Lock and Code

Afleveringen

1. What do your apps know about you? (re-air, feat. Tim Shott)

   1 november 2026 · 44 min

   Afspelen
   Something’s not right in the world of location data. Lees meer

   In January 2025, a location data broker named Gravy Analytics was hacked, with the alleged cybercriminal behind the attack posting an enormous amount of data online as proof. Though relatively unknown to most of the public, Gravy Analytics is big in the world of location data collection, and, according to an enforcement action from the US Federal Trade Commission last year, the company claimed to “collect, process, and curate more than 17 billion signals from around a billion mobile devices daily.”

   Those many billions of signals, because of the hack, were now on display for security researchers, journalists, and curious onlookers to peruse, and when they did, they found something interesting. Listed amongst the breached location data were occasional references to thousands of popular mobile apps, including Tinder, Grindr, Candy Crush, My Fitness Pal, Tumblr, and more.

   The implication, though unproven, was obvious: The mobile apps were named with specific lines of breached data because those apps were the source of that breached data. And, considering how readily location data is traded directly from mobile apps to data brokers to advertisers, this wasn’t too unusual a suggestion.

   Today, nearly every free mobile app makes money through ads. But ad purchasing and selling online is far more sophisticated than it used to be for newspapers and television programs. While companies still want to place their ads in front of demographics they believe will have the highest chance of making a purchase—think wealth planning ads inside the Wall Street Journal or toy commercials during cartoons—most of the process now happens through pieces of software that can place bids at data “auctions.” In short, mobile apps sometimes collect data about their users, including their location, device type, and even battery level. The apps then bring that data to an advertising auction, and separate companies “bid” on the ability to send…

2. A sextortion conspiracy killed his son (feat. John DeMay)

   18 oktober 2026 · 48 min

   Afspelen
   At just 17 years old, Jordan DeMay was murdered by strangers online. Lees meer

   That’s how Jordan’s father, John DeMay, described what happened to his son four years ago. At home in Michigan, Jordan was readying for a weekend trip when he received a friend request on Instagram. The invite was sent by a user named “dani.robertts” whose profile showed an attractive young woman. After accepting the request, Jordan and the account chatted about nothing in particular—teenage matters, getting to know one another—before “dani” became flirtatious, eventually sending Jordan what she claimed was a nude photograph of herself.

   Jordan responded in kind with an explicit photograph of himself.

   But here, a trap was revealed.

   “Dani Robertts” was not a young, friendly, interested woman. Dani Robertts was several men, sending messages from thousands of miles away in Lagos, Nigeria, who had followed a script to pressure young men into handing over their money. This was not the first time these men had run this scam. But with a great deal of investigative work, it hopefully has become the last.

   What happened to Jordan can happen to anyone—and it has happened to far too many young men and women today. It is a type of attack commonly referred to as “sextortion.”

   Today, on the Lock and Code podcast with host David Ruiz, we speak with John DeMay about his son Jordan, his family’s relationship with social media, and what parents should know.

   Tune in today.

   You can also find us on Apple Podcasts, Spotify, and whatever preferred podcast platform you use.

   For all our cybersecurity coverage, visit Malwarebytes Labs at malwarebytes.com/blog.

   Show notes and credits:

   Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)

   Licensed under Creative Commons: By Attribution 4.0 License

   http://creativecommons.org/licenses/by/4.0/

   Outro Music: “Good God” by Wowa (unminus.com)

3. A true tale of virtual kidnapping (re-air)

   4 oktober 2026 · 19 min

   Afspelen
   On Thursday, December 28, 2023, at 8:30 pm in the Utah town of Riverdale, the city police began investigating what they believed was a kidnapping. Lees meer

   17-year-old foreign exchange student Kai Zhuang was missing, and according to Riverdale Police Chief Casey Warren, Zhuang was believed to be “forcefully taken” from his home, and “being held against his will.”

   The evidence leaned in police’s favor. That night, Zhuang’s parents in China reportedly received a photo of Zhuang in distress. They’d also received a ransom demand.

   But as police in Riverdale and across the state of Utah would soon learn, the alleged kidnapping had a few wrinkles.

   For starters, there was no sign that Zhuang had been forcefully removed from his home in Riverdale, where he’d been living with his host family. In fact, Zhuang’s disappearance was so quiet that his host family was entirely unaware that he’d been missing until police came and questioned them. Additionally, investigators learned that Zhuang had experienced a recent run-in with police officers nearly 75 miles away in the city of Provo. Just eight days before his disappearance in Riverdale, Zhuang caught the attention of Provo residents because of what they deemed strange behavior for a teenager: Buying camping gear in the middle of a freezing winter season. Police officers who intervened at the residents’ requests asked Zhuang if he was okay, he assured them he was, and a ride was arranged for the teenager back home.

   But what Zhuang didn’t tell Provo police at the time was that, already, he was being targeted in an extortion scam. But when Zhuang started to push back against his scammers, it was his parents who became the next target.

   Zhuang—and his family—had become victims of what is known as “virtual kidnapping.”

   For years, virtual kidnapping scams happened most frequently in Mexico and the Southwestern United States, in cities like Los Angeles and Houston. But in 2015, the scams began reaching farther into the US.

   The scams the…

4. The AI plot to scan and destroy books (feat. Emanuel Maiberg)

   20 september 2026 · 39 min

   Afspelen
   If you want AI to tell you a story, it will. If you want that story to sound like one of your favorite authors, it can. And if you’re one of the authors that AI can imitate, you might be a little upset at what feels like theft. Lees meer

   In 2024, the authors Andrea Bartz, Charles Graeber, and Kirk Wallace Johnson sued Anthropic, the creator of Claude, alleging that the company had wrongfully digested millions of copyrighted works—including some of their very own—to train its AI models. The lawsuit grew to include more than 300,000 writers, and in September 2025, Anthropic agreed to pay $1.5 billion to settle the claims.

   That headline-worthy payout, however, would eventually be paired with more startling news.

   In January 2026, a district court judge unsealed thousands of documents related to the litigation. When The Washington Post investigated the documents, reporters found references to a secret project inside Anthropic called “Project Panama,” which Anthropic itself described as the company’s effort “to destructively scan all the books in the world.”

   Anthropic is not alone in this.

   On August 17, 404 Media co-founder and reporter Emanuel Maiberg revealed that Amazon is doing something similar inside a department it calls VGT3. By hiding an Apple AirTag in one book from a 1,000-book order, and then tracking the shipment across the country, 404 Media identified the book’s final destination to be a facility outside Las Vegas, where, according to employees, books are cut apart and scanned.

   Today, on the Lock and Code podcast with host David Ruiz, we speak with Maiberg about Amazon’s VGT3 operation and the likely commonplace practice of AI companies purchasing, scanning, and destroying books in an effort to build “frontier” models.

   “They’re buying a book, they’re scanning it, they’re mulching the book, and then the digital version of the book exists behind this wall where we don’t even know if they plan to sell it, right? It’s like they might keep it behind a wall, and th…

5. Loyalty points fraud is funding hacker holidays (feat. Kim Sutherland)

   6 september 2026 · 40 min

   Afspelen
   Crooks are taking a holiday. They’re counting on you to fund it. Lees meer

   For decades, cybercriminals have stolen roughly the same types of data. Biographical and personal details—like Social Security numbers, birthdates, addresses, and phone numbers—can be stolen to commit identity fraud. Credit card numbers, expiration dates, and CVC codes can be stolen to make fraudulent purchases. Usernames and passwords can, in the wrong hands, let a cybercriminal impersonate someone, steal sensitive photographs to later use for extortion, or abuse a reputation.

   All of these attack models seek to turn sensitive or important data into currency. But an emerging form of digital fraud is targeting data that, when used strategically, practically is currency: Loyalty points.

   Loyalty points programs are run by nearly every type of consumer-facing business today, from hotels to airlines to grocery stores to donut shops. As repeat customers accrue these points, they can exchange them for discounted prices on future purchases, cutting the costs of hotel stays, flights, rental cars, and even entire vacations.

   But the value stored within these loyalty points makes them a high target for cybercrime, said Kim Sutherland, Global Head of Fraud and Identity at LexisNexis® Risk Solutions.

   “Most loyalty currency is worth about one cent per point, and then there are premium programs that can be worth more than that,” Sutherland said, explaining that 100,000 airlines points, for example, can be worth $1,000 in the US. “Why criminals care so much about this is because most of us are not paying attention to our loyalty programs the same way we would our bank account.”

   But diligence is much needed here, Sutherland said, noting that one Chicago teacher only learned that 240,000 of his airlines points had been stolen because he received a basic confirmation email about their use. In another example, a man’s airline miles were stolen and fraudulently used to book rental cars in New York and Memphis.

   Today…

6. What happens to your data when you die? (feat. Tamara Kneese)

   23 augustus 2026 · 37 min

   Afspelen
   You will die. Your data will not. Lees meer

   The afterlife of our information is a recent phenomenon, and some of the companies with the most to sort through are still just figuring it out.

   As far back as 2007, Facebook was forced to reckon with mass grief when users asked the company to maintain the profile pages of the 32 victims killed by a school shooter at Virginia Tech that year. Those pages became de facto memorials for loved ones to fill with comments, and today, memorialization has become a full-fledged feature on both Facebook and Instagram. Platforms like YouTube, Pinterest, and LinkedIn—launched with likely zero strategy for a user’s death—now have procedures for next-of-kin to request that a deceased person’s account be deactivated.

   Now, think about all the other ways your data can linger after death.

   Every year, people accumulate more and digital stuff—email addresses, social media profiles, contact lists, domain names, subscription services, online banking accounts, and the phones, laptops, and tablets that hold it all—and every year, as that digital stuff accumulates, it compounds into ever more problems for someone else to sort out. Here, a small industry of digital estate planners have cropped up, helping families retrieve and preserve anything valuable, no matter how digital, from Spotify playlists, to poignant social media posts that mattered, to the photos stored on a phone.

   And where retrieval fails, artificial intelligence has offered an attempt at comfort. The chatbot service Replika launched in 2015 after its founder uploaded a dead friend’s text messages. HereAfter AI reportedly let users upload voice recordings to power a chatbot that sounded and spoke like the deceased. Film studios have pursued the same idea for entertainment, seeking to portray deceased actors in future films.

   Surprisingly, almost none of this activity is governed by law, said Tamara Kneese, author of the 2023 book “Death Glitch: How Techno-Solutionism Fails Us in This Life…

7. How to fake a data trail (and maybe lower prices) (feat. Chris Parr)

   9 augustus 2026 · 40 min

   Afspelen
   It may sound entirely bizarre but the prices you once paid for hotels, educational classes, or staplers could have all been higher because you used a Mac computer, lived in a certain zip code, or lacked an Office Depot in your neighborhood. Lees meer

   No, really.

   In 2012, The Wall Street Journal reported that the travel booking site Orbitz showed Mac users pricier hotel options than PC users, because the company had determined that Mac users spend, on average, 30% more a night on hotels. That same year, The Wall Street Journal (once again) reported that Staples.com showed higher prices to visitors who lived farther away from a competitor like Office Depot. And in 2015, the reporting outfit ProPublica revealed that customers in certain zip codes were shown higher prices for college test prep courses offered by The Princeton Review.

   As that investigation found, if customers:

   “type some zip codes into the company’s website, they are offered The Princeton Review’s premier course for as little as $6,600. For other zip codes, the same course cost as much as $8,400. One unexpected effect of the company’s geographic approach to pricing is that Asians are almost twice as likely to be offered a higher price than non-Asians.”

   This is surveillance pricing put into action.

   Under surveillance pricing, companies collect as much data as possible about consumers so that they can alter the literal prices those consumers pay for the exact same goods as everyone else. It is reportedly what caused some customers to see higher prices for televisions in the Target app when those customers were physically located in a Target parking lot. It is also allegedly why Home Depot customers in wealthy neighborhoods oddly paid less. And it is what Delta Airlines walked away from after public backlash.

   The near-omnipresence of surveillance pricing is also why so many videos can be found online today that claim that minor alterations to a person’s data trail—like changing an IP address using a VPN or sh…

8. What's your data worth on the dark web?

   26 juli 2026 · 24 min

   Afspelen
   Twenty years ago, a British mathematician named Clive Humby popularized a phrase that came to describe data’s relationship with the entire global economy: “Data is the new oil.” Lees meer

   Pithy as the phrase sounds, it is undeniably true.

   Data steers decisions at businesses of every size. Data created entirely new industries built around its capture. And, for a select number of companies, data has produced billions—if not trillions—of dollars in value.

   So how is it that, on the dark web, your stolen identity can be purchased for just 95 cents?

   That’s what a Malwarebytes researcher found last month after spending 48 hours inside the dark web to investigate cybercrime. Across a variety of forums and directories, he found subscription plans for malware that steals information once implanted on a device. He found guides for deploying social engineering scams. He found people selling their services to build fake websites that trick people into handing over their usernames and passwords. And he found one of the dark web’s most traded commodities—personal data, packaged together about individual people, to help a cybercriminal commit identity fraud.

   These packages are called “fullz.” For victims in the United States, a fullz contains a full name, Social Security Number, date of birth, address, and other personal details. That is enough, on its own, for a cybercriminal to potentially open a bogus line of credit, file a fake tax return, access financial accounts, or obtain medical services under someone else’s name.

   As we wrote on Malwarebytes Labs:

   “For less than the cost of a cup of coffee, a cybercriminal can buy enough information to devastate someone’s financial life.”

   It’s the kind of risk that could scare anyone, especially considering the scale behind it. In just the first six months of 2026, Malwarebytes found more than 7,500 compromised data sets on the dark web containing more than 8.4 billion records.

   And yet, even today, cybersecurity professionals still get ask…

9. Trusting your kids online isn't enough

   12 juli 2026 · 39 min

   Afspelen
   There is a lot going on right now regarding the safety of kids online. Lees meer

   In the United States, the majority of state legislatures have passed age verification laws requiring a variety of websites to more rigorously verify the age of their visitors. In the United Kingdom, Canada, Norway, Spain, and Germany, lawmakers are considering bans on social media access for anyone under the age of 16—Australia passed its ban in 2025. In schools across the world, smartphones have been removed from classrooms, hallways, and cafeterias. And online, some of the most popular apps and video games with children, such as Discord and Roblox, have implemented default restrictions on what young users can find and who they reach.

   But all this activity comes after rising crises at home, as an increasing number of behavioral researchers connect increased social media use with increased rates of depression, isolation, and suicidal thoughts. So, until real, societal change takes place, what is a concerned parent to do?

   That’s what we’re trying to answer today.

   Today, on the Lock and Code podcast with host David Ruiz, we bring back Anna Brading, editor-in-chief of Malwarebytes Labs and director of content and, perhaps most importantly, mother of three. With a long career in cybersecurity—and an equally long time spent reading, writing, and assigning some of the cybersecurity world’s most pressing headlines—Brading has a unique perspective on what is most dangerous to her children online.

   Brading’s list of priorities is long, and includes improper image use, “online nastiness,” and Roblox, but she has a few rules and guidelines to help. She sets a one-hour-a-day video game limit on the weekends, restricts YouTube to a communal and monitored activity, and requests that no one share photos of her children online without her express permission. Importantly, she also reminds parents to trust their guts.

   “If the norm now is mental health issues or online grooming or non-consensual porn or const…

10. This pay gap is programmed (feat. Veena Dubal)

    28 juni 2026 · 42 min

    Afspelen
    Pay is personal for plenty of Americans, but a new distribution model that consumes vast quantities of worker data is turning pay into something else: personalized. Lees meer

    For an increasing number of workers in America, the money they can expect to be paid on any given day, week, or month is unknown to them. They could work the same number of hours as they did the shift before. They could help the same number of customers. They could do everything, as nearly similar as possible, and still be paid less than another worker in the exact same position, or even themselves just last week.

    The mechanism behind this pay disparity is called algorithmic wage discrimination and while the term may be new, it’s inner workings could sound quite familiar.

    Algorithmic wage discrimination describes the zig-zag pay that is meted out to contract workers by big companies like Uber and Amazon. Whereas many workers in the world rely on salaries, or commissions, or self-determined contract rates, workers at Uber are different.

    In the same way that Uber decides what you pay for a ride to the airport, Uber also decides what a driver makes. And the calculus behind that decision is opaque. Location, traffic, the time of day, and the number of drivers on the road all play some role, but not a complete one. And in the same way that Uber incentivizes you with a flash sale or a price so high that you maybe walk a couple blocks in a different direction to get a lower price, Uber incentivizes drivers with bonuses and challenges, keeping them on the road perhaps longer than they intended.

    The end result, then, isn’t just unpredictable pay—it’s potentially an attempt to predict and control behavior.

    For her 2023 paper, titled “On Algorithmic Wage Discrimination,” professor of law Veena Dubal spoke with many Uber drives who compared this system to “casino culture,” in that the pay is unpredictable but the potential for a jackpot—or, just a good payment on one ride—is enough to convince drivers to stic…

Alle 172 afleveringen →