Your personal data is collected by almost every site or app you visit. The world is more data hungry than ever because it’s now the most important asset, even more valuable than oil. Your shopping history is logged, your search history is captured and your phone number, email address and IDs are all stored. 

But that doesn’t mean all this data is safe. If you’ve ever received a spam call, phishing email or a fake support call, your personal data is out there.

And if you want proof of how poorly your data is treated, a newly uncovered database offers a stark reminder. More than 16 billion login credentials, collected from years of past data breaches, have been compiled into one of the largest aggregated archives of cybersecurity incidents ever seen, according to a report.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join.

10 SIGNS YOUR PERSONAL DATA IS BEING SOLD ONLINE

A woman working on her laptop  (Kurt “CyberGuy” Knutsson)

What you need to know about the 16 billion password data breach affecting Google, Apple and Facebook

Cybernews describes the exposed database as a “blueprint for mass exploitation.” The records include login credentials from popular platforms like Google, Facebook and Apple.

Security researchers emphasize that this isn’t the result of a new, single breach. Instead, it’s a massive collection of previously stolen credentials from various past leaks, phishing scams and third-party data exposures, some of which were forgotten, underreported or reshared.

BleepingComputer, a cybersecurity site that reviewed the archive, confirmed the data appears to be aggregated from older breaches rather than a fresh incident. This makes the scope of the exposure particularly dangerous because attackers can use this central trove for targeted attacks, including credential stuffing.

Credential stuffing becomes much easier when attackers have access to such a vast pool of usernames and passwords. This technique involves using stolen login details across multiple sites, exploiting the fact that many users reuse the same credentials. So, even if your account wasn’t part of a recent breach, you could still be at risk if your old credentials are part of this newly indexed compilation.

An illustration of a hacker at work  (Kurt “CyberGuy” Knutsson)

DOUBLECLICKJACKING HACK TURNS DOUBLE-CLICKS INTO ACCOUNT TAKEOVERS

How Google and Meta are responding to the massive password leak

We reached out to Apple, Google and Meta for comment.

A Google spokesperson stated that this issue did not stem from a Google data breach and that Google continues to strongly encourage users to adopt more secure, passwordless authentication methods, such as passkey. They also suggest using tools like Google Password Manager, which securely stores your passwords and notifies you when they’ve been involved in a breach, allowing you to take immediate action.

A rep from Meta said, “We don’t have a statement to share at this time as we’re still looking into this,” but did offer some tips to secure your account, a security check-up tool, and the introduction of passkeys on Facebook.

We did not hear back from Apple before our deadline.

WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

A Google smartphone     (Kurt “CyberGuy” Knutsson)

MALWARE EXPOSES 3.9 BILLION PASSWORDS IN HUGE CYBERSECURITY THREAT

5 essential ways you can protect yourself after the Apple, Google Data breach

With credential leaks becoming a growing threat, protecting your data requires a mix of smart security habits and reliable tools. Here are five effective ways to keep your information safe.

1. Use a password manager: Infostealer malware often targets passwords saved directly in web browsers, making them easy targets. Instead of relying on your browser to store credentials, use a dedicated password manager that offers zero-knowledge architecture and military-grade encryption to keep your data safe. The best options work across all your devices and browsers, offer secure sharing, monitor for data breaches, and even generate health reports on your passwords. Get more details about my best expert-reviewed Password Managers of 2025 here.

2. Enable two-factor authentication (2FA): Even if your credentials are stolen, 2FA adds an extra layer of security by requiring a second form of verification, such as a code from an authentication app or biometric confirmation. Cybercriminals rely on stolen usernames and passwords to break into accounts, but with 2FA enabled, they cannot gain access without the additional security step. Make sure to enable 2FA on important accounts like email, banking, and work-related logins.

3. Use strong antivirus software and be cautious with downloads and links: Infostealer malware often spreads through malicious downloads, phishing emails, and fake websites. Avoid downloading software or files from untrusted sources, and always double-check links before clicking them. Attackers disguise malware as legitimate software, game cheats, or cracked applications, so it is best to stick to official websites and app stores for downloads.

The best way to safeguard yourself from malicious links is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.

4. Keep software updated:  Cybercriminals exploit outdated software to deliver malware. Keeping your operating system, browsers, and security software up to date ensures that known vulnerabilities are patched. Enable automatic updates whenever possible, and install reputable antivirus or endpoint protection software that can detect and block infostealer threats before they compromise your system.

5. Consider a personal data removal service: The massive leak of 16 billion credentials shows just how far your personal information can spread and how easily it can resurface years later in aggregated hacker databases. Even if your passwords were part of an old breach, data like your name, email, phone number, or address may still be available through data broker sites. Personal data removal services can help reduce your exposure by scrubbing this information from hundreds of these sites. While no service can guarantee total removal, they drastically reduce your digital footprint, making it harder for scammers to cross-reference leaked credentials with public data to impersonate or target you. These services monitor and automatically remove your personal info over time, which gives me peace of mind in today’s threat landscape. Check out my top picks for data removal services here. 

Get a free scan to find out if your personal information is already out on the web

CHAOS RANSOMWARE HITS OPTIMA TAX RELIEF, LEAKS 69GB OF DATA

Kurt’s key takeaway

Passwords are no longer enough. That is why I have always believed tech companies should phase them out entirely and require two-factor authentication across the board. Passwords, once the foundation of online identity, are now one of its weakest links. Companies like Google and Meta are already building systems that move beyond them. The tools are available. The message is clear. You do not need to wait for a breach to start taking security seriously.

CLICK HERE TO GET THE FOX NEWS APP

Do you think tech companies are investing enough in their cybersecurity infrastructure? Let us know by writing to us at Cyberguy.com/Contact. 

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you’d like us to cover

Follow Kurt on his social channels

Answers to the most asked CyberGuy questions:

New from Kurt:

Copyright 2025 CyberGuy.com.  All rights reserved. 

Those people scanning the beach with metal detectors, hoping for a lucky find, might not be thrilled about what’s next. While beaches are where we unwind, play, and connect with nature, they’re also under constant threat from plastic pollution and human debris. That’s where BeBot comes in.

BeBot, an all-electric beach-cleaning robot developed in Italy by Niteko Robotics in partnership with 4ocean and Poralu Marine, is quietly transforming environmental technology. This innovative machine delivers a smarter, cleaner, and more sustainable way to keep our shorelines pristine, combining advanced robotics with eco-friendly design.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join.

HUMANOID ROBOTS HANDLE QUALITY CHECKS AND ASSEMBLY AT AUTO PLANT

How BeBot works: Tech specs and core features

BeBot operates entirely on electric power, relying on batteries and, in some versions, solar panels. This approach ensures there are no emissions, so the robot does not contribute to greenhouse gases or other forms of pollution. Unlike traditional gas-powered beach-cleaning equipment such as tractors, BeBot is quiet and unobtrusive, which allows it to work at any time without disturbing wildlife or beach visitors. Its cleaning capacity is impressive. BeBot can cover up to 32,200 square feet of beach in a single hour, which is 20 to 30 times more effective than manual trash collection. The robot can remove up to 200 pounds of debris in one session, targeting items like plastic bottles, cigarette butts, food packaging, and cotton buds. BeBot’s design allows it to dig up to about four inches into the sand, and its sifting grids, which measure roughly half an inch by half an inch, capture even the smallest pieces of plastic and trash that would be difficult for people to collect by hand.

Remote operation is another standout feature. BeBot can be controlled from up to 950 feet away, giving operators the flexibility to clean large or crowded beaches safely. Its unique track system distributes pressure evenly across the sand, which helps prevent beach erosion and protects sensitive habitats such as turtle nesting sites. The robot’s battery can last up to three hours on a full charge, and some models can run for as long as eight hours.

AUTONOMOUS TRASH-GOBBLING ROBO BOAT WAGES WAR ON WATERWAY WASTE

Beyond trash: Versatility and attachments

BeBot is not limited to trash collection. Its modular design supports a variety of attachments, allowing it to rake seaweed and algae, level sand, and carry heavy loads such as beach chairs, umbrellas, or even jet skis. With the sifter removed, BeBot can transport up to 900 pounds, making it a valuable tool for both public and private beaches, nature reserves, golf courses, and other sandy environments.

STOP SORTING YOUR GARBAGE WITH THIS NEW TECHNOLOGY

Real-world impact: BeBot in action

BeBot has already demonstrated its effectiveness in places like Lake Tahoe, where Eco-Clean Solutions deployed it to clean over one million square feet of shoreline across twenty beaches. Videos of BeBot in action show the robot digging up all kinds of debris, including flip-flops and cigarette filters. The robot has also been used on beaches in Michigan, Ohio, Wisconsin, Florida, and North Carolina. In each location, BeBot has received praise for its ability to remove hard-to-spot debris and for raising public awareness about the dangers of microplastics.

GET FOX BUSINESS ON THE GO BY CLICKING HERE

THIS AI ROBOT GARBAGE PICKER CAN SORT OVER 500 TYPES OF TRASH IN SECONDS

Why BeBot matters: Environmental and social benefits

BeBot is making a difference by protecting wildlife and ecosystems. Plastic pollution is not just unsightly; it is deadly for marine life. Millions of tons of plastic enter the oceans each year, harming hundreds of species, including nearly half of all marine animals. BeBot’s gentle cleaning process reduces these threats without disturbing sensitive habitats or compressing turtle eggs. Cleaner beaches lead to healthier ecosystems and better experiences for visitors. Because BeBot operates quietly and efficiently, it is ideal for popular tourist destinations where traditional machinery would be disruptive or damaging. The robot also sparks important conversations about pollution and inspires communities to take action, complementing human-led cleanups by targeting the small plastics that often go unnoticed.

SUBSCRIBE TO KURT’S YOUTUBE CHANNEL FOR QUICK VIDEO TIPS ON HOW TO WORK ALL OF YOUR TECH DEVICES

Kurt’s key takeaways

This little robot is making a big difference, showing us that you do not need massive machines to tackle massive problems. With help from organizations like 4ocean and Poralu Marine, BeBot is changing the game for beach cleanups and setting a new bar for what we can expect from eco-friendly tech. So, the next time you are strolling along the shore, keep an eye out for BeBot quietly doing its thing, helping to create cleaner beaches and a healthier future for everyone.

CLICK HERE TO GET THE FOX NEWS APP

What are your thoughts on using advanced technology like BeBot to tackle environmental challenges on our beaches? Let us know by writing us at Cyberguy.com/Contact

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you’d like us to cover

Follow Kurt on his social channels

Answers to the most asked CyberGuy questions:

New from Kurt:

Copyright 2025 CyberGuy.com.  All rights reserved.  

ClickFix, a social engineering tactic that has been targeting both Windows and Mac users since early 2024, continues to evolve. 

Just last month, I reported on how attackers were using fake CAPTCHA prompts to trick Windows users into installing malware themselves. 

Now, that same trick is being turned against macOS. Cybersecurity researchers have uncovered a new campaign using ClickFix to deliver Atomic macOS Stealer (AMOS), a powerful information-stealing malware targeting Apple systems.

SPOT FAKE ONLINE STORES, AVOID FACEBOOK SUBSCRIPTION SCAMS

Illustration of a hacker at work. (Kurt “CyberGuy” Knutsson)

What is ClickFix malware, and how does it work?

Security researchers at CloudSEK have identified a new threat targeting macOS users through imitation and deception. The campaign uses a technique known as ClickFix to lure victims through fake online verification prompts. This time, attackers are spoofing Spectrum, a major telecom provider in the United States. They use fraudulent domains that closely resemble Spectrum’s real support portals. These include misleading addresses like panel spectrum net and spectrum ticket net.

Visitors to these sites are shown a standard-looking CAPTCHA box, asking them to verify their identity. When they do, the site displays a fake error message that says the CAPTCHA failed. Users are encouraged to click a button labeled “Alternative Verification.” This triggers a command to be copied silently to their clipboard. What happens next depends on the user’s operating system. On macOS, instructions guide the user to paste and run the command in Terminal. That command is actually a shell script designed to steal information and download malware.

The script is particularly dangerous because it uses legitimate macOS system commands. It asks for the system password, harvests credentials and disables security protections. It then downloads AMOS. This is a known information stealer with a history of targeting Apple devices. The malware collects sensitive data like passwords, cryptocurrency wallet keys, browser autofill data and saved cookies.

Researchers believe the campaign was created by Russian-speaking attackers. Clues include comments written in Russian found within the malware’s code. Analysts also noted that the delivery infrastructure was poorly assembled. Mismatched instructions appeared across devices. For example, Linux users were shown Windows commands. Mac users were told to press keys that only exist on Windows machines.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join.

Fake Captcha on a Mac. (CloudSEK)

OUTSMART HACKERS WHO ARE OUT TO STEAL YOUR IDENTITY

Why ClickFix attacks are so effective

ClickFix is a social engineering method that has rapidly gained popularity among cybercriminals. It relies on users trusting what they see and blindly following simple instructions. In this campaign, the attacker’s goal is to make the victim execute the infection process themselves. Once the user follows through, the system is compromised without needing a traditional exploit.

Researchers believe ClickFix has been active since at least March 2024. I first reported on it in June 2024, when attackers used fake error messages from Google Chrome, Microsoft Word and OneDrive to push their payloads. Victims were shown prompts offering a “fix,” which copied a malicious PowerShell command to their clipboard. They were then instructed to paste and run it in PowerShell or through the Run dialog.

By November 2024, the method had evolved further. A new wave of attacks targeted Google Meet users, beginning with phishing emails that mimicked internal meeting invites. These emails contained links that redirected to fake Meet landing pages designed to look like they came from the victim’s own organization.

Fake Captcha on a Mac. (CloudSEK)

MALWARE EXPOSES 3.9 BILLION PASSWORDS IN HUGE CYBERSECURITY THREAT

6 ways to protect yourself from ClickFix and similar malware

To protect yourself from the evolving threat of ClickFix malware, which continues to target users through sophisticated social engineering tactics, consider implementing these six essential security measures:

1. Be skeptical of CAPTCHA prompts: Legitimate CAPTCHA tests never require you to paste anything into Terminal. If a website instructs you to do this, it’s likely a scam. Close the page immediately and avoid interacting with it.

2. Don’t click links from unverified emails and use strong antivirus software: Many ClickFix attacks also start with phishing emails that impersonate trusted services like Booking.com or Google Meet. Always verify the sender before clicking on links. If an email seems urgent or unexpected, go directly to the company’s official website instead of clicking any links inside the email.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.  Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices. 

3. Enable two-factor authentication: Enable two-factor authentication whenever possible. This adds an extra layer of security by requiring a second form of verification, such as a code sent to your phone, in addition to your password.

GET FOX BUSINESS ON THE GO BY CLICKING HERE

4. Keep devices updated: Regularly updating your operating system, browser, and security software ensures you have the latest patches against known vulnerabilities. Cybercriminals exploit outdated systems, so enabling automatic updates is a simple but effective way to stay protected.

5. Monitor your accounts for suspicious activity and change your passwords: If you’ve interacted with a suspicious website, phishing email, or fake login page, check your online accounts for any unusual activity. Look for unexpected login attempts, unauthorized password resets, or financial transactions that you don’t recognize. If anything seems off, change your passwords immediately and report the activity to the relevant service provider. Also, consider using a password manager to generate and store complex passwords. Get more details about my best expert-reviewed Password Managers of 2025 here.

6. Invest in personal data removal service: Consider using a service that monitors your personal information and alerts you to potential breaches or unauthorized use of your data. These services can provide early warning signs of identity theft or other malicious activities resulting from ClickFix or similar attacks. While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time. Check out my top picks for data removal services here. 

Get a free scan to find out if your personal information is already out on the web

MASSIVE SECURITY FLAW PUTS MOST POPULAR BROWSERS AT RISK ON MAC

Kurt’s key takeaway

Even experienced users can be tricked when malicious behavior is disguised as routine. The attack didn’t just exploit a vulnerability in macOS, but also your familiarity with verification flows. As long as security instructions look like part of the usual experience, people will continue to run malicious code themselves. Mac users, like everyone else, need to treat every familiar-looking interface with a little more skepticism. Especially when it asks for your password.

CLICK HERE TO GET THE FOX NEWS APP

Do you think tech companies are doing enough to stop malware like ClickFix? Let us know by writing to us at Cyberguy.com/Contact. 

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels

Answers to the most asked CyberGuy questions:

New from Kurt:

Copyright 2025 CyberGuy.com.  All rights reserved.