November 17, 2025

Security Briefing: Stay Alert - November 17, 2025

Stay Ahead of the Scams: New updates every Monday and Thursday.

Welcome to your essential security briefing. Cybercriminals don't take a holiday, and today's top stories are all about protecting your personal information and your wallet from increasingly clever scams.

📦 Holiday Warning: The QR Code "Brushing" Scam is Here

As the holiday shopping season ramps up, law enforcement and consumer protection groups are warning of a sharp rise in a scam known as "brushing," which now includes a dangerous new twist.

• What is Brushing? You receive an unexpected package from a retailer (like Amazon or a major online marketplace) that you did not order. Inside, the item may be cheap or completely worthless. The criminals do this to place fake, glowing reviews under your name, boosting their own sales rankings.

• The New Danger: QR Codes: Scammers are now putting QR codes inside these packages. If you scan the code (curiosity is dangerous!), it often directs you to a fake "customer service" or "package tracking" website designed to:

  • Steal Login Credentials: Trick you into entering your real passwords.

  • Install Malware: Silently download a program that spies on your phone or computer.

  • https://www.ic3.gov/PSA/2025/PSA250731

• Action You Must Take:

• 1. DO NOT Scan the QR Code: If you receive a package you didn't order, throw away any materials with a QR code.

  2. Monitor Your Accounts: Check your credit card and bank statements for any small, unauthorized charges.

  3. Report It: You can report brushing scams to the Better Business Bureau (BBB) or the retailer whose name is being abused.

🌐 Google Lawsuit Targets Massive Text Scams (Smishing) - https://www.npr.org/2025/11/12/nx-s1-5604857/google-lawsuit-phishing-text-message-scammers

Google has taken legal action against a major, organized criminal network that develops tools for SMS phishing (Smishing)—the practice of sending fraudulent text messages.

• The Threat: This criminal network sells sophisticated software kits that allow low-skill scammers to easily send text messages impersonating hundreds of legitimate companies (banks, delivery services, retail stores). These texts aim to steal your payment card information and turn it into mobile wallet funds (like Apple Pay or Google Pay).

• Action You Must Take:

  • NEVER Click Links in Texts: No matter how legitimate the message looks—even if it seems to be about an undelivered package or a suspended bank account—do not click the link in the text message.

  • Verify Independently: If you're concerned, delete the text and call the company (your bank, FedEx, etc.) using the official phone number found on their website or on the back of your bank card.

🖲️Tech Alert: Logitech Confirms Data Breach - https://www.forbes.com/sites/daveywinder/2025/11/17/logitech-data-breach---what-we-know-as-0-day-hack-attack-confirmed/

Electronics company Logitech recently confirmed a data breach involving unauthorized access to its internal systems.

• What Happened: Hackers reportedly exploited a flaw in third-party software used by the company. While Logitech states that sensitive personal information like Social Security numbers or credit card details were likely not housed in the affected system, some employee and consumer data may have been copied.

• The Risk to You: If you are a Logitech customer, your name, email, or other contact information may have been exposed.

• Action You Must Take: Be extremely alert for targeted phishing emails that look like they're from Logitech or other companies you use. Scammers will use the exposed information to make their emails seem more real.

💡Urgent: Patch Your Chrome Browser Now!

Google has released an urgent security update for its Chrome web browser to address a vulnerability that is already being exploited by attackers in the wild (a zero-day).

• The Threat: The flaw, related to the browser's JavaScript engine, could allow an attacker to remotely execute code on your computer, meaning they could take control simply by having you visit a malicious website.

• Action You Must Take: If you use Google Chrome, please update it immediately:

  1. Open Chrome.

  2. Click the three dots in the top right corner.

  3. Go to Help > About Google Chrome.

  4. The browser will automatically check for and install the latest update. You must restart your browser when prompted for the fix to take effect.

🔒 Quick Defense Checklist

• Update Everything: Use this weekend to install any overdue updates on your smartphone, tablet, and home computer. These updates patch critical security holes that hackers love to exploit.

• Use MFA (Multi-Factor Authentication): This is the single most important step you can take. Turn on two-factor or multi-factor authentication for your email, banking, and social media. If criminals steal your password, they still can't get into your account without the code sent to your phone.

• Monitor Financial Accounts: Check your credit card statements and bank balances online today. Look for any charges you don't recognize.