• 🗒️✅ Your Security Checklist
• 🏆🎖️ Test Your Security Skills
• 📰 Your Weekly Security Update
• 🤨 This Should Be on Your Radar 📡
• 🙈 Security Fail of the Week 👎
• 🍎📱 Security Updates from Apple 🍎

If you take nothing else from this newsletter, do these three things to protect yourself:

1. Turn on two-factor authentication wherever possible. You can use the Apple Passwords app to store two-factor authentication codes.
2. Use passkeys for accounts that support them. A passkey allows you to sign into an account using your password manager itself instead of a password.
3. Enable Stolen Device Protection on your iPhone. This useful security feature prevents any changes to your Apple Account and device security settings when you are away from familiar locations.

In case you missed it, be sure to check out our free class on cybersecurity for Apple enthusiasts.

What should you do in the following scenario?

🤔 Let’s say you keep receiving emails that you’re sure are scams, and they all come from the same email address. Should you…

1. Reply to one email with a message that just says “STOP” or “remove me from your list.”
2. Block the email address and mark the messages as junk.
3. Look for a link to unsubscribe at the bottom.
4. Block the email address.

Scroll to the bottom to see how you did!

We’ve all seen frauds on Facebook, Instagram, and Threads. We’ve all seen ads that couldn’t possibly be real, received messages that were obviously fake, and raised our eyebrows at Facebook Marketplace posts. It should be no surprise that Facebook, Instagram, and Threads, which are all owned by Meta, are fighting an epidemic of fraud; but journalists at the Wall Street Journal have gone a step further and made the argument that most online fraud and scams—from post package scams to pig butchering—depend to some degree on Meta’s technologies, and on the company’s unwillingness to invest in sufficient moderators. This is some excellent and engaging journalism, and we recommend you take a look. The Wall Street Journal has the story.

The Bottom Line: If you use Facebook, consider limiting how much personal information you share with the platform and limiting the reach of your posts to only friends. Always exercise caution when communicating with strangers and verify identities with a live video call whenever possible. Never send money without knowing for sure what you’re paying for.

Do You Use Discord? Researchers May Have Captured Your Messages and Published Them Online

Researchers at the University of Finance Minas Gerais in Brazil have compiled a database of over 2 billion Discord messages sent between 2015 to 2024. The messages were scraped from more than 3,000 public Discord servers and have reportedly been anonymized by the team. According to 404 Media, the goal of the team’s project is to allow others to use the database when researching mental health and politics. However, it would appear they broke Discord’s Developer Policy, which prohibits data scraping.

The Bottom Line: This serves as an important reminder that public Discord servers are public and can be accessed by anyone. If you used public Discord servers anytime in the past decade, your messages might be in this database. Once you get used to a messaging platform, it’s easy to forget that it isn’t secure. Instead, we recommend using secure messaging platforms like Signal or WhatsApp.

The UK’s Legal Aid Agency Suffers Cyber Breach

In the UK, if you need a lawyer and can’t afford one, you get one through the Legal Aid Agency. That agency has had a breach, and the agency says that user data from 2010–2024 onward may have been compromised. Those who rely on the agency are often required to submit highly sensitive information as part of their request for legal aid, including the details of alleged crimes, criminal history, financial and employment information, and personal details like their current address. Read more at the AP.

The Bottom Line: If you have relied on the UK’s Legal Aid Agency, then you should review what information you’ve shared with them and take steps to protect yourself if that information were to go up for sale on the dark web. Steps may range from freezing your credit to changing your address, depending on the specific details of your case.

The Secure Messaging App Signal Has Found a Clever Way to Defeat Windows Screen Recording Feature

Microsoft has introduced a Windows 11 feature called Recall that will capture a screenshot on Windows machines every three seconds, then use GenAI to summarize the screenshot so that users can search their past activities in more detail. The resulting data trove of past activity represents a massive privacy and security vulnerability, as any malware in the system would not have to install its own keystroke reader or an activity recorder; it would just have to access records stored by Recall.

The secure messaging app Signal has found a clever workaround to keep your Signal messages out of Recall’s archive, though: they’re using the built-in tool to hide copyrighted material. When you try to take a screenshot of a Disney film or the new Andor Star Wars TV show, the screenshot will end up blank. This is because of a system that protects copyrighted content, and Signal will use that same system to hide your messages in the Signal app from the Recall screen recording feature.

The Bottom Line: You can disable Recall on Windows, and we recommend doing so. Hopefully, others like password managers and banking apps will follow Signal’s rather clever leadership to protect their content as well.

Good News! Messaging App Telegram Cleans House, Shuts Down Criminal Marketplaces

Two of the largest criminal marketplaces to have ever existed have been shut down, and that’s just the start of Telegram’s house-cleaning spree. The messaging app hosted both the Huoine Guarantee and Xinbi Guarantee networks, where black market goods and services could be bought and sold, principally through the cryptocurrency Tether. Huoine Guarantee had an estimated 900,000 users in January of 2025, and facilitated an estimated $25 billion in transactions. Risky Biz has the full story.

The Bottom Line: The disruption to the criminal ecosystem and marketplace is good news and may temporarily result in fewer scams. However, with so much money at stake, the networks are sure to find a new messaging system.

Did a Scene from Stranger Things Really Leak, or Is That a Scam?

Scammers have been targeting Gen Z using episodes of their favorite shows as bait, warns security firm Kaspersky. The scams run a wide range, but follow a simple pattern: post a link that claims to offer early or exclusive access to a popular show’s latest content, but instead of a video, the user will get malware. These scams might be found in Google’s promoted search results, or on Facebook or other social media, but wherever you find them, don’t fall for them. Forbes has the full story.

The Bottom Line: Usually, a scam like this would require you to manually install something on your device—the website can’t install it; you have to. But the website can try to trick you into installing the malware by pretending it’s a video player, or an encoder for their special video format, or something similar. You can protect yourself in a few ways: an adblocker may prevent these malicious posts from ever showing up, so you never get a chance to click them. A DNS cloaking service like NextDNS may prevent the page from loading if you do click a link. Finally, a malware scanner like Malwarebytes might intercept the malware before it’s installed, or help you mitigate an infection. In the end, nothing is better than knowing about the scam in advance and spotting it before you click on anything.

Age Verification May Soon Be Required to Download Apps in Texas

According to Reuters, Texas could be the second state to require app stores to verify user ages before allowing them to download apps or make purchases. The bill, which only requires Governor Abbott’s signature to pass, would require parental consent for users under 18 to install apps. This move appears to be an effort to ban or, at least, limit social media apps for minors, although a separate bill targeting social media specifically has also passed the Texas House of Representatives. Apple and Google both oppose the bill, since it would mean sharing age data with all apps, regardless of intent.

The Bottom Line: If you are in Texas, you may soon be required to verify your age to use the App Store.

Flock Traffic Cameras Used by ICE

Last week, we mentioned the controversial traffic camera company Flock, whose networks of cameras can be installed by a municipality or police force to track the movements of vehicles by their license plate, make, and color. Flock also allows customers to share access to their databases with other municipalities and law enforcement agencies, all without requiring court authorization or a warrant. 404 Media reports that the network is frequently accessed by US Immigration and Customs Enforcement (ICE), who do not police traffic violations.

The Bottom Line: The Electronic Frontiers Foundation maintains the Atlas of Surveillance, a volunteer-supported map of regions known to employ public surveillance technologies, including Flock traffic cameras. You can check to see if those cameras are used in your area, or contribute your own data if their map is incomplete in your area.

A Star Wars Fan Site Was a Front for the CIA

There’s nothing immediately practical about this story, but it’s historically interesting. In the 2010s, the CIA built a bunch of innocuous websites to communicate with their agents. One of these was a Star Wars fan website where agents could enter a password in the search bar to open a secret console for messaging with their case officer. You can still use the Internet Archive’s Wayback Machine to view the website. 404 Media has the full story, with screenshots and links.

Stalkerware Apps Shut Down Following Data Breach

Three “Stalkerware” apps, Cocospy, Spyic, and Spyzie, have been shut down. Stalkerware apps are apps that can be loaded on a phone to spy on the phone’s owner. Legal versions are sold as parental control apps for parents to keep an eye on their children, but the same apps also enable domestic abuse and stalking. They’re not usually found on Apple’s app store, and instead must be installed manually from a third-party app store. On iPhones, most stalkerware apps don’t install on your device. Instead, they usually work by logging in to your Apple Account and accessing the iPhone’s device backups stored in iCloud.

According to TechCrunch, a security researcher discovered that these three apps shared a security flaw that allowed their data to be accessed by anyone and, at the same time, exposed the email addresses of everyone who had signed up to use the apps. The researcher was able to scrape over 3 million emails and uploaded them to Have I Been Pwned. Once this data breach was revealed to the apps, all three have now stopped working, their websites have disappeared, and their cloud storage has been wiped.

The Bottom Line: Cocospy, Spyic, and Spyzie apps mainly affect Android users, so if you have an Android device, you can dial **001** in the phone app and hit the call button. If one of those apps is installed on your device, a “systems” panel will pop up that will include the option to remove the spyware. If you are using an iPhone and you are concerned about stalkerware, you can go into the Settings app > General > iPhone Storage > Hidden Apps to find any apps that are hidden, and also check under Settings > Apple Account and look at the bottom to see a list of devices that are logged in to your Apple ID and remove any devices you don’t recognize.

Malware Authors Infected Their Own Computers

Sixteen alleged authors of a malware service called Danabot have been indicted by the US Department of Justice. The Danabot service specialized in stealing credentials and other identity information. The indictment alleges that many users of Danabot accidentally infected their own computers with their malware—which then stole their credentials and identity information. When law enforcement took control of the servers where the malware was storing all its stolen data, they gained access to that data, and the malware author’s own compromised computers revealed their identities. Krebs On Security has the full story.

The Bottom Line: If you’re going to develop malware, be a chum and go ahead and infect yourself. On behalf of all of us, that would be best. On a more practical level, you can employ a malware scanner such as Malwarebytes to try to catch infostealer malware before it installs and to mitigate infections. This isn’t foolproof, so it’s important to learn to avoid installing infostealer malware by recognizing the strategies of scammers.

Everything you need to know about Apple’s latest software updates.

• The most recent iOS and iPadOS is 18.5
• The most recent macOS is 15.5
• The most recent tvOS is 18.5
• The most recent watchOS is 11.5
• The most recent visionOS is 2.5

The correct answer is B: Block the email address and mark the messages as junk. Here's how to block email addresses on your iPhone, and here’s how to mark emails as junk.

There is far too much security and privacy news to cover it all. When building this newsletter, we look for scams, hacks, trouble, and news to illustrate the kinds of problems Apple enthusiasts may encounter in our private lives, and the self defense we can practice to keep our devices, accounts, and lives secure. Our commentary focuses on practical advice for everyday people. This newsletter was written by Cullen Thomas and Rhett Intriago and edited by Sarah Kingsbury.

In case you missed it, be sure to check out our free class on cybersecurity for Apple enthusiasts.

Interested in keeping your iPhone data private? Check out:

• Protect Your iCloud Data
• Keep Your Web Browsing Activity Private
• Private WiFi Address: What Is It & How to Enable It

If you enjoyed this newsletter, you’ll love all the security content available on iPhone Life Insider!

This premium subscription includes:

• The complete iPhone Life Privacy & Security Course for Apple Enthusiasts and other free online courses taught by expert instructors
• In-depth guides on everything from security to iPhone photography to other Apple devices
• Daily, bite-sized video tips on topics ranging from iCloud security to password management
• A digital subscription to iPhone Life Magazine, where you’ll find articles covering the best security gear, apps, and in-depth how-tos
• The monthly premium iPhone Life Security Newsletter covering everything you need to know to keep your digital life secure
• Access to the ad-free version of the iPhone Life Podcast and exclusive bonus content
• Expert help with all your most pressing Apple Watch questions in our private Ask an Expert Facebook Group

Join the Insider community today and save 30 percent!