The Signal

A brand-new phone arrives at your door. Within the hour your carrier calls: so sorry, that was the wrong model, or an extra unit, or are furbished one by mistake; please send it back with this label and the right one ships tomorrow. The delivery was real. The call was not. Sometimes the scammers ordered the phone on your account in the first place, and sometimes they just knew yours was coming. Either way, the device ends up at their address and the bill ends up on yours. Today: both versions, why the real delivery is the trick, and the one rule that ends it: nobody legitimate ever calls to ask for a phone back.

Last month's AI-headlines episode made a prediction:AI doesn't make criminals new, it makes them faster, and the doer is still human. This week the prediction arrived as a police report. One self-taught hacker, a former security tester, adopted an AI attack tool in late August and went from ordinary intrusions to more than ninety breached organizations, hospitals, schools, big companies, and golf courses, with ransom demands in thirty-eight of them. He was caught the old way, through server logs. Today: what this case proves, what it changes for ordinary people (more breach letters, from smaller places), and why the ladder was built for exactly this.

PHP is the invisible software that runs roughly seven in ten websites with a known server-side language, including most of WordPress. This week it got two critical flaws that let an attacker with no account run code on a server just by sending a crafted request, and the attempts went from thousands to millions in a day. You don't run PHP. The sites you log into do. Today: what happened, the honest calibration of what it means for a person who isn't a web host, and the two groups of listeners with real homework, including anyone with a small-business or hobby website.

This show has told you to turn on automatic updates more times than any other piece of advice, because the fix almost always exists before the attack. This week: the case where the update was the attack. Attackers got into a software company's servers, pointed its backup program at a malicious download, and the program installed it without asking, because that's what updates do. Today: how it happened, why it's rare, why the auto-update advice still stands, and the one upgrade to the rule: it matters whose updates you trust.

“Zero-click spyware spread through ads" is the kind of headline that makes people want to throw their phone in a lake. Today: what zero-click actually means, how this one worked (the ad decided whether you were a target before it did anything), who it was aimed at, why that is almost certainly not you, and the short list of things that matter if you ever might be. Calm, precise, no lake.

After a year of this show teaching people to spot fake bank texts, impostor calls, and the "install this app" trick, the phone is starting to help. Google announced defenses that read scam patterns in messages from strangers, check suspicious links before you open them, verify that a "bank" call really came from the bank, and stop malware from quietly forwarding your calls. Today: what each one actually does, where it falls short, the settings to flip tonight, and the rule that stays yours no matter how smart the phone gets.

Browser extensions, the small add-ons that block ads, save coupons, or unlock right-click, run inside the one program where your whole life passes through: your browser. Many can read every page you visit and everything you type on it. This fall researchers found a batch that had been good for years, built an audience, and then quietly turned, including some that were bought from their original developers. Today: why an extension is a far bigger decision than it looks, the business model that turns helpful tools into spyware, and the ten-minute cleanup that most people have never done.

You search for something, the first result looks right, you click. This week researchers showed how criminals buy that tops pot: a search ad that displayed a trusted destination, bounced through a legitimate redirect, and landed on a counterfeit download page where the visible command was real and the copy button was lying. The paste rule still wins, but the bigger lesson is the one the show hasn't given its own episode: the top of your search results is rented space, and the people renting it include criminals. Today: search ads for software, for login pages, and for customer-support phone numbers, and the one habit that skips all three.

Security researchers found malware baked into the firmware of low-cost Android phones before they were ever sold: a hidden system app that silently installs and removes other apps, runs ad fraud in the background, and enrolls the phone in a residential-proxy network, all with privileges a normal app can never get. One owner reported the official firmware update reinfected the device. It's the streaming-box story, now inside the device you carry everywhere, and it answers a question the show hasn't tackled: how do you know if a cheap phone is actually cheap?

USPS: your package is on hold due to an unpaid redelivery fee of $0.30." The most familiar scam text in America has one feature that makes it brilliant and one that makes it beatable: the fee is tiny on purpose, nobody panics over thirty cents, and the real theft is the card number you type to pay it. Today: the whole anatomy, the three facts about real carriers that end it, and the holiday-season version of the front-door rule.