Summer is in full swing, and that means one thing — it’s time to travel! Remember how people used to prepare for trips? Buying pocket guidebooks and phrasebooks, bombarding all our well-traveled friends with questions: “What should I see?”, “How much do tours cost?”, “And how do I get a SIM card?“.

These days, the world has changed. You can plan a comfortable trip while lounging on your sofa with a smartphone in hand — or even while waiting at the airport gate. All you need do is download the right apps. In this guide, we’ll help you prep both yourself and your phone for your journey:

• How to find your bearings in a new place?
• How to stay connected?
• How to get around comfortably?
• How to enjoy the city like a local?
• How to find good food?
• How to travel safely?

How to find your bearings in a new place?

Sure, you could buy a paper map in advance, but it’s much easier to download a few mapping apps. Yes, a few — don’t rely on just one.

Google Maps. An absolute must-have for any traveler. Plan routes and find nearby hotels, cafes, currency exchanges, and attractions. Read folks’ reviews for insider knowledge on the best spots (and the ones to avoid). Google Maps is every traveler’s digital Swiss Army knife — useful for a ton of different things (as long as you’ve downloaded offline maps in advance or have an internet connection).

Organic Maps. If you’re going somewhere beyond the reach of mobile networks, offline maps are your best bet. You can download a detailed map of your destination before your trip. It includes everything you’d find in Google Maps — restaurants, shops, transport stops — just without user ratings and reviews.

One standout feature is route planning for walking, biking, and hiking. You can even switch to a topographic view to see elevation changes — great for mountainous terrain or outdoor adventures.

Guru Maps. Among tourists, this app is known as “the king of navigation” — and for good reason. With Guru Maps you can venture far off the grid without getting lost. It’s made for finding hiking trails, routes through the wilderness, even swamp-trekking — perfect for when Google Maps and Organic Maps find no route at all.

Like the other two, Guru Maps is free to use, but there’s also a paid Pro version. This lets you download unlimited maps and create enough pins and GPS tracks for even the most hardcore traveler.

How to stay connected?

Offline apps are great, but pre-downloaded information alone isn’t always enough. Especially in big cities, it’s essential to stay online. There are a few ways to do this.

eSIM. Get a local SIM card, or better yet, an eSIM. You can use the Kaspersky eSIM Store app to find and activate affordable local data plans — no roaming fees or plastic SIM cards needed.

It’s simple: install Kaspersky eSIM Store, choose your destination, and buy a data plan that suits your needs. Along with the data package, you’ll receive your free eSIM — simply install it in your device in a couple of clicks. Later you can top up your eSIM for the same or different destinations with more great plans from local operators. And you’re not limited to just one country at a time — if you’re traveling across several countries, choose a regional plan or even get global coverage in 122 countries for constant connection.

eSIMs from Kaspersky eSIM Store don’t include a phone number — they only support data transfer. But your regular SIM stays in your device, so you can still receive texts and calls. Of course, you don’t need to answer roaming calls — but you can see who contacted you and respond via messenger using your eSIM data.

The cool thing is that you can set up eSIMs in advance, including the date your data plan will activate. Kaspersky eSIM Store offers both expiring plans (valid for 30 days in most countries) and non-expiring ones where unused gigabytes are saved for your next trip.

eSIMs and related services are provided by our tech partner BNESIM Limited. For more on all the benefits of eSIMs, check out our blog post: Internet on the go with Kaspersky eSIM Store

Mobile operator app. If you still plan to use roaming from your usual operator, be sure to install their app to monitor your data use, enable roaming options, and top up.

However, there’s a downside here: roaming usually costs much more than using an eSIM from Kaspersky eSIM Store. Yes, some providers offer special plans like unlimited messaging or map access, but relying on them could backfire in a crucial moment. For example, what if you’re in a small town where Google Maps’ timetables for public transportation aren’t up to date? You’ll need to look for an alternative transport app or take a completely different route. That could mean using a search engine — which can be painfully expensive on roaming data.

How to get around comfortably?

This is where specialized apps come to the rescue — reliable in big cities and helpful even in small towns where you could otherwise get stuck.

Moovit. An app to help you navigate public transport almost anywhere in the world. It sources real-time data from transport providers — including private companies — so seasoned travelers trust Moovit in cities with a well-developed public transit system. But don’t expect it to tell you exactly when a local bus is going to arrive in a tiny remote village. In such cases, it’s best to rely on taxis.

Uber. If you’ve ever taken a taxi, there’s a good chance you already have Uber on your phone. It’s one of the world’s biggest ride-hailing platforms: just enter your destination, choose a rate, and wait for your driver. Simple and intuitive — but there’s a catch: Uber isn’t available everywhere. You’ll have no trouble getting a ride in North America, Europe, and parts of Asia, but elsewhere your best bet is often a local taxi app.

• Yandex Go. Great for rides in Russia, Georgia, Kazakhstan, Belarus, Moldova, Armenia, Kyrgyzstan, Lithuania, Serbia, and Uzbekistan.
• DiDi. Use this app in China, Argentina, Australia, Brazil, Chile, Colombia, Costa Rica, Ecuador, Egypt, Japan, Mexico, New Zealand, Panama, Peru, and the Dominican Republic.
• Grab. The go-to ride-hailing app for Southeast Asia: Singapore, Cambodia, Myanmar, Malaysia, the Philippines, Thailand, Vietnam, and Indonesia.
• Careem. Ideal for travel in Egypt, Bahrain, Iraq, Jordan, Pakistan, Saudi Arabia, Kuwait, Morocco, and the UAE.

Bonus: InDrive is a unique app that lets you name your price for a ride and choose a driver. Available in 48 countries.

How to enjoy a city like a local?

Sometimes you only have a few hours or a couple of days to explore a huge city. So how do you quickly decide what to see and where to go? Previously, you could find such answers on Foursquare — but what now?

Visit a City. According to its developers, this app covers more than 3000 cities worldwide. Choose free mini-guides, buy tickets to museums and attractions, or book tours. With just a few clicks, you can plan a trip — say, two days in Istanbul — and get a detailed itinerary down to the minute.

Many major cities now offer their own travel apps — so check those out too. For a Thames-side stroll, try Visit London; if it’s mosques and markets you’re after, check Istanbul Tourist Pass; and if you’ve always dreamed of seeing Park Güell, use Hola Barcelona.

ChatGPT. Yes, artificial intelligence can help here too, creating an itinerary for any city on Earth and offering it in a neat PDF or spreadsheet. Just bear in mind that AI can’t always account for real-world factors like traffic or opening hours — things that are kept up-to-date by real people in specialized apps like Visit a City.

But for general plans, ChatGPT works wonderfully. Just tell it something like, “Plan a 2-day trip to Istanbul for two people in their 30s. The pace should be relaxed and must include Galata Tower, a San Sebastián cheesecake stop, and a Bosphorus cruise. Break it down by time, considering traffic.”

How to find good food?

If you’re just looking for a quick bite while exploring, Google Maps or any other map app will do the trick — as long as you’ve got an internet connection, you’ll see nearby food options in seconds. But if you’re after something more authentic or sophisticated, there are dedicated apps for that.

The MICHELIN Guide. Not sure where to eat and want a guaranteed good spot? Pick any restaurant in this guide — and you can even book a table right in the app. A common myth is that Michelin is only for expensive fine dining, but that’s not true anymore: today the guide includes plenty of local gems with reasonable prices and great service. So whether you’re a foodie or just want a reliable recommendation, the MICHELIN Guide has something for every budget.

TheFork. This popular app makes sure no tourist goes hungry — at least in Europe. It’s packed with everything you need: addresses, menus, cuisine types, food photos, average prices, real reviews, and the ability to book a table directly. Sounds ideal, but as usual there’s a catch: TheFork only works in certain major European cities — for now: Paris, Amsterdam, Barcelona, Lisbon, Madrid, Milan, Rome, Geneva, Brussels, Stockholm, Marseille, and Bordeaux.

Local apps. Just like with taxis, every country — or even every city — tends to have its own version of TheFork. So it’s worth doing a little research to see what app is popular at your destination. For example, in the United States, you’ll want Resy and Yelp, while in China, Dianping is the go-to (if your Chinese is ok: it’s only available in Chinese).

Bonus: Flush Toilet Finder. This handy app helps you locate public toilets all over the world — a perfect companion to your restaurant guide. While general maps might also show toilet locations, Flush Toilet Finder provides extra details such as wheelchair accessibility, whether access codes or keys are required, and how much it costs.

How to travel safely?

Connecting to the first open Wi-Fi spot you find is not a great idea — and neither is storing a passport scan in your photo gallery. Here’s how to add a dash of digital safety to your perfect trip mix:

Obsidian. You’ll probably want to plan your trip in advance — and most likely, you’ll try to do so using the standard Notes app on your phone. That’s not the safest option, and sometimes not the most convenient either when it comes to storing important information. Consider Obsidian — it protects your notes with end-to-end encryption and syncs them across your devices. But there are other similar apps out there, which we wrote about in our article Keep it under wraps: encrypted note-taking apps and to-do lists.

Kaspersky Password Manager. Store photos or PDFs of your passports, tickets, vouchers, and other important documents in secure storage — they can only be decrypted and viewed after entering a main password that only you know. At the same time, you can easily add or open any document on any device — the app is cross-platform and constantly syncs information between your smartphone and computer. In addition, our password manager can store two-factor authentication tokens. Remember that traditional one-time passwords may not arrive via SMS while roaming, or they may be severely delayed. Take a couple of minutes at home to configure your frequently used apps and websites so that 2FA codes are generated in Kaspersky Password Manager instead of being sent via SMS.

Kaspersky VPN Secure Connection. If you’ll be connecting to unfamiliar Wi-Fi networks often during your trip, your best bet is to protect your connection. You can do this with the help of one of the fastest VPNs in the world. Plus, VPN also lets you change your phone’s location in advance — so your search results become local! That way, even from home, you can plan visits to the events that locals actually go to, not just tourist traps.

Wherever you’re going, remember — happiness is only real when shared. Stay connected with Kaspersky eSIM Store and share your favorite travel moments with your loved ones.

What else to read before your trip:

• How to travel safely
• Internet on the go with Kaspersky eSIM Store
• Fake Wi-Fi on board a flight
• Going on vacation? Beware of scammers
• Four ways to find spy cameras

Kaspersky official blog – ​Read More

Security-First Culture (SFC) is an organization-wide commitment where security considerations influence decision-making at every level, from strategic planning to daily operational tasks. 

It’s not just about having fancy tech or a dedicated IT team; it’s about making security a core part of how the company thinks and acts. A mindset where every decision, from coding a new app to sending an email, considers “How could this go wrong, and how do we protect against it?”.  
 
Leaders set the tone by prioritizing security, allocating resources, and weaving it into the company’s strategy. Every employee, regardless of their role, understands that they play a critical part in the organization’s security posture.    

Main Principles of Security-First Culture 

1. Proactive Risk Management. Teams don’t wait for incidents to happen. They actively identify, assess, and mitigate risks before they materialize into threats. 

2. Continuous Learning and Adaptation. Threats evolve, so should your people and your strategies. Regular training, updates, and process improvements are standard practice. 

3. Transparency and Communication. Open dialogue about security concerns, incidents, and best practices creates an environment where problems are addressed quickly. 

4. Security by Design. New products, services, and processes are developed with security considerations built-in from the beginning. Security supports innovation; it doesn’t block it. 

5. Data-Driven Decision Making. Security decisions are based on threat intelligence, risk assessments, and measurable outcomes rather than assumptions or gut feelings. 

The principles sound sensible but quite challenging to implement. Transferring to SFC might look like an organizational revolution demanding changes on all levels, from the leadership mindset to everyday practices. And of course it must be quite a recourse-consuming adventure. Is the outcome worth it?  

Benefits of Security-First Culture 

The advantages of implementing SFC extend far beyond just preventing cyberattacks. But the straightforward outcome of suffering less breaches must certainly be considered. Verizon’s 2022 Data Breach Report says 82% of breaches involve human error, so a security-minded workforce can slash that risk. 

Fewer breaches mean less damage: financial, reputational, operational. Preventing even one incident can save millions: the average cost of a data breach exceeded $4 million back in 2023, according to IBM.  Besides, if an attack does happen, a prepared organization bounces back faster, minimizing damage and downtime. 

Customers, partners, and stakeholders have greater confidence in organizations that demonstrably prioritize security. This translates to stronger business relationships and competitive advantages. 

Less obvious but no less valuable benefits include:  

• Improved Operational Efficiency: When security practices are integrated into daily workflows, they become second nature, reducing friction and improving overall productivity. 

• Regulatory Compliance: A security-first approach makes compliance with various regulations (GDPR, HIPAA, SOX, etc.) more straightforward and less costly. 

• Innovation Enablement: Paradoxically, strong security foundations enable organizations to innovate more freely, knowing they have robust safeguards in place. 

• Employee Empowerment: When staff feel confident handling threats, they’re more engaged and take ownership of their role in security. 

SFC Champions and Those Who Paid the Price 

Several organizations have become benchmarks for security-first culture: 

Microsoft: Following significant security challenges in the early 2000s, Microsoft implemented their “Security Development Lifecycle” and “Assume Breach” philosophy, fundamentally transforming their approach to security.  
 
Google: Their “BeyondCorp” zero-trust security model and continuous security innovations demonstrate a deep cultural commitment to security. 

Apple: Known for privacy-by-design principles and strong encryption standards across all products and services. 

Not every company gets it right (providing us with impressive and didactic examples). These high-profile disasters could’ve been mitigated with a stronger SFC: 

Equifax (2017): A failure to patch a known vulnerability led to a breach exposing 147 million people’s data. A lack of proactive monitoring and employee awareness was a key factor. 

SolarWinds (2020): A supply chain attack compromised multiple organizations. Inadequate security training and siloed responsibilities left gaps that attackers exploited. 

AT&T (Multiple breaches 2023-2024): Repeated incidents affecting millions of customers demonstrate ongoing security culture deficiencies despite previous breaches. 

Evaluating Your Current Security Culture 

Here’s how to understand where you stand: 

Cyber Threat Intelligence as a Pillar of Security-First Culture 

Cyber Threat Intelligence (CTI) isn’t just a technical capability — it’s the nervous system of a security-first culture. CTI provides the contextual awareness that transforms reactive security measures into proactive, strategic defense.  

Like security-first culture permeates and consolidates every organizational unit and structure, state-of-the-art CTI vendors like ANY.RUN offer solutions to cover security-related challenges on all business levels.  

CTI for Enriching Cyber Threat Investigations and Response 

Daily security operations rely on CTI to prioritize alerts, contextualize incidents, and guide response efforts. Instead of treating all security events equally, intelligence helps teams focus on genuine threats.  

Threat Intelligence Lookup allows employees of any grade to utilize a vast database of fresh Indicators of Compromise (IOCs), Behavior (IOBs), and Attack (IOAs) to instantly collect context for alerts, incidents, and campaigns. The data is continuously updated and derived from the attacks on over 15,000 companies using ANY.RUN’s Interactive Sandbox for hands-on investigations of malware and phishing attacks. 

An employee does not have to be a security expert to make a search request like a suspicious IP address and receive an instant verdict that the notorious banking stealer Lumma might have penetrated the perimeter:   

TI Lookup enables teams to quickly gather critical threat context, transforming existing indicators tin actionable insights into the threat to hand to mitigate risks and protect the organization. 

CTI for Proactive Threat Monitoring 

When it comes to tactical implementation, security tools and controls are configured based on current threat intelligence, ensuring defenses remain relevant as the threat landscape evolves.  

Threat Intelligence Feeds provided by ANY.RUN deliver up-to-date curated indicators of compromise like URLs, domains, and IPs, enriched with threat context, to integrate with detection and monitoring systems and identify threats before they become incidents. 

CTI For Early Detection of Malicious Files and URLs 

Smart threat intelligence solutions improve employees’ ability to make better security decisions in ambiguous situations. ANY.RUN’s Interactive Sandbox makes it possible to analyze any suspicious link, email, or file, and not just get a malicious/benign verdict, but to understand malware’s behavior as well as its operators’ TTPs. 

Thanks to interactivity, the sandbox makes it possible to engage with the environment and the threat just like on a standard desktop, detonating every stage of the attack to reveal the final malicious payload. 

As we can see, the Sandbox file analysis exposes its malicious behavior and labels it as AsyncRAT trojan. 

The intuitive interface of the sandbox simplifies malware analysis for junior security professionals and even non-specialists, providing them with a clear understanding of any threat.   

Sign up for ANY.RUN’s Interactive Sandbox with a business email 

CTI For Improving Security Strategy 

In strategic planning, CTI informs long-term security investments by identifying emerging threats and industry-specific risks. When planning business expansion, drafting a security budget for the next quarter, or gathering information on the key cybersecurity risks, it provides crucial context about the current threat landscape. 

ANY.RUN’s TI Reports contain manually collected intel on APTs, as well as malware and phishing campaigns that pose a danger to businesses right now. The reports help security teams gain greater visibility into the threats active at the moment and proactively defend their infrastructure. 

Step-by-Step Algorithm to Deploy SFC 

1. Assess Current State: Survey employees, audit processes, and measure metrics like phishing click rates to identify gaps. 

2. Develop Security Strategy: Align security with business goals, like customer trust or operational continuity. Create comprehensive plan addressing people, process, and technology. Establish policies and security rules (e.g., password standards, MFA use) and integrate them into workflows. 

3. Train Employees and Implement Tools: (firewalls, encryption, threat intelligence solutions, and monitoring systems to support human efforts). 

4. Measure and Iterate: Track KPIs (e.g., incident response time, training completion) and refine strategies based on results. 

5. Review Regularly: Conduct quarterly audits and update tactics to address new threats. 

6. Celebrate Successes: Recognize and reward security-positive behaviors. Share knowledge and learn from security community.  

Final Thoughts 

A security-first culture isn’t just about tech — it’s about people, processes, and a shared commitment to staying safe. By embedding cyber threat intelligence into every step, from leadership to daily operations, organizations can stay ahead of attackers, protect their data, and build trust with customers.  

Organizations that successfully implement security-first culture supported by robust threat intelligence capabilities don’t just survive in today’s threat environment. They thrive, using their security posture as a foundation for innovation, growth, and competitive advantage. 

About ANY.RUN  

Over 500,000 cybersecurity professionals and 15,000+ companies in finance, manufacturing, healthcare, and other sectors rely on ANY.RUN. Our services streamline malware and phishing investigations for organizations worldwide.  

• Speed up triage and response: Detonate suspicious files using ANY.RUN’s Interactive Sandbox to observe malicious behavior in real time and collect insights for faster and more confident security decisions.  

• Improve threat detection: ANY.RUN’s Threat Intelligence Lookup and TI Feeds provide actionable insights into cyber attacks, improving detection and deepening understanding of evolving threats. 

Start 14-day trial of ANY.RUN’s solutions in your SOC today 

The post A Guide to Developing Security-First Culture Powered by Threat Intelligence  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

On this here blog of ours we constantly write about all sorts of cyberattacks and their devastating effects — from cryptocurrency theft to personal data leaks. Yet there’s a different category of high-profile hacks: those where the hackers aren’t after money, but instead pull off silly stunts that are mostly harmless enough and just for fun (though some (one in particular — the Ecovacs hack, below) could be more serious than others). Today, we tell you about five of these and discuss the lessons we can learn from them…

“They’re everywhere!” When traffic lights talk to you in the voices of Zuckerberg and Musk

In the spring of 2025, unknown individuals hacked crosswalk buttons on traffic lights across Silicon Valley. These audio-enabled buttons are widely installed on pedestrian signals across the United States. As you might expect, they’re designed for people with visual impairments: their main purpose is to play voice messages that help pedestrians who can’t see well understand when it’s safe to cross the road.

The unknown individuals replaced the standard voice messages on crosswalk buttons in several Silicon Valley towns with their own — featuring AI-generated imitations of the ubiquitous tech-billionaires Mark Zuckerberg and Elon Musk. Videos recorded by local residents show the hacked buttons playing the messages.

In a voice imitating Mark Zuckerberg: “It’s normal to feel uncomfortable or even violated, as we forcefully insert AI into every facet of your conscious experience. I just want to assure you, you don’t need to worry because there’s absolutely nothing you can do to stop it.”

In a voice imitating Elon Musk: “You know, they say money can’t buy happiness… I guess that’s true. God knows I’ve tried. But it can buy a Cybertruck and that’s pretty sick, right? F***, I’m so alone.”

Another message in a simulated Musk voice: “You know, people keep saying cancer is bad, but have you tried being a cancer? It’s f****** awesome. Call me Elonoma. Heh-heh-heh.”

The billionaires’ voices were clearly AI-generated, but exactly how the hackers managed to breach the traffic light audio buttons remains unknown. Security experts have noted, however, that default passwords are often used when connecting these kinds of buttons, and nobody bothers to change them after installation.

It looks like no one was hurt by the prank – except maybe the billionaires’ pride.

In Illinois, students learn a key lesson: never forget about Rick

On the last Friday of the 2021 school year, all the TVs and projectors in classrooms across six schools in Cook County, Illinois, turned on by themselves. A message appeared on the screens: “Please remain where you are. An important announcement will be made shortly.” A five-minute countdown timer was displayed below the unsettling message…

Five minutes later, 500 screens simultaneously started showing the famous Rick Astley video for Never Gonna Give You Up. Later that same day, the song played again over the schools’ public address systems.

The hackers behind this surprise pop… classic’s airing were four American students, and what they did was pull off one of the biggest Rickrolls in history that day. A Rickroll is a popular online prank where an unsuspecting user is sent a seemingly important or exciting link, only to be redirected to the video for English singer Rick Astley’s 1987 hit, Never Gonna Give You Up. Rickrolling achieved cult status back in 2007 after spreading on the 4chan imageboard.

Let’s get back to the four students. Their massive Rickroll was a hi-tech twist on a classic American tradition known as the senior prank: basically, a good-natured prank pulled by high-school, college, or university seniors before graduation.

However, the four Illinois students clearly took it to a new level. To pull off their Rickroll, they exploited fairly basic vulnerabilities in the school’s infrastructure. For example, the pranksters gained access to the system controlling hundreds of projectors and TVs across the entire school district because the default usernames and passwords hadn’t been changed after setup.

Similarly, the students were able to log into the schools’ audio public address systems. The person who originally configured the PAs diligently changed the default system password to the one provided as an example in the user manual, which of course was available online. While they were at it, the hacking team discovered an administrator account with “password” used as the password.

It’s worth highlighting just how responsibly the hackers approached the whole operation. Before carrying out the Rickroll, the prankster team prepared a detailed 26-page report, which they sent to the school administrators immediately after the incident. In it, the students thoroughly described their actions and provided recommendations for improving the schools’ cybersecurity. Additionally, once the Rickroll was over, the script they wrote restored the school systems back to their original state.

We always knew: the rise of the machines would begin with robot vacuums

Last year, reports surfaced online about a series of hacks targeting Chinese-made Ecovacs Deebot X2 robot vacuums in cities across the United States. Pranksters assumed control of the robots’ movements and shouted expletives through the built-in speakers. Additionally, they could spy on the owners through the integrated cameras.

The story seemingly had its beginnings at the DEF CON 32 hacker conference, where cybersecurity researchers Dennis Giese and Braelynn Luedtke presented their talk, Reverse engineering and hacking Ecovacs robots. The presentation described vulnerabilities they’d discovered in Ecovacs robot vacuums and lawnmowers, as well as methods for exploiting them. As part of their study, the researchers were able to gain remote access to the built-in microphones and cameras and control the vacuums’ movements. We previously covered their work in detail in our post Ecovacs robot vacuums get hacked.

(By the way, during their presentation at DEF CON, Giese and Luedtke themselves became the target of a hacker prank: a member of the audience managed to take control of the presenter’s clicker and spent several minutes messing with the speakers by randomly flipping through their slides.)

Giese and Luedtke reported their findings to the vendor in a responsible manner. Ecovacs engineers attempted to patch the vulnerabilities, but didn’t have much luck. Several months after the report went out, unknown tech enthusiasts, likely inspired by the study, were able to recreate the techniques described in it to execute a series of attacks on other people’s robot vacuums. For example, in one such attack in California, a robot chased the owner’s dog around the house while shouting obscenities.

The exact number of victims from this series of hacks remains unknown, as it’s plausible that the pranksters didn’t always make their presence obvious — they might have simply observed the vacuum owners’ lives. That, clearly, would have been a very serious infringement of those owners’ privacy – and could in no way be described as mere “fun and games”; neither could this: what if Ecovacs lawnmowers are next?

Lizard Squad “breaking free”: a defacement free redesign of Lenovo’s website

Here’s another playful attack by teenagers, this time targeting Lenovo. A decade ago, the computer manufacturer’s website was hacked. Visitors were redirected to a slideshow featuring photos of bored-looking adolescents, presumably the hackers themselves, all set to the song Breaking Free from Disney’s High School Musical.

Clicking on the slideshow would lead users to the hacking group Lizard Squad’s account on X, which was still known as Twitter at the time. The hackers left a jab at the webmasters in the source code: “The new and improved rebranded Lenovo website featuring Ryan King and Rory Andrew Godfrey”. These two individuals had previously been linked to Lizard Squad.

The attack was orchestrated via DNS hijacking. The hackers altered the DNS records for lenovo.com, causing all users attempting to reach the official company website to be automatically redirected to a fake page controlled by the pranksters.

The attack was apparently a protest against what was seen as the computer vendor’s lax attitude toward security and user protection. Shortly before the defacement, it was revealed that Lenovo had been selling laptops preloaded with Superfish malware. This made users who purchased infected devices potentially vulnerable to data interception and man-in-the-middle attacks. Thus, the hack seems kind of wrong, but at the same time feels justified.

Bring back 2013, when Twitter accounts were hacked for mischief — not crypto scams

These days, when the X account of a high-profile individual or major company gets hacked, it almost invariably leads to some kind of cryptocurrency scam. But it wasn’t always this way. Just a decade ago, popular accounts on what was then still known as Twitter were more often hijacked for giggles than for illicit financial gain.

Take February 2013, for example. Unknown hackers breached Burger King’s Twitter account to post this gem: “We just got sold to McDonalds! Look for McDonalds in a hood near you.”

On top of that, Burger King’s profile picture was swapped out for the McDonald’s logo, and their bio read: “Just got sold to McDonalds because the whopper flopped.” The bio also included the misspelled line “FREDOM IS FAILURE” and a dead link to a press release.

For about an hour, the attackers posted increasingly outrageous messages before Twitter finally suspended the account. Interestingly, Burger King’s arch-rival, McDonald’s, tweeted a message of support — while making sure to clarify they had nothing to do with the breach.

Fast-forward to August 2017, which was when the Ourmine hacking outfit targeted the Twitter account of soccer giant Real Madrid. The hackers used the club’s account to announce that none other than Lionel Messi, who then played for Real Madrid’s fiercest rival, FC Barcelona, was transferring to Real Madrid.

The post quickly racked up 2800 likes and 3100 retweets. Ourmine also posted a series of tweets claiming responsibility for the hack, with one declaring, “Internet security is s*** and we proved that.” It’s hard to argue with that.

A takeaway from the hacks: protect your password from the start

Perhaps the most crucial lesson to learn from these online shenanigans is this: using weak — or even worse, default — passwords is a surefire way to hand control of your device, account, or website to internet pranksters… if you’re lucky. Weak passwords were what tripped up city infrastructure and school administrators, and it’s highly likely that the Twitter account hacks were also linked to a careless approach to password policies.

This blog has frequently discussed how to create strong passwords. But to wrap things up, let’s reiterate a few basic rules of password hygiene:

• Passwords should be at least 16 characters long, or even longer if the website allows it.
• When creating a password, it’s good practice to mix uppercase and lowercase letters, numbers, and special characters.
• It’s best to avoid easily guessable things like common words or dates in your password. And you definitely shouldn’t use the word “password”.
• Ideally, your password should be a random combination of characters.
• Create a new, unique password for each website.

Of course, any user today signs up for dozens, if not hundreds, of online services. So, remembering long and unique passwords for each one isn’t feasible. That’s where Kaspersky Password Manager can help you manage this and protect yourself not just from pranks, but from far more serious consequences.

Additionally, the app automatically checks all your passwords for uniqueness, and helps you create truly strong and random combinations of characters. So, when using Kaspersky Password Manager, you don’t need to keep all those complex rules in mind — the password manager does it all for you. Beyond passwords, Kaspersky Password Manager can store and sync two-factor authentication tokens and passkeys. We recently thoroughly explored this new passwordless technology for accessing websites and services in our complete guide to using passkeys in 2025.

Kaspersky official blog – ​Read More