A critical balance accounting error in Cosmos EVM enabled attackers to steal millions of dollars across multiple blockchain networks between August 20 and 25.

Related Posts:

• CVE-2026-81934: Redis RCE PoC Exploit Now Public
• CVE-2026-78319: SAUTER Controller RCE Flaw Disclosed
• CVE-2026-82329 Exploited: JFrog Artifactory Admin Takeover

The post Cosmos EVM Flaw Triggers Multi-Chain Heist appeared first on Daily CyberSecurity.

WeedHack malware still targets Minecraft gamers through fake client sites and Minecraft SEO poisoning, McAfee Labs warns.

Related Posts:

• SynkLoader Malware Deploys Multi-Language Attack Tools
• macOS ClickFix Malware Exploits Polygon C2
• Cruciferra Malware Loader Uses ClickFix Lures to Kill EDR

The post WeedHack Malware Still Hits Minecraft Gamers via Fake Sites appeared first on Daily CyberSecurity.

Tel Aviv, Israel, 24th July 2026, CyberNewswire

Kenya is investigating a Kenya cyberattack that temporarily defaced President William Ruto’s official website with an anti-government message and a Bitcoin ransom demand for five bitcoins, reportedly worth about $330,000. The attackers replaced the website’s homepage with the message, displayed a cryptocurrency wallet address and threatened to publish unspecified information about President William Ruto unless the ransom was paid.

The website was hacked on Saturday, July 18, 2026. Following the incident, access to the presidential website was temporarily restricted as authorities began containment, forensic analysis and restoration efforts. According to local media reports, access to the website was restored by Monday.

Kenya Cyberattack Prompts Incident Response

Kenya’s Ministry of Information, Communications and the Digital Economy confirmed that the official website of the President had been affected by a cybersecurity incident.

The ministry said that after the incident was detected, the ICT Authority immediately activated established cybersecurity incident response protocols.

As a precautionary measure, access to the presidential website was temporarily restricted to facilitate containment, forensic analysis and restoration efforts.

The ministry said appropriate mitigation measures had since been implemented and that restoration of the website was underway.

[caption id="attachment_113245" align="aligncenter" width="600"] Source: Kenya’s Ministry of Information, Communications and the Digital Economy[/caption]

At the time of the statement, the government said there was no evidence of unauthorized access to sensitive data, data exfiltration or loss of information. It also stated that government systems and digital services remained secure and operational.

The ICT Authority is working with relevant government agencies and technical partners to conduct a comprehensive forensic investigation and establish the full circumstances surrounding the incident.

Kenya President William Ruto Cyberattack Investigation

The Kenya President William Ruto cyberattack involved the defacement of the president’s official website. The attackers replaced the homepage with an anti-government message, displayed a cryptocurrency wallet address and demanded five bitcoins.

The attackers also threatened to publish unspecified information about President William Ruto if the ransom was not paid.

The government has not reported evidence of unauthorized access to sensitive data or data exfiltration. The ongoing forensic investigation is expected to establish the circumstances surrounding the incident and determine the extent of the attack.

Kenya Government Website Hack Follows Earlier Incidents

The latest Kenya government website hack follows previous cyber incidents involving government digital services and websites.

In July 2023, Kenya’s eCitizen platform, which is used for dozens of public services, was disrupted by a cyberattack. The incident affected agencies including the National Transport and Safety Authority and Kenya Power.

On November 17, 2025, hackers launched a coordinated attack on several government websites, including the presidency’s portal. The websites were temporarily knocked offline, while some pages were replaced with extremist messages.

According to the information provided by local media, the government later blamed a group calling itself PCP@Kenya, restored the affected platforms and promised stronger cyber defences.

Bitcoin Ransom Demand Targets Presidential Website

The latest incident involved a Bitcoin ransom demand for five bitcoins, reportedly valued at approximately $330,000. The attackers displayed a cryptocurrency wallet address and threatened to release unspecified information about the president.

It remains unclear from the available information whether the attackers accessed systems or data beyond the presidential website. The Kenyan government has said there is currently no evidence of unauthorized access to sensitive data, data exfiltration or loss of information.

The ICT Authority and relevant government agencies are continuing their forensic investigation to establish how the incident occurred and determine the full circumstances surrounding the Kenya cyberattack.

Boston, Massachusetts, 30th June 2026, CyberNewswire

A government website in northern India was taken offline after unidentified hackers allegedly gained unauthorized access and replaced its homepage with pro-Pakistan messages and slogans. The MDA hack targeted the official website of the Meerut Development Authority, a government agency responsible for urban development in the Indian state of Uttar Pradesh. Authorities discovered the breach on Saturday and immediately disabled public access to the website while technical teams worked to contain the incident and restore services. Instead of the agency's usual information on urban planning, housing, and public services, visitors encountered a black screen displaying objectionable content and political messaging. Instead of the usual information on urban planning and public services, visitors to the government portal were greeted by a black screen displaying objectionable content. 

MDA Hack Forces Website Offline 

Following the discovery of the MDA hack, officials initiated emergency response measures to secure the affected systems and prevent further unauthorized access. The website was placed under maintenance as cybersecurity teams began assessing the extent of the compromise. Authorities are also investigating whether the MDA hack affected any internal systems or data beyond the publicly visible website. The website remains offline while authorities continue working to bring it back online safely. Officials are also assessing the extent of the cyberattack and whether any additional systems or data may have been compromised during the incident. 

Police Register Case After Hackers Deface Website 

Law enforcement agencies have opened an investigation after local officials confirmed that the MDA hack had compromised the government website. Police are working alongside cybersecurity specialists to determine how the attackers gained access, identify the techniques used during the intrusion, and trace those responsible. Investigators are expected to examine server logs and other digital evidence to establish the origin and scope of the cyberattack. Officials have not disclosed whether the MDA hack resulted from an exploited software vulnerability, compromised credentials, or another attack method.

Investigation Underway Into Pro-Pakistan Website Defacement 

Investigators are working to identify the individuals or group responsible for displaying the pro-Pakistan messages on the MDA website. Law enforcement agencies are expected to rely on digital forensic experts to examine server logs, identify the attack methods used by the hackers, and collect evidence that could help establish the origin of the cyberattack.  Officials have not yet disclosed whether the attackers gained access through a technical vulnerability or another method. The investigation is expected to determine the full scope of the breach and recommend measures to prevent similar incidents in the future.

Why the MDA Hack Raises Security Concerns 

The Meerut Development Authority is a statutory body responsible for the planned development of Meerut and the surrounding areas in Uttar Pradesh. Its responsibilities include land acquisition, infrastructure development, housing projects, and urban planning initiatives. As a public-facing government agency, its website serves as an important source of information for residents and stakeholders.  The MDA hack highlights the risks associated with cyberattacks targeting government institutions. Websites operated by public authorities often contain sensitive information and play a critical role in delivering services and official updates. A successful breach not only disrupts these services but can also be used to spread propaganda, as seen in this case with the appearance of pro-Pakistan content on the homepage.  Such incidents can undermine public confidence in government digital platforms and reinforce the need for stronger cybersecurity practices across public institutions. 

Authorities Focus on Strengthening Cybersecurity 

Officials have stated that restoring the website is only one part of the response. Alongside recovery efforts, authorities are reviewing security measures to reinforce the MDA's digital infrastructure against future attacks by hackers.  The investigation is expected to provide insights into the techniques used during the cyberattack and help authorities implement stronger safeguards. The police have assured the public that all necessary steps are being taken to resolve the matter promptly and identify those responsible for the MDA hack. 

An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States today, after a cybercrime group defaced the service’s login page with a ransom demand that threatened to leak data from 275 million students and faculty across nearly 9,000 educational institutions.

Canvas parent firm Instructure responded to today’s defacement attacks by disabling the platform, which is used by thousands of schools, universities and businesses to manage coursework and assignments, and to communicate with students.

Instructure acknowledged a data breach earlier this week, after the cybercrime group ShinyHunters claimed responsibility and said they would leak data on tens of millions of students and faculty unless paid a ransom. The stated deadline for payment was initially set at May 6, but it was later pushed back to May 12.

In a statement on May 6, Instructure said the investigation so far shows the stolen information includes “certain identifying information of users at affected institutions, such as names, email addresses, and student ID numbers, as well as as messages among users.” The company said it found no evidence the breached data included more sensitive information, such as passwords, dates of birth, government identifiers or financial information.

The May 6 update stated that Canvas was fully operational, and that Instructure was not seeing any ongoing unauthorized activity on their platform. “At this stage, we believe the incident has been contained,” Instructure wrote.

However, by mid-day on Thursday, May 7, students and faculty at dozens of schools and universities were flooding social media sites with comments saying that a ransom demand from ShinyHunters had replaced the usual Canvas login page. Instructure responded by pulling Canvas offline and replacing the portal with the message, “Canvas is currently undergoing scheduled maintenance. Check back soon.”

“We anticipate being up soon, and will provide updates as soon as possible,” reads the current message on Instructure’s status page.

While the data stolen by ShinyHunters may or may not contain particularly sensitive information (ShinyHunters claims it includes several billion private messages among students and teachers, as well as names, phone numbers and email addresses), this attack could hardly have come at a worse time for Instructure: Many of the affected schools and universities are in the middle of final exams, and a prolonged outage could be highly damaging for the company.

The extortion message that greeted countless Canvas users today advised the affected schools to negotiate their own ransom payments to prevent the publication of their data — regardless of whether Instructure decides to pay.

“ShinyHunters has breached Instructure (again),” the extortion message read. “Instead of contacting us to resolve it they ignored us and did some ‘security patches.'”

A source close to the investigation who was not authorized to speak to the press told KrebsOnSecurity that a number of universities have already approached the cybercrime group about paying. The same source also pointed out that the ShinyHunters data leak blog no longer lists Instructure among its current extortion victims, and that the samples of data stolen from Canvas customers were removed as well. Data extortion groups like ShinyHunters will typically only remove victims from their leak sites after receiving an extortion payment or after a victim agrees to negotiate.

Dipan Mann, founder and CEO of the security firm Cloudskope, slammed Instructure for referring to today’s outage as a “scheduled maintenance” event on its status page. Mann said Shiny Hunters first demonstrated they’d breached Instructure on May 1, prompting Instructure’s Chief Information Security Officer Steve Proud to declare the following day that the incident had been contained. But Mann said today’s attack is at least the third time in the past eight months that Instructure has been breached by ShinyHunters.

In a blog post today, Mann noted that in September 2025, ShinyHunters released thousands of internal University of Pennsylvania files — donor records, internal memos, and other confidential materials — through what the Daily Pennsylvanian and other outlets later determined was, in part, a Canvas/Instructure-mediated access path.

“Penn was the named victim,” Mann wrote. “Instructure was the mechanism. The incident was treated as a Penn-specific story by most of the national press and quietly handled by Instructure as a customer-specific matter. That framing was wrong then. It is dramatically more wrong in light of the May 2026 events, which now look like the planned escalation of an attack pattern that ShinyHunters had been working against Instructure’s environment for at least eight months prior. The September 2025 Penn breach was the proof of concept. The May 1, 2026 incident was the production run. The May 7, 2026 recompromise was ShinyHunters demonstrating publicly that the May 2 ‘containment’ did not happen.”

In February, a ShinyHunters spokesperson told The Daily Pennsylvanian that Penn failed to pay a $1 million ransom demand. On March 5, ShinyHunters published 461 megabytes worth of data stolen from Penn, including thousands of files such as donor records and internal memos.

ShinyHunters is a prolific and fluid cybercriminal group that specializes in data theft and extortion. They typically gain access to companies through voice phishing and social engineering attacks that often involve impersonating IT personnel or other trusted members of a targeted organization.

Last month, ShinyHunters relieved the home security giant ADT of personal information on 5.5 million customers. The extortion group told BleepingComputer they breached the company by compromising an employee’s Okta single sign-on account in a voice phishing attack that enabled access to ADT’s Salesforce instance. BleepingComputer says ShinyHunters recently has taken credit for a number of extortion attacks against high-profile organizations, including Medtronic, Rockstar Games, McGraw Hill, 7-Eleven and the cruise line operator Carnival.

The attack on Canvas customers is just one of several major cybercrime campaigns being launched by ShinyHunters at the moment, said Charles Carmakal, chief technology officer at the Google-owned Mandiant Consulting. Carmakal declined to comment specifically on the Canvas breach, but said “there are multiple concurrent and discrete ShinyHunters intrusion and extortion campaigns happening right now.”

Cloudskope’s Mann said what happens next depends largely on whether Instructure’s customers — the universities, K-12 districts, and education ministries paying for Canvas — choose to apply pressure or absorb the breach quietly.

“The history of education-vendor incidents suggests the path of least resistance is the second one,” he concluded.

Update, May 8, 11:05 a.m. ET: Instructure has published an incident update page that includes more information about the breach. Instructure said its Canvas portal is functioning normally again, and that the hackers exploited an issue related to Free-for-Teacher accounts.

“This is the same issue that led to the unauthorized access the prior week,” Instructure wrote. “As a result, we have made the difficult decision to temporarily shut down Free-for-Teacher accounts. These accounts have been a core part of our platform, and we’re committed to resolving the issues with these accounts.”

Instructure said affected organizations were notified on May 6.

“If your organization is affected, Instructure will contact your organization’s primary contacts directly,” the update states. “Please don’t rely on third-party lists or social media posts naming potentially affected organizations as those lists aren’t verified. Instructure will confirm validated information through direct outreach to all affected organizations.”

Update, May 11, 10:16 p.m. ET: Instructure posted an update saying they paid their extortionists in exchange for a promise to destroy the stolen data. “The data was returned to us,” the update reads. “We received digital confirmation of data destruction (shred logs). We have been informed that no Instructure customers will be extorted as a result of this incident, publicly or otherwise.”

A hacktivist group with links to Iran’s intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports out of Ireland, Stryker’s largest hub outside of the United States, said the company sent home more than 5,000 workers there today. Meanwhile, a voicemail message at Stryker’s main U.S. headquarters says the company is currently experiencing a building emergency.

Based in Kalamazoo, Michigan, Stryker [NYSE:SYK] is a medical and surgical equipment maker that reported $25 billion in global sales last year. In a lengthy statement posted to Telegram, a hacktivist group known as Handala (a.k.a. Handala Hack Team) claimed that Stryker’s offices in 79 countries have been forced to shut down after the group erased data from more than 200,000 systems, servers and mobile devices.

“All the acquired data is now in the hands of the free people of the world, ready to be used for the true advancement of humanity and the exposure of injustice and corruption,” a portion of the Handala statement reads.

The group said the wiper attack was in retaliation for a Feb. 28 missile strike that hit an Iranian school and killed at least 175 people, most of them children. The New York Times reports today that an ongoing military investigation has determined the United States is responsible for the deadly Tomahawk missile strike.

Handala was one of several hacker groups recently profiled by Palo Alto Networks, which links it to Iran’s Ministry of Intelligence and Security (MOIS). Palo Alto says Handala surfaced in late 2023 and is assessed as one of several online personas maintained by Void Manticore, a MOIS-affiliated actor.

Stryker’s website says the company has 56,000 employees in 61 countries. A phone call placed Wednesday morning to the media line at Stryker’s Michigan headquarters sent this author to a voicemail message that stated, “We are currently experiencing a building emergency. Please try your call again later.”

A report Wednesday morning from the Irish Examiner said Stryker staff are now communicating via WhatsApp for any updates on when they can return to work. The story quoted an unnamed employee saying anything connected to the network is down, and that “anyone with Microsoft Outlook on their personal phones had their devices wiped.”

“Multiple sources have said that systems in the Cork headquarters have been ‘shut down’ and that Stryker devices held by employees have been wiped out,” the Examiner reported. “The login pages coming up on these devices have been defaced with the Handala logo.”

Wiper attacks usually involve malicious software designed to overwrite any existing data on infected devices. But a trusted source with knowledge of the attack who spoke on condition of anonymity told KrebsOnSecurity the perpetrators in this case appear to have used a Microsoft service called Microsoft Intune to issue a ‘remote wipe’ command against all connected devices.

Intune is a cloud-based solution built for IT teams to enforce security and data compliance policies, and it provides a single, web-based administrative console to monitor and control devices regardless of location. The Intune connection is supported by this Reddit discussion on the Stryker outage, where several users who claimed to be Stryker employees said they were told to uninstall Intune urgently.

Palo Alto says Handala’s hack-and-leak activity is primarily focused on Israel, with occasional targeting outside that scope when it serves a specific agenda. The security firm said Handala also has taken credit for recent attacks against fuel systems in Jordan and an Israeli energy exploration company.

“Recent observed activities are opportunistic and ‘quick and dirty,’ with a noticeable focus on supply-chain footholds (e.g., IT/service providers) to reach downstream victims, followed by ‘proof’ posts to amplify credibility and intimidate targets,” Palo Alto researchers wrote.

The Handala manifesto posted to Telegram referred to Stryker as a “Zionist-rooted corporation,” which may be a reference to the company’s 2019 acquisition of the Israeli company OrthoSpace.

Stryker is a major supplier of medical devices, and the ongoing attack is already affecting healthcare providers. One healthcare professional at a major university medical system in the United States told KrebsOnSecurity they are currently unable to order surgical supplies that they normally source through Stryker.

“This is a real-world supply chain attack,” the expert said, who asked to remain anonymous because they were not authorized to speak to the press. “Pretty much every hospital in the U.S. that performs surgeries uses their supplies.”

John Riggi, national advisor for the American Hospital Association (AHA), said the AHA is not aware of any supply-chain disruptions as of yet.

“We are aware of reports of the cyber attack against Stryker and are actively exchanging information with the hospital field and the federal government to understand the nature of the threat and assess any impact to hospital operations,” Riggi said in an email. “As of this time, we are not aware of any direct impacts or disruptions to U.S. hospitals as a result of this attack. That may change as hospitals evaluate services, technology and supply chain related to Stryker and if the duration of the attack extends.”

According to a March 11 memo from the state of Maryland’s Institute for Emergency Medical Services Systems, Stryker indicated that some of their computer systems have been impacted by a “global network disruption.” The memo indicates that in response to the attack, a number of hospitals have opted to disconnect from Stryker’s various online services, including LifeNet, which allows paramedics to transmit EKGs to emergency physicians so that heart attack patients can expedite their treatment when they arrive at the hospital.

“As a precaution, some hospitals have temporarily suspended their connection to Stryker systems, including LIFENET, while others have maintained the connection,” wrote Timothy Chizmar, the state’s EMS medical director. “The Maryland Medical Protocols for EMS requires ECG transmission for patients with acute coronary syndrome (or STEMI). However, if you are unable to transmit a 12 Lead ECG to a receiving hospital, you should initiate radio consultation and describe the findings on the ECG.”

This is a developing story. Updates will be noted with a timestamp.

Update, 2:54 p.m. ET: Added comment from Riggi and perspectives on this attack’s potential to turn into a supply-chain problem for the healthcare system.

Update, Mar. 12, 7:59 a.m. ET: Added information about the outage affecting Stryker’s online services.

The FBI, CISA, and NSA reportedly are investigating the hack by an unnamed "sophisticated" actor of a FBI surveillance system that holds sensitive information. The breach carries the hallmarks of Chinese nation-state groups and comes amid concerns about attacks in the wake of the war against Iran and the shrinking of the federal cybersecurity apparatus.

The post FBI is Investigating the ‘Sophisticated’ Hack of Its Surveillance System appeared first on Security Boulevard.

“My phone’s been hacked!” These are words you never want to hear or say. Ever. You are not alone in this sentiment.

Our phones have become the central hub of our lives, storing everything from personal and financial information, access to payment apps, files, photos, and contacts. This has made our phones irresistible, prized targets for cyber criminals. And because these devices are always on and always with us, the opportunity for attack is constant. What are the signs that you have been hacked and how can you reclaim your control? This guide walks you through the common indicators of a hacked phone and what steps you can take to protect your data and privacy.

What is phone hacking and how does it work?

Phone hacking is the unauthorized access and control of your smartphone and its data. It can happen to any person and any device, whether it’s an iPhone or an Android. To achieve this, cybercriminals—also called hackers—use various types of malicious software, sometimes called malware, such as:

• Spyware, which secretly tracks your every move
• Adware, which bombards your device with pop-up ads
• Ransomware, which locks your files until you pay a fee 

These attacks are typically motivated by financial gain, such as stealing banking credentials, or by a desire to monitor someone’s personal life. 

The cost of phone hacking to you

Phone hacking isn’t just a technical or convenience issue. It has real and often costly consequences for your personal life, finances, and privacy. Here, we list the kinds of losses you might face with a hacked phone:

• Financial loss: Hackers can access banking apps to drain your accounts, steal credit card information for fraudulent purchases, or use your phone to subscribe to premium services without your consent.
• Identity theft: Cybercriminals can steal personal information from your device, such as your social security number, passwords, and photos—to open new accounts or commit crimes in your name.
• Severe privacy invasion: Through spyware, an attacker can turn on your phone’s camera and microphone to secretly record you, track your location in real-time, and read all your private messages.
• Emotional and reputational damage: The stress of being hacked is significant. A criminal could use your accounts to impersonate you, spread misinformation or damage your relationships with family, friends, and colleagues.

The consequences of a hacked phone go far beyond inconvenience. This is why it is so critical to stay alert for the warning signs of a compromise and know exactly what to do if your phone is hacked.

Common ways hackers gain access to your smartphone

The unfortunate reality is that anyone’s phone can be targeted and successfully hacked. Cybercriminals have developed several sophisticated methods that allow them to remotely take over your device. These tactics are done mainly by surreptitiously installing malicious software or malware, monitoring calls and messages, stealing personal information, or even taking over your various accounts. Here are detailed explanations for each hacking method:

• Malicious apps: Malware can be disguised as legitimate applications, such as games and utility tools, available on unofficial third-party app stores. Once installed, it can steal data, track your location, or install more malware. Always be cautious of apps that ask for permissions that exceed their intended function, such as a calculator app requesting access to your contacts.
• Visiting malicious websites: Visiting a compromised website on your phone could infect it with malware through a drive-by download which automatically installs malicious software, scripts that exploit your phone’s operating system vulnerabilities, or pop-ups or ads that trick you into authorizing a download, often disguised as a software update or a prize notification. 
• Phishing or smishing: You might receive a text message (SMS) or email that appears to be from a trusted source, like your bank or a delivery service. These messages contain links that lead to fake websites designed to trick you into entering your passwords or personal information. A common example is a text claiming there’s a problem with a package delivery, urging you to click a link to reschedule.
• Unsecured public Wi-Fi: When you connect to a free, public Wi-Fi network at a café, airport, or hotel without protection, your data can be vulnerable. Hackers on the same network can intercept the information you send, including passwords and credit card details. Using a virtual private network (VPN) protects you on public networks.
• SIM swapping: This sophisticated scam involves a hacker impersonating you and convincing your mobile carrier to transfer your phone number to a new SIM card they control. Once they have your number, they can intercept calls and texts, including two-factor authentication codes, allowing them to take over your online accounts.
• Juice-jacking: Cybercriminals can modify public USB charging stations to install malware onto your phone while it charges. This technique can steal sensitive data from your phone. It’s always safer to use your own AC power adapter and a wall outlet.
• Outdated operating systems: Hackers actively search for security holes in older versions of iOS and Android. Installing the latest security updates for your phone’s operating system locks the doors to malware as these updates contain critical patches that protect you from newly discovered threats.

12 signs your phone was hacked

To be certain that your phone has been hacked, here are some signs you should consider. Note that these might be signs of a hacked phone, yet not always. 

1. More popups than usual: Phones hit with adware will be bombarded with pop-up ads. Never tap or click on them, as they might take you to pages designed to steal personal information.
2. Data spikes or unknown call charges: A hacker is likely using your phone to transfer data, make purchases, send messages, or make calls via your phone. 
3. Issues with online accounts: Spyware might have stolen your account credentials, then transmitted them to the hacker, leading to credit and debit fraud. In some cases, hackers will change the password and lock out the device owner.
4. Unexpected battery drain: Your phone’s battery dies much faster than usual because hidden malware is constantly running in the background.
5. Sluggish performance: Your device freezes, crashes, or lags significantly as malicious software consumes its processing power and memory.
6. Unfamiliar apps or messages: You discover apps you never installed or see outgoing calls and texts you didn’t make, indicating unauthorized use.
7. Phone overheats while idle: Your device feels unusually warm even when you’re not using it, a sign of malware overworking the processor.
8. Random reboots or shutdowns: The phone restarts on its own, which could be caused by conflicting malicious code or a hacker remotely controlling it.
9. Camera or mic activates unexpectedly: Someone may be spying on you when the camera or microphone indicator light turns on when you aren’t using it.
10. Websites look different: Pages you visit look unusual or frequently redirect you to spammy sites, indicating your web traffic is being hijacked.
11. Unauthorized 2FA requests: You receive notifications for two-factor authentication codes you didn’t request, a strong signal that someone has your password and is trying to access your accounts.
12. Inability to shut down properly: Your phone resists being turned off or fails to shut down completely, as malware may be designed to keep it running. 

If you see several of these signs, it’s crucial to take immediate action to secure your device and data.

Clarifying misconceptions about phone hacking

Ultimately, the biggest factor in security is user behavior. Regardless of whether you use Android or iOS, practising safe habits—like avoiding suspicious links, using strong passwords, and keeping your operating system updated—is the most critical defense against having your phone hacked.

What’s easier to hack: Android or iPhone?

This is a long-standing debate, and the truth is that both platforms can be hacked. Android’s open-source nature and accommodation of third-party sources apps create more potential vulnerabilities. Additionally, security updates can sometimes be delayed depending on the device manufacturer. iPhones, while generally more secure, can be vulnerable if a user jailbreaks the device or falls victim to phishing and other social engineering scams.

Can answering a phone call get you hacked?

Simply answering a phone call cannot install malware on a modern, updated smartphone. The real danger comes from social engineering, where the caller will convince you into taking an action that compromises your security such as giving your personal information or installing something yourself. This is often called vishing or voice phishing.

Can your phone camera be hacked?

Yes, your phone’s camera and microphone can be hacked, a process known as camfecting. This is typically done using spyware hidden in malicious apps disguised as legitimate software that you may have been tricked into installing. Signs of a compromised camera include the indicator light turning on unexpectedly, finding photos or videos in your gallery that you didn’t take, or experiencing unusually high battery drain.

Can a phone be hacked when turned off?

When your phone is completely powered down, its network connections and most of its hardware are inactive, making it impossible to be actively hacked over the internet. However, some modern smartphones have features that remain active even when the device seems off, like the location tracker. Sophisticated, state-level spyware like Pegasus are also theoretically capable of attacking a device’s firmware even while turned off. 

Hacking off a hacker: A step-by-step recovery guide 

Sometimes you are fortunate enough to catch the hacking attempt while it is in progress, such as during a vishing incident. When this happens, you can take these immediate steps to thwart the hacker before, during and after:

• Use call screening and blocking: Enable your carrier’s spam call filtering services and manually block any suspicious numbers that call you.
• Never share one-time codes: Legitimate companies will never call you to ask for a password, PIN, or two-factor authentication (2FA) code. Treat any such request as a scam.
• Hang up and verify independently: If you receive a suspicious call, hang up immediately. Find the official phone number for the company online and call them directly.

Discovering that your phone has been hacked can be alarming, but acting quickly can help minimize the damage and restore your privacy. Here are the actions to take to regain control and protect your personal information:

1. Back up essential data: Before taking any action, save your irreplaceable data such as photos, contacts, and important documents to a cloud service or computer. Do not back up applications or system data, as these may be infected.
2. Disconnect immediately: The first step is to restart your phone in Safe Mode (for Android) or Recovery Mode (for iPhone). This cuts off its connection to Wi-Fi and cellular networks, preventing the hacker from sending or receiving more data.
3. Run a security scan: Use a trusted mobile security app, like McAfee Mobile Security to scan your device. It’s designed to find and remove malware that may be hiding on your phone.
4. Delete suspicious apps and files: Manually go through your applications and delete anything you don’t remember installing or that looks unfamiliar. Check your downloads folder for suspicious files and delete those as well.
5. Clear browser cache and data: Malicious code could be stored in your browser’s cache. Go into your browser settings and clear all history, cookies, and cached data to remove lingering threats.
6. Change your passwords: From a separate, uninfected device, change the passwords for your critical accounts, including email, banking, and social media. Use a password manager to create and store strong, unique passwords for each account. Enable 2FA where possible for added security. 
7. Secure your accounts: Review recent activity on your online accounts for any unauthorized transactions or messages. Have your bank accounts frozen and request new cards and credentials.
8. Update your operating system: Check for and install the latest OS update for your device. These updates often contain critical security patches that can fix the vulnerability the hacker exploited in the first place.
9. Perform a full shutdown when needed, disable always-on location features if you’re concerned.
10. Perform a factory reset: If the issues persist, a factory reset is your most effective —and last—option. Once you have backed up files, resetting is a straightforward process and will completely remove any lingering malware.
11. Verify backups before restoring: After cleaning your device or a factory reset, be cautious when restoring data. Ensure your backup is from a date before the hacking occurred to avoid reinfecting your phone. Restore only essential data and manually reinstall apps only from official app stores.
12. Notify your contacts and authorities: Let your contacts know your phone was hacked so they can be wary of strange messages from your number. If you suspect identity theft or financial fraud, report it to the relevant authorities and your financial institutions immediately.

Future-proof your phone from hacks

• Set a SIM PIN: Add a personal identification number to your SIM card through your phone’s settings. This prevents a fraudster from using your SIM in another device to execute a SIM swap attack.
• Enable automatic security updates: Ensure your phone is set to automatically download and install OS updates. These patches often fix critical security vulnerabilities that hackers actively exploit.
• Use encrypted DNS: Enable the Private DNS feature on Android or an equivalent app on iOS to encrypt your web traffic lookups. This prevents eavesdroppers on public Wi-Fi from seeing which websites you visit.
• Disable developer options and USB debugging: These settings are for app developers and can create security backdoors if left on. Turn them off in your phone’s settings unless you have a specific need for them.

Protective measures to take in the first place

Applying security measures the moment you bring home your brand new phone helps to keep your phone from getting hacked in the first place. It only takes a few minutes. Follow these tips to find yourself much safer from the start:  

1. Install trusted security software immediately. You’ve adopted this good habit on your desktops and laptops. Your phones? Not so much. Online protection software gives you the first line of defense against attacks, and more.
2. Go with a VPN. Make a public network safe by deploying a virtual private network, which serves as your Wi-Fi hotspot.  It will encrypt your data to keep you safe from advertisers and prying eyes.
3. Use a password manager. Strong, unique passwords offer another primary line of defense. Try a password manager that can create and safely store them. 
4. Avoid public charging stations. Look into a portable power pack that you can charge up ahead of time or run on AA batteries. They’re pretty inexpensive and are a safer alternative to public charging stations.  
5. Keep your eyes on your phone. Preventing the actual theft of your phone is important. This is a good case for password or PIN protecting your phone, and turning on device tracking. In case it is stolen, Apple and Google provide a step-by-step guide for remotely wiping devices.  
6. Stick with trusted app stores. Stick with legitimate app stores like Google Play and Apple’s App Store, which vet apps to ensure they are safe.
7. Keep an eye on app permissions. Check what permissions your apps are asking for. Both iPhone and Android users can allow or revoke app permission.
8. Update your phone’s operating system. Keeping your phone’s operating system up to date can fix vulnerabilities that hackers rely on to pull off attacks—it’s another tried and true method to keep your phone safe and performing well.

Advanced ways to block hackers from your phone

• Enable a SIM Card PIN: Set up a PIN for your SIM card to prevent hackers from using it in another phone for a SIM swap attack, which requires the PIN upon restart.
• Use an eSIM if possible: An embedded SIM (eSIM) cannot be physically removed from your phone, making it difficult for criminals to execute a fraudulent SIM swap.
• Enforce encrypted DNS: Configure your phone to use DNS-over-HTTPS (DoH), which encrypts your DNS queries, preventing eavesdroppers on public Wi-Fi from seeing which websites you visit.
• Deploy a hardware security key: For the ultimate 2FA protection, a physical key (like a YubiKey) for sensitive accounts makes it nearly impossible for hackers to log in without it.
• Disable USB debugging and developer mode: Unless you are an app developer, keep these advanced Android features off to close potential backdoors that malware could exploit.
• Turn off unused wireless radios: Manually disable Wi-Fi, Bluetooth, and NFC when you aren’t using them to reduce your phone’s attack surface and prevent unauthorized connections.

Stay proactive with mobile security

Protecting your phone from hackers doesn’t have to be overwhelming. By remaining vigilant for the warning signs, keeping your software updated, and using trusted security tools, you can significantly reduce your risk of getting your phone infiltrated. Think of your digital security as an ongoing practice, not a one-time fix. 

Mobile security solutions like McAfee Mobile Security are specifically designed to scan your device for malware, spyware, and other malicious code. Key features to look for in a quality security app include real-time antivirus protection, web protection to block dangerous websites, and privacy monitoring to check which apps have access to your personal data. McAfee Mobile Security also offers award-winning antivirus, real-time malware scanning to stop malicious apps before they can cause harm. The included Secure VPN encrypts your connection, making public Wi-Fi safe for browsing and banking. With features like Identity Monitoring to alert you if your details are found on the dark web and Safe Browsing to block risky websites, you’re protected from multiple angles. 

Be very cautious of fake anti-hack apps; these could be scams that can install malware themselves. To be safe, always download security software from reputable providers through official channels like the Google Play Store or Apple’s App Store.

The post How to Know If Your Phone Has Been Hacked appeared first on McAfee Blog.