• Talos reported 5 vulnerabilities to Broadcom and Dell affecting both the ControlVault3 Firmware and its associated Windows APIs that we are calling “ReVault”. 
• 100+ models of Dell Laptops are affected by this vulnerability if left unpatched. 
• The ReVault attack can be used as a post-compromise persistence technique that can remain even across Windows reinstalls.  
• The ReVault attack can also be used as a physical compromise to bypass Windows Login and/or for any local user to gain Admin/System privileges. 

Dell ControlVault overview 

Dell ControlVault is “a hardware-based security solution that provides a secure bank that stores your passwords, biometric templates, and security codes within the firmware.” A daughter board provides this functionality and performs these security features in firmware. Dell refers to the daughter board as a Unified Security Hub (USH), as it is used as a hub to run ControlVault (CV), connecting various security peripherals such as a fingerprint reader, smart card reader and NFC reader. 

Here is a photographic example of a USH board:  ​​​​

This is the board in its natural environment:  

The current iterations of the product are called ControlVault3 and ControlVault3+. and can be found in more than 100 different models of actively-supported Dell laptops (see DSA-2025-053), mostly from the business-centric Lattitude and Precision series. These laptop models are widely used in the cybersecurity industry, government settings and challenging environments in their Rugged version. Sensitive industries that require heightened security when logging in (via smartcard or NFC) are more likely to find ControlVault devices in their environment, as they are necessary to enable these security features. 

Findings 

Today, Talos is publishing five CVEs and their associated reports. The vulnerabilities include multiple out-of-bounds vulnerabilities (CVE-2025-24311, CVE-2025-25050) an arbitrary free (CVE-2025-25215) and a stack-overflow (CVE-2025-24922), all affecting the CV firmware. We also reported an unsafe-deserialization (CVE-2025-24919) that affects ControlVault’s Windows APIs. 

Impact 

With a lack of common security mitigations and the combination of some of the vulnerabilities mentioned above, the impact of these findings is significant. Let’s highlight two of the most critical attack scenarios we have uncovered. 

Post-compromise pivot 

On the Windows side, a non-administrative user can interact with the CV  firmware using its associated APIs and trigger an Arbitrary Code Execution on the CV firmware. From this vantage point, it becomes possible to leak key material essential to the security of the device, thus gaining the ability to permanently modify its firmware. This creates the risk of a so-called implant that could stay unnoticed in a laptop’s CV firmware and eventually be used as a pivot back onto the system in the case of a Threat Actor’s post-compromise strategy. The following video shows how a tampered CV firmware can be used to “hack Windows” by leveraging the unsafe deserialization bug mentioned previously. 

0:00

/0:22

1×

Physical attack 

A local attacker with physical access to a user’s laptop can pry it open and directly access the USH board over USB with a custom connector. From there, all the vulnerabilities described previously become in-scope for the attacker without requiring the ability to log-in into the system or knowing a full-disk encryption password. While chassis-intrusion can be detected, this is a feature that needs to be enabled beforehand to be effective at warning of a potential tampering. 

Another interesting consequence of this scenario is that if a system is configured to be unlocked with the user’s fingerprint, it is also possible to tamper with the CV firmware to accept any fingerprint rather than only allowing a legitimate user’s.   

0:00

/0:07

1×

Remediation 

Mitigation 

To mitigate these attacks, Talos recommends the following: 

• Keep your system up to date to ensure the latest firmware is installed. CV firmware can be automatically deployed via Windows Update, but new firmware usually gets released on the Dell website a few weeks prior. 
• If not using any of the security peripherals (fingerprint reader, smart card reader and NFC reader) it is possible to disable the CV services (using the Service Manager) and/or the CV device (via the Device Manager).  
• It is also worth considering disabling fingerprint login when risks are heightened (e.g., leaving one’s laptop unattended in a hotel room). Windows also provides Enhanced Sign-in Security (ESS), which may help mitigate some of the physical attacks and detect inappropriate CV firmware. 

Detection 

To detect an attack, consider the following: 

• Depending on your laptop model, chassis intrusion detection can be enabled in the computer’s BIOS. This would flag physical tampering and may require entering a password to clear the alert and restart the computer. 
• In the Windows logs, unexpected crashes of the Windows Biometric Service or the various Credential Vault services could be a sign of compromise. 
• Cisco customers using Cisco Secure Endpoint can be made aware of potential risks with the signature definition “bcmbipdll.dll Loaded by Abnormal Process”. 

Conclusion 

These findings highlight the importance of evaluating the security posture of all hardware components within your devices, not just the operating system or software. As Talos demonstrated, vulnerabilities in widely-used firmware such as Dell ControlVault can have far-reaching implications, potentially compromising even advanced security features like biometric authentication. Staying vigilant, patching your systems and proactively assessing risk are essential to safeguard your systems against evolving threats. 

Cisco Talos Blog – ​Read More

• In 2023, Talos collaborated with NetHope and Cisco Crisis Response to create a customized Backdoors & Breaches expansion deck for international humanitarian organizations, addressing their unique cybersecurity challenges. 
• The new expansion deck helps NGOs with constrained budgets improve proactive security and incident response skills through engaging tabletop exercises that are specific to their technical, political, and logistical challenges. 
• Hundreds of expansion decks have been distributed to international NGOs, and Talos has received positive feedback for their practicality and relevance. 
• Building on this success, we partnered with NGO-ISAC to develop a United States-specific deck for domestic NGOs, enhancing their cybersecurity preparedness.

---

Humanitarian organizations and the cybersecurity landscape

Hello friends! My name is Joe Marshall and I work at Cisco Talos as a cyber threat researcher and security strategist. Throughout my travels with Talos, I’ve met extraordinary individuals and organizations who fight injustices in a variety of ways: caring for children, feeding the unhoused, promoting democracy, protecting the environment, or resettling refugees who are fleeing from war. 

In moments of unimaginable crisis and pain, the international non-governmental organization (NGO) folks I met are on the front lines distributing aid, documenting human rights abuses, assisting first responders, and offering comfort to people who have had their worlds upended. I unabashedly admire and respect them. 

Unfortunately, international NGOs have historically struggled in cybersecurity. No matter an NGO’s size, limited donor and grant dollars mean that sustaining the organization competes with delivering aid, leaving little (if any) funding for cybersecurity. As a result, public sector offensive actors, mercenary spyware organizations, and state-sponsored actors take advantage of this to target or financially exploit these NGOs, even though they are assisting some of the most vulnerable people in the world. No one gets a pass in this modern era of cybercrime!

Helping the helpers

In 2023, the Cisco Crisis Response (CCR) team — a group that helps local agencies and communities prepare for, respond to, and sustainably rebuild from crises — approached my team at Talos with a rare opportunity to help incorporate cybersecurity into their work alongside their partner, NetHope.

NetHope is a humanitarian assistance organization that “helps our nonprofit Members effectively address the world’s most pressing challenges through collaboration, collective action and the smarter use of technology.” They also host the NetHope Global Summit, a yearly gathering of international NGOs to discuss technical issues and solutions to enable their member NGOs’ missions.

Before this project, I was not well-versed in the challenges of the NGO cybersecurity landscape or operating realities. Every business vertical is unique, and my first few meetings with NetHope forced me to confront the stark realities of the cybersecurity poverty line. With NGOs’ limited cybersecurity budgets, expertise, and resources, I knew our project had to have a low barrier to entry.

After much brainstorming, I suggested that we create an NGO-centric version of the popular cybersecurity tabletop exercise, “Backdoors & Breaches,” to keep workers’ incident response skills sharp.

What is a tabletop exercise? 

A tabletop exercise (TTX) is a group thought experiment. The “Game Master” presents various scenarios and variables to their players, who are usually team leaders in their business, to see how they respond as a group. At a high level, TTXs are a way to help your team prepare for worst-case scenarios and cost-effectively develop plans and responses to a variety of incidents. As they say, “Fortune favors the prepared.”

For example, a hospital might want to conduct a TTX to develop and test incident response and data recovery if hackers were to attack their electronic health records. An electric utility company might conduct a TTX to test critical infrastructure restoration and coordination with emergency responders. And, of course, a humanitarian assistance organization may need to protect itself against cyber attacks to keep their life-saving work going!

An introduction to Backdoors & Breaches

Backdoors & Breaches is a card-based TTX developed and published under a GNU license by Black Hills Information Security. It’s a novel game designed to teach both technical and non-technical players cybersecurity incident response in a format similar to the popular Dungeons & Dragons roleplaying game. Here’s an example of gameplay at the RSA Conference, with the digital version of the game:

If you want to accommodate a specific technical aspect of security, like industrial control systems, the cloud, or threat hunting, you can modify Backdoors & Breaches with expansion decks. Customizing cards to reflect your team’s unique circumstances can result in better buy-in and even a higher level of preparedness when a breach occurs.

Talos and NetHope create a new expansion

It was this potential customization that attracted me to making a new expansion deck for the international humanitarian community. The concept of Talos and NetHope adapting a cost-effective, portable, and easy-to-understand TTX to fit the limited cybersecurity budgets of typical NGOs was irresistible. To bring this vision to life, I assembled a diverse team of seasoned cybersecurity NGO professionals, technologists, and crisis response specialists who recognized the value in developing new cards.

The result was a new deck that seamlessly merged into the original Backdoors & Breaches game. These unique cards are modeled from real events and speak to the unique technical, political, and logistical challenges that humanitarian assistance organizations may face during cyber attacks. Here are some examples:

We presented this new expansion at the NetHope Global Summit in 2023, where participants widely enjoyed it. We found that this expansion pack brought them together in ways the generic deck on its own likely wouldn’t have. Many people shared first-hand experiences with the stressful situations these cards presented, which led to authentic and open conversations on the best responses to the scenarios.

Over the course of several summits, Talos and NetHope have given away hundreds of physical copies of the expansion, and we’ve received a lot of positive reception from the international NGO community. If you’re curious, you can also find the cards online here.

The U.S. domestic NGO edition

In a country as large as the United States, there are hundreds of domestic NGOs that operate solely within the country and local communities. The NGO Information Sharing and Analysis Center (NGO-ISAC) is a 501(c)(3) nonprofit organization that focuses on domestic civil society organizations.

Using the momentum of our Backdoors & Breaches international humanitarian expansion pack, Talos partnered with NGO-ISAC to create a new deck that reflects U.S.-specific NGO security situations.

If the NGO’s team is spread across the country and wants to play, that’s not a problem! Using this GitHub link you can instantiate and connect to a mini web server on your local computer. With a web sharing tool, you can stream it to any size audience and folks can play along virtually. You can easily use Python for this.

Conclusion

International and domestic NGOs are critical to aid delivery and civil society, but they’re heavily targeted by threat actors who seek to disrupt or exploit their missions. TTXs like Backdoors & Breaches lower the barrier to entry for organizations to have serious conversations about security posture and response, and NetHope and Talos’ custom expansions provide industry-specific scenarios to enrich the experience.

I feel very fortunate to have had the opportunity to volunteer and donate my time to help NGO workers and volunteers fight the good fight. Whether you’re a threat intelligence organization, an international NGO providing medical care to refugees, or a domestic food bank fighting hunger, Talos is with you.

Cisco Talos Blog – ​Read More

July brought powerful new updates to help your SOC catch threats faster, reduce manual effort, and make more confident decisions, right inside your existing workflows. From fresh integrations to better detection coverage, these changes are built to support your team every step of the way. 

In this update: 

• New IBM QRadar SOAR integration to automate investigations and speed up response 

• Launch of a free TI Lookup plan, giving all users access to live attack data from 15K SOCs 

• New Debian ARM VM for analyzing malware targeting IoT and embedded systems 

• Expanded detection with 163 new behavior signatures, 13 YARA rules, and 2,772 Suricata rules 

Keep reading to explore what’s new and how these updates can improve your daily workflows and threat visibility. 

Product Updates 

IBM QRadar SOAR Integration: Faster, Smarter Incident Response 

We’ve officially launched the ANY.RUN app for IBM QRadar SOAR, helping SOC teams move faster, reduce manual effort, and make smarter decisions without leaving their existing workflows. 

With this integration, analysts can detonate suspicious files and URLs in ANY.RUN’s interactive sandbox directly from QRadar SOAR, and get verdicts, behavioral logs, and IOCs pushed back into the incident automatically. This not only speeds up triage, but also cuts Mean Time to Respond (MTTR) and reduces the risk of missing stealthy threats. 

You can also enrich key indicators using ANY.RUN’s Threat Intelligence Lookup, pulling in fresh, real-world threat context from live malware samples observed across 15,000+ organizations. 

What Your Team Gains: Business and Operational Impact 

The new IBM QRadar SOAR integration delivers real performance and value across your SOC. By combining automated sandbox detonation with live threat intelligence enrichment, ANY.RUN helps security teams reduce alert fatigue, move faster, and make better-informed decisions. 

• Lower workload and faster response: Automation cuts down manual triage and enrichment, letting analysts focus on critical threats, not routine tasks. 

• Improved efficiency across tiers: Tier 1 and Tier 2 analysts benefit from streamlined investigation and escalation, while senior staff gain the bandwidth to focus on strategy and tuning. 

• Smarter decisions, better processes: Sandbox reports and TI Lookup insights feed directly into playbooks and detection rules, driving continuous improvement. 

• Early visibility into stealthy threats: Real-time behavioral data exposes multi-stage and evasive attacks that traditional tools often miss. 

• Stronger ROI from existing tools: The integration adds powerful behavioral context to your SOAR workflows, without requiring new infrastructure or steep learning curves. 

How to Get Started 

Getting started is easy, just install the ANY.RUN app from IBM App Exchange and connect your account using an API key. You can enable sandbox analysis, Threat Intelligence Lookup, or both, depending on your workflow.  

Threat Intelligence Lookup Gets a Free Plan and More Power for Premium 

This July, we made accessing high-quality threat intelligence easier than ever. ANY.RUN’s Threat Intelligence Lookup (TI Lookup) now includes a Free plan, giving every analyst and SOC team access to real-time, actionable data from millions of sandboxed malware sessions. 

“Threat Intelligence in ANY.RUN continues to evolve — not only by adding more features, but by making the right ones easier to use.” 
— Aleksey Lapshin, CEO at ANY.RUN 

We’ve simplified access to ANY.RUN’s threat intelligence ecosystem with a cleaner, faster entry point. With the Free plan, you can now explore Public Samples, TTPs, Suricata rules, and malware trends without cost or complexity. 

Users can perform unlimited searches using core indicators like file hashes, URLs, domains, IPs, Suricata IDs, and MITRE ATT&CK techniques, and combine them using the AND operator for refined threat queries. 

What You Can Achieve with TI Lookup Free 

The essential features in the free tier help SOC teams address real-world challenges: 

• Enrich threat investigations: Gain extensive context by linking existing artifacts to real-world attacks observed in the wild. 

• Reduce response time (MTTR): Analyze threat behavior, objectives, and targets directly from sandbox sessions to support fast, informed decisions. 

• Strengthen proactive defense: Gather intel on emerging threats early, before they escalate, using real-time data. 

• Grow your team’s expertise: Help SOC analysts learn from real-world malware by exploring TTPs through the interactive MITRE ATT&CK matrix. 

• Develop SIEM, IDS/IPS, or EDR rules: Use collected intelligence to fine-tune detection rules and boost your organization’s overall defense. 

You can view up to 20 recent sandbox sessions per query, giving you insight into how threats evolve and behave across multiple industries and regions. 

All you need to do to get started is sign up or log into your ANY.RUN account, and you’re in. 

Go Beyond the Basics with TI Lookup Premium 

The Free plan gives your team a powerful starting point, but with TI Lookup Premium, you gain the scale, depth, and automation needed for enterprise-grade investigations. Premium unlocks three times more threat data, advanced search capabilities, and access to exclusive features like private search, YARA rule matching, alert subscriptions, and API integration. 

Whether you’re triaging alerts, threat hunting, or building detection rules, Premium gives you full control over your threat intelligence workflows, so your SOC stays ahead of threats, not just reacts to them. 

Reach out to us for trial access to TI Lookup Premium for your SOC team.

Debian Sandbox for ARM Malware Detection and Analysis 

To help SOC teams stay ahead of evolving threats, ANY.RUN now supports Linux Debian 12.2 64-bit (ARM) in our Interactive Sandbox. This new environment enables deep analysis of malware targeting ARM-based systems, commonly found in IoT devices, embedded infrastructure, and lightweight servers. 

ARM-based malware is becoming a serious concern across industries. These attacks often target underprotected systems to establish botnets, steal resources, or maintain unauthorized access, making early detection critical. 

With the new Debian (ARM) VM, analysts can: 

• Engage directly with ARM-based malware in a live, isolated environment to trigger and observe hidden behaviors 

• Uncover advanced tactics like persistence, evasion, and privilege escalation with process-level visibility 

• Trace execution paths in real time, from dropped files to command-line activity 

• Correlate behaviors with known TTPs using integrated MITRE ATT&CK mapping for threat classification 

The new ARM VM is available to Enterprise users. Simply open a new analysis and select Linux Debian 12.2 (ARM, 64-bit) from the OS list to get started. 

What this update brings to your SOC: 

• Faster analysis: Accelerate triage, incident response, and threat hunting with a dedicated ARM environment that delivers instant behavioral insights. 

• Reduced platform costs: Analyze ARM-based threats alongside Windows, Android, and Linux samples, all within the same sandbox platform. 

• Smarter incident escalation: Collect rich, actionable data during Tier 1 analysis to support better handoffs to Tier 2 teams. 

• Stronger analyst expertise: Empower your team to investigate real-world ARM malware, improving skillsets through hands-on, safe analysis. 

Threat Coverage Update 

In July, our team expanded detection capabilities significantly to help SOCs stay ahead of evolving threats: 

• 163 new signatures were added to strengthen detection across malware families and techniques. 

• 13 new YARA rules went live in production, boosting accuracy and enabling deeper hunting capabilities. 

• 2,772 new Suricata rules were deployed, ensuring better coverage for network-based attacks. 

These updates mean analysts get faster, more confident verdicts in the sandbox and can enrich SIEM, SOAR, and IDS workflows with fresh, actionable IOCs. 

New Behavior Signatures 

In July, we added a new set of behavior signatures to help SOC teams detect stealthy, obfuscated, and persistent techniques earlier in the attack chain. These signatures are triggered by actions, not static indicators, giving your analysts deeper visibility and faster context during investigations. 

Malware Families 

Obfuscation & Evasion Techniques 

• ASCII char obfuscation (POWERSHELL) 

• Escape characters obfuscation (POWERSHELL) 

• Formatting operator obfuscation (POWERSHELL) 

Persistence Techniques 

• Suspicious task schedule using the at utility 

• Overwriting the (ps, ss, ls, dir, find, lsof) system utility 

• Binding /proc/pid with mount to hide activity 

• Delete the USN journal volume to hide file creation activity 

Recon & Credential Access 

• Get credential information from host via cmdkey 

File/Registry/OS Abuse 

• Stealing a registry hive 

• Cipher free space wipe 

• Use SyncAppvPublishingServer as a Powershell host to execute Powershell code 

• Executes commands from a specially prepared ie4uinit.inf file 

• driver loading without leaving file traces on disk 

Payload Delivery 

• Finger tool payload download abuse 

• IMEWDBLD tool payload download abuse 

Other 

• BART: Loader activity observed in stealthy malware campaigns 

• susp-lnk: Flags suspicious .lnk shortcut behavior often used for initial access 

• susp-clipboard: Detects suspicious clipboard manipulation commonly used in credential theft or staged payload delivery 

YARA Rule Updates 

In July, we released 13 new YARA rules into production to help analysts detect threats faster, improve hunting accuracy, and cover a wider range of malware families and evasion tactics. 

Some key additions: 

New Suricata Rules 

We’ve also added 2772 targeted Suricata rules to help SOC teams catch stealthy data exfiltration attempts and phishing campaigns more reliably. Here are a few hihglights: 

• Telegram data exfiltration (sid:85002387): Detects attempt to exfiltrate stolen data via Telegram Bot API 

• Fake government domain pattern (sid:85002265): Identifies potentially fraudulent domains mimicking legitimate government services 

• Microsoft authorization phishing (sid:85002349): Tracks phishing attacks by observing legitimate MS Auth URL on unknown/fake domain 

These new rules enhance detection for modern phishing and exfiltration tactics and are automatically applied in your ANY.RUN sessions. 

About ANY.RUN 

ANY.RUN supports over 15,000 organizations across banking, manufacturing, telecom, healthcare, retail, and tech, helping them build faster, smarter, and more resilient cybersecurity operations. 

Our cloud-based Interactive Sandbox enables teams to safely analyze threats targeting Windows, Linux, and Android systems in under 40 seconds; no complex infrastructure required. Paired with TI Lookup, YARA Search, and Threat Feeds, ANY.RUN empowers security teams to accelerate investigations, reduce risk, and boost SOC efficiency. 

Start your 14-day trial and take full control of threat analysis 

The post Release Notes: QRadar SOAR App, TI Lookup Free Access, and 2,900+ New Detection Rules appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

The stereotype of Gen Z as lazy, uncommitted employees averse to hard work, and prone to job-hopping is quite common. But the statistics tell a different story. Nearly half of Zoomers juggle multiple gigs: a full-time job, freelancing, and various side hustles. And cybercriminals have identified these polyworking young professionals as convenient targets.

Our experts dug into this trend and uncovered some non-obvious threats. This article explores how Gen Z can navigate their multi-job lifestyles without putting their cybersecurity at risk.

More apps, more problems

The core issue stems from the sheer number of corporate apps and accounts Gen Z has to juggle. Think about it: Zoom for one job, Slack for another, and Notion for tasks across the board. And the more applications they use, the larger the attack surface for cybercriminals. Scammers constantly send phishing emails that convincingly impersonate employers, and distribute malware disguised as business software. They can even send fake assignments, pretending to be your boss.

From mid-2024 to mid-2025, Kaspersky experts recorded six million attacks involving fake collaboration platforms. Most often, attackers imitated the “golden trio” of corporate applications: Zoom, and Microsoft Excel and Outlook.

Here’s how it might play out: an attacker sends an email seemingly from Zoom asking you to update the app. The email contains a link that leads to a phishing site mimicking the real Zoom page. This fake site then immediately downloads a bogus application to your device. The imposter app could then steal your contacts’ data or even gain access to your entire work environment — the potential scenarios are numerous.

How scammers are deceiving job-seeking Gen Z

If you’ve ever seen a message in a neighborhood chat like, “URGENT: remote work, $60 an hour!” — it’s likely a scam. But these days scammers have grown much more sophisticated. They’re posting what look like legitimate job openings on popular job platforms, detailing the terms so thoroughly that the positions appear genuine. In reality, even the most well-crafted job posting can turn out to be completely fake.

Cybercriminals may even conduct fake interviews to make their schemes appear more convincing. One common form of extortion targets Gen Z through fake “interviews”, where victims are told to log out of their personal Apple ID and access a purported “company” account. If the victim complies, the scammers activate Lost Mode, effectively bricking the applicant’s iPhone. Naturally, they then demand a hefty sum to unlock it.

Freelance opportunities also deserve a close look. The search for freelance work is often less formal than traditional job hunting: all communication happens through messaging apps, and payments might even come from a client’s personal account. It’s incredibly easy to imitate this casual communication style, and scammers exploit this. In a worst-case scenario, instead of landing a new gig, you could end up with a bricked phone, malware infection, compromised personal accounts, or even losing all your money to the “client”.

It’s impossible to list every single red flag when you’re looking for a new job, but here are the main things to watch out for.

• If someone wants something done yesterday and is promising a ton of cash for it, you’re likely dealing with scammers.
• Third-party payments. Stick to payment methods you trust.
• Sign-in/sign-out requests. Be extremely wary if someone asks you to sign in or out of any accounts — especially your personal Apple ID.
• Paid training. If they’re asking you to pay for training upfront with the promise of reimbursement later — simply ignore them.
• Excessive personal data. Applying to be a dog walker, but they’re asking for copies of every page of your passport? No way, José.

Why Gen Z is being targeted, and how to fight back

Some companies have adopted BYOD policies, asking employees to use their personal tech for work. The problem is, these are often the same devices used for everything else: gaming, downloading files from the internet, and chatting with friends. Do we even need to say that downloading torrents on the laptop used for work is a dubious idea?

Many Gen Zers also make a costly mistake when using a large number of applications: they use one password for everything. Just a single data breach (and they happen all the time!), and cybercriminals can gain access to all your messaging apps, calendars, email clients, and other work-specific applications. Of course, coming up with and remembering complex passwords every time is a challenge. That’s why we recommend using a password manager that can generate strong, unique passwords, and securely store them for you.

What else you can do to avoid falling victim to cybercriminals while you’re job searching?

• Boost your cybersecurity knowledge by playing Case 404.
• Always enable two-factor authentication wherever possible. By the way, you can store your 2FA tokens in our password manager.
• Avoid downloading apps or updates from suspicious websites.
• Install Kaspersky Premium on your personal devices. This application can prevent you from opening phishing links, and significantly improve your personal security.

Cybersecurity cheat-sheet for polyworkers:

• Creating an unforgettable password
• How to shrink your digital footprint
• Keep it under wraps: encrypted note-taking apps and to-do lists
• How to use ChatGPT, Gemini, DeepSeek and other AI securely
• What to do if someone tries to hack you

Kaspersky official blog – ​Read More