All rights reserved.
Technology
Halide co-founder is suing former partner Sebastiaan de With for taking source code to Apple
Lux Optics co-founder Sebastiaan de With made headlines when he joined Apple in late January. The company was behind Halide, one of the most popular photography apps for the iPhone, which gained a cult following for its robust pro-level controls.
Apple was apparently a big enough fan that it tried to acquire the developer last summer. Those talks never bore fruit, and eventually the company simply hired de With. At the time, it was widely believed that Apple had poached him from Lux. But new allegations from a lawsuit filed by co-founder Ben Sandofsky in the California Superior Court of Santa Cruz claim de With was fired for financial misconduct in December of 2025.
According to The Information, the suit “accuses de With of improperly using more than $150,000 in Lux corporate funds to pay for personal expenses,” as well as “taking Lux source code and confidential material with him when he joined Apple.”
An attorney for de With denied those claims and said that “The attempt to insert Apple into this dispute appears designed to create leverage and attract attention.“
-
Detroit, MI4 days agoDrummer Brian Pastoria, longtime Detroit music advocate, dies at 68
-
Oklahoma1 week agoFamily rallies around Oklahoma father after head-on crash
-
Nebraska1 week agoWildfire forces immediate evacuation order for Farnam residents
-
Georgia7 days agoHow ICE plans for a detention warehouse pushed a Georgia town to fight back | CNN Politics
-
Alaska1 week agoPolice looking for man considered ‘armed and dangerous’
-
Science1 week agoFederal EPA moves to roll back recent limits on ethylene oxide, a carcinogen
-
Movie Reviews4 days ago‘Youth’ Twitter review: Ken Karunaas impresses audiences; Suraj Venjaramoodu adds charm; music wins praise | – The Times of India
-
World1 week agoThousands march worldwide in solidarity with Palestine, Iran on al-Quds Day