Your 5-Minute Security Checklist
Do this right now:
- Install a VPN app for the next time you use public WiFi
- Check browser notification settings — remove any suspicious sites
- Review Google account third-party access — revoke unknown apps
- Audit app permissions — deny camera/contacts/location where not needed
- Disable auto-download in WhatsApp and Telegram
1. The “Allow Notifications” Trap
You visit a website and it immediately asks: “This site wants to send you notifications — Allow or Block?”
Most people click Allow just to make it go away. Big mistake.
What actually happens:
- Scammers use this permission to send fake virus alerts, prize scams, and phishing links directly to your screen
- These notifications look like real system warnings — mimicking PayPal, Netflix, Microsoft, or your bank
- In November 2025, researchers discovered “Matrix Push C2” — a malware system that pushes fake security alerts through browser notifications to steal credentials
- Once allowed, these spam notifications follow you even to a new device when you log into your browser
Quick Fixes:
- Always click Block on notification requests from unfamiliar sites
- Never allow notifications from streaming, download, or “free” content sites
- If you accidentally allowed, revoke it immediately
How to Remove (Android Chrome): Settings → Site Settings → Notifications → Find the suspicious site → Block or Remove
How to Remove (iPhone Safari): Settings → Safari → Notifications → Turn off for unwanted sites
2. The “Sign in with Google” Trap
That convenient “Sign in with Google” button is everywhere. One click and you’re in. But do you know what access you’re giving?
What most people miss:
- Some apps only request your name and email (low risk)
- Others request access to your contacts, calendar, Drive files, or even “manage your account” (high risk)
- In January 2025, researchers found a Google OAuth vulnerability affecting approximately 10 million accounts tied to defunct company domains
- Attackers purchased old startup domains and gained access to employee accounts on Slack, Notion, Zoom, and HR systems containing tax documents, pay stubs, and social security numbers
Quick Fixes:
- Before clicking “Sign in with Google,” check what permissions the app is requesting
- For important accounts (banking, health, work), create a separate login instead
- Avoid using Google Sign-in on random sites just for convenience
- Regularly audit which apps have access to your Google account
How to Check (Google Account): Go to myaccount.google.com → Security → Third-party apps with account access → Review and remove apps you don’t recognize or no longer use
3. The App Permissions Trap
You download a simple flashlight app or a casual game. First thing it asks: “Allow access to Camera, Contacts, Location, and Storage?”
Why would a flashlight need your contacts?
The reality:
- In 2024, Google blocked 2.36 million policy-violating apps and prevented 1.3 million apps from getting excessive permissions
- Malware like “Joker” hides in innocent-looking apps, steals SMS messages, contacts, and secretly subscribes you to premium services
- “Tria Stealer” malware (discovered 2024) requests permissions to harvest data from Gmail, WhatsApp, Outlook, and banking apps — including one-time passwords (OTPs)
- Once you grant permission, the app can silently send your data to remote servers
Quick Fixes:
- Ask yourself: “Does this app actually need this permission to work?”
- A calculator doesn’t need camera access. A wallpaper app doesn’t need contacts.
- Deny unnecessary permissions — most apps work fine without them
- If an app refuses to work without suspicious permissions, uninstall it
How to Audit Permissions (Android): Settings → Apps → Select app → Permissions → Revoke anything unnecessary
How to Audit Permissions (iPhone): Settings → Privacy & Security → Select permission type (Camera, Contacts, etc.) → See which apps have access and toggle off
4. The WhatsApp/Telegram Malicious Link Trap
You receive a link in a WhatsApp group or Telegram channel. It looks like a video, a document, or a “must-see” file. You tap it.
Behind the scenes, malware is already downloading.
Real incidents:
- Water Saci (October 2025): Malware spreads through WhatsApp by automatically sending malicious zip files to ALL your contacts and groups once your account is compromised
- EvilLoader (2025): Telegram vulnerability disguises malware as video files. When you try to play the “video,” it installs malicious code
- Sturnus (November 2025): Advanced malware reads your WhatsApp, Telegram, and Signal messages in real-time by abusing Android’s Accessibility Service — bypassing end-to-end encryption by reading messages directly from your screen
- Pre-installed malware (2024): Cheap Android phones found with fake WhatsApp/Telegram apps pre-installed that steal cryptocurrency wallet addresses
Quick Fixes:
- Never open unexpected files or links, even from known contacts (their account may be hacked)
- Disable auto-download of media files
- If someone sends a suspicious link, call them to verify before clicking
- Avoid downloading apps from links shared in groups — always use official app stores
How to Disable Auto-Download (WhatsApp): Settings → Storage and Data → Media Auto-Download → Set all to “No Media”
How to Disable Auto-Download (Telegram): Settings → Data and Storage → Automatic Media Download → Disable for all chat types
5. Using Public WiFi? Connect VPN First
Free WiFi at coffee shops, airports, and hotels feels like a gift. But open networks are easy to intercept — anyone nearby with the right tools can see your browsing activity and capture passwords.
Why it matters:
- Hackers use “man-in-the-middle” attacks on public WiFi to intercept your data
- Your real IP address reveals your approximate location and can be used to track you
- Websites you visit can log your IP and browsing behavior
- Without encryption, your login credentials travel in readable format
Quick Fixes:
- Always use a VPN when connecting to public WiFi
- A VPN encrypts your traffic and hides your real IP address, making your data unreadable to snoopers
Pro Tip — The Safer Way to Connect:
- First, connect to VPN using your mobile data
- Then connect to the public WiFi
- This ensures your connection is encrypted from the very first moment
Don’t have a VPN subscription?
- Use VPN free trial when traveling or working from cafes
- Even a few hours of protection is better than browsing exposed
What a VPN protects:
- Hides your IP address and location
- Encrypts all your internet traffic
- Prevents ISPs and hackers from seeing what sites you visit
- Blocks man-in-the-middle attacks on public networks
What a VPN doesn’t protect:
- Won’t stop you from clicking phishing links
- Won’t protect against malware you download yourself
- Won’t help if you willingly enter credentials on fake sites
These aren’t advanced hacking techniques. They’re everyday traps that rely on you clicking “Allow” without thinking. The good news? A few setting changes and better habits can block most of them.
Stay alert. Stay protected.
