Clop has discovered what life is like on the receiving end of an extortion demand after rival crew ShinyHunters hijacked its leak site and demanded an eight-figure payout. The takeover surfaced over the weekend, when Clop's dark web leak site displayed a large "DOMAIN SEIZED BY SHINYHUNTERS" banner and the tagline "rooting your systems since '19 ;)." ShinyHunters told Reuters that it broke into the site on Friday by exploiting a vulnerability in the software powering it. The crew claimed this gave it extensive access to Clop's infrastructure. "We basically own them now," it said. Clop has not responded publicly, although two security researchers told Reuters that the clash appeared genuine. The Register has also viewed the defaced site, where ShinyHunters is posting increasingly colorful demands. According to ShinyHunters, the feud dates back to Clop's attacks on Oracle E-Business Suite (EBS) customers last year. ShinyHunters claims it discovered the zero-day first, only for Clop to obtain the exploit and use it against corporate networks. It now wants a share of the proceeds. In a message posted on September 19, ShinyHunters demanded an eight-figure payment, claiming the sum represented 2.333 percent of its own net worth. A later update raised the demand to "all the money you made off the EBS campaign plus more AND WITH INTEREST." ShinyHunters also threatened to identify companies that allegedly paid Clop and publish the sums and Bitcoin addresses involved. ShinyHunters turned the screw again on September 21, warning that its demands would increase with every 24 hours that Clop failed to respond. It now also wants a public apology, because apparently having your dark web extortion site hijacked isn't embarrassing enough. Clop is one of the most prolific data extortion groups in cybercrime. The gang has spent years exploiting vulnerabilities in enterprise software to steal data and extort victims, most notoriously during the 2023 MOVEit campaign, which affected thousands of organizations and exposed information belonging to tens of millions of people. ShinyHunters has an extensive rap sheet of its own, having been linked to numerous large-scale data theft and extortion campaigns. Its latest target is rather more familiar with that business model than most. The potential damage to Clop goes beyond the defacement of its leak site. If ShinyHunters has the wider access it claims and publishes records of previous ransom payments, the fallout could extend to companies that believed paying Clop had kept their identities and negotiations private. For now, though, those claims remain unverified. There is also the small matter of Clop's reputation. Leak sites are intended to demonstrate that an extortion crew has both the stolen goods and control of its operation. Having yours hijacked by a rival and repurposed to demand money from you is not exactly a glowing advertisement. ShinyHunters says the price will continue rising every 24 hours until Clop responds. The extortionists have become the extorted. ®
The Rust project has warned that attackers appear to be targeting its contributors and crate owners in an attempt to compromise their devices and accounts, potentially allowing malware to be distributed through its package ecosystem. Posting to the Rust blog, security-focused software engineer Adam Harvey said the tactics resemble those used in North Korean fake recruiter campaigns. "A video call is set up for something positive – maybe for a job, maybe for a project, maybe for a contract opportunity – and then that's used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard)," Harvey wrote. "These attackers are setting up new but legitimate-seeming company profiles, including plausible LinkedIn presences, in order to pass cursory inspection." The warning follows several attacks targeting the Rust community over the summer. In June, Rust developers were targeted with fake interview approaches purporting to come from a Singaporean venture capital firm. Matt Mastracci, who maintains packages on Rust's crates.io registry, said the supposedly recruiting business turned out to be defunct. The initial approach nevertheless appeared convincing and almost led to his machine being infected with a remote access trojan (RAT). The attempted deployment of a RAT resembles activity described in an international advisory issued last week by agencies in Australia, Germany, Japan, and the US. The advisory said North Korean operators had used fake job interviews to compromise more than 30,000 devices and steal over $10 million. Separately, Rust's package ecosystem suffered a supply chain attack in August, when malicious versions of the arrayref crate were published that downloaded malware onto users' machines. Arrayref had recorded 245 million downloads over its lifetime, although the malicious releases were available for less than two hours. The evidence suggested that a maintainer's credentials had been compromised rather than the malware being deliberately introduced by the project's developers. Harvey urged Rustaceans to scrutinize unsolicited approaches even when the sender appears legitimate, and to conduct calls through trusted platforms. ®
Author here. The post describes three memory-safety bugs which have been in Godot since v1.0 and v3.0. All three are still present in current releases. The bugs can affect exported games that load community-authored data files. Godot allows attackers using maliciously crafted files to trigger reads or writes past the end of a buffer, inside the process running the game. The post includes the response from Godot maintainers who deny this is a security issue, and my reply to them. Happy to give more information about the bugs or the audit if there are questions.
I have been developing a tool wrapped around tshark. The first blog post was about hitting a wall on a 2.5 GB file. Later, I talked about parallelizing the PCAP processing in my second blog post where I ran into a file corruption bug. I was using PcapSplitter from PcapPlusPlus in connection mode and output started coming back corrupted.
The initial signal came from "Total Block Length" errors thrown by tshark on some output files. The actual signal came when I built a small reproduction. PcapSplitter reported 12 files and 48 packets, but on disk, there were 11 files and 44 packets. Exit code zero and printed "Finished" on standard output.
Two wrong theories first. Someone on Reddit suggested file descriptor exhaustion. It was plausible but I found that at low ulimit -n it silently drops most packets and still exits zero. A real bug, but not mine. Then, I found that the PcapSplitter library has a hardcoded MAX_NUMBER_OF_CONCURRENT_OPEN_FILES = 250 with an LRU that closes and reopens handles past it. My minimal reproduction was 13 connections, nowhere near the cap.
The real culprit: the PcapSplitter's FiveTupleSplitter caused file truncation/corruption on TCP session reuse (i.e., a new SYN packet arrives for an already tracked 5-tuple hash).
The correct part of the splitter was assigning a new file number when a TCP session reuses a 5-tuple, but the filename function builds the name from IP and port only. So, in this case, both sessions get the same filenames. Then main.cpp sees a file number it has never seen, and opens that file fresh, without append. This truncates the existing file or causes a race condition between two active file writer handlers.
I filed the issue with a 13-connection reproduction, the maintainer and I worked out a fix that only suffixes on an actual collision, tested on the same corruption, and now the fix is merged.
AI labs are toying with an industry-wide pact to slow development. Meanwhile, widely available AI chatbots are already helping uncover a tidal wave of security flaws.
When you scroll through your teen’s iPhone during a casual check-in, you might see messaging apps, a few games, school tools, maybe TikTok. Everything looks normal. But what if some of the apps your child uses most aren’t showing up at all? What if that innocent-looking calculator icon is actually a vault for hidden photos, private chats, and secret social media accounts?
This isn’t science fiction or paranoia. Teens now have powerful tools to keep entire corners of their digital lives invisible to parents. Starting with iOS 18, which rolled out in late 2024, iPhone users can now natively lock and hide apps from the Home Screen, search results, and even from obvious parts of the App Library without biometric authentication.
If you suspect your child or teen is hiding apps and engaging in potentially harmful online activities, you may find this guide helpful. We’ll discuss the current digital landscape that threatens children and methods for checking for and uncovering hidden apps. More importantly, we will share insights on how to start conversations with your teens about the risks of hiding apps, and tips on how to keep your child safe from predators and other cybercriminals.
Key Takeaways
Teens hide apps for many reasons, including seeking normal privacy, avoiding conflict over screen time, and concealing genuinely risky behavior such as cyberbullying, sexting, and contacting strangers.
iOS 18’s native hiding features allow users to lock apps behind Face ID and move them to a hidden folder, making casual parental discovery much harder.
Parents can check for hidden apps by reviewing iPhone Storage settings, Screen Time reports, and the App Library’s Hidden folder.
The healthiest approach blends understanding how hiding works with ongoing, honest family conversations and smart use of security tools.
Why Kids and Teens Hide Apps on iPhone
The ability to conceal apps on iPhones has expanded with iOS 18’s native features and disguise vault apps. Teens worldwide can now make entire app categories invisible to parental checks. Before exploring how to uncover hidden apps, it’s important to first understand why children do it. When we grasp their motivations, we are better positioned to respond constructively rather than punitively.
Privacy from Parents and Peers
A study from the Pew Research Center shows that about half of parents in the U.S. look through their teen’s phone. But many teens use hidden apps to keep parts of their social life private: conversations with crushes, embarrassing photos, fan fiction, fake Instagram or finsta accounts where they share unfiltered thoughts.
These patterns reflect global trends as smartphones become central to adolescent identity worldwide, according to Nexus Teen Academy. Hiding isn’t always about danger. Often it’s about autonomy and the universal teenage desire for private space.
Avoiding Screen Time Limits and Parental Controls
In its survey, Pew Research also revealed that around 47% of parents in the U.S. set screen time limits. To circumvent this restriction, some teens find workarounds such as hiding apps to bypass Screen Time, keeping backup social apps off the approved list, or using web browsers instead of installed apps.
Hiding Risky or Sensitive Content
Some teens hide apps or use secondary accounts to disguise risky content or activities they may be involved in, including for sexting, dangerous challenges, or contacting strangers or certain communities. Vault apps may store explicit images or bullying screenshots that teens are ashamed to show adults. Hiding removes early warning signs that could prompt intervention before situations escalate.
The Risks of Hiding Apps
Hidden apps are just one piece of a larger digital reality in which teens spend hours each day online, often beyond adult supervision. To respond effectively, you need to recognize the prevalence and hazards of this trend.
Screen Time and Conflict in Families
Studies show that teens globally spend around 7 hours and 22 minutes looking at device screens daily, 4.8 hours of which are on social media. However, too much time spent on social media has been linked to poor mental health, including symptoms of depression and anxiety. Long screen time was linked to conflict in 38% of families, another survey found.
Mental Health Concerns
When screen time creates constant conflict in the family, hiding apps can feel like a way to keep the peace for teens. This impulse can hide situations that are genuinely harmful to children’s and teens’ mental health and overall well-being. Pediatric health organizations note that unsupervised, high-intensity, and excessive use of social media is linked to increased anxiety, depression, sleep disruption, and body image issues.
Contact with Strangers and Harmful Communities
Hidden messaging apps may contain conversations with unknown contacts, including adults with predatory intentions, communities that encourage eating disorders or self-harm, and secret accounts that host cyberbullying.
As your child or teen removes visibility of their online activities, you as a parent lose an early-warning system to late-night usage spikes, obsessive checking, or mood changes related to specific apps, signs that could help you intervene before a crisis develops.
How to Hide Apps on iPhone
Understanding how apps are hidden will help you know what’s possible and where to look.
Apple’s Hidden Apps Feature in iOS 18
In September 2024, Apple introduced a feature where the app icon and name vanish from the Home Screen entirely, moving into a special Hidden folder in the App Library that requires biometric or passcode authentication to access. These hidden apps won’t appear in Spotlight search, Siri suggestions, or standard app lists. While this feature has legitimate privacy use for adults to protect critical apps such as banking, email, or social media in case their device is lost or stolen, some kids have misused it to make entire categories of apps invisible without any technical workarounds.
Older Tricks Kids Still Use
Before iOS 18, tech-savvy teens found creative workarounds. They could remove apps from the Home Screen to appear only in the App Library, bury them in deep folders, or use the Shortcuts app to change app icons and names, making social apps look like utilities labeled “Tools” or “Notes.”
Calculator and Utility Vault Apps Explained
App stores host dozens of apps that look innocent but serve as secret lockers. Known as vault apps, these masquerade as calculators, music players, or utilities, but hide a private space filled with photos, videos, or messages. Some vault apps require multiple passwords: the first opens a decoy vault with harmless content, while the second unlocks the real stash. Others include stealth features like auto-closing when flipped, photographing wrong-code attempts, or sending fake error messages.
How to Find Hidden Apps on iPhone
Even when apps are hidden from view, they don’t disappear entirely from the device. Knowing where to look can help you get a clearer picture of what’s actually installed on your child’s iPhone.
Check iPhone Storage
To find hidden apps on your teen’s phone, you can start by doing it the old-fashioned way. Go to Settings > General > iPhone Storage. Legitimate calculators or flashlights typically use under 30 MB. A calculator consuming 200 MB or more is likely storing content. Vault apps still report storage usage and usually appear in Screen Time reports unless tracking is disabled. This gives you a concrete detection technique without advanced skills. It’s not foolproof, but it’s a useful starting point.
Review the Hidden Folder in App Library
Open the App Library by swiping left past your last Home Screen page. Scroll all the way down. If any apps are hidden, you’ll see a Hidden section, but accessing it requires authentication. If your teen has set up Face ID, you’ll need their cooperation or their passcode to view this folder.
Analyze Screen Time Reports
Go to Settings > Screen Time > See All Activity, then tap into specific days or weeks and scroll through the Apps section. If your teen uses an app heavily, the total hours will likely appear in usage reports even if the app is hidden from the Home Screen. Keep in mind that users can turn off Screen Time tracking for individual apps, but many teens don’t think to do this, making it a useful secondary check.
Healthy Ways Parents Can Respond to Hidden Apps and Digital Secrecy
Very tech-savvy teens can turn off Screen Time, use web versions of apps in private browsers, or delete vault apps before checks and reinstall them after. Technical detection is a conversation starter, but it won’t address the root cause. The goal isn’t to win in an arms race against your child, but to build an environment where hiding feels less necessary.
Start with Conversations
As a parent, it is natural to check your teen’s phone, even as health organizations urge more dialogue about social media risks. But your teen may worry that you will overreact or judge them harshly for normal experimentation. Resolving this tension requires conversation, not just monitoring.
Frame it as collaborative. Explain your concern about certain apps: cyberbullying, predatory strangers, self-harm content, and scams targeting young people. Ask what they like and dislike about their online spaces and why they feel pressure to hide things. Explain that you’re supporting their safety, not invading privacy. If your teen trusts that distinction, they’re more likely to disclose risky situations.
Set Clear, Age-Appropriate Digital Rules
Create a written family tech agreement that covers specifics: which apps are allowed at which ages, whether vault apps are permitted, the process for joint monthly check-ins rather than surprise raids, and consequences for breaking the rules.
Adjust expectations as kids age: A 13-year-old and a 17-year-old need different levels of autonomy. Younger teens might agree to open-phone policies, while older teens earn more privacy with clear red lines around illegal and harmful content, or contact with unknown adults. When rules are clear and mutually agreed on, teens feel respected and are more likely to follow them.
No locking or hidden apps in Family Sharing: Kids aged 13 to 17 in a Family Sharing group can lock or hide an app. However, a parent or guardian in the group can still see which apps were installed and how much time they were used, and restrict access to them using Screen Time.
Use parental control tools: Consider a comprehensive solution that includes parental controls, which can help your children build healthy digital habits by allowing you to monitor their usage, set limits, and even track their whereabouts.
Recognize the Red Flags
Hidden apps alongside sudden mood changes, withdrawal, secretive behavior, school performance drops, or sleep pattern changes could signal something serious. If you notice these patterns, reach out to school counselors, your child’s pediatrician, or a mental health professional. The goal is early intervention, not punishment. Kids in these situations need help, not sanctions.
Final Thoughts
The ability to hide apps on iPhones has expanded dramatically with iOS 18’s native features and vault apps. While this capability has legitimate privacy use for adults, teens could misuse it by making entire app categories invisible to casual parental checks.
But kids hiding apps are just a symptom, not the root problem. When parents focus solely on finding every hidden app, it can erode trust and push kids to hide even more cleverly. The most effective response blends technical awareness and relationship work.
Have a calm conversation with your child about online privacy and safety. Lead with genuine interest and share concerns openly. Next, collaboratively review the Screen Time and iPhone Storage reports. If you find something unexpected, respond with curiosity, not anger.
Finally, create clear, age-appropriate family agreements about phone use and privacy boundaries. Revisit them as your child grows. Make space for private corners of their digital life while maintaining firm red lines around illegal content, contact with strangers, or harmful material.
Security tools such as McAfee+ Family Plans can support your children’s digital safety by allowing you to block harmful content, manage screen time, and monitor their location. The goal isn’t perfect control. It’s ongoing communication, smart boundaries, and enough visibility to catch warning signs early.
When it comes to AI models, security functions as an afterthought, as evidenced by increased instances of agents hacking organizations and people, and other security mishaps with agents gone rogue. There's also an opportunity here for companies to offer new solutions. This should not come as a shock to anyone, according to cybersecurity investors and accelerator executives. “On one hand, we shouldn’t be surprised that increasingly capable agents are finding creative and sometimes unexpected ways to accomplish their objectives,” Matt Hartman, chief strategy officer at Merlin Group, told The Register. “On the other, we can’t accept harmful behavior as inevitable or unmanageable.” It’s the same story that plays out with every emerging technology, from laptops to cloud, said Todd Graham, managing partner at Microsoft’s M12 venture fund. “Every time we've built a new piece of infrastructure, we've conveniently forgotten the security,” Graham told The Register. Herein lies the opportunity for early-stage security companies. “If laptops were default secure, we wouldn't have CrowdStrike,” Graham said. “If the cloud was default secure, we wouldn't have Wiz. If identity wasn't default secure, we wouldn't have a bunch of Active Directory add-ons and Okta.” When it comes to AI security, “a lot of ships are going to rise with this tide,” he added. What’s different with AI is the speed at which models are advancing. While companies adopted cloud technologies over a period of years, organizations are moving full speed ahead to incorporate agents and other AI tools into their production environments and allow them to access the most business-critical data and applications. Yet they don’t have a strong handle on how to manage, secure, or even identify the agents that are already roving about their systems. “This is a transition happening month over month, and given the rate of change we’re seeing in the market, I’m in no way or shape surprised that this issue has come to a head in a rather dramatic fashion,” Graham said. “The incidents that have occurred - I’m not going to defend them, but they should be a wake up call. This is a moment in time where we need to insert security, and we're just going to have to insert it faster.” 'Ships are going to rise' with the AI tide Hartman joined Merlin after a lengthy career in federal cybersecurity, including senior roles at the US Cybersecurity and Infrastructure Security Agency. In his private-sector role, he helps determine which early- to growth-stage cybersecurity companies the group invests in, and then works with these firms to scale their technology across government, critical infrastructure, and other highly regulated markets. “We’re particularly interested in the security layer that governs agent behavior: identity for non-human actors, clear limits on what they can access and do, and an audit trail for actions taken on an agency’s behalf,” he said. “Agencies aren’t just asking how to adopt agents, they’re asking how to constrain them and prove what one did at 2 AM on a Tuesday.” But while “the opportunity is enormous,” startup founders need to do more than just build an agentic AI security product. “AI has made it faster and cheaper than ever to build a product, so the bar for differentiation keeps rising,” Hartman said. “As the cost of building technology falls, the value shifts toward differentiated capabilities and the ability to take them to market. Founders who can do both have a real opportunity to define this category.” Graham also says that end-users are looking for agentic identity and governance products - “I truly believe someone is going to build the next Okta, just as SaaS generated Okta,” - but adds he sees several founders “thinking way too small.” “I’m seeing a lot of companies that are solving a sliver of the problem,” Graham said. “And the reality is, if I'm a CISO for a Fortune 500 company, no way I'm going to go buy 15 things to do one thing. If you look at the standard identity stack that we’ve had for humans for quite some time, it has governance, you know, access control, authorization, access. For agents, someone's going to have to come to us with a solution that does all of the things.” Agentic identity is the next unicorn When it comes to non-human identities, however, that’s a really big, tough ask. Service accounts remain a prime target for hackers because they typically have high privileges and passwords that never expire. Securing these non-human accounts still plagues security teams - and that’s even before agents entered the mix. Beyond agentic identity, AI endpoint security - think of this as CrowdStrike for AI - is another area ripe for inventive startups, Graham said. He says it’s a challenge he would personally tackle as a founder, but he’s been banned from starting any more companies, so that’s not going to happen. “If you have a breach, and you know you get hauled in front of Congress to explain why you didn't have antivirus turned on [or] EDR, you’re going to add AI endpoint pretty quickly to that list,” Graham said. “It feels like a very hot area that is still early enough, if someone wanted to build a quality solution.” Existing endpoint and antivirus vendors “will absolutely” build products to fill this void, he added. “But it does feel like again a moment in time where disruption is coming for everyone, especially those that have you know pre-existing commitments to go solve.” Graham admits he is “worried” about the recent real-world bad behavior by AI agents. “If left unencumbered, if left to its own devices, I am very concerned about where the endpoint is for this,” he said. Still, he’s “comforted” because he’s seen this scenario play out before, with security scrambling to keep up with infrastructure development. Graham also was "pleasantly surprised” by Anthropic CEO Dario Amodei’s now infamous “We Must Pace the Frontier” essay. “I'm not taking the cynical view that it's some sort of grand conspiracy to get around antitrust,” he told us. “I'm a believer that AI is this awesome tool that is going to fundamentally change a lot of lives for the better. But we’ve got to put in the work now,” Graham said. “We've kicked the security can down the road long enough, and now we need to solve it.” ®
Talk about your competitor getting through the door. Security researchers used Anthropic's Claude to help hack into OpenAI employees’ ChatGPT accounts. A trio of bug hunters researching frontier AI labs’ security weaknesses chained two vulnerabilities to take over multiple OpenAI employees’ ChatGPT accounts, then used that access to demonstrate they could reach an internal OpenAI repository by opening a harmless pull request. The entire timeline, from initial discovery to accessing OpenAI’s repo, took less than 72 hours and earned the researchers a $6,500 reward from OpenAI’s bug bounty program on Bugcrowd. “Until two months ago, any user or OpenAI employee logging into OpenAI’s own help forum (community.openai.com) could have had their ChatGPT and Codex accounts taken over,” Hacktron researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini said in a writeup about their research. “Since people can connect various services to Codex and ChatGPT, the scope of what we could theoretically access was huge, including GitHub, Slack and emails.” And, in a poetic twist, they used rival AI giant Anthropic’s Claude models to develop the exploit. Claude has shown a propensity to hack organizations without human guidance, as have OpenAI's models. The team gained initial entry on July 25 via OpenAI’s community forum. The forum runs on Discourse, which typically uses FastImage to perform image checks. However, since FastImage didn’t support HEIF files in the affected setup, HEIF images uploaded to Discourse passed through ImageMagick, which used libheif to process them before converting them to another image format. “That exposed the underlying libheif parser directly to attacker-controlled files,” the researchers wrote. Using Claude Opus 4.8, the trio found a heap buffer overflow flaw in the libheif library and attempted to use that model to develop a remote code execution (RCE) attack, but this didn’t work on Discourse’s default configuration. But then, Anthropic released Claude Opus 5. The bug hunters used the newer model to generate an exploit script, and achieved RCE on OpenAI’s instance. The trio “immediately” reported the vulnerability to OpenAI. “We then took over an OpenAI employee’s account, whose Codex was connected to OpenAI’s Github organization,” they wrote. “To demonstrate impact without actually accessing any internal code, we sent a prompt to this employee’s Codex account to open a PR for us in OpenAI’s internal monorepo. Then we stopped any further testing.” Neither OpenAI nor Anthropic responded to The Register’s requests for comment. OpenAI fixed the flaw within about 14 hours of the report’s submission, marked the issue as resolved, and paid the Hacktron team a $6,500 bounty. “To clarify the scope of that award: testing against the Discourse-hosted community.openai.com was explicitly excluded from our bug bounty program,” OpenAI said in a comment shared by Hacktron. “The award recognizes the OpenAI-side finding, not the actions against Discourse.” Discourse also issued a fix that added image-processing sandboxing, and published a security advisory GHSA-vhm9-85gw-x335 with patching and rebuild guidance. The entire hack took a few days for an AI agent and a few hours of human work. “Work that once required a well-resourced team and months of effort can now be compressed into days,” the researchers said. “Security assumptions must catch up with attacker capabilities.” ®
North Korea's employment scams work both ways. As well as placing fraudulent IT workers inside Western companies, regime-backed cybercriminals have posed as recruiters to infect more than 30,000 devices and steal over $10 million, according to an international advisory. Law enforcement and cybersecurity agencies from Australia, Germany, Japan, and the US issued an update on the campaign on Thursday. They said the attackers had compromised more than 7,000 cryptocurrency wallets and stolen funds that ultimately supported the North Korean regime. The agencies track the activity collectively as WaterPlum. Its operators target web designers, engineers, and cryptocurrency and Web3 specialists with bogus recruitment approaches. During the supposed interview process, victims are instructed to download files presented as coding assignments or other recruitment tests. Opening them backdoors the applicants' computers and installs malware. Once inside, the attackers deploy remote access trojans (RATs) and information stealers, giving them persistent access to credentials and other sensitive data long after the fake interview ends. In some cases, the compromised machines may later provide a route into corporate systems when the jobseekers secure legitimate employment. WaterPlum operators use that access to steal intellectual property, credentials, clipboard contents, keystrokes, cryptocurrency wallet data, and identity documents that can support further impersonation. "Stolen IDs can be used by North Korean IT workers to impersonate victims and generate foreign currency," the advisory [PDF] said. "Stolen credentials may be leveraged to exfiltrate crypto assets, personal data, trade secrets, etc., from victims' employers, clients, or contracting parties. The actors can also use stolen sensitive information for extortion." The agencies attributed at least $10.71 million in thefts to these tactics, with the proceeds funneled to Pyongyang. The recruiter campaign complements North Korea's better-known tactic of placing its own IT workers in technology roles at Western and allied companies. The scheme has been extensively documented and has generated revenue for North Korea for years. Researchers estimate that roughly 100,000 North Korean IT workers are employed or seeking work worldwide. Some are supported by accomplices operating laptop farms, which make remote workers appear to be based in the country where they were hired. The workers collect salaries from companies in countries that impose heavy sanctions on North Korea, with much of the money surrendered to the state. The sprawling IT worker fraud is thought to net Kim Jong Un's regime upwards of $500 million a year. The scale of the operation means some applicants inevitably succeed, although employers are becoming more familiar with signs of fraudulent North Korean candidates. Applicants often submit impressive resumes claiming prestigious educational backgrounds, extensive work experience, and language skills that may not withstand scrutiny during an interview. Other warning signs include repeated refusals to meet in person, suspicious interruptions to video feeds, voices in the background, and requests for payment in cryptocurrency. Fraudulent workers may also use AI face-swapping software, which can produce visual artifacts during video calls and prompt them to disable their cameras shortly after an interview or meeting begins. The agencies recommend that any organization suspecting it has engaged a fraudulent North Korean IT worker launch a full forensic investigation and assume that credentials and other sensitive data have been compromised. ®
Scammers impersonating law enforcement or government officials have cost victims more than $1.6 billion since January 2025, the FBI reports. The FBI’s Internet Crime Complaint Center (IC3) received close to 61,000 complaints of this type between January 2025 and July 2026, putting the average per-complaint loss at more than $26,000. The most common type of scam is one involving criminals convincing targets to pay a sum of money to remove charges the fraudsters claim were filed against them. Typically contacting targets via unsolicited phone calls, the scammers usually claim that the target has committed or is connected to a crime, and threaten consequences such as arrest and prison time if a payment is not made. Accounting for roughly 11 percent of the complaints is a different type of scam, which involves alleging victims did not fulfill their assigned jury duty or missed a court date, then threatening them with a fine or arrest unless they pay. Of these 6,833 complaints, scammers caused losses amounting to nearly $36 million. A more profitable variant involves a more targeted approach. Scammers will complete some due diligence on a target, such as ascertaining their profession, and tailor the scam to their job. The IC3 has seen cases in which scammers contact medical practitioners, for example, claiming their medical license is expiring or that it was used in the commission of a crime. Payment is then demanded either under the guise of renewing the license or as part of an extortion attempt to "protect their professional reputation." Victims reported 3,322 instances of this kind of targeted scam, with total losses exceeding $37 million. A far less common tactic, deployed in 496 of the total complaints, saw scammers claim that documents such as driver's licenses or passports had expired and demand payment to renew them. Despite accounting for a minority of cases, criminals still netted $348,000 using this method. Finally, and arguably the most elaborate tactic the IC3 outlined, was the targeting of Americans from different ethnic communities, foreign nationals, and international students in the US. The nature of the targeting was not the aspect the criminals invested the most effort in. The general procedure was also similar to the other examples: Scammers impersonate foreign law enforcement or US-based foreign diplomatic officials, threatening to cancel the victim’s home-country passport or have them extradited. However, these scams sometimes involve video calls. The criminals are known to don a country’s law enforcement uniform, or in some cases even take the calls in movie-style sets they create to mimic real government facilities. The IC3 said that it received 1,809 complaints of this kind of targeted scam during the 19-month reporting period, with total losses exceeding $140 million. It means nearly 10 percent of the overall losses stemmed from one scam that accounted for less than 3 percent of the total complaints. Law enforcement impersonation scams are common across the world, although they may take different shapes from country to country. In the Netherlands, for example, police received more than 7,200 reports of fake police officer scams in the first half of 2026 alone, although the criminals behind them don’t hide behind a phone or keyboard. Scams in the Netherlands see fraudsters approach victims at their homes, usually targeting the elderly population, offering to safeguard their valuables while posing as a trusted authority. In reality, the criminals simply steal the jewelry, money, bank cards, and other valuables they are entrusted to protect. Cases like these have surged across the country in recent years, and aspiring crooks as young as 14 have tried to cash in on the trend. Police have invested more in public awareness campaigns as a result. The FBI reminded the public that neither it nor any other law enforcement agency will call an individual and demand payment or request personal or sensitive information. Citizens should remember to ask for credentials and make attempts to independently verify the identity of the caller, such as calling the relevant office using publicly available details and asking for the caller by name. The IC3 recently reported its most damaging year for internet scams. It released 2025’s data in April, covering all types of cybercrime, pegging total losses at $20.87 billion – the first time it has reported annual losses exceeding the $20 billion threshold. ®
Login
