The Signal

That bargain streaming box promising free everything maybe moonlighting: security researchers keep finding cheap, off-brand Android TV devices that quietly rent out your home internet connection to strangers, criminals' traffic exiting through *your* address, while running ad fraud in the background. How the "too cheap to be true" box economy works, how to tell if a device in your living room is respectable, and the one buying rule that ends the problem.

The gold-bar courier scam, the most expensive con running against older Americans, with individual losses routinely in the hundreds of thousand. A layered cast of fake tech support, fake bankers, and fake federal agents convinces someone their savings are in danger, walks them into buying real gold from a real dealer, and sends a courier to collect it "for safekeeping." Today: the full anatomy, the moment-by-moment tells, and the one dinner-table sentence that beats it, because this is the episode built to be played for your parents.

Google just patched a Chrome flaw that criminals are actively using, not theoretical, not a demo, in use against real people. Your to-do is thirty seconds. And since scary headlines about this will use the term all week, today we finally decode the most dramatic phrase in security news: "zero-day." It's a holiday; we'll keep it quick.

Those six-digit codes your phone gets when you log in somewhere, the show has spent all summer telling you to turn them on. Today is the fine print: the scam where a criminal, already holding your password, triggers a *real* code from your *real* bank and then calls to ask you to read it back "for verification." One rule makes you immune, and it has no exceptions: a code is for typing into a site, never for telling a human.

A warning making the rounds this week: pop-ups shouting "your browser is out of date. update now!" are appearing on real, otherwise trustworthy websites that have been quietly compromised. The "update" they offer is malware. The tell is beautifully simple, and it's the flip side of a habit this show already taught: real updates install themselves. Software that begs isn't yours.

A healthcare technology vendor called CareCloud, which most of its victims couldn't have named, confirmed this month that records of more than 3.75 million patients were stolen. What was stolen? Social Security numbers, IDs, financial details, health insurance information. It's the signature breach of a category we've never covered: medical data. Why it leaks from companies behind your doctor, why it's worth more than a credit card number, and the specific playbook for protecting yourself, because this one has its own.

Roblox, the game platform two-thirds of American kids aged 9 to 12 have played, is facing more than 170 federal lawsuits and actions from multiple states alleging it made it too easy for adults to pose as children and target young users. What the allegations describe, what Roblox has changed, and the five protections that matter most. which work on every platform, not just this one.NCMEC Cyber Tipline https://report.cybertip.org/NCMEC Take It Down https://takeitdown.ncmec.org/

Passkeys, the sign-in method quietly replacing passwords on Google, Apple, Amazon, PayPal, and more. What they actually are in plain English, why they defeat the two attacks this show covers most (phishing and credential stuffing), the honest fine print, and the ten-minute way to start tonight with the one account that matters most.

Fitness apps like Strava have accidentally revealed secret military bases, an aircraft carrier's position, and the movements of presidents. This all through workouts shared by people trained in secrecy. Today: what that means for the rest of us, why the sensitive data isn't your heart rate but your *routine*, and the fifteen-minute settings audit that lets you keep the app and lose the exposure.

A newly documented Android attack turns a victim's own phone into a card reader for criminals: one convincing "bank" phone call, one sideloaded app, and then the killer move, "tap your card on your phone and enter your PIN to verify." Thirteen minutes, start to finish, including a loan taken out in the victim's name. Today: how tap-to-pay actually works, why the scam needs *you*, and the rules that end it.

Breach notices are arriving at a record pace. Over 471million victim notices in just the first half of 2026 and the letters themselves are quietly getting emptier. Only about a quarter now say what was actually taken, which is down from over ninety percent five years ago. Today: why the letters shrank, and the five-minute skill of reading one anyway, including where to find the details the letter left out.

The FTC said out loud on August 10 what most people assume isn't true. Social media platforms don't always vet the ads they show you, or the advertisers behind them. People reported losing $95 million in 2025 just from ordering something they saw in a social ad, and $2.1 billion to social media scams overall.

Aura, a company whose product is protecting your identity, disclosed that an attacker tricked an employee by phone and accessed roughly 900,000 records from a marketing database. The irony writes the headline, but the useful episode is underneath: what these services really do, what the free version looks like, and how to decide if paying makes sense for your family.

The Canvas breach, the largest education data breach on record, touching roughly 275 million accounts across nearly nine thousand schools and universities. Data lost included private messages between students and teachers. As families log back in this month: what was taken, what the ransom payment did and didn't buy, and what parents and students can actually do about a platform they can't opt out of.

Modern cars quietly record how you drive. Your braking, speed, acceleration, location, timing and a chain of lawsuits and state investigations alleges that data has been flowing to data brokers and on to insurance companies. Some drivers discovering it only when their premiums jumped. What your car collects, where it allegedly goes, and the two concrete things you can do about it.

Weekly Signal, covering what you missed over the last week.

A phishing campaign impersonating Bank of America tricks people into installing "Account Guard". Supposedly protection software, actually a remote-access tool that hands a stranger the keys to your computer, disguises itself as "Windows Security," and resists removal. The rule this episode installs instead: no real company will ever ask to see or control your screen.

Back-to-school is the second-biggest shopping season of the year, and scammers run their own semester right alongside it: fake school messages, fake supply deals, fake scholarships, fake housing. One field guide, four costumes, one rule: anything about your kid or your money gets verified through the school itself.

Hackers disrupted more than 30 Minnesota community water systems, and utilities in at least seven states have reported similar incidents. They locked out operators, boil-water notices were sent out, and plants switched to manual operations. The scariest-sounding headline of the summer, and the verdict is calmer than you'd think: no contamination reported, real safeguards held, and the two things a normal person should do are simple.

Weekly Signal, covering what you missed over the last week.

Camera-and-microphone smart glasses have gone mainstream, and the backlash is real: covert recording of strangers, a lawsuit over who actually sees the footage, and researchers showing the glasses can be paired with facial recognition. What's the actual risk to a normal person?

Those random texts: "Hey, how've you been?", "Are we still on for dinner?", "Hi, this is Amy", aren't mistakes. They're the opening move of one of the most patient scams running, and the entire defense is refusing to say hello back.

A flaw in Meta's AI support chatbot let attackers reset the password of Instagram accounts. No hacking, just asking. About 20,000 accounts were hijacked. Every account with two-factor authentication turned on was untouched

Weekly Signal, covering what you missed over the last week.

ClickLock, a new Mac malware, doesn't sneak. Instead, it bullies. It closes every app you open, over and over, until you type your password into its fake prompt. But the whole attack starts with one trick anyone can learn to spot: a "prove you're human" page that asks you to paste a command.

That's Not Your Daughter Calling: the AI "cloned voice" emergency scam the FBI is warning about, and the free family safe word that beats it.

The "boss scam": an email or text that looks like it's from your CEO or manager, asking for your cell number and then an urgent favor, usually buying gift cards. This episode is a field guide to the tells, dedicated to someone I know who just faced it.

Weekly Signal, covering what you missed over the last week.

Five people were just charged in the UK over "Russian Coms," a subscription service that let scammers make their calls appear to come from real bank phone numbers, over 1.8 million scam calls and an estimated 170,000 victims.

The $88 Scam-Text Factory: why those "unpaid toll" and "package on hold" texts keep coming, and the one habit that stops them cold.

Weekly Signal, covering what you missed over the last week.

New university research tested 281 of the most-downloaded free VPNapps and found many fail at the one job people install them for. The flagged apps havebeen downloaded over 2.4 billion times combined.

Welcome to Signalpost Cyber. I'm here to be your signpost through the noise. Cutting jargon, skipping the panic, and telling you plainly whether that scary headline actually affects you. Every episode: what happened, should you care, what to do. This is the calm you've been missing.