The IT Nerd

The way Americans protect their devices is undergoing a quiet shift. According to the second annual Antivirus Market Report 2026 from cybersecurity news portal Cybernews, built-in operating system tools have overtaken traditional third-party antivirus software as the primary line of defense for the majority of US internet users, while smartphones remain dangerously underprotected.

The study, based on a survey of 1,005 US adults conducted between March 30 and April 10, 2026, also shows a sharp drop in consumer enthusiasm for AI-powered security and a measurable rise in cybercrime.

Key findings:

• 53% of US PC users and 51% of mobile users rely on built-in OS security (such as Microsoft Defender or Apple’s native tools) as their primary protection, which is roughly 139 million and 134 million Americans, respectively.
• Only 18% of mobile users invest in third-party antivirus, compared with 41% on computers; 14% of mobile users use no cybersecurity tools at all.
• Favorability toward AI-powered threat detection fell from 77% in 2025 to 47% in 2026.
• The share of Americans who reported experiencing cybercrime grew by 14% year over year.
• McAfee and Norton remain the leading third-party brands for the second year in a row; AVG dropped out of the rankings entirely.
• Paid antivirus has overtaken free versions: 68% of PC and 66% of mobile antivirus users now hold a premium subscription.
• Data breaches were named the single greatest personal cybersecurity threat by 36% of respondents.

Smartphones are severely underprotected

Smartphones are the most-used personal device as 85% of respondents use one outside of work, yet they receive the least investment in security. Beyond the 14% of mobile users who report no protection at all, another 16% are unsure what protection they have, leaving a substantial share of the US smartphone population effectively unguarded.

Compared with the 2025 report, third-party antivirus use on mobile devices fell by roughly 10 percentage points, while computer protection inched up by two.

AV market consolidates around two names

Among third-party antivirus users on computers, McAfee leads with 40% market share, followed by Norton (37%), Malwarebytes (19%), and Bitdefender (9%).

On smartphones the order flips: Norton takes 42%, McAfee 39%, Surfshark 16%, and Bitdefender 15%.

The strong showing of Surfshark and Bitdefender on mobile points to growing traction among multi-tool security users. AVG, which appeared in last year’s report, was not used by survey respondents at all in 2026.

Consumers are okay with paying more for protection

Among users who do choose third-party antivirus, paid subscriptions are now clearly preferred:  68% of PC antivirus users and 66% of mobile antivirus users hold a premium plan, a notable jump from the 32% in 2025.

The data suggests that the segment still actively purchasing antivirus is increasingly willing to spend more for stronger protection, while everyone else is migrating to whatever ships with their device.

Antivirus is becoming one tool among many

Americans are no longer relying on antivirus software in isolation. VPNs are now used by 62% of PC and laptop users and 65% of mobile users, ahead of ad blockers and password managers.

The AI hype in cybersecurity is fading

Enthusiasm for AI-based security has collapsed in just twelve months. Favorability toward AI-powered threat detection dropped from 77% in 2025 to 47% in 2026, and 9% of users said AI features would actively make them less likely to use a given antivirus product.

Cybercrime keeps climbing

The share of Americans reporting personal experience with cybercrime rose by 14% year over year. Among those affected, 74% said the experience directly influenced their decision to start or continue using antivirus protection, meaning that, for many US consumers, security upgrades still tend to follow a harmful experience instead of preventing it.

Trust is now a huge competitive differentiator

Forty percent of respondents had heard of antivirus-related controversies, including Kaspersky’s US ban over national security concerns and Avast’s case for selling user browsing data. Among those aware, 82% said the information influenced their trust or purchasing decisions. The effect was strongest among users aged 18–24.

Demographic differences persist

Women are less likely than men to fall victim to cybercrime and tend to rely more on built-in tools and free antivirus software. Men are more likely to invest in paid third-party antivirus and additional security tools. Among non-users, men also showed higher levels of distrust toward antivirus software overall.

Data breaches are the biggest cybersecurity fear 

When asked to identify their greatest cybersecurity concern, 36% of respondents named data breaches at companies that store personal information, followed by phishing (31%), accidentally downloading malware (24%), and being specifically targeted by hackers (24%).

Notably, AI-related threats such as deepfake scams entered the top five, ranking ahead of the long-standing concern of unsafe public Wi-Fi.

The full report is available at: https://cybernews.com/best-antivirus-software/antivirus-market-report

Methodology

The survey was conducted online via the Cint panel between March 30 and April 10, 2026, among 1,005 US respondents aged 18 to 74. Quotas were applied to ensure balanced representation across age, gender, and region. Margin of error: ±3.1% at the 95% confidence level. Population estimates referenced in the report are based on US Census Bureau 2026 data.

On April 16th, the Cybernews research team discovered an exposed server owned by a threat actor. The exposed information is controlled by a carding market called Jerry’s Store.

Here are the key findings:

• Jerry’s Store is a tool that provides credit card validity percentages. In other words, threat actors used this tool to check if stolen payment cards are still operational.
• Jerry’s Store operators used Cursor, an AI-assisted development environment, to set up the leaking server and administrator-facing dashboards.
• Researchers believe that relying on an AI assistant to set up the server was the main reason why it ended up exposed, and that the threat actor received flawed instructions for building the dashboards.
• “While in this case it helped identify credit card fraud-related abuse, it’s also a lesson for developers using Cursor for legitimate uses, showing how it can lead to accidental data leaks,” researchers said. 

Researchers identified nearly 200K credit card details that the service deemed “invalid,” and over 145K counts of valid payment card information, including:

• Credit card numbers;
• Expiration dates;
• Security codes;
• Cardholder names;
• Cardholder addresses.

For more information, here’s the full report: https://cybernews.com/security/jerrys-store-vibecode-exposes-stolen-credit-cards

New research by Cybernews reveals that there have been 156 deepfake incidents targeting currently-serving U.S. officials in the past two years. Most of them are of Donald Trump. The research analyzed deepfakes of the President, Vice President, Cabinet members, governors, and Congress members.

Here are the key findings:

• 23 out of 602 currently-serving U.S. officials were targeted at least once during the analyzed period.
• In the past two years, there have been 156 deepfake instances of currently serving U.S. government officials. President Donald Trump alone accounts for 90 of the 156 instances recorded, or 58% of all deepfake incidents in the dataset.
• The next most targeted figures are Marco Rubio (13 instances) and JD Vance (12 instances). Together, the top three account for 115 out of 156 instances, or 73.7% of all recorded cases.
• 76% of deepfakes targeted Republicans – but without Trump, the distribution is more balanced.
• The most-deepfaked democrat is Alexandria Ocasio-Cortez with 9 instances recorded.
• The likelihood of being targeted by deepfakes drops sharply in larger groups, such as the House and Senate, where individual members are less visible and less recognized by the media.

For more information and visuals, here’s the full report: https://cybernews.com/ai-news/most-deepfaked-us-government-officials

By Stefanie Schappert

A Discord group’s unauthorized access to Anthropic AI’s powerful Mythos model on Tuesday is doing more than raising questions about the guardrails around powerful AI cybersecurity tools.

It’s exposing a bigger problem for the cybersecurity industry: AI can now find flaws and exploit them so quickly that defenders may be the ones left truly exposed.

A group of AI-fueled Discord info-seekers – one of them linked to a third-party vendor of the AI startup – managed to access the highly gatekept cybersecurity defense system in February, the same day of its debut. 

Using a mixed bag of insider access, web-scouring bots, and some raw ingenuity, the breach is triggering a fresh wave of alarm across an already spooked industry.

Ironically, as the Discord incident was unfolding, the Cloud Security Alliance – in a rapid-response briefing published days after Mythos was unveiled – warned that AI was accelerating vulnerability discovery faster than organizations could keep up, creating the perfect storm for defenders.

Finding thousands of flaws and zero days across hundreds of software systems, the introduction of Mythos has effectively shrunk the patch window defenders have relied on for years – from days to just a few hours.

If released in the wild and adopted by hackers, security teams will inevitably be tasked with building an entirely new playbook to help decide how to prioritize and fix what matters – and there’s still no guarantee they can stem the cyber bleeding. 

More than 250 security leaders helped shape the briefing, which argues the challenge is no longer just finding flaws, but deciding which ones actually pose real risk – and fixing them before they can be turned into working exploits.

It’s a shift some security experts say the industry is still underestimating. The problem is no longer discovery alone. It is remediation, accountability, and whether defenders can keep up as AI moves from identifying vulnerabilities to showing how they can be exploited in the real world.

The Mythos moment may ultimately be less about a single powerful cybersecurity model and more about what happens in the shrinking window between finding a flaw and weaponizing it.

Anthropic’s answer, for now, is Project Glasswing – a tightly controlled effort to use Mythos to help secure critical software before comparable models become more widely available.

But even that highlights the larger issue at hand: the industry knows what is coming and is still scrambling to build that much-needed playbook in time to defend against larger threats, such as nation-state or ransomware attackers.

If a group of AI nerds could get into Mythos – allegedly without malicious intent – imagine the fallout if the next ones to slide through that door were actual criminals.

ABOUT THE EXPERT

Stefanie Schappert, a senior journalist at Cybernews, is an accomplished writer with an M.S. in cybersecurity, immersed in the security world since 2019.  She has a decade-plus experience in America’s #1 news market working for Fox News, Gannett, Blaze Media, Verizon Fios1, and NY1 News.  With a strong focus on national security, data breaches, trending threats, hacker groups, global issues, and women in tech, she is also a commentator for live panels, podcasts, radio, and TV. Earned the ISC2 Certified in Cybersecurity (CC) certification as part of the initial CC pilot program, participated in numerous Capture-the-Flag (CTF) competitions, and took 3rd place in Temple University’s International Social Engineering Pen Testing Competition, sponsored by Google.  Member of Women’s Society of Cyberjutsu (WSC), Upsilon Pi Epsilon (UPE) International Honor Society for Computing and Information Disciplines.

A threat actor surfaced on a popular hacker forum, claiming to possess data belonging to Lacoste, Ralph Lauren, Canada Goose, and Carter’s.

The threat actor shared a small batch of sample images, roughly three to four per brand. The Cybernews research team has gone through the files provided.

These screenshots appear to include employee details such as full names and work email addresses. Others hint at possible customer data, though those portions were partially redacted by the actor before being posted. The full extent of the alleged breach remains under wraps, but Cybernews has reached out to the brands for confirmation.

Data that was allegedly stolen:

• Full names and work email addresses of company staff;
• Screenshots showing email addresses and home addresses of customers;
• Internal metadata in the form of various numerical values and system-specific data points.

The attacker states in the post that it is “supply chain data.” Cybernews researchers analyzed the technical fingerprints left behind in the samples.

“Generally, the format of this data repeats across different brands mentioned and their samples,” our researchers noted. This points toward a supply chain attack, where a third-party service provider, likely one specializing in data management or retail logistics, was the true entry point. “The data itself looks like it came from SQL server DBMS, because photo samples included specific SQL server-related metadata, such as row version numbers,” our research team explained.

“The company may have had some compromised employee accounts. It could’ve also had some system misconfigurations that led to unauthorized access to internal data without necessarily having any account credentials,” our researchers added.

For more information, here’s the full report: https://cybernews.com/security/lacoste-ralph-lauren-supply-chain-data-breach/

Just before the Iran-U.S. ceasefire deal hit the news, the U.S. announced that Iran-affiliated threat actors attacked critical U.S. infrastructure through internet-facing Operational Technology (OT) systems, which are used to control physical processes such as water systems and energy grids.

Cybernews’ Senior Information Security Researcher Aras Nazarovas provided some extensive commentary on this. He explains what made these attacks possible and what protective measures should be taken with Operational Technology (OT) systems.

This is not just a one-off campaign – it’s a repeatable attack model

“Attackers didn’t rely on anything particularly advanced. They took advantage of OT systems that were supposed to be isolated but ended up exposed to the internet. This is a very common issue in OT systems, and the same kind of attack can be repeated again and again, until the systems are properly secured.”

OT environments often lack the standard security features that IT environments have

“OT environments often don’t have the same security controls as IT systems. Instead, they rely much more on physical security and isolation. These systems are built to stay active 24/7, so a lot of standard protections like encryption or strong authentication aren’t always in place. In some cases, traffic is unencrypted for simplicity, and default passwords are still used.

That’s why isolation is so important. OT systems are supposed to be air-gapped and kept completely separate from IT networks and the internet. In the Iranian attacks on U.S. critical infrastructure, that basic rule wasn’t followed – systems that should have been isolated were exposed online. To avoid this kind of situation, the first step is simple: don’t connect them to the internet in the first place.”

Global VPN downloads hit an all-time high of 487 million in 2022 — and have been falling ever since. Downloads dropped to 404 million in 2023, partially recovered to 464 million in 2024, and fell again to 412.5 million in 2025, according to the latest iteration of the Cybernews VPN Adoption Report.

The report analyzed download data for the 50 most popular VPN apps from the Google Play Store and Apple App Store across 126 countries, compared against each country’s population to calculate adoption rates.

The Gulf states dominate the top 10

The countries where VPN adoption remains highest are overwhelmingly in the Persian Gulf. The UAE leads the world at 85.5%. The driving forces are state-level content restrictions and VoIP service blocks, as large expatriate populations need to communicate internationally.

Europe is showing consistent growth

Europe is the one region still showing consistent growth in 2025, while adoption rates in most other regions slowed down significantly. Three European countries sit in the global top 10 — the United Kingdom at #7, the Netherlands at #8, and France at #10. France saw the biggest climb of any G7 nation, rising 12 positions since the previous report. Seven of the global top 20 are now European, with the Nordics and Baltics also posting steady gains.

Adoption in G7 countries varies widely

Among G7 nations, the picture is uneven. The UK and France are both in the global top 10, while Italy and Japan remain far behind their peers.

The United States, despite producing the largest absolute download volumes, ranks only #21 — with downloads falling from 63.4 million in 2024 to 54.1 million in 2025.

Where VPN adoption is falling fastest

The steepest single-year declines were concentrated in countries with volatile political or regulatory environments. Myanmar dropped 19.4 percentage points in a single year, Nauru fell 17.1 pp, and Russia declined 12.3 pp.

The countries where almost no one uses a VPN

The lowest adoption rates are concentrated in Africa — 8 of the bottom 10 countries are African.

Full report here: https://cybernews.com/best-vpn/vpn-usage-by-country/

By Jurgita Lapienytė, Editor-in-Chief at Cybernews 

A new BBC report revealed what we suspected all along – big tech platforms turn a blind eye to harmful content for the sake of profit. Platforms allow so-called borderline content – misogynistic, sexist, racist, conspiracy-driven – that is harmful yet legal.

According to the report, based on accounts from a dozen whistleblowers and insiders, Meta engineers were instructed to allow more borderline content to compete with TikTok. Meanwhile, TikTok is said to have prioritized several user complaints involving politicians to “avoid threats of regulation or bans.”

Unsurprisingly, big tech platforms denied any wrongdoing, insisting that they do not amplify harmful content.

Algorithms are allegedly designed to better understand user interests and needs, and cater to them accordingly. Unfortunately, most of what a user “wants” turns out to be conspiracy theories, AI slop, deepfakes, and pro-Nazi content. Or at least the algorithm seems to think so – because most of this is so-called ragebait content, designed to provoke a strong response from the user.

And since users engage with it, the algorithm is tricked into “thinking” this is what people want. Humans behind the algorithm must clearly understand this is not the case, but clicks translate to cash. So why would Big Tech cut the branch it’s sitting on?

In 2024, Meta earned $16 billion, or 10% of its annual revenue, from scam ads and banned goods. The information comes not from a third-party analytics firm but from Meta’s own documents, proving that the tech giant is well aware of how much harm it can spread – and how much money it can make along the way.

While platforms and lawmakers take their sweet time debating what borderline content is, people are left to deal with the psychological fallout of social media addiction. From the inability to tell right from wrong or fake from real, loss of concentration, sleep, and even sense of self, to radicalization, depression, and self harm – the consequences of companies toying with their algorithms to meet business goals are dire for humanity.

It’s not only our mental health that’s at stake. Adversaries, well aware of algorithmic logic, abuse it to spread misinformation and straightforward lies, sowing division to influence elections all over the world – making us wonder just how much harm performative compliance has already done to democracy.

ABOUT THE AUTHOR 

Jurgita Lapienytė is the Editor-in-Chief at Cybernews, where she leads a team of journalists and security experts dedicated to uncovering cyber threats through research, testing, and data-driven reporting. With a career spanning over 15 years, she has reported on major global events, including the 2008 financial crisis and the 2015 Paris terror attacks, and has driven transparency through investigative journalism. A passionate advocate for cybersecurity awareness and women in tech, Jurgita has interviewed leading cybersecurity figures and amplifies underrepresented voices in the industry. Recognized as the Cybersecurity Journalist of the Year and featured in Top Cyber News Magazine’s 40 Under 40 in Cybersecurity, she is a thought leader shaping the conversation around cybersecurity. Jurgita has been quoted internationally.

ABOUT CYBERNEWS

Cybernews is a globally recognized independent media outlet where journalists and security experts debunk cyber by research, testing, and data. Founded in 2019 in response to rising concerns about online security, the site covers breaking news, conducts original investigations, and offers unique perspectives on the evolving digital security landscape. Through white-hat investigative techniques, Cybernews research team identifies and safely discloses cybersecurity threats and vulnerabilities, while the editorial team provides cybersecurity-related news, analysis, and opinions by industry insiders with complete independence. For more, visit www.cybernews.com.

By Stefanie Schappert

From hospital supply chains to payment networks, the latest Iran-linked cyber threats show how geopolitical retaliation can disrupt the companies and services people depend on every day.

Verifone and Stryker Bring Cyberwar Closer to Home

Verifone and Stryker are the clearest signs yet that cyberwar is no longer confined to government agencies or military systems.

In less than a day on Wednesday, the Iran-linked hacktivist group Handala claimed attacks on both companies – Verifone, a major payments provider with strong ties to Israel, and Stryker, one of the biggest medical technology firms in the US.

In Stryker’s case, the fallout appeared far bigger than ordinary corporate IT downtime.

The group claimed it wiped more than 200,000 systems, servers, and mobile devices and stole 50TB of data. It also said the attack forced shutdowns across Stryker offices in 79 countries, though Stryker says it operates in 61 countries and impacts more than 150 million patients annually.

What’s more, more than 5,000 workers at Stryker’s Ireland hub were reportedly sent home, while healthcare providers in the US struggled to order surgical supplies through the company, according to KrebsOnSecurity. 

AOL reported that the disruption also affected Lifenet, a platform used by emergency responders to send patient data to hospitals.

That is what makes this story more than another burst of geopolitical cyber noise – it shows how retaliation abroad can hit the companies and systems ordinary people rely on every day.

Iran-Linked Threats Are Already Multiplying Online

The threat is not limited to one or two headline-grabbing incidents. In an early March advisory, Sophos warned that likely tactics could include website defacements, DDoS attacks, ransomware, destructive wipers, hack-and-leak operations, phishing, and password spraying.

Researchers also say the infrastructure for the next wave may already be in place. ThreatLabz identified more than 8,000 newly registered domains tied to the Middle East conflict, warning that many may still be “weaponized or used in threat campaigns in the near future.”

The lures include fake news blogs, conflict-themed malware files, and other content designed to exploit panic and curiosity while tensions remain high.

At the same time, more sophisticated Iranian-linked operators do not appear to be starting from scratch.

In my recent Cybernews reporting on Seedworm, the Iran-backed espionage group was found maintaining access to multiple organizations since early February – before the current escalation became front-page news – with targets spanning banking, aviation, technology, and nonprofit organizations.

The Easiest Way in Is Still Human Error

Cyberwar is no longer a niche story about espionage and classified systems, but has moved into the mainstream.

US cyber agencies warned last June (after the US bombed Iran’s nuclear facilities), that Iranian cyber actors often exploit familiar weaknesses – including unpatched software, known vulnerabilities, and default or commonly used passwords on internet-connected accounts and devices.

Those risks are also getting easier to scale. 

CrowdStrike’s latest threat reporting says AI is “scaling attacks and lowering barriers to entry,” turning it into both a force multiplier for cyberattacks and a new attack surface.

AI is allowing threat groups to move faster, generate more convincing phishing lures, and automate more of the attack chain than many defenders are prepared for.

We have seen this playbook before. Russia’s GRU-linked Sandworm hackers were blamed for disruptive attacks on Ukraine’s power grid, including a 2022 incident that researchers said coincided with missile strikes and triggered power cuts.

And after the October 7 attacks, US agencies warned that Iran-linked actors had targeted US water and wastewater facilities by exploiting Unitronics PLCs used in industrial control systems.

All because the PLCs were Israeli-made – once again, proving how quickly geopolitical cyber retaliation can move from symbolism to systems that touch everyday life.

For organizations, that means patching faster, locking down internet-facing devices, turning on MFA, and training employees on the latest phishing lures.

For everyone else, it is a reminder that human error is still one of the easiest ways in – and that the next disruption may hit not a government target, but the companies people depend on without thinking twice.

ABOUT THE AUTHOR

Stefanie Schappert, a senior journalist at Cybernews, is an accomplished writer with an M.S. in cybersecurity, immersed in the security world since 2019.  She has a decade-plus experience in America’s #1 news market working for Fox News, Gannett, Blaze Media, Verizon Fios1, and NY1 News.  With a strong focus on national security, data breaches, trending threats, hacker groups, global issues, and women in tech, she is also a commentator for live panels, podcasts, radio, and TV. Earned the ISC2 Certified in Cybersecurity (CC) certification as part of the initial CC pilot program, participated in numerous Capture-the-Flag (CTF) competitions, and took 3rd place in Temple University’s International Social Engineering Pen Testing Competition, sponsored by Google.  Member of Women’s Society of Cyberjutsu (WSC), Upsilon Pi Epsilon (UPE) International Honor Society for Computing and Information Disciplines.

Cybernews is a globally recognized independent media outlet where journalists and security experts debunk cyber by research, testing, and data. Founded in 2019 in response to rising concerns about online security, the site covers breaking news, conducts original investigations, and offers unique perspectives on the evolving digital security landscape. Through white-hat investigative techniques, Cybernews research team identifies and safely discloses cybersecurity threats and vulnerabilities, while the editorial team provides cybersecurity-related news, analysis, and opinions by industry insiders with complete independence. For more, visit www.cybernews.com.

The US Pentagon recently approved Elon Musk’s Grok AI for classified military operations while threatening Anthropic with penalties for refusing to remove ethical safeguards from its Claude AI.

Jurgita Lapienytė, chief editor at Cybernews had this to say:

Safety rules are being thrown out.

“For the fear of its Claude being used for the surveillance of American citizens or used to develop mass weapons, the US leading AI company has backed out of the deal with the Pentagon, and is now facing penalties for standing its ground. Yes, the government shouldn’t allow any company to dictate the terms for defence operations. But should AI companies be punished for having safety rules? If the biggest market players are forced onto their knees, smaller companies will stop having safety rules, too. Will being “safe” become bad for business?”

Machines making kill decisions.

“Currently, AI is not only untrustworthy but also very dangerous when unsupervised. In military operations, it can also be used to dehumanize operations by offering gamified experiences for officers and soldiers, and shifting personal responsibility.”

Approval based on politics, not security.

“You’d expect your government to pick the best technology and go to great lengths to discuss the best possible solutions for American citizens and defense goals. What seems to have happened here is that, in the heat of public discussion, another company got fast-tracked, while at the same time it’s facing hefty fines and even bans in other countries.”

This might be a security issue for other countries, too.  

“When the world’s most powerful military starts using AI without being transparent about exactly how, one can begin to wonder just how much US operations overseas are influenced by the algorithm. Every country in conflict with the US should keep a close eye on this development.”