IoT and Stolen Cars: Thieves May Use Tech to Grab Your Ride

The 10 Most Stolen Vehicles in America in 2025

Vehicle theft declined in the United States in 2025, but several models remained frequent targets because of their popularity, availability, and persistent appeal to thieves (National Insurance Crime Bureau [NICB], 2025; Car and Driver, 2026). According to NICB data, the most stolen vehicle in America in 2025 was the Hyundai Elantra, followed by the Honda Accord and the Hyundai Sonata (NICB, 2025; Car and Driver, 2026).
Ranked Vehicles 

 

The 10 most stolen vehicles in America in 2025 were the following:

• Hyundai Elantra (21,732)
• Honda Accord (17,797)
• Hyundai Sonata (17,687)
• Chevrolet Silverado 1500 (16,764)Honda Civic (12,725)
• Kia Optima (11,521)
• Ford F-150 (10,102)
• Toyota Camry (9,833)
• Honda CR-V (9,809)
• Nissan Altima (8,445)

 

Theft Trends

NICB reported that U.S. vehicle thefts experienced a decline in 2025, yet the same report still identified specific models that were stolen far more often than others. NICB specifically stated that the Hyundai Elantra remained the most stolen vehicle model in 2025 with 21,732 thefts, followed by the Honda Accord with 17,797 thefts and the Hyundai Sonata with 17,687 thefts (NICB, 2025).

Car and Driver’s report on the NICB figures confirms the same ranking and shows that the list included a mix of sedans, pickups, and one SUV, suggesting that theft risk in 2025 was not limited to one body style or market segment (Car and Driver, 2026). The presence of the Chevrolet Silverado 1500 and Ford F-150 on the same list as the Honda Civic, Toyota Camry, and Nissan Altima shows that both high-volume passenger cars and high-demand trucks remained attractive targets (Car and Driver, 2026). 

Internet of Things

Modern connected vehicles increasingly function like Internet of Things systems because they rely on wireless connectivity, cloud services, software-driven features, and communication between in-vehicle components and outside networks (Trend Micro, 2021). Trend Micro explains that connected cars use technologies such as 5G, cloud-connected applications, over-the-air updates, and vehicle-to-network communication, all of which expand what vehicles can do while also increasing cybersecurity exposure (Trend Micro, 2021).

Trend Micro also notes that the modern connected car is becoming similar to a “smartphone-on-wheels,” with applications communicating through middleware, gateway electronic control units, and cloud services. These systems can introduce risks such as denial-of-service attacks, man-in-the-middle attacks, hijacking of services, data privacy issues, authentication and management issues, incorrect data, and misconfiguration problems (Trend Micro, 2021). As the costs and resale values for car computers, collision avoidance systems, and other tech devices increase, thieves now also disassemble vehicles to steal those items.

Radio frequency interception and transmission devices are sometimes used to capture the codes transmitted by key fobs on some vehicles. The codes are then used to reprogram devices that the thieves emply to unlock, start, and steal a vehicle. 

This means connected technology can create additional pathways that thieves or cybercriminals may try to exploit. If remote services, app connections, or cloud-linked vehicle functions are not properly secured, the same connectivity designed for convenience may also increase opportunities for unauthorized access or interference (Trend Micro, 2021). 

Prevention Methods

NICB advises vehicle owners to use layered theft-prevention practices rather than relying on a single measure. Its prevention guidance recommends removing keys or fobs from the vehicle, locking doors and windows, parking in well-lit areas, and using anti-theft technology such as steering wheel locks, audible alarms, and aftermarket tracking devices (NICB, n.d.).

These recommendations support the use of steering wheel locking devices, alarm systems, and location-tracking tools as practical deterrents. They also fit well with additional protective measures such as ignition kill switches or fuel-system shutoff devices, which are commonly used to make a stolen vehicle harder to start or move, although the verified NICB source specifically highlights locks, alarms, and tracking devices rather than detailing those other devices individually (NICB, n.d.).

For connected vehicles, owners must  recognize that digital security matters alongside physical security. Because connected cars increasingly depend on cloud services, APIs, and networked vehicle systems, keeping manufacturer software current and treating app-based vehicle access cautiously are sensible precautions consistent with the risks described by Trend Micro (Trend Micro, 2021). 

References

Car and Driver. (2026, March 23). What cars were stolen most last year? The top 10 may surprise you. https://www.caranddriver.com/news/a70833130/top-10-most-stolen-cars-2025/

National Insurance Crime Bureau. (2025). U.S. vehicle thefts experience historic decline. https://www.nicb.org/news/news-releases/us-vehicle-thefts-experience-historic-decline

National Insurance Crime Bureau. (n.d.). Prevent vehicle theft. https://www.nicb.org/prevent-vehicle-theft

Trend Micro. (2021, February 15). Connected cars, 5G, the cloud: Opportunities and risks. https://www.trendmicro.com/en_us/research/21/b/connected-cars-5g-the-cloud-opportunities-and-risks.html

IoT Devices: A Growing Security Challenge

Internet of Things (IoT) devices are central to how organizations deliver services and manage infrastructure. As devices proliferate, they expand the digital attack surface. 

Data from Verizon’s 2024 Mobile Security Index report indicates that 70% of public sector respondents said their organization had experienced a security incident involving a mobile or IoT device (Verizon, 2024). These endpoints are no longer peripheral risks—they are often at the center of modern cyber incidents.

Even organizations that have not yet experienced a known incident face serious challenges managing their IoT systems. Devices are frequently deployed across departments and facilities, added rapidly to support new initiatives, and not always inventoried or governed by consistent security standards. The result is classic “device sprawl”: too many devices, in too many places, with too little centralized visibility. For the public sector, where systems often support critical services, this sprawl can translate directly into operational and safety risks.

To respond, users need to treat mobile and IoT security as a core element of their cybersecurity posture. That means maintaining asset inventories, enforcing configuration baselines, segmenting networks to limit blast radius, and integrating mobile/IoT telemetry into existing monitoring and incident response workflows. With attacks increasingly targeting these devices, proactive governance can be the difference between a contained incident and a larger crisis.

Reference

Verizon. (2024). 2024 Mobile Security Index (MSI). Verizon.

IoT: Cyberthreats to Automatic Tank Gauge (ATG) Systems

Automatic tank gauge (ATG) systems are a cybersecurity concern because they are often internet-connected industrial control systems that monitor fuel storage, leak detection, and tank inventory at gas stations and other critical facilities (BitSight, 2024; Dutch Institute for Vulnerability Disclosure [DIVD], 2025). Reporting in 2026 indicates that attackers have actively targeted exposed ATG systems in the United States, reinforcing long-standing warnings from researchers that these devices can be manipulated when they are placed online without adequate access controls (Energy Marketers of America, 2026; In Food & Fuel, 2026).

What is an Automatic Tank Gauge (ATG)?

An automatic tank gauge is an electronic monitoring system used to measure fuel levels, detect leaks, and support inventory management in underground or aboveground fuel storage systems (U.S. Environmental Protection Agency [EPA], n.d.; DIVD, 2025). In practice, ATGs help operators track tank conditions and support release detection obligations that are part of underground storage tank compliance and environmental protection programs (EPA, n.d.).

Who Controls ATGs?

ATGs are generally controlled by the owners and operators of fuel storage systems, such as gas stations, convenience stores, fuel distributors, and operators of facilities that store petroleum or hazardous substances (EPA, n.d.). State, territorial, tribal, and federal regulators do not typically operate the devices directly, but they regulate the broader underground storage tank environment and compliance expectations surrounding release detection and environmental protection (EPA, n.d.). Vendors, service contractors, and remote monitoring providers may also play a role when they install, configure, maintain, or remotely access the systems (DIVD, 2025; Veeder-Root, 2024).

How Many ATGs Are There in the United States?

A precise national count of ATG devices in the United States is uncertain. The EPA states that approximately 542,000 underground storage tanks nationwide store petroleum or hazardous substances, but that figure refers to tanks rather than ATG units, and one facility may have multiple tanks while not every tank count translates directly into a one-to-one ATG count (EPA, n.d.). The closest verifiable contextual figure is the EPA’s estimate of approximately 542,000 underground storage tanks in the United States (EPA, n.d.).

What Are the Vulnerabilities of ATGs?

The clearest recurring vulnerability is direct exposure of ATG interfaces to the public internet without proper authentication or network isolation (DIVD, 2025; BitSight, 2024). DIVD reported that exposed systems from multiple manufacturers, especially certain Veeder-Root models, could be accessed through serial interfaces commonly reachable on TCP port 10001, allowing unauthorized parties to view fuel levels, change tank labels, alter alarm thresholds, and modify monitoring parameters (DIVD, 2025). BitSight reported multiple critical vulnerabilities across six ATG systems from five vendors and warned that internet-exposed ATGs remain attractive targets for sabotage and cyberwarfare scenarios (BitSight, 2024).

Other weaknesses include poor password practices, insecure remote connectivity, weak segmentation between operational technology and business networks, and overreliance on remote polling designs that require open network paths into the ATG environment (DIVD, 2025; PAS, 2025). Veeder-Root’s guidance also emphasizes controls such as firewalls, access restrictions, and secure remote connectivity, which indirectly confirms that misconfiguration and unnecessary exposure are central risk factors (Veeder-Root, 2024).

What Are the Threats to ATGs?

The threat landscape includes unauthorized access, reconnaissance, tampering, denial-of-service activity, and operational disruption (DIVD, 2025). Researchers and industry alerts have described attackers changing passwords, modifying system information, deleting data, and interfering with remote access and fuel operations when gauges are exposed online (In Food & Fuel, 2026; DIVD, 2025). In addition to opportunistic criminal exploitation, researchers have warned that ATGs could be targeted in sabotage or cyberwarfare contexts because they are part of the fuel distribution ecosystem and are present at critical facilities beyond retail gas stations (BitSight, 2024; DIVD, 2025).

What Harm Could Come from a Cyberattack on an ATG?

Potential harm from an ATG cyberattack includes environmental damage, operational shutdowns, business interruption, false inventory readings, disabled alarms, and impaired leak detection (BitSight, 2024; DIVD, 2025). BitSight reported that attackers may be able to change critical parameters such as tank geometry and capacity, disable alarms, and interfere with automatic or manual responses, creating the possibility of fuel leaks, safety incidents, and economic losses (BitSight, 2024). Industry reporting in 2026 also described incidents in which stations could not pump gas until affected devices were reset or restored, showing that even attacks short of physical damage can disrupt daily commerce and fuel availability (In Food & Fuel, 2026).

Who Would Want to Threaten an ATG and Why?

Several categories of adversaries could have an interest in ATG systems. Cybercriminals may target them for disruption, extortion, vandalism, or opportunistic exploitation of poorly secured systems (DIVD, 2025; In Food & Fuel, 2026). Nation-state or state-aligned actors may view ATGs as a soft target within critical infrastructure, particularly because fuel distribution has economic and public safety significance and ATGs are often locally managed rather than defended through a uniform national architecture (BitSight, 2024; CNN, 2026). Hacktivists or malicious insiders could also target ATGs to cause embarrassment, interrupt fuel sales, or manipulate records and alarms for ideological, retaliatory, or personal reasons, although specific motive patterns vary by incident and are not always publicly confirmed (DIVD, 2025).

What Are the Recent Reports of Attacks on ATGs?

Industry and media reporting from 2026 indicates that attacks against ATGs were not merely theoretical. Energy Marketers of America circulated a cybersecurity advisory in April 2026 stating that known cyberattacks were targeting ATGs in Tennessee and that cybercriminals were targeting systems nationwide, including at least 15 affected tanks at one convenience store chain (Energy Marketers of America, 2026). In Food & Fuel reported that the Utah Department of Public Safety had identified 76 vulnerable ATGs in Utah and more than 4,000 across the United States, while also describing confirmed incidents involving unauthorized access to tank and sensor data, false alarms, and deletion of system information (In Food & Fuel, 2026).

Mainstream reporting also linked the 2026 campaign to suspected Iranian actors. CNN reported that U.S. officials believed Iranian hackers had breached fuel tank monitoring systems at gas stations across multiple states by accessing internet-connected ATGs that lacked password protection (Bertrand et al., 2026). Because attribution in fast-moving cyber incidents can evolve, that point should be treated as a reported government assessment rather than a final judicial finding (Bertrand et al., 2026).

What Measures Should Be in Place to Protect ATGs?

The strongest protective measure is to avoid exposing ATGs directly to the public internet (DIVD, 2025; Veeder-Root, 2024). Recommendations include placing ATGs behind properly configured firewalls, using VPN gateways or dedicated hardware interfaces for remote connectivity, applying source IP filtering, and setting passwords on serial ports where the feature is supported (DIVD, 2025; Veeder-Root, 2024). Operators should also audit their network configurations regularly to identify exposed systems, restrict third-party remote access to only what is necessary, and separate ATG environments from broader corporate or payment networks (DIVD, 2025; PAS, 2025).

Additional protective measures include maintaining documented incident response procedures, validating alarm and leak-detection settings, coordinating with qualified service vendors, and promptly applying vendor guidance or security updates when available (DIVD, 2025; Veeder-Root, 2024). Because some ATG risk stems from insecure deployment rather than a single patchable flaw, sound architecture, restricted connectivity, and administrative discipline remain as important as software maintenance (DIVD, 2025).

References

Bertrand, N., Lillis, K. B., & Marquardt, A. (2026, May 15). Iranian hackers have breached fuel tank readers at gas stations across multiple U.S. states, sources say. CNN. https://www.cnn.com/2026/05/15/politics/iran-hackers-tank-readers-gas-stations

BitSight. (2024, September 23). Critical vulnerabilities discovered in automated tank gauge systems. https://www.bitsight.com/blog/critical-vulnerabilities-discovered-automated-tank-gauge-systems

Dutch Institute for Vulnerability Disclosure. (2025, August 25). DIVD-2025-00005 - Exposed automated tank gauge systems. https://csirt.divd.nl/cases/DIVD-2025-00005/

Energy Marketers of America. (2026, April 13). Urgent cybersecurity advisory: Nationwide cyberattacks targeting automatic tank gauges (ATGs). https://www.fueliowa.com/latest-news.cfm/Article/INDUSTRY-NEWS/Urgent-Cybersecurity-Advisory-Nationwide-Cyberattacks-Targeting-Automatic-Tank-Gauges-ATGs/2026-4-14

In Food & Fuel. (2026, April 23). Cybersecurity alert: Automatic tank gauge systems targeted. https://www.infoodandfuel.org/news/cybersecurity-alert-automatic-tank-gauge-systems-targeted

PAS. (2025, April 24). Securing your Veeder-Root ATG: Protecting against vulnerabilities in remote connectivity. https://passtesting.com/news/securing-your-veeder-root-atg-protecting-against-vulnerabilities-in-remote-connectivity

Perplexity AI. (2026). Perplexity AI [Large language model]. https://www.perplexity.ai/

U.S. Environmental Protection Agency. (n.d.). Underground storage tanks (USTs). https://www.epa.gov/ust

Veeder-Root. (2024, August 14). Ensuring automatic tank gauge security compliance. https://www.veeder.com/us/ensuring-automatic-tank-gauge-security-compliance

AI Use Statement

Perplexity AI was employed in the research and development of this information. 

=-=-=-=-=-=

Video: https://youtu.be/HbBIadarg60

Cybersecurity: 50 Tips for Personal & Business Protection

Cybersecurity is no longer optional—it’s essential. Cyber threats such as phishing, ransomware, andidentity theft continue to rise, impacting both individuals and businesses. Implementing solid cybersecurity practices can strengthen your online safety and protect sensitive data.

This guide provides 50 cybersecurity tips to improve your security posture, covering personal safety, workplace security, data protection, and more.

---

General Cybersecurity Tips

Understand Cybersecurity Risks: Anyone can be a target of a cyberattack, not just large organizations.

• Use Strong, Unique Passwords: Create complex passwords and avoid reusing them. 
• Enable Two-Factor Authentication (2FA): Adds an extra login barrier against credential theft. 
• Keep Software Updated: Updates fix vulnerabilities and prevent malware infections. 
• Back Up Data Regularly: Use encrypted cloud storage or external drives. 
• Avoid Public Wi-Fi for Banking or Work: Use a VPN for secure browsing. 
• Beware of Phishing Emails: Always double-check the sender before clicking links.
• Secure Your Home Wi-Fi: Change default router credentials and use WPA3 encryption.
• Use Antivirus/Anti-Malware Software: Select reputable security solutions.
• Check Privacy Settings: Manage what information you share on social media.

 

---

Device Security

• Lock devices with strong PINs or biometrics.
• Avoid public charging stations—carry your own cables and adapters.
• Use a standard user account instead of an admin account for daily tasks.
• Encrypt sensitive files to prevent unauthorized access.
• Regularly patch IoT devices and change default credentials.

---

Email and Internet Use

• Double-check sender information to avoid email spoofing. 
• Never click on unknown links. 
• Use secure, up-to-date browsers. 
• Clear cache and cookies frequently. 
• Download apps only from trusted marketplaces.

 

---

Workplace Cybersecurity

• Train employees on phishing awareness and password hygiene. 
• Use multi-factor authentication (MFA) for company logins.
• Establish and update written security policies.
• Perform regular penetration testing and security audits.
• Rely on encrypted communication tools for business.

 

---

Data Protection

• Enforce "minimum necessary" access to internal files.
• Monitor data transfers to detect shadow IT usage. 
• Apply data loss prevention (DLP) tools.
• Encrypt and secure cloud-stored files.
• Update written policies to reflect new threat landscapes.

 

---

Incident Response

• Develop a written incident response plan.
• Train with simulated breach scenarios.
• Encourage instant reporting of suspicious behaviors.
• Contain attacks quickly to minimize damage.
• Keep clients, regulators, and partners informed in case of breaches.

---

Physical Cybersecurity

• Secure physical access controls in workspaces.
• Install CCTV and remote monitoring for critical areas.
• Shred sensitive records before disposal.
• Deploy badge-based entry systems.
• Implement MDM (mobile device management) for company smartphones.

 

---

Advanced Cybersecurity Measures 

• Shift toward a Zero Trust Architecture.
• Deploy EDR (Endpoint Detection and Response) tools.
• Use network segmentation to isolate sensitive systems.
• Integrate threat intelligence feeds. 
• Partner with peer organizations to share best practices.

 

---

Personal Cybersecurity Practices

• Disconnect when devices are not in use. 
• Use trusted password managers like 1Password or Bitwarden. 
• Be skeptical of free services that seem too good to be true. 
• Check your online banking and email account history regularly. 
• Research tools and apps before installation.

 

---

Why Cybersecurity Best Practices Matter

Implementing even a few of these cybersecurity tips can drastically reduce exposure to digital threats. From password safety to incident response readiness, both individuals and organizations must take proactive steps to minimize risk.

For additional resources, also read:

• How to Protect Against Phishing Attacks 
• Securing IoT Devices at Home and Work 
• Top Cybersecurity Tools for Small Businesses

 

---

References

• 52 Cybersecurity Tips – Driz Group
• Best Cybersecurity Practices – Sprinto
• Cybersecurity for Employees – Nulab
• Expert Security Tips – Heimdal Security
• Cyber Security Practices – Ekran System

---

Please buy a coffee at the link below for our excellent editor Ava Gozo 

 

 

 

 

 

 

 

Cybersecurity: SIM Card Swapping: How to Prevent Account Takeover Fraud

---

SIM card swapping fraud can happen to anyone. If criminals succeed, they can steal a phone number, take over accounts, and access bank or cryptocurrency funds. Most people know to be cautious about phishing emails, but SIM swapping scams often go unnoticed and can be devastating?

---

What Is SIM Card Swapping?

Your phone number is stored on a small SIM chip in your device. If a criminal convinces your provider to move your number to a SIM card they control, they gain access to your calls and texts. This matters because:

• Many companies send login codes and password resets by text.
• Scammers intercept those codes and can break into important accounts.
• Victims face stolen money, identity theft, and recovery headaches.

---

How SIM Card Swapping Happens

• Fraudsters first gather details about a victim—address, date of birth, account numbers:
• They call the mobile carrier, pretending to be the victim.
• The victim’s phone stops working, and the scammer now controls the number.
• They claim the phone is lost or broken, requesting a new SIM card.
• The carrier activates that SIM, transferring the victim’s number.
• SIM card swapping can occur with both physical SIM cards and eSIMs, as the underlying attack involves transferring a phone number or carrier profile rather than the physical card itself. 

---

Signs Your SIM Card Was Swapped

Watch for these red flags:

• Phone suddenly has no service for calls or texts.
• Family or friends say somebody else answered, or call attempts fail.
• Alerts from bank, email, or other accounts about requested password changes

If any occur, contact your carrier immediately.

---

How to Protect Yourself

Defend against SIM swap fraud with these best practices:

• Add a PIN or password to your mobile account: This makes impersonation harder for attackers.
• Use app-based login codes (Google Authenticator, Authy) instead of SMS: These cannot be intercepted by SIM swapping.
• Keep personal info private: The less a criminal knows, the harder their attack.
• Monitor your accounts: Enable alerts for suspicious logins or money movements.

---

Set Up Extra SIM Protection with Your Carrier

Major carriers provide additional security—see their pages to set up SIM locks, account PINs, and fraud alerts:

• Google Fi: Enable SIM Number Lock
• AT&T: Add a wireless passcode
• Verizon: Set an account PIN
• T-Mobile: Enable account security PIN/Passcode

Be sure to visit your carrier's support pages for step-by-step instructions.

---

Final Takeaway

SIM card swapping isn’t about hacking a phone—it’s social engineering aimed at telecom providers. A few minutes setting up SIM locking and carrier PINs can prevent account takeover and protect identity. Think of SIM protection as adding a deadbolt before trouble happens—most criminals move on if it looks too difficult.

Take time today to secure your SIM and implement strong account protection. It could save stress, money, and time. 

References

1. https://www.kaspersky.com/resource-center/threats/sim-swapping
2. https://www.trumarkonline.org/blog/sim-swapping-and-port-out-fraud/
3. https://www.mcafee.com/blogs/mobile-security/what-is-sim-swapping/
4. https://www.itgovernance.eu/blog/en/scammers-are-using-seo-to-strengthen-phishing-attacks
5. https://www.verizon.com/about/account-security/sim-swapping
6. https://www.thomsonreuters.com/en-us/posts/corporates/sim-swap-fraud/

 ___________________________________________

Please buy a coffee at the link below for our excellent editor Ava Gozo 

Cybersecurity: Securing Your Network: The TP-Link Controversy & Router Safety Tips

TP-Link, a major Chinese router manufacturer, is under investigation by U.S. authorities over national security concerns. A possible ban on its products in the U.S. is being considered, raising questions about cybersecurity, market dominance, and router safety for both home and business users.

Key Points of the TP-Link Investigation

• Market Dominance: TP-Link controls about 65% of the U.S. market for home and small business routers .

• Government Usage: TP-Link routers are deployed across federal agencies, including the Department of Defense and NASA .

• Cybersecurity Concerns: Reports suggest Chinese hackers have compromised thousands of TP-Link routers to launch attacks on Western organizations .

• Pricing Strategy: The DOJ is examining whether TP-Link’s below-market pricing strategy violates antitrust laws .

Potential Implications of a TP-Link Ban

If a ban on TP-Link devices is implemented, the U.S. router market could face major disruptions. A policy shift may happen as early as next year under the new administration . Such a move would leave millions of U.S. households and businesses searching for alternative router solutions.

Security Risks and Vulnerabilities in TP-Link Routers

• Hacking Reports: Microsoft confirmed that a Chinese hacking group used compromised TP-Link routers in attacks on North American and European organizations .

• CISA Alerts: The U.S. Cybersecurity and Infrastructure Security Agency identified vulnerabilities in TP-Link devices that could allow remote code execution .

• Persistent Flaws: Researchers note that TP-Link routers often ship with unpatched security flaws, drawing criticism over poor vendor response .

How to Check if Your Router is Compromised

With router-based cyberattacks becoming more common, it’s important to detect signs of compromise early. Look out for:

• Unexplained slow internet speeds

• Difficulty logging into your router’s admin settings

• Browser redirects to strange websites

• Suspicious network activity during unusual hours

• Unknown devices connected to your network

• Unfamiliar software appearing on connected devices

Steps to Check Your Router

1. Log into your router’s admin panel and review logs for suspicious activity .

2. Check the device list for unknown or unauthorized entries .

3. Verify DNS settings to ensure they haven’t been changed .

If you suspect a compromise:

• Change the administrator password immediately.

• Update your router’s firmware to the latest version.

• Consider performing a factory reset for a clean start .

Final Takeaway: Protecting Your Network

The TP-Link controversy adds to growing concerns about router security and foreign-manufactured hardware. Regardless of brand, users should take proactive cybersecurity measures, keep firmware updated, and regularly monitor their networks for suspicious behavior.

Staying informed ensures that both home networks and businesses remain protected against evolving cyber threats.

---

References

Slashdot – U.S. Weighs Banning TP-Link Routers
Reuters – U.S. Considers Ban on TP-Link
NordVPN – Router Malware
Business Insider – TP-Link Pricing Debate
Ars Technica – U.S. Weighs Ban Over Security Concerns
Netgear Community – Has My Router Been Hacked?
Asia Financial – TP-Link Ban Report
CBS News – TP-Link Router Ban Considered
Keeper Security – Signs of Hacked Router
BleepingComputer – U.S. Considers Ban on TP-Link

_________________________

Please buy a coffee at the link below for our excellent editor Ava Gozo 

 

 

 

 

 

 

 

Cybersecurity: Recruiters Targeted by Fake Job Seekers in Malware Scam

Recruiters are facing a cyber threat as financially motivated hackers, notably the FIN6 group (also known as Skeleton Spider), shift tactics to social engineering campaigns. The attackers are posing as job seekers on popular platforms like LinkedIn and Indeed, luring unsuspecting recruiters into downloading malware via fake portfolio websites.

How the Scam Works

The scam starts when cybercriminals, pretending to be legitimate job applicants, reach out to recruiters through job-hunting platforms. After initial contact, they send a follow-up phishing email that directs the recruiter to a convincing online portfolio site. These sites, often hosted on Amazon Web Services (AWS), mimic authentic job seeker pages, sometimes using plausible names associated with the applicant.

To evade automated security systems, the phishing emails do not contain clickable hyperlinks. Instead, recruiters are prompted to manually type the provided web address into their browser, which helps the attackers bypass link-detection tools[1].

The Malware: More_eggs

Once on the fake portfolio site, the recruiter is asked to complete a CAPTCHA and other checks to prove they are human, further evading automated scanners. If they proceed, they are offered a ZIP file to download—purportedly a resume or work sample. Inside the ZIP is a Windows shortcut (.LNK) file that, when opened, executes a hidden JavaScript payload using wscript.exe. This payload connects to the attackers' command-and-control server and installs the More_eggs backdoor.

More_eggs is a modular, JavaScript-based malware-as-a-service tool that allows attackers to:

• Remotely execute commands
• Steal credentials
• Deliver additional malicious payloads

Notably, More_eggs operates in the memory of the users device, making it harder for traditional antivirus solutions to detect.

Evasion Tactics

FIN6 leverages several techniques to avoid detection and takedown:

• Anonymous Domain Registration: Domains are registered through GoDaddy with privacy services, obscuring the true identity of the registrants[1].
• Cloud Hosting: Hosting malicious sites on AWS infrastructure provides legitimacy and resilience against quick takedowns[1].
• Human Verification: CAPTCHAs and environmental checks ensure only real users (not automated scanners) reach the malware download stage[1].

Industry Response

AWS responded to the incident by reaffirming its commitment to enforcing its terms of service and collaborating with the security research community. The company encourages reporting of any suspected abuse through its dedicated channels for swift action.

Takeaways for Recruiters and Organizations

This campaign highlights the evolving landscape of cyber threats, where even those in hiring roles are now prime targets. Key steps for recruiters and organizations to protect themselves include:

• Treat unsolicited portfolio links with suspicion, especially if they require manual entry into a browser.
• Avoid downloading ZIP files or clicking on shortcut files from unknown or untrusted sources.
• Ensure endpoint security solutions are updated and capable of detecting in-memory malware.
• Report suspicious activity to IT or security teams immediately.

Recruiters and organization should be aware of the attacks and use caution with job applicants.

References

___________________________________________

Please buy a coffee at the link below for our excellent editor Ava Gozo 

Cybersecurity: Disturbing Spying Revelations: Meta/Facebook/Instagram & Yandex

Overview:

The web page https://localmess.github.io/ discloses a previously undocumented and highly invasive tracking technique used by Meta (Facebook/Instagram) and Yandex that affected billions of Android users. Researchers [4] discovered that this method covertly linked users' mobile web browsing sessions to their identities in native apps, bypassing standard privacy protections. 

The practice was active until early June 2025, when both Meta and Yandex, after being caught with their hands in the proverbial PII cookie-jar, ceased these behaviors following public disclosure [1][2][3].

Key Findings

1. Covert Web-to-App Tracking via Localhost on Android

·       Meta and Yandex embedded scripts (Meta Pixel and Yandex Metrica) on millions of websites.

·       When a user visited such a site in a mobile browser on Android, the script would communicate directly with native apps (like Facebook, Instagram, or Yandex Maps) installed on the same device.

·       This communication happened via localhost sockets—special network ports on the device that allow apps to talk to each other without user knowledge or consent [1][3].

2. How the Tracking Worked

·       Meta Pixel:

o   The Meta Pixel JavaScript sent the browser’s _fbp cookie (used for advertising and analytics) to Meta apps via WebRTC (using STUN/TURN protocols) on specific UDP ports (12580–12585).

o   Native Facebook and Instagram apps listened on these ports in the background, received the _fbp value, and linked it to the user’s app identity, effectively de-anonymizing web visits[1][3].

o   This bypassed protections like cookie clearing, incognito mode, and Android permission controls.

·       Yandex Metrica:

o   Yandex’s script sent HTTP/HTTPS requests with tracking data to localhost ports (29009, 29010, 30102, 30103), where Yandex apps listened.

o   The apps responded with device identifiers (e.g., Android Advertising ID), which the script then sent to Yandex servers, bridging web and app identities[1].

3. Privacy and Security Implications

·       This method allowed companies to:

o   Circumvent privacy mechanisms such as incognito mode, cookie deletion, and even Android’s app sandboxing.

o   Link browsing habits and cookies with persistent app/user identifiers, creating a cross-context profile of the user.

o   Potentially expose browsing history to any third-party app that listened on those ports, raising the risk of malicious exploitation[1][3].

4. Prevalence

·       Meta Pixel was found on over 5.8 million websites; Yandex Metrica on nearly 3 million.

·       In crawling studies, thousands of top-ranked sites were observed attempting localhost communications, often before users had given consent to tracking cookies[1].

5. Timeline and Disclosure

·       Yandex has used this technique since 2017; Meta adopted similar methods in late 2024.

·       Following responsible disclosure to browser vendors and public reporting in June 2025, both companies stopped the practice. Major browsers (Chrome, Firefox, DuckDuckGo, Brave) have since implemented or are developing mitigations to block such localhost abuse[1][3]

Technical Details

Aspect	Meta/Facebook Pixel	Yandex Metrica
Communication Method	WebRTC STUN/TURN to UDP ports (12580–12585)	HTTP/HTTPS requests to TCP ports (29009, etc.)
Data Shared	_fbp cookie, browser metadata, page URLs	Device IDs (AAID), browser metadata
Apps Involved	Facebook, Instagram	Yandex Maps, Browser, Navigator, etc.
User Awareness	None; bypassed consent and privacy controls	None; bypassed consent and privacy controls
Platform Affected	Android only (no evidence for iOS or desktop)	Android only (no evidence for iOS or desktop)
Risk of Abuse	High: enables de-anonymization, history leakage	High: enables de-anonymization, history leakage

Broader Implications

·       Bypassing Privacy Controls:
This method undermined the effectiveness of cookie controls, incognito/private browsing, and Android’s app isolation, showing that even sophisticated privacy tools can be circumvented by creative inter-app communications[1][3].

·       Need for Platform-Level Fixes:
Browser and OS vendors are now patching this specific exploit, but the underlying issue—unrestricted localhost socket access—remains a systemic risk on Android. The researchers call for stricter platform policies and user-facing controls for localhost access[1].

·       User and Developer Awareness:
Most website owners were unaware their sites enabled this tracking. End-users had no indication or control over the process. The lack of transparency and documentation from Meta and Yandex is highlighted as a major concern[1].

Conclusion

The research revealed a disturbing tracking vector that allowed Meta and Yandex to link users’ web and app identities on Android at a massive scale, defeating standard privacy safeguards. The disclosure led to rapid mitigation, but the incident underscores the need for deeper systemic changes in how browsers and mobile platforms handle inter-app communications and tracking[1][2][3]. “This tracking method defeats Android's inter-process isolation and tracking protections based on partitioning, sandboxing, or clearing client-side state.”[1]

1.      https://localmess.github.io

2.      https://www.grc.com/sn/sn-1029-notes.pdf

3.      https://gigazine.net/gsc_news/en/20250604-meta-yandex-tracking/

4.      Researchers & Authors of the localmess github page: Aniketh Girish (PhD student),  Gunes Acar (Assistant Professor),  Narseo Vallina-Rodriguez (Associate Professor), Nipuna Weerasekara (PhD student), Tim Vlummens (PhD student).

Note: Perplexity.AI was used to assist in preparing this report.