A wave of phishing scams is currently targeting Amazon users, putting millions of accounts at risk. Criminals are sending fake emails and text messages that appear to come from Amazon, tricking users into clicking on links that lead to fraudulent login pages. If you enter your details on these fake pages, your account can be hijacked.
Amazon has confirmed that some of these phishing messages claim your Prime subscription is being renewed at a suspicious price. The messages often include personal information to make them look more believable. In some cases, users are sent text messages about fake refunds or order issues, further increasing the chances of someone falling for the scam.
Cybersecurity firm Guardio recently reported a dramatic rise in such attacks, noting a 5000% increase in fake Amazon texts over just two weeks. These messages aim to trick users into entering their Amazon credentials, which the attackers can then use to take over accounts.
While Amazon has removed tens of thousands of fake websites and phone numbers used in these scams, the attacks continue to spread. The U.S. Federal Trade Commission (FTC) has also issued warnings, reminding consumers that Amazon will never ask for sensitive information over email or text.
To help protect users, Amazon is urging everyone to update their security settings. Here’s what you should do right away:
1. Turn on Two-Step Verification (2SV)
This adds an extra layer of protection to your account. Once enabled, you’ll need both your password and a one-time code to sign in.
• Avoid using SMS for 2SV — it’s less secure.
• Instead, use an authentication app like Google Authenticator or Apple’s Passwords.
If you’ve already set up 2SV through SMS, switch to an app by turning off the current method, clearing your 2SV settings, and enabling it again using your preferred app.
2. Use a Passkey for Sign-In
Passkeys are a newer, more secure login method that links your Amazon account to your device’s fingerprint or face unlock feature. Unlike passwords, passkeys cannot be phished.
• Even if someone tricks you with a fake login page, they won’t be able to access your account without your physical device.
These two simple steps can greatly reduce your risk of being hacked. With phishing scams on the rise, now is the time to update your settings before it’s too late.
An app for tracking employee productivity by logging keystrokes and capturing screenshots was hit by a major privacy breach resulting in more than 21 million images of employee activity left in an unsafe Amazon S3 bucket.
Experts at Cybernews discovered the breach at WorkComposer, a workplace surveillance software that monitors employee activity by tracking their digital presence. Although the company did secure access after being informed by Cybernews, the data was already leaked in real time to anyone with an internet connection, exposing the sensitive work information online of thousands of employees and companies.
WorkComposer is an application used by more than 200,000 users in various organizations. It is aimed to help those organizations surveil employee productivity by logging keystrokes, monitoring how much time employees spend on each app, and capturing desktop screenshots every few minutes.
With millions of these screenshots leaked to the open web raises threats of vast sensitive data exposed: email captures, confidential business documents, internal chats, usernames and passwords, and API keys. These things could be misused to target companies and launch identity theft scams, hack employee accounts, and commit more breaches.
Also, the businesses that have been using WorkCompose could now be accountable to E.U GDPR (General Data Protection Regulation) or U.S CCPA (California Consumer Privacy Act) violations besides other legal actions.
As employees have no agency over what tracking tools may record in their workday, information such as private chats, medical info, or confidential projects; the surveillance raises ethical concerns around tracking tools and a severe privacy violation if these screenshots are exposed.
Since workers have no control over what tracking tools may capture in their workday, be it private chats, confidential projects, or even medical info, there’s already an iffy ethical territory around tracking tools and a serious privacy violation if the screenshots are leaked.
The WorkComposer incident is not the first. Cybernews have reported previous leaks from WebWork, another workplace tracking tool that experienced a breach of 13 million screenshots.