By most people’s standards, Emma was careful with her phone. She used a password manager, ignored messages from numbers she didn’t know, and had never clicked a link that turned out to be bad. Then, one Tuesday evening, she got scammed by a restaurant menu. Not the menu itself: the QR code on the table, which her camera wouldn’t read, and the free scanner app she downloaded to read it.
The app had four and a half stars. When it asked for Accessibility access, a setting that lets an app see and control everything on your screen, she tapped Allow. It scanned the menu, and she forgot about it.
Two weeks later she opened her banking app. The login screen looked normal, so she typed her password. It wasn’t her bank’s screen. It was a copy, drawn over the real one by the scanner app, which had been waiting for exactly this moment. It read the one-time code when her bank texted it, logged in, and deleted the alerts as the money left.
No one exploited a technical vulnerability on Emma’s phone. She willingly installed a malicious application that cloaked itself as a legitimate utility, gave it the permissions needed, and the rest happened quietly in the background. All the attacker needed was a convincing app and a hungry person on a Tuesday. She made it easy without ever noticing she’d done anything at all.
The uncomfortable truth
We tend to imagine cybercriminals as people in hoodies typing furiously at code. Mostly, they aren’t. They run the same handful of tricks at enormous scale, betting on you behaving the way most people behave: reusing the old password, postponing the update, reacting to the urgent message before pausing.
The scale is hard to picture. In 2025, the FBI’s Internet Crime Complaint Center logged just over a million complaints, nearly 3,000 a day, and almost $21 billion in reported losses [1]. Most of that money didn’t leave through clever hacking. It left through phishing, fake investments, and people being talked into it. They aren’t looking for you. They’re looking for whoever is easiest tonight.
That’s why this year’s Cybersecurity Awareness Month theme is a plain instruction: Don’t make it easy for them.
Just stop being the person they’re betting on.
Point Wild’s Lat61 Threat Intelligence Team spends its days pulling apart malware and scam kits to see exactly how they work. Here are the seven things cybercriminals are counting on.
The password you've been recycling for years
Somewhere out there, a website you signed up for in 2014 has been breached. Your email and password from that site are now in a list, and that list is being tried against your bank, your email, and your social accounts, automatically, thousands of times a minute.
If you reuse passwords, one breach becomes ten. This is called credential stuffing, and it’s the most boring, most successful attack on the internet. Nobody guesses your password. They just try the one you already gave away.
The fix: Use a password manager and let it generate a different password for every account.
From the Lat61 Threat Intelligence Team: Your passwords don’t always have to leak from a website. In July, our team dissected Vanta Stealer, an infostealer that lifts saved logins out of Chromium browsers, Discord, Telegram, Steam, Roblox and Minecraft, plus crypto wallets and documents, in a single pass. If those passwords are reused, one infected laptop unlocks everything.
The inbox that unlocks everything else
Think about what your inbox can do. Forgot your bank password? The reset link goes to your email. Same for your shopping accounts, your cloud storage, your social media. Whoever gets into your inbox can reset all of them, and can read years of receipts and addresses that make the next scam far more convincing.
Multi-factor authentication (MFA) means a password alone isn’t enough. Even if yours leaks tomorrow, the attacker still needs the code on your phone.
The fix: Turn on MFA. Use an authenticator app or passkeys rather than SMS codes where you can, and never share a one-time code with anyone, including someone claiming to be your bank.
From the Lat61 Threat Intelligence Team: MFA helps a lot, but it can be beaten. Our teardown of Tycoon 2FA, a phishing kit rented out for as little as $120 for ten days, showed how. The victim gets a fake “new voicemail” email, clicks through a fake CAPTCHA, and lands on a flawless copy of the real login page. Everything they type there, including the one-time code, is passed straight through to the real site by the kit, which then logs in as them. The code worked exactly as designed; it just went to the wrong person first. That is why we’d steer you towards passkeys wherever they’re offered: a passkey uses your phone’s fingerprint or face unlock and is tied to the real website, so there is no code to type and nothing for a kit like this to pass along. One more thing: if your phone asks you to approve a login you didn’t start, don’t tap Approve just to make it go away. Someone has your password and is trying to get past the second step.
The message you answered too fast
Phishing hasn’t changed much in principle: a message that appears to come from someone you trust, asking you to do one small thing. What has changed is the range. It arrives by email, by text (smishing), and increasingly by phone call (vishing), and it works for the same reason it always has: it lands at the right moment and asks for something reasonable.
The old spotting tips don’t hold up anymore. Spelling mistakes? AI writes clean English. Check the logo? The pages are exact copies. And one increasingly convincing form is the voice call. Attackers clone a voice from a few seconds of video posted online, then ring you as your daughter, your manager, or your bank’s fraud team. The story is always the same: something has gone wrong, and you need to act right now.
This isn’t a future problem. The FBI tracked AI-assisted fraud for the first time in 2025: more than 22,000 complaints and nearly $893 million lost, with voice cloning and convincing videos of loved ones among the tools used [1].
The fix: Never act from inside the message. Whatever it asks you to do, whether that’s pay, log in, confirm your details, or call a number, close it and go in through the front door instead: open the app you already have, type the website address yourself, or ring the number printed on the back of your card. If the request is real, it will be waiting for you there. If it isn’t, it won’t exist anywhere except inside the link they sent you. For phone calls, the same rule applies: hang up and call back on a number you looked up yourself. A real bank will never be offended by that, and will never ask you to move money to a “safe account”.
From the Lat61 Threat Intelligence Team: Next year it will be a different event and the same trick. In June our team found clusters of fake World Cup ticket sites running full checkouts, complete with order IDs and familiar payment logos. Some didn’t bother stealing cards at all and simply redirected fans to gambling sites.
The update you keep putting off
All software has bugs, and some of those bugs are security holes: ways for an attacker to get into your phone, laptop or router without you doing anything wrong. When a company finds one, it fixes it and sends out an update. That’s what most of those “Update available” prompts are.
The catch is that the fix is also an announcement. Once an update is released, attackers study it to work out what it fixed, then go looking for everyone who hasn’t installed it yet. Every “Remind me tomorrow” is another day you’re on that list.
Many of the nastiest infections don’t need you to click anything. A malicious ad on a legitimate site or a booby-trapped PDF can be enough if you’re running last month’s browser. The same goes for your router and smart TV, which nobody updates unless you do.
The fix: Turn on automatic updates for your operating system, browser, and apps. Restart your devices once a week, and retire anything that no longer receives updates.
From the Lat61 Threat Intelligence Team: This is how botnets get built. Our analysis of Mirai shows how it works: it scans the internet for routers and cameras that are still running old software with known security holes, or still using the password they shipped with, and walks straight in. Each device it gets into becomes a bot that attacks other targets on command, and the owner never notices anything.
The app you never checked
This is the one that got Emma. It’s never been easier to build an app, which means it’s never been easier to build a bad one. Anyone can describe an app to an AI tool and ship it within the hour, untested.
From your side of the screen, it looks like fake banking apps that copy the real icon, “free” PDF converters that harvest your contacts, browser extensions that get sold to a new owner and quietly update themselves into spyware, and “install this to track your order” links that bypass the app store entirely.
The common thread is permissions. An app can only steal what you let it see. A flashlight app doesn’t need your microphone.
The fix: Install from the official app store only, never from a link in a message. Read the permissions before you tap Accept, and delete anything you haven’t opened this year.
From the Lat61 Threat Intelligence Team: Emma’s story is drawn from our analysis of Crocodilus, which we found hiding inside QR scanners, phone cleaners, and crypto trackers. Once installed, it asks for Accessibility access, then draws a fake login screen over your real banking app, reads your OTP texts, and even adds fake “Bank Support” numbers to your contacts. A useful-looking app, one permission too many.
The attachment you weren't expecting
The phishing email doesn’t always want your password. Sometimes it just wants you to open the file. An invoice, a shipping document, a voicemail, a CV, a scanned contract. It looks like a PDF or a zip, and inside is a small script whose only job is to fetch the real payload.
What arrives is usually a remote access trojan, or RAT: software that hands a stranger your keyboard, your webcam, your files, and your saved passwords for as long as it goes unnoticed.
The fix: Treat any attachment you weren’t expecting as suspect, even from a name you know, because their account may be the one that’s compromised. If it isn’t a plain document, photo or PDF you were expecting, don’t open it, and never click “Enable content” when a file asks you to. When in doubt, ask the sender on a different channel whether they actually sent it.
From the Lat61 Threat Intelligence Team: This is the most common chain our team sees, and we’ve taken apart several of these this year. Agent Tesla arrived as an ordinary-looking phishing email and, once running, recorded every keystroke and raided the clipboard for passwords. BotHelper went further: it let the operator watch the victim’s screen live, as it happened. Both started with an attachment.
The blackmail email with nothing behind it
It arrives with a crude subject line and gets straight to the point. Your computer has been infected, it says. Your webcam has been recording you. Pay $1,200 in Bitcoin within a couple of days, or the footage goes to your family, your colleagues, and everyone in your contacts. It may add that the malware has already deleted itself, so there is no point looking for it, and that copies of this email will keep arriving until you pay.
In campaigns like the one our team analyzed, the threats are often bluffs. The threat actors provide no evidence that they actually possess the footage they claim to have. The email is sent in identical form to millions of addresses from lists bought or stolen years ago, and it earns its money from the small fraction of people frightened enough to pay before thinking. If it offers any proof, it’s usually an old password that came from a data breach, not from your webcam.
The fix: Don’t reply, don’t pay, and don’t click anything in it. Delete it. If it quotes a password you still use anywhere, change that password. Report it to your email provider as phishing so the filters learn, and if the webcam thought bothers you, a sticker over the lens costs nothing.
From the Lat61 Threat Intelligence Team: In July, our team traced one of these campaigns back through Phorpiex, a botnet made of ordinary infected home computers. The uncomfortable detail is who sends the emails: the victims’ own machines. Once a PC is infected, it quietly downloads a list of target addresses, disguised as a .jpg file, and starts sending the sextortion emails by the thousand. In the background, it also mines cryptocurrency, capped at a quarter of the processor so the owner doesn’t notice the slowdown, and swaps any crypto wallet address the owner copies for the attacker’s own. The person reading the threat and the person unknowingly sending it are often the same kind of victim.
What habits alone can't fix
Here’s the honest part. Even people who do all seven of these things still click the wrong link sometimes. A convincing scam lands at the end of a long week, when you’re tired and the app has four and a half stars. A brand-new piece of malware hasn’t been seen by anyone yet. A website you’ve trusted for years gets compromised.
Sometimes the attack doesn’t touch you at all. It lands on a company you trust and arrives as a legitimate-looking update. And some scams are built for careful people: ClickFix shows a fake error and talks you into “fixing” it by pasting a command yourself. No habit covers all of that.
Good habits make you a worse bet. They don’t take you off the table. For the rest, keep security software running on every device and let it do its job quietly in the background.
Cybercriminals running these operations were never counting on you being an expert, only on you being ordinary. Most of the time, being slightly less ordinary than the next person is enough. Don’t make it easy for them.
References
- Federal Bureau of Investigation, 2025 Internet Crime Report, Internet Crime Complaint Center, published April 2026. Figures used: 1,008,597 complaints; nearly 3,000 complaints per day; nearly $21 billion in reported losses; 22,364 AI-related complaints costing nearly $893 million. Press release · Full report (PDF)
All other real-world cases cited in the From the Lat61 Threat Intelligence Team notes link directly to the relevant Point Wild analysis.
The Cybersecurity Awareness Month 2026 theme, Don’t Make It Easy for Them, is set by the National Cybersecurity Alliance.