As Android Central reports, users have received unexpected emails telling them their phone number has been verified for secondary Google accounts.

Like me and many others, you may have one Google account for everyday use, another for work, and a third for things you would rather keep separate. But if you’re using an Android phone, those accounts may have something in common that you didn’t intend or even know about: your phone number.

Google’s own documentation confirms that phone number verification is on by default and adds your number to all Google accounts signed in on the device. This applies to both existing accounts and any you add later.

Google says phone number verification helps support features such as signing in, account recovery, Rich Communications Services (RCS) messaging, and finding or securing a lost device.

But it also means that a number you intended to use with your main account can become associated with a secondary account simply because both are signed in on the same Android device.

If you deliberately left your phone number off a secondary account, this links it to your real identity without you knowingly making that connection. Your number doesn’t automatically become public, but Google gains another way to connect accounts you wanted to keep separate.

This reminded me of an article I wrote about unexpected Google account connections: “Google Play sign-ins can be abused to track another person’s movements.” Signing in to Google Play on one phone allowed me to see its movements in Google Maps Timeline.

“After some digging I learned that my Google account was added to my wife’s phone’s accounts when I logged in on the Play Store, but was not removed when I logged out after noticing the tracking issue.”

While that particular issue should be solved by Google’s move toward device-based Timeline storage, unwanted phone number associations need to be removed manually.

How to remove your number from separate accounts

Phone manufacturers arrange their settings differently, so there may be some differences in menu names and locations. We tried to make sure everyone can follow these instructions, but there might be makes and models where you get stuck. Feel free to ask in the comments and maybe others with the same phone can help you.

Step 1: Turn off automatic phone number verification

This needs to be done on the Android phone itself:

• Open the phone’s Settings app.
• Tap Google. On some phones, this may be called Google services or Google services and preferences.
• Open All services.
• Under Privacy & security, tap Phone number verification.
• Turn off Verify phone numbers automatically, or the equivalent verification switch shown on your phone.

Turning this off does not remove numbers already added to your accounts.

Step 2: Check which accounts already have your number

This step can be done in a browser, so should be the same for everyone.

• Open a browser and type myaccount.google.com into the address bar.
• Check the account picture or initial in the top-right corner. Make sure you are looking at the account you want to inspect.
• Select Personal info.
• Find Contact info, then select Phone. Depending on the layout, you may see Phone directly.
• Select any number listed to review its details and how it is used.

To remove the number from that account, select the delete icon and follow the on-screen instructions. Repeat for each account you want to check.

Step 3: Check for other uses of the number

There’s a wrinkle. Google says changing a number in your Google Account only affects some services. Other services, such as 2-Step Verification, may use the number separately and may not all appear on the Phone page.

On each account you are cleaning up:

• Check the number’s Usage section on the Phone page to see which services are listed.
• Visit Security or Security & sign-in and review your recovery phone and 2-Step Verification settings.
• If you use another Google service that has its own phone number settings, check those settings too.

If your goal is to remove the number entirely from a particular account, don’t assume deleting it from Personal info has removed every separate use. Check those security settings as well, but make sure to keep a working alternative sign-in and recovery method before removing the number.

Android Central reports that some users say automatic verification switches itself back on after they disable it. Those are user reports, not confirmation that this happens on every phone. But if you’re concerned, check the setting again later.

---

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

.wp-block-kadence-advancedbtn.kb-btns97520_6de029-2f{gap:var(--global-kb-gap-xs, 0.5rem );justify-content:flex-start;align-items:center;}.kt-btns97520_6de029-2f .kt-button{font-weight:normal;font-style:normal;}.kt-btns97520_6de029-2f .kt-btn-wrap-0{margin-right:5px;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button{color:#555555;border-color:#555555;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{color:#ffffff;border-color:#444444;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button::before{display:none;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{background:#444444;}

Data breach notifications are telling victims less than ever. What the company leaves out can still shape what you do next.

You receive an invitation to a password-protected meeting, a secure chatroom, or a shared document. To get access, it says, you need to enter a short code on a sign-in page for one of your accounts.

The message claims the code will let you open the document or join the meeting. In fact, it approves a sign-in the scammer started.

The page is real and the code works, which is why this type of attack—known as device code phishing—is so dangerous.

Device code phishing abuses a legitimate sign-in feature intended for devices that cannot easily display a normal login screen (such as smart TVs, printers, conference-room equipment, and some command-line tools). Instead of entering a username and password on the device itself, you open a browser on another device, visit a sign-in page, enter a short code, and approve the sign-in. This allows the app or device that displayed the code to access your account.

In this phishing attack, the scammer starts the sign-in and gets you to enter the code and approve the request. That can give the scammer access to your account.

How device code phishing works

Device code phishing relies on the OAuth 2.0 Device Authorization Grant, a standard sign-in method for devices with no browser or limited input.

An attack generally follows these steps:

1. An attacker starts a legitimate device code sign-in request for an app or device they control.
2. The sign-in service generates a short, temporary code and a legitimate verification page.
3. The attacker uses social engineering, such as a fake Teams invite, a document-sharing request, or an invitation to join a “secure” chat, to pass that code to the victim.
4. The victim visits the genuine sign-in page, enters the code, and approves the request.
5. The attacker’s waiting device receives authentication tokens.

Those tokens act as digital passes, allowing the attacker to access the victim’s account without knowing their password.

What the attacker can access depends on the app and the permissions granted. It could be limited to one service, or include email, files, contacts, and other services. Multifactor authentication (MFA) doesn’t necessarily stop this attack, because the victim may complete the MFA check themselves while authorizing the attacker’s sign-in.

Checking the address alone will not reveal this as a scam because it’s a legitimate page. For example, in an attack targeting a Microsoft account the victim may be sent to a genuine Microsoft sign-in page, such as microsoft.com/devicelogin. Some approval screens identify the app requesting access, but others may not.

The key question to ask yourself here is: Did this code appear in an app or on a device I was trying to sign in to, or was I given it to open a document, join a meeting, or pass a security check?

How to stay safe

Device code phishing is a feature of phishing kits such as EvilTokens. Be cautious if an unexpected message asks you to:

• Enter a code on an account sign-in page.
• Approve a sign-in for a device or application you did not set up.
• Use a sign-in code to join a meeting, access a document, or enter a chatroom.
• Act urgently because an invitation, document, password, or account supposedly expires soon.
• Move a conversation to another messaging app and complete a “security check.”

If you entered the code and approved the sign-in, check the account’s recent activity, connected apps, and devices for anything you don’t recognize. Sign out everywhere and change your password.

Pro tip: Use the free Malwarebytes Scam Guard to help you assess a suspicious message and decide what to do next.

---

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

The tech journalists at 404 Media learned that OpenAI is hiring hundreds of contractors to read and review a massive stream of real users’ ChatGPT prompts and responses.

“Project Lily” is reportedly a program that asks contractors to score or critique ChatGPT’s answers to improve the chatbot’s quality and behavior.

The fact that prompts may sometimes be reviewed by humans should not come as a complete surprise. AI companies also monitor conversations for safety reasons. Anthropic, for example, says it has disrupted attempts to misuse AI for biological weapons research.

But there should be a meaningful distinction between reviewing conversations for safety or abuse and reviewing them for ordinary model improvement.

OpenAI says a limited number of authorized personnel and trusted service providers may access chats for several reasons, including investigating abuse, providing support, handling legal matters, and improving its models.

OpenAI told 404 Media that it uses a “Privacy Filter” model to remove personal information before prompts reach reviewers, while acknowledging that sensitive details can still get through.

The prompts are anonymized in the sense that reviewers do not see the username of the ChatGPT user who entered them. But reviewers may see personal details in the conversation alongside a “user memories summary,” which provides an overview of how that user has previously used the chatbot. Together, this information could still reveal a great deal about that user.

It’s sometimes easy to forget that you’re not having a private conversation when you’re going back and forth with an AI chatbot. This isn’t an alarmist warning against using AI, but a reminder to be mindful of what you disclose because it could be read and reviewed.

How to opt out of AI chatbot training

ChatGPT

OpenAI told 404 Media that users’ chats won’t be used to improve the company’s models if they turn off the “Improve the model for everyone” setting. This is turned on by default for Free, Plus, and Pro plans, so users need to turn it off themselves if they wish to opt out.

However, opting out does not prevent all human access. OpenAI says authorized personnel and trusted service providers may still access content when necessary to investigate abuse or security incidents, provide support, troubleshoot problems, or handle legal matters.

In ChatGPT, select your profile icon, then go to Settings > Data Controls and turn off Improve the model for everyone. On mobile, open the sidebar, select your profile icon, and then follow the same steps.

Perplexity

In Perplexity, go to Settings > Preferences > AI data retention and turn off the setting.

Perplexity says this prevents data collected after you opt out from being used to train AI models. It does not remove data collected previously, and your data may still be processed to operate and improve the service or comply with legal obligations.

Claude

In Claude, select your name and go to Settings > Privacy. Under Help Improve our AI Models, turn off the setting.

Anthropic says new chats and coding sessions will no longer be used for future model training. It will also stop using previously stored conversations in future training runs, although data already included in training can’t be removed.

Anthropic also notes one important exception:

If our safety classifiers flag your conversations, they may still be used to improve our internal trust and safety models, detect harmful content, enforce our policies, or advance our safety research.

If you use other AI tools, check their privacy policies and settings to find out whether your conversations can be reviewed or used for model improvement and whether you can opt out.

---

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Don’t panic if you spot an illegally created image or video of you online – there are ways to request its removal

MIT Technology Review’s How To series helps you get things done. 

Your thermostat may not look like a power plant. Neither does your electric vehicle, home battery, or HVAC system. But utility and energy companies increasingly want to treat them like one.

A virtual power plant, or VPP, is a collection of household devices (such as smart thermostats, electric-vehicle chargers, home batteries, and solar panels) that a utility can control. Usually that means commanding the devices to draw less electricity during peak hours. For example, the utility might adjust your thermostat or delay or slow EV charging when electricity demand is high. 

In exchange, the utility offers VPP participants a discount on their energy bills and, in some cases, a signing bonus. Seth Frader-Thompson, CEO and cofounder of EnergyHub, a software company that helps utility companies run VPP programs, says a smart thermostat program may offer an initial bonus of roughly $50 to $150, plus about $25 to $50 per year, while home battery and EV devices could yield hundreds or thousands of dollars in annual savings.

The amount of power the utility might throttle in any one home is small. But it adds up, Frader-Thompson says. “When you put it together at the scale of hundreds of thousands, or millions, it has a pretty profound impact,” he says, equivalent to “firing up a power plant.”

As of 2023, there were already more than 500 VPP programs operating in the US alone, and the number has only grown since, especially with big players like Google starting to invest in this technology to help power their data centers. An estimated 4 million households with smart thermostats were enrolled in a VPP program as of last year. 

But the approach is still new, and some programs may still have some kinks to work out, says Severin Borenstein, faculty director of UC Berkeley’s Energy Institute at Haas and member of the board of governors of the California Independent System Operator, which manages most of the state’s electric grid. If a program is not implemented well, he says, a utility may incorrectly predict when VPP participants plan to use more electricity and pay them for not using energy they weren’t planning to use anyway, potentially increasing energy bills for nonparticipants. Still, Borenstein says, “if we do it well, I think it can really be a benefit,” one that could help utilities avoid an expensive grid upgrade or emergency measures to conserve power.

Most consumer VPPs today are less dramatic than the name suggests and don’t actively send energy from your EV or home battery to the grid. But battery-to-grid programs are on the rise—and potentially offer even larger savings for consumers in the future.

So how do you actually sign up for a VPP? And how do you know if it’s worth it?

1. Check whether your utility company has a program and, if so, whether it actually supports your devices.

The types and brands of home devices supported vary from program to program. Your utility’s website is the obvious place to look to see if yours qualifies, but it’s important to note that you may not actually see the phrase “virtual power plant” anywhere. You may have better luck searching for your utility’s name plus terms like “demand response,” “peak rewards,” “connected solutions,” “battery storage,” “smart thermostat rewards,” “managed charging,” or “bring your own device.”

But don’t stop with the utility, Frader-Thompson says: “The way most people actually learn about this and sign up is through the manufacturer of the device they have.” In other words, the offer may show up through your smart thermostat app, EV app, or battery app, or in an email from the company that made the device.

Once you find a program, the instructions for enrollment may be as simple as clicking through an app, filling out a utility form, or confirming your account and device information through a third-party enrollment page. EV drivers may be able to see the terms and payment in their automaker app and enroll “with a click of a button,” says Joseph Vellone, CEO of the EV-focused VPP company ChargeScape.

Eligibility can get annoyingly specific. A smart thermostat program could require an approved Wi-Fi thermostat; an EV program may depend on your automaker, charger, utility territory, or rate plan; a battery program may depend on the battery brand, inverter, or installer and whether your system can communicate with the utility.

These programs are also not evenly distributed across the country. Most programs are established in places with lots of flexible devices, stressed grids, supportive utilities, or strong state policies—especially California, Texas, New England, and increasingly parts of the mid-Atlantic region.

2.  Ask yourself how much flexibility you can afford.

Before you sign up for a VPP, you’ll want to determine whether you’re willing to let a company adjust a device in your home—even if it typically happens only a few times a week.

For some people, this may be an easy decision: If your EV sits plugged in all night but only needs two hours to charge, shifting when that charging happens may be almost invisible. A home battery program could be lucrative if you understand how often the battery will be used, how much backup power you can keep, and whether extra cycling affects your equipment.

Other households, however, “do not have the flexibility to engage in one of these programs,” says Sanya Carley, a professor at the University of Pennsylvania and faculty director of the Climate Center for Energy Policy. She says that people who work night shifts, have caregiving responsibilities or health needs, or are already aggressively limiting their energy use to save money may have less room to allow a utility to adjust heating, cooling, or charging rates during peak hours for grid demand. 

3. Review the opt-out rules and read the fine print.

VPP programs generally give participants the ability to override temporary changes made by the utility. This right to “opt out” is what makes them workable for many customers. Can you skip a day of the program on your thermostat if you’re planning to have guests over? Can you tell your car to charge immediately before a long road trip? Can you keep a battery reserve for outages? Utilities are typically motivated to make the opt-out process as simple as possible, with few rules and restrictions.

It could also be worth investigating where your data might be going. EV and battery programs may need to collect data about things like charging status and schedule, or how much power a device is drawing, while smart thermostat data may reveal patterns about when people are home, sleeping, or using appliances.The Electronic Frontier Foundation, a nonprofit focused on digital rights, has warned that this data could be used to infer private routines inside a home; depending on the program, that information may not only move through a utility but get distributed to device manufacturers, software platforms, or third parties involved in running the program.

ChargeScape and Energy Hub say the data used for these programs is limited and functional. EV data is focused on “the physics and the energy of the asset itself,” Vellone says. Frader-Thompson explains, “It doesn’t really matter what any one customer is doing. It matters what the average customer is doing.”

4. Decide whether the offer is worth it for you.

The amount of compensation for signing up for a VPP can vary widely. The payment also may not come as a regular check. It might be a signup bonus, a gift card, a monthly bill credit, a discounted thermostat, free or cheaper EV charging, an annual performance payment, or additional “export credits” for energy sent back to the grid. 

The most expensive devices, namely EVs and home batteries, are often what yield the greatest savings, which adds a barrier to entry for those who cannot afford these products in the first place. A smart thermostat program can be a low-stakes way to start.

You might have a variety of reasons for wanting to sign up, including supporting the overall health of the grid or avoiding the construction of a new power plant in your community. “There are not that many things that you can do that directly contribute to decarbonizing the electric supply, or to improving affordability, or to improving reliability, and this is just a clearly effective way to do that,” Frader-Thompson says. “And you get paid for it.”

In short, the best VPP program is not necessarily the one that pays the most. It’s the one that clearly tells you what it can control, how much money you’ll get, how easily you can say no—and how well it supports a community’s energy goals. Your home probably won’t feel like a power plant. But if your thermostat, car, or battery can bend a little when the grid needs it, your home can act like a small piece of one.

A Google spokesperson announced on Reddit that it has started rolling out the first version of its Advanced Flow, designed to make installing apps from unverified developers safer.

Let us explain what sideloading is, why Google Play is not 100% safe, what to look for when you’re sideloading so you can do it more safely, and how Google’s Advanced Flow helps with that.

What is sideloading?

Sideloading lets Android users install apps from outside Google Play. It can be useful, but it also creates opportunities for scams and malware.

Android’s openness is one of its enduring strengths. You are not limited to a single app store: You can install apps from a developer’s website, an alternative marketplace, an enterprise portal, or a file shared directly with you.

That is called sideloading. It is not automatically dangerous, but it removes some of the guardrails that come with conventional app-store distribution. Getting apps from the Google Play Store itself is no guarantee of safety, but there is at least some vetting. Google says it blocked more than 1.75 million policy-violating apps from being published in 2025 and banned more than 80,000 developer accounts associated with harmful apps.

There are several reasons for sideloading:

• The developer distributes an app directly from its own website
• An app is unavailable in your country or on Google Play
• An alternative app repository offers what you’re after, for example open-source software
• You need an enterprise, beta, or specialized app
• You want to install a version that is not currently offered through Google Play

But malware authors and online scammers use the same flexibility. They may impersonate banks, delivery services, government agencies, crypto platforms, news readers, or job recruiters, then urge victims to install an app to “secure” an account, receive a payment, or resolve an invented problem.

Google Play is not a free pass

Google Play has review processes, policy enforcement, developer controls, and Google Play Protect. It also runs ongoing checks after an app is published. Those measures meaningfully reduce risk, but they do not make every listing harmless or every developer trustworthy.

Threats that can still surface through official channels include:

• Trojans disguised as useful utilities, games, or financial apps
• Adware and apps that misrepresent their behavior
• Subscription traps and deceptive billing practices
• Data-harvesting apps that request more access than they need
• Sleeper apps that change behavior after passing an initial review

Google Play Protect checks Play Store apps before download and also scans apps from other sources. It can warn about, disable, or remove potentially harmful apps, but it should be viewed as one layer of security, not a substitute for scrutinizing an app before installing it.

---

---

In short, “available on Google Play” is a positive signal, not a security verdict.

Why sideloading requires attention

The main difference between installing from a recognized store and downloading an APK from elsewhere is not simply the file format. It is the trust chain.

When you sideload, you may have fewer assurances about:

• Who created the app
• Whether the file has been altered or repackaged
• Whether the download site is impersonating a legitimate developer
• Whether you will receive genuine updates
• Whether a scammer is manipulating you into disabling security protections

Social engineering is often the decisive factor. A convincing caller, pop-up, text, or chat message may insist that installing an app is urgent. The attacker’s goal is often to make the victim bypass warnings before they have time to question the request.

Treat any unexpected request to install an app as suspicious, especially when it comes with urgency, secrecy, a promise of money, or a claim that your bank, government, employer, or device provider requires it.

A legitimate bank, government agency, law-enforcement organization, or technical-support provider should not call or message you and instruct you to install an APK or weaken Android security settings.

How to sideload more safely

Sideload only when you have a specific reason for it, and make sure the decision came from you rather than an unexpected message or phone call.

• Start at the developer’s official site. Don’t use sponsored search results, random download portals, links sent by strangers, or lookalike domains.
• Verify the developer independently. Check the publisher’s official website, documentation, public code repository, and trusted community channels. The information supplied on the download page alone is not enough.
• Prefer established repositories. If an app is distributed outside Google Play, use a source with a strong reputation for provenance and signature verification where possible. For advanced users, it can be useful to compare an APK’s signing certificate or cryptographic hash against a value published by the developer. That is not practical for everyone, but it can help detect fakes.
• Do not install apps under pressure. End the call, close the chat, and independently research the claimed organization using contact details you find yourself.
• Keep Google Play Protect enabled. It scans apps during installation and periodically afterward, including apps installed from outside Google Play.
• Review permissions before and after installation. Be especially cautious if a simple app wants access to accessibility services, SMS messages, notifications, device administration, contacts, or screen recording.
• Keep Android and apps updated. Security fixes can protect against both operating-system flaws and known malicious app behavior.
• Use reputable mobile security software. A separate security layer can help identify risky behavior and provide additional visibility into potentially unwanted or malicious apps.
• Remove permissions and uninstall apps you no longer trust or use. An app that seemed harmless at installation can become a liability if its developer abandons it or changes direction.

How Google’s new Advanced Flow helps

Google is rolling out Advanced Flow for installing apps from developers that have not completed Android’s new identity-verification process. The feature is intended for users who understand the risks of installing unverified software but still need that flexibility.

The design is notable because it targets social-engineering attacks as well as malware. Instead of allowing an immediate, one-tap override, the flow requires users to:

• Enable developer mode in system settings. This is easy enough and helps prevent accidental or one-tap bypasses often used in high-pressure scams.
• Complete a quick safety check to make sure that no one is talking you into turning off your security. Scammers often pressure victims into disabling protections.
• Restart your device, which cuts off any remote access or active phone calls a scammer might be using to guide you.
• Wait one day, then confirm the change using biometrics, such as fingerprint or face unlock, or your device PIN. This one-time, one-day delay breaks the urgency scammers rely on, giving you time to think.

Once you have completed the process, you can choose to allow installs from unverified developers for seven days or indefinitely.

Advanced Flow does not mean Google Play is risk-free, nor does it make unverified apps inherently malicious. Developer verification establishes accountability: It connects an app to a verified developer identity, but it does not establish that every app is benign or suitable for every user.

At the end of the day, it’s up to you. Install apps because you chose them after checking the source, not because someone else manufactured an emergency.

Whether an app comes from Google Play or an external source, pause before installing. Check who made it, why it needs the permissions it asks for, whether the download route is trustworthy, and refuse when a stranger is trying to rush you. That little friction is a feature, not just a nuisance.

---

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

GitHub is rapidly becoming the go-to platform for sharing software. Originally built for developers to collaborate on code, it now hosts millions of projects ranging from hobby scripts to widely used applications. That popularity, however, has also made it an attractive delivery platform for cybercriminals.

For most home users, GitHub is not something you need to use in your daily life. You might encounter it when searching for a tool, following installation instructions, or trying out something recommended on a forum or social media. And that’s where the risk begins. GitHub is not an app store. It does not check every repository for safety, and anyone can upload code, including cybercriminals.

Recent campaigns highlight how this can be abused. We’ve seen cybercriminals create convincing repositories that impersonate well-known brands like Malwarebytes and LastPass, offering downloads that are anything but legitimate. In other cases, hundreds of repositories have been spun up to distribute Trojanized versions of popular software. These pages often look polished, include documentation, and even fake user engagement to appear trustworthy.

We’ve also seen campaigns targeting specific groups, including retro-gamers, people looking for free AI agents, OpenClaw users, and people searching for AppleCare+ service.

What exactly is GitHub, and when should you use it?

At its core, GitHub is a code hosting platform. Developers use it to share source code, track changes, and collaborate. For home users, its legitimate uses include:

• Accessing open-source tools that are not available elsewhere
• Downloading updates or beta versions directly from developers
• Viewing the source code to understand how software works

For developers, GitHub is indispensable. For home users, it’s optional and should be approached with the same caution you’d apply to downloading files from anywhere else on the internet.

Unless you have a specific reason, you don’t need to download software from GitHub. Most mainstream applications have official websites or trusted distribution channels. If you find yourself on GitHub because a search result or online guide led you there, that’s a good moment to slow down and verify what you’re looking at.

How to stay safe

Malicious repositories often rely on a mix of social engineering and technical shortcuts. Some red flags include:

• Brand impersonation: The repository claims to be from a well-known company, but the account name doesn’t match the official organization. Attackers often use subtle variations or newly created accounts.
• Recently created accounts: A repository tied to an account that was created days or weeks ago is a warning sign, especially if it claims to host established software.
• Unusual download methods: Legitimate projects typically provide source code and, where appropriate, clearly documented releases. Be cautious if you’re encouraged to download executables directly from obscure links or archives.
• Inflated or fake activity: Star counts, forks, and issues can be manipulated. A repository with lots of stars but little meaningful discussion or contribution history may not be what it seems.
• Poor or generic documentation: Many malicious repositories copy text from legitimate projects but fail to maintain consistency. Look for vague instructions, broken links, or mismatched branding.
• Security warnings ignored: If your browser, antivirus, or operating system flags a download, take it seriously. These warnings are often your first line of defense.

Cybercriminals are increasingly exploiting trusted platforms to blend in and bypass traditional defenses. Recognizing that shift is key. The next time you land on a GitHub page offering a convenient download, take a closer look. A few extra seconds of scrutiny can save you from installing something you never intended.

• Use an up-to-date, real-time anti-malware solution and don’t ignore its warnings—even if, or especially if, the “developer” tells you to expect them.
• Remember that GitHub repositories do not undergo a vetting process. The responsibility for deciding what you can safely download ultimately lies with you.
• It’s usually safer to start from the vendor’s official website and follow its link to GitHub, rather than the other way around.

---

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.