❌

Normal view

Why BioWare's Neverwinter Nights still has thousands of active players

17 October 2026 at 07:00

Neverwinter Nights was made by the studio that produced seminal RPGs Baldur's Gate, Star Wars: Knights of the Old Republic, Mass Effect, and Dragon Age. It sold well and was critically acclaimed at launch. Yet, somehow, it has not been canonized in most gamers' minds over the decades the same way the games that came before and after it were.

Nonetheless, more than two decades later, it still has a tight-knit and surprisingly active community that none of those other games can rival. I think that's partly because it was a completely different beast.

Read full article

Comments

© GOG

‘There is no secret agenda’: Nara Smith on home-making absolutely everything, raising four kids at 25 – and why she’s definitely not a tradwife

10 October 2026 at 07:00

The model, actor and influencer is known for making her own frozen yoghurt, bubblegum or even toothpaste while dressed in immaculate haute couture. But she insists she is not who the internet thinks she is

Nara Smith is not a tradwife, she wants you to know that. Nor is she an ex-tradwife – pace the New York Times who included her in a feature on how ex-tradwives are as popular a movement now as the tradwives were in the first place. Nor was she peddling a tradwife-adjacent lifestyle choice by marrying at 18, having four children by 24, and devoting hours to cooking and documenting it online. Nor is she Mormon, by the way. Although, yes, her husband, the model and former teen heart‑throb Lucky Blue Smith, was raised Mormon, but we’ll get to that. Nor was she telegraphing subliminal religious messages in her content: “There is no secret agenda.” Nor was she abandoning her biracial heritage by wearing her hair in a sleek little bob. Nor was she leaning into a 1950s housewife archetype – even when dressed in a pink and red polka-dot minidress to batch-cook sourdough.

Smith wants you to scrap everything you think you know about her and start again. She also doesn’t care if you don’t. As with her content: “Those that get it, get it. Those that don’t, don’t. And that’s totally fine. I tell people: ‘If you don’t like my content, I won’t see you scroll past me.’ ‘If you need to block me for your own sanity, please do. I promise I won’t know.’ And if you want to stick around, that is beautiful, I’m grateful, welcome.”

Continue reading...

© Photograph: Mary Rozzi/The Guardian

© Photograph: Mary Rozzi/The Guardian

© Photograph: Mary Rozzi/The Guardian

‘People are feeling the real impacts’: influencers use humor to make fun of the private equity industry

9 October 2026 at 07:00

Skits and parodies making fun of the trillion-dollar industry have taken over social media, racking up millions of views

Johnny Hilbrant Partridge kept getting stuck next to the same kind of finance guy at weddings – the one bragging about his family’s full-time nanny and lavish vacations while name-dropping elite club memberships and private schools.

To Partridge, a former fitness instructor, their shameless knack for self-promotion felt ripe for comedy. Using a filter that puts an exaggerated sneer on his face, Partridge donned a puffer vest and created “The PE Guy”, a caricature of the men who work in the private equity industry.

Continue reading...

© Photograph: Bloomberg/Getty Images

© Photograph: Bloomberg/Getty Images

© Photograph: Bloomberg/Getty Images

StreamRat Android malware spreads through Meta and TikTok ads

3 September 2026 at 12:04

A malicious advertising campaign promoting a fake free TV-streaming service reached roughly 570,000 Meta users.

The researchers who discovered the campaign found that its streaming-themed ads were aimed at Spanish-speaking users, with most observed victims located in Spain. One Meta campaign ran from June 11 through July 3, 2026, and the same banners were also used to distribute the malware through TikTok.

The available data shows the ads’ reach, not the number of downloads or infections, but it demonstrates how quickly paid advertising can put a scam in front of a very large audience.

The ads promoted an Android banking Trojan and infostealer called StreamRat. It can monitor what’s on screen, capture information typed into apps, show convincing fake screens to steal usernames and passwords, and allow attackers to control the device remotely.

We often warn people not to click suspicious links in unexpected texts or emails. But malicious advertising is harder to recognize because it appears in the same feeds where people expect to find promotions, videos, and recommendations.

This campaign is a perfect demonstration of why “after-the-fact” ad checks are inadequate when it comes to protecting social media users. Attackers used familiar social media advertising and carefully tailored instructions to turn casual interest in free entertainment into a risky app installation.

How the attack worked

The ad led victims to a website posing as a streaming platform. The site checked whether a visitor was using Android. Non-Android visitors were simply prevented from downloading anything, while Android users were shown an app download option. This is a common way for scammers to concentrate their efforts on devices their malware can infect.

The site also identified whether someone had arrived through Instagram, TikTok, Facebook, or a regular browser. It then displayed instructions suited to that situation, including steps to allow the browser to install apps from “unknown sources.” In other words, this was not a generic malicious download page: It was designed to coach people through the security warnings that would normally make them stop and think.

StreamRat is an Android banking Trojan and infostealer. It can monitor what’s on screen, capture information typed into apps, show convincing fake screens to collect usernames and passwords, and enable attackers to operate the device remotely. The researchers also found options to cover the screen with a black page or fake Android update screen. These can distract victims while criminals interact with the phone behind the scenes.

How to stay safe

While this campaign targeted Spanish-speaking people, primarily in Spain, the following guidelines can help anyone avoid similar attacks.

  • Avoid installing Android apps from ads, direct-download websites, social media messages, sponsored search results, or links sent by strangers.
  • Download apps through Google Play whenever possible, and check the developer’s name, reviews, and app history rather than relying on an ad.
  • Before enabling installation from “unknown sources,” read our guide, Sideloading on Android: What it is, why it’s risky, and how to do it more safely.
  • Be very cautious when an app asks for Accessibility access, screen-sharing permission, Device Admin privileges, or permission to become the default launcher. Permissions that don’t line up with the intended use of the app are very suspicious.
  • Use an up-to-date, real-time anti-malware solution on all your devices.

What to do if you installed a suspicious app

If you installed a suspicious APK and granted it Accessibility access, disconnect the phone from Wi-Fi and mobile data. If possible, revoke the app’s Accessibility access and remove it. Use another device to change relevant passwords and contact your bank if you used banking apps on the infected phone. A factory reset may be necessary if you cannot confidently remove the infection.

Malwarebytes for Android detects the components of StreamRat as Android/Trojan.Agent.ACRAEEF8A36H36, Android/Trojan.Agent.ACR02DB0614H7, and Android/Trojan.Dropper.ACR9B7ECE83D1.


Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

A week in security (August 17 – August 23)

24 August 2026 at 03:01

Last week on Malwarebytes Labs:

Stay safe!


Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Fake TikTok rewards promise cash you’ll never get

17 August 2026 at 07:15

TikTok-branded “rewards” pages are promising users cash for checking in every day, completing small tasks, and earning points. Those points supposedly convert into real money, and the balances look enormous. A countdown timer usually warns that your balance is about to expire. But when you try to withdraw it, there’s always something else you need to do first.

If you just want the short version

TikTok does have a legitimate Creator Rewards Program, but it doesn’t work like the sites we’re talking about here. Creator Rewards is for eligible creators in certain countries who meet specific requirements. They earn rewards for eligible original videos, not for checking in every day or completing tasks on a separate rewards website.

If you find a TikTok-branded site offering large cash rewards for check-ins, referrals, or simple tasks, don’t assume it’s legitimate just because TikTok has its own rewards program.

You can end up chasing a payout that was never coming, handing over personal or banking details, or installing an unwanted app.

  • Fake TikTok rewards sites
    Fake TikTok rewards sites
  • Fake TikTok rewards sites
    Fake TikTok rewards sites
  • Fake TikTok rewards sites
    Fake TikTok rewards sites
  • Fake TikTok rewards sites
    Fake TikTok rewards sites
  • Fake TikTok rewards sites
    Fake TikTok rewards sites

How these pages typically work

Most versions of this scam are built to look like a mobile shopping or loyalty app. There’s a TikTok logo, a “welcome back” greeting, a daily check-in tracker, and tabs for tasks, referrals, and your profile. At first glance, it can easily look like an official rewards program connected to TikTok.

When you tap through to the “redeem” screen, the numbers can show a cash balance in the thousands, converted from a huge pile of points, along with a countdown warning that your balance is about to expire. The minimum withdrawal is usually low enough to make cashing out look easy.

It isn’t.

Sites like this tend to introduce one more requirement every time you get close to actually withdrawing the cash. Refer more friends, watch more videos, complete a sponsored offer through an affiliate network, or download a separate app to “verify” your identity.

The app download may be the real goal, particularly if the operator gets paid for generating installs. The app could also be adware or other unwanted software.

Big numbers don’t mean real money

Nothing on these pages reflects a real ledger. A balance on the screen doesn’t mean there’s money waiting for you.

On a fake rewards site, the points, cash balance, and countdown can simply be numbers generated by the site itself, with no connection to TikTok’s actual systems.

The operator simply invents a sum that feels too good to walk away from.

So who is making money?

These sites tend to make money the same way most ad-funnel scams do: through affiliate and CPA (cost-per-action) programs.

CPA means the site operator can get paid when you do something, such as clicking an ad, signing up for a service, or installing an app. So even if you never receive the promised reward, your clicks, sign-ups, and downloads can still make money for someone else.

Why it’s easy to get pulled in

A daily check-in streak creates a small sense of investment. Walking away means giving up your streak and the money you think you’ve already earned.

Then there’s the big balance sitting on the screen and a countdown telling you it’ll disappear if you don’t act soon. Together, they give you plenty of reasons to keep going and very little time to question whether any of it is real.

What to do if you find one

  • Don’t enter banking details, card numbers, or ID information unless you’ve confirmed you’re using an official TikTok service.
  • If you were prompted to download an app outside TikTok itself, don’t install it. If you already have, uninstall it and run a security scan on your device.
  • Don’t refer friends or family to keep a streak going or unlock a withdrawal. You’d just be pulling them into the same funnel.
  • Check rewards in TikTok itself. TikTok’s Creator Rewards Program is for eligible creators and is managed through TikTok. If a separate website claims you can earn TikTok cash rewards through check-ins or simple tasks, don’t assume it’s part of the same program.

Reward-mill scams like this aren’t unique to TikTok. The same check-in-and-cash-out formula appears with other brand names too. The name may change, but the trick is much the same: Keep you clicking with the promise that your money is just one more task away.


Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Don’t get fooled by TikTok resin art scams

24 July 2026 at 10:56

Resin art has become a popular corner of TikTok, with some videos attracting millions of views. But not every glossy, colorful post is what it claims to be. Scammers are using the look of handmade resin art to trick buyers, collectors, and even fellow artists into sending money for work that either doesn’t exist or wasn’t created by the person posting it.

There are plenty of genuine resin artists on TikTok. Unfortunately, the platform has also attracted scammers who steal videos and impersonate legitimate creators.

  • Fake resin art
  • Fake resin art
  • Fake resin art
  • Fake resin art
  • Fake resin art
  • Fake resin art

The scam is fairly straightforward. A TikTok account presents itself as a resin artist, posts satisfying videos, and invites people to “DM to order.” In some cases, the videos are stolen from other creators, the account has no real process footage, and the seller disappears after receiving payment.

One resin artist discovered that scammers were using their videos to impersonate them and scam TikTok users. They shared the following comment:

Ridiculous TikTok scammer…lol. Profile says they’re a resin artist and to DM them to order, but none of the videos are theirs. When I wrote to them asking them to take down the many videos of mine that they posted, passing them off as their own with no credit, their answer was that they aren’t a resin artist and are just sharing videos they like 🤣🤣 Literally about 1/4 of “their” videos are mine 🙄

These scams often rely on trust and urgency. The account may show polished clips of poured resin, finished coasters, trays, jewelry, or wall art, then push buyers to move the conversation into direct messages. Once the buyer moves to a different platform, the scammer typically requests a deposit, full payment, or personal details with little chance of being held accountable.

And real artists don’t just get their work ripped off. A scammer may contact a creator claiming to want to buy, feature, or license their work, but the real goal is to extract fees, banking information, or other sensitive data. Social media art scams are often repetitive because they are built from the same templates and scripts.

Script is similar across many videos in resin art scams
Different videos, same script

How to spot a TikTok resin art scam

The safest approach is the boring one: verify before you pay. If the artwork looks amazing but the seller’s identity is vague, the risk is real.

Check the TikTok account

Before ordering, look for signs that the artist is genuine:

  • The account didn’t appear overnight and has a history of original posts.
  • The same videos don’t appear under multiple creator names or belong to another artist.
  • The creator shows themselves making the artwork, with consistent process videos, a recognizable workspace, and works in progress.
  • The videos don’t contain obvious AI artifacts, such as impossible resin effects or objects moving after they’ve supposedly been sealed inside hardened resin.
  • Comments raising concerns haven’t been deleted or buried under generic praise.
  • The seller isn’t pushing you to order only through direct messages or asking for payment before you’ve verified who they are.

Check the website

If you do click through to a website, spend a few minutes checking it before you buy:

  • Look for a genuine returns and refunds policy, a physical business address, company or VAT details (where applicable), and consistent contact information.
  • Check how old the website is. Scam sites often use domains that were registered only weeks or months ago, especially when they claim to have been selling handmade products for years.
  • Search for recent independent reviews rather than relying on testimonials published on the site itself.
  • Run a reverse image search on the product photos to see whether they’ve been copied from another artist.
  • Only pay using a method that offers buyer protection, such as a credit card or PayPal. If a seller insists on a bank transfer, cryptocurrency, or another irreversible payment method, walk away.

Not every resin art account is a scam. Many belong to genuine artists, and that’s why impersonation scams can be so convincing.

If you’re unsure, paste the website address into Malwarebytes Scam Guard and ask whether it shows signs of being fraudulent. It can help identify suspiciously new domains and other common scam indicators.

Use Malwarebytes Scam Guard to check whether a social media post or website is part of a scam.

Use real-time web protection to block known fraudulent and malicious websites, like Browser Guard did for this web shop:

Browser Guard blocks the web shop due to likely fraud
Browser Guard blocks the fraudulent website

Both are free—making them much cheaper than sending money to a scammer.


Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

The Cyber Express Weekly Roundup: TikTok Age Verification Probe, Healthcare Data Breach, Qantas Ruling, and Major Cyberattacks

weekly round

This week’s cybersecurity roundup highlights growing concerns around online child safety, healthcare data protection, supply chain risks, and cyber threats affecting organizations worldwide. From regulatory scrutiny of digital platforms to large-scale vulnerabilities and operational disruptions, recent incidents show how cyber risks continue expanding across industries.  The key theme in this weekly roundup is the increasing pressure on organizations to strengthen security, improve data protection measures, and adapt to rapidly changing threat environments. Regulators, businesses, and cybersecurity teams are facing challenges ranging from social engineering attacks and malware incidents to vulnerabilities affecting widely used enterprise technologies. 

The Cyber Express Weekly Roundup 

UK Investigates TikTok Age Verification Compliance 

The UK communications regulator Ofcom has launched an investigation into TikTok’s age verification system, examining whether the platform is meeting its child safety obligations under the Online Safety Act. The probe comes as the UK government prepares stricter social media restrictions for users under 16, with enhanced age assurance requirements expected to take effect by Spring 2027. Read more… 

Partnered Health Cyberattack Exposes Australian Patient Data 

Healthcare provider Partnered Health has suffered a cyberattack that exposed sensitive patient information from 21 clinics across Australia. The compromised data reportedly includes personal details, Medicare information, health insurance records, and medical documents. Authorities and the company continue investigating the incident to determine the full scope of the breach and whether additional information was affected. Read more… 

Qantas Data Breach Cleared After Privacy Review 

Australia’s privacy regulator has concluded its review of the 2025 Qantas data breach, finding no evidence that the airline failed to take reasonable measures to protect customer information. The incident affected approximately 5.67 million records after attackers used social engineering techniques to compromise a contact center employee. Read more… 

Nichirei Cyberattack Disrupts KFC Japan Supply Chain 

Japanese frozen food and logistics company Nichirei experienced a cyberattack that disrupted deliveries to KFC Japan after unauthorized access impacted its systems. The company isolated affected infrastructure, suspended certain logistics operations, and began recovery efforts with external cybersecurity specialists while investigating the incident. Read more… 

Microsoft Patch Tuesday Addresses 622 Security Flaws 

Microsoft’s July 2026 Patch Tuesday update fixed 622 vulnerabilities across its product ecosystem, making it the company’s largest security release to date. The update included patches for two actively exploited zero-day vulnerabilities, CVE-2026-56164 and CVE-2026-56155, affecting Microsoft SharePoint Server and Active Directory Federation Services. Read more… 

Nihon Kotsu Cyberattack Disrupts Japan Taxi Operations 

Japan’s largest taxi operator, Nihon Kotsu, suffered a malware-related cyberattack that forced the company to shut down parts of its IT infrastructure. The incident, detected on July 11, 2026, affected taxi dispatch services and internal systems as the company worked to contain the attack and investigate potential data exposure. Read more… 

Weekly Cybersecurity Takeaway 

This week’s cybersecurity developments highlight the growing complexity of modern cyber threats, with attacks and security challenges affecting technology platforms, healthcare providers, logistics companies, transportation services, and enterprise software environments. From regulatory action on digital safety to actively exploited vulnerabilities and supply chain disruptions, organizations are facing increased pressure to strengthen resilience and respond faster to emerging risks. 

TikTok Age Verification Under Investigation as UK Tightens Child Safety Rules

TikTok age verification

The UK's communications regulator has launched a formal investigation into TikTok age verification, raising questions over whether the platform is adequately protecting children online under the country's Online Safety Act. The move comes as Britain prepares to introduce a social media ban for under-16s, with regulators warning that current age assurance methods used by some platforms may not be sufficient to prevent children from accessing harmful content.

The investigation follows the publication of a new Ofcom report that found age checks are becoming more common across online services, but significant gaps remain, particularly on social media platforms and some pornography websites.

Ofcom Questions TikTok Age Verification Method

According to Ofcom, some social media companies rely primarily on age inference methods to identify child users. These systems estimate a user's age based on their online behavior rather than verifying it directly.

The regulator said it has "serious doubts" about whether these methods are capable of meeting the standards required under the Online Safety Act. Ofcom believes some companies may be failing to correctly identify a significant number of children, potentially exposing them to harmful content, including pornography, self-harm, and suicide-related material.

As a result, Ofcom has launched a formal investigation into whether TikTok is complying with its legal duties to protect children from harmful content.

The regulator also warned that age inference alone will not be considered sufficient for enforcing the government's planned restrictions on social media use by children under 16. Platforms using such methods have been urged to adopt more effective age assurance technologies or provide compelling evidence demonstrating their effectiveness.

Age Checks Increase Across Online Services

The report found significant progress in the adoption of age checks since the Online Safety Act's child protection duties came into force in July 2025.

Between July 2025 and January 2026, the proportion of children encountering highly effective age checks increased from 25% to 43%.

Ofcom said more than 69 million age checks were completed across a sample of 32 UK services during the second half of 2025, representing a 23-fold increase compared to the previous six months.

The regulator also reported that all of the UK's top 10 pornography websites and most of the top 100 now have age verification measures in place.

Among children aged 8 to 14 who attempted to access pornography, only 8% visited such services. Half of those children reached only websites with age checks, while nearly 87% of their visits lasted less than 30 seconds, suggesting age verification discouraged continued access.

Search Engines Also Face Scrutiny

Despite the wider rollout of age assurance, Ofcom found that children can still easily discover pornography websites without age checks through Google Search and Bing.

Its analysis found that 33% of first-page Google search results and 54% of Bing results directed users to pornography websites lacking age verification or equivalent protections.

Following discussions with the regulator, Google and Bing have agreed to work with Ofcom on practical measures to reduce the visibility of such websites in search results.

Meanwhile, Ofcom continues enforcement against adult services that fail to comply with the law. The regulator has opened 23 investigations involving 88 adult service providers, with many either introducing age assurance or blocking UK users after enforcement action.

UK Moves Toward Social Media Ban for Under-16s

The investigation comes as the UK government advances plans to introduce a social media ban for under-16s, modeled on Australia's approach.

Under the proposal, platforms including TikTok, Snapchat, Instagram, Facebook, YouTube, and X would be prohibited from offering social media services to users under 16. Messaging services such as WhatsApp and Signal are not expected to be included.

The government also plans to introduce additional protections, including restrictions on livestreaming and communication with strangers for children under 16 across social media and certain gaming platforms. Similar safeguards would apply by default to users aged 16 and 17 to avoid what officials describe as a "cliff-edge" at age 16.

The proposed measures are expected to be presented to Parliament before the end of the year, with implementation targeted for Spring 2027.

Ofcom said it will submit a rapid assessment to Parliament by the end of October outlining what constitutes highly effective age assurance for verifying whether someone is over 16, helping shape future enforcement of the planned restrictions.

❌