Brahim

“Facebook disabled my account for suspicious activity” — but the suspicious activity started with one click. Someone reached out to me on X, asking if I could help recover their hacked account. I asked what happened. Their story was a reminder of how easily people can lose accounts they use every day. They received an email that looked like a suspicious login alert from Facebook. They clicked the link. Facebook later disabled the account for suspicious activity. I asked for a screenshot of the email so I could investigate. They couldn't access the account anymore, and the email had been deleted because they thought it was spam. I couldn't verify exactly what happened, but the story raises an important question: Here's what everyone needs to understand, especially if you're not into tech. 1. A familiar logo doesn't prove an email is genuine. Scammers can copy Facebook's branding, colours and email layout to make fake alerts look real. 2. An email can look urgent without being legitimate. “Your account will be disabled in 24 hours” is the kind of message designed to make you panic and click before thinking. 3.A link can look trustworthy but lead somewhere dangerous. A fake Facebook login page can look almost identical to the real one. Enter your password there, and you may have just handed it to an attacker. 4.Facebook can send legitimate login and security alerts. The trick is knowing how to verify them. Instead of clicking the email link, open the official Facebook app or type facebook.com into your browser yourself. Check your account notifications and security settings there. 5.Never share your password or verification code with someone claiming to help you. Even a genuine-looking support message can be a trap. 6.Don't delete suspicious emails immediately if you may need to investigate them. Don't click anything in them. Keep the message long enough to inspect the sender and report it as phishing. If you've already clicked, don't panic act quickly to secure your account. If you've already entered your password on a suspicious page, change it through the official website or app, secure the email account connected to Facebook, enable two-factor authentication, and review active sessions. If you're locked out, use Facebook's official recovery page: facebook.com/hacked And please understand this: being a victim doesn't mean you're stupid. These scams are designed to fool people. But learning how they work can stop the next attempt from succeeding. Now I'm curious: How did you lose access to your first hacked account? Was it a fake login link, a code you shared, a suspicious app, or something else? Share your experience. Someone reading it might recognise the same trick before it's too late.

Imagine buying a device to protect your money, only to discover someone may have tampered with it before you bought it. That's the warning from a recent cryptocurrency security incident. Ledger, a company that makes physical crypto wallets, asked distributors across several Asian markets to stop selling devices while it investigated tampered wallets. According to reports, some modified devices contained a hidden component capable of stealing the owner's 24-word recovery phrase and transmitting it to an unauthorized party. What's a recovery phrase? It's a set of secret words that can restore access to your crypto wallet. If someone gets those words, they may be able to steal your funds. Here's the scary part: The device could look legitimate while the hidden hardware did its work. What should you learn from this? • Buy security devices from trusted, authorized sources. • Never share your recovery phrase with anyone. • Never enter it into a website or app just because someone tells you to. • If you suspect your wallet has been tampered with, don't enter your recovery phrase into that device. We spend so much time worrying about hackers breaking into our devices. But what happens when the device itself cannot be trusted? Source: bleepingcomputer.com/news/se…

Your smart TV could give a hacker more control than you think. Researchers have found a chain of security flaws in LG smart TVs that can let an attacker on the same network take complete control of a vulnerable device. Here's how it works. The flaws affect webOS, LG's smart TV operating system. Researchers found hardcoded credentials, a way to bypass the normal pairing process, and a weakness that could let attackers run commands with root privileges. In simple terms, they could potentially go from bypassing security to gaining the highest level of control over the TV. The scary part? The attack can work without a PIN prompt or any action from the TV owner. LG has issued a fix, and the researchers have published technical details of the exploit. If you own an LG smart TV, check for a firmware update and install the latest version available for your model. Your TV is a computer connected to your home network. It deserves security updates just like your phone or laptop. Source: ssd-disclosure.com/lg-webos-… LG security updates: lgsecurity.lge.com/bulletins…

A Google Ads can look legitimate and still lead you into a malware trap. Hackers are abusing Google Ads to trick people searching for Claude AI on Mac into downloading malicious software. Here's how it works. You search for Claude, see a sponsored result, and click it. The page looks like an installation guide. It even shows what appears to be a legitimate command for installing Claude. But there's a catch. When you click the copy button, it secretly puts a different command on your clipboard. You paste it into your Mac's Terminal and run it, thinking you're installing an AI tool. Instead, you may be executing a command that downloads and runs malicious code. This is particularly dangerous because Terminal is a powerful tool that lets you give your computer direct instructions. And no, this isn't just a problem for developers. Anyone searching for AI software could encounter a convincing fake download page. Here's how to protect yourself: • Download apps directly from their official websites. • Be suspicious of sponsored search results, even when they look professional. • Never paste commands into Terminal just because a website tells you to. Understand what they do first. The dangerous part isn't just the fake website. It's how easily a normal installation process can be turned against you. Source: bleepingcomputer.com/news/se…

Samsung Galaxy S26 has been hacked repeatedly at Pwn2Own Ireland 2026. Security researchers have demonstrated multiple exploit chains against the flagship phone, including attacks that achieved remote code execution. One of the most concerning claims comes from Ikotas Labs: A previously unknown vulnerability may allow remote code execution on the Galaxy S26 potentially triggered by sending a single email. Even more interesting: The researchers say the same vulnerability may also affect Google's Pixel 10. Remote Code Execution (RCE) basically means an attacker can make your device run their own code remotely. No physical access required. At Pwn2Own, researchers demonstrated a four-bug chain against the Galaxy S26. Only one of those vulnerabilities was already known to Samsung. The rest were previously unknown. And this isn't just one successful attack. The Galaxy S26 has now been compromised multiple times during the competition by different security teams. The scary part is that the technical details haven't been publicly released yet. No CVEs. No full exploit details. No confirmed affected components. That means we don't yet know exactly how the alleged email attack works or how widely the vulnerability can be exploited. But there's a bigger lesson here: Even a fully patched flagship phone can still contain vulnerabilities that haven't been discovered yet. That's exactly why zero-day research matters. Researchers find the bugs → vendors get notified → patches can be developed before criminals get the same knowledge. If you're using a Galaxy S26 or Pixel 10, keep your device updated and be extremely careful with unexpected emails and attachments. Your phone doesn't need to be old to be vulnerable.

🚨 30 million+ records were exposed online — and several PepsiCo operations were caught in it. But here's the part companies should pay attention to: PepsiCo wasn't directly hacked. The problem was a third-party vendor. Researchers found a publicly accessible MongoDB database belonging to EDX Solutions, a Mexican electronic document management provider. No authentication was protecting it. Inside? 292GB of data across 48 databases. Researchers found invoices, tax documents, employee accounts, plaintext credentials, API tokens, digital certificates and supplier information. Several PepsiCo locations across Latin America were among the affected data. The exposure reportedly involved companies across at least 8 countries. And this is where things get dangerous. A database like this isn't just a pile of random documents. An attacker could potentially use the information to impersonate suppliers, redirect payments, take over accounts or create convincing fraud using legitimate business information. That's the supply-chain problem: Your company can have strong security... but if a vendor handling your data leaves the door open, your information can still end up on the internet. This is why vendor security isn't just paperwork. If another company can access your data, their security becomes part of your security.

Imagine working at a bank. Before you can approve an important transaction, you need a physical USB security key. So even if someone steals your password, they shouldn't be able to get in. Sounds secure, right? Now imagine the software connecting that USB key to your computer has a serious vulnerability. That's what researchers found in SConnect, software from Thales that was used to connect hardware security tokens to websites, including systems used by banks and governments. The vulnerability is called CVE-2026-18397 and it has been rated 9.4/10 — Critical. But what exactly can an attacker do? This is where RCE comes in. RCE means Remote Code Execution. In simple English: It means an attacker can make your computer run their own commands or programs from somewhere else. Think of it like this: You have a locked house. Your password is the key. Your security guard is the hardware security token. But an attacker finds a hidden hole in the communication system. They don't need to break the front door. They use that hole to tell the computer: “Run this program for me.” And the computer does it. Researchers from Bay Area Labs reportedly demonstrated an attack that could take control of a vulnerable computer in roughly 6–10 seconds. The attack could begin simply by visiting a malicious webpage. That's the scary part. You don't necessarily need to download a suspicious file. You don't necessarily need to give the hacker your password. The vulnerable SConnect software itself could become the way in. And because SConnect was used with 3SKey, a USB security token used by organizations connected to SWIFT and other sensitive systems, the potential impact is serious. But there's an important detail: There is no evidence that this vulnerability has been used to steal money from SWIFT banks. Researchers demonstrated the ability to remotely execute code. They warned that, depending on the environment, an attacker who gained control of a banking computer could potentially do much more. SWIFT has already been moving customers away from SConnect. Its replacement, Web Connect, was introduced in 2025, and SWIFT says SConnect support ended in September 2026. So if you're wondering: “Why should I care? I don't work for SWIFT.” Here's the lesson. Having a hardware security key does NOT automatically make a system safe. The security around the key matters too. Your strongest security device can still be connected to vulnerable software. And sometimes... the weakest part of a security system isn't the lock. It's the software connecting the lock to everything else.

WhatsApp is testing a feature that basically says: “This conversation stays on your phone.” It’s called Restricted Chat. If you enable it for a private one-on-one chat, WhatsApp adds 4 restrictions: • The chat won't be available on your linked devices • Media from the chat won't automatically save to your gallery • You can't export the conversation • Meta AI can't be used with that chat So if you normally use WhatsApp on your phone + laptop, a Restricted Chat can be kept on your primary phone only. And this isn't replacing WhatsApp's end-to-end encryption. Your normal WhatsApp messages and calls are already end-to-end encrypted. Restricted Chat is an extra privacy layer for conversations you don't want spreading across devices or being processed through certain features. Right now, it's only being tested with selected Android and iOS beta users. WhatsApp hasn't announced when everyone will get it. Honestly, this is the kind of WhatsApp privacy setting people should understand before they actually need it. Because sometimes the problem isn't someone hacking your WhatsApp. It's simply someone getting access to another device where your WhatsApp is already logged in.

Your car might know more about you than you think. The Dutch intelligence service AIVD just warned that modern cars can become a source of sensitive information. Think about it. Your car can have microphones, cameras, GPS, Bluetooth, Wi-Fi and an internet-connected infotainment system. It can know where you go. Who connects their phone. What locations you search for. And potentially what is happening inside and around the vehicle. The AIVD says malicious actors could potentially access some of these systems, and recommends that people handling sensitive information avoid confidential conversations in or around smart cars. They also advise being careful about connecting phones through Bluetooth/Wi-Fi or USB, and about entering sensitive locations into the car's navigation system. We used to worry about hackers breaking into our phones and computers. Now we have another device carrying our data around every day Our car.

Microsoft is about to make it much harder for attackers and some legitimate tools to inject JavaScript into Entra ID login pages. Starting in mid-to-late October, Microsoft will enforce a stricter Content Security Policy (CSP) on browser-based Microsoft Entra ID sign-ins. What does that actually mean? When you visit the Entra login page, your browser can load and execute scripts. If an attacker manages to inject a malicious script for example through a compromised browser extension or another vulnerability that code could potentially interact with the page and steal sensitive information. Microsoft's new CSP adds another layer of protection. Instead of allowing arbitrary external scripts to run, Entra ID will restrict scripts to trusted Microsoft-hosted sources and block unauthorized injected code. This is particularly important because attackers can use script injection and XSS techniques to manipulate what users see or interact with during authentication. But there's a catch. Some legitimate browser extensions and enterprise tools also inject code into sign-in pages. Microsoft is warning organizations to identify these tools before the October rollout. Admins can test their sign-in flows with the browser developer console open and look for CSP violations. If a tool depends on injecting scripts into the Entra login page, it may stop working correctly. The good news: Users will still be able to sign in. Microsoft says the change does not affect Microsoft Authentication Library (MSAL) or API-based authentication because the enforcement applies specifically to browser-based sign-in at login.microsoftonline.com. This is a good example of how security controls can sometimes break functionality that organizations have quietly depended on. If your company uses Microsoft Entra ID, this isn't something to wait until October to investigate.