Understand the digital world.
Act with confidence.
Practical writing about online safety, privacy, scams, emerging technology, responsible participation and the devices we depend on.
The Xsolis Healthcare Breach and the Value of Medical Information
A reported Xsolis breach potentially affected more than a million people and highlights the sensitivity of healthcare information.
Latest thinking.
The Xsolis Healthcare Breach and the Value of Medical Information
A reported Xsolis breach potentially affected more than a million people and highlights the sensitivity of healthcare information.
Why Urgency Is One of the Most Effective Scam Tools
Scammers use urgency to reduce the amount of time victims have to verify what they are being told.
Why Small Businesses Still Need Offline or Isolated Backups
Ransomware incidents in 2026 continue to demonstrate why backups need to survive a compromise of the main network.
Why Phishing-Resistant Authentication Matters More in 2026
The growth of sophisticated phishing is increasing the value of authentication methods designed to resist phishing.
Password Reuse Is Still Dangerous in 2026
Even as passkeys become more common, reused passwords remain a simple way for attackers to move between accounts.
Why Reporting a Scam Helps More Than You Think
Reports help investigators identify patterns, infrastructure and criminal networks.
Good Grammar Doesn't Mean a Message Is Legitimate Anymore
AI-assisted writing means polished grammar is no longer a reliable test for phishing.
Why Email Is Still One of the Biggest Phishing Battlegrounds
Despite newer messaging platforms, email remains a major channel for identity attacks and fraud.
Why Your Email Account Is Often Your Digital Master Key
Email accounts can become the recovery path into many other online services.
The Second Attack After a Data Breach: Follow-Up Phishing
Information exposed in a breach can later be used to make phishing messages more believable.
Why Human Verification Still Matters in an AI-Assisted Internet
When synthetic media becomes convincing, independent verification becomes more important than visual confidence.
Why Cloud API Access Has Become a Security Target
Attackers are increasingly abusing legitimate cloud APIs after compromising identities.
I Clicked a Phishing Link in 2026: What Should I Do Now?
Clicking a suspicious link does not automatically mean you have been hacked, but what you do next matters.
What a Data-Breach Notification Actually Means
A breach notification tells you that information may have been exposed, but the correct response depends on what data was involved.
When Ransomware Forces a Hospital Back to Paper
A 2026 ransomware incident affecting a US medical centre demonstrates how cyberattacks can become operational emergencies.
The Security Value of Slowing Down
Taking a few minutes to verify an urgent request can prevent a much larger loss.
When Criminals Compromise a Telecom Employee's Login
INTERPOL described a Nigerian case in which a cybercrime group used compromised staff credentials to infiltrate a telecommunications platform.
The TAKE IT DOWN Act: What Online Safety Changes Matter to Users
The FTC's 2026 enforcement activity around the TAKE IT DOWN Act highlights the growing focus on non-consensual intimate imagery online.
How Storm-2949 Turned a Compromised Identity Into a Wider Cloud Breach
A Microsoft investigation shows how social engineering and password-reset abuse can become a path into cloud infrastructure.
South African Organisations Faced More Than 2,000 Cyberattacks a Week in Early 2026
Cyberattack volumes reported for South African organisations show why cybersecurity is no longer only an enterprise IT concern.
South Africa's Ransomware Landscape in 2026
South African ransomware incidents in 2026 show the continuing importance of resilience, backups and incident response.
Why South African Scam Alerts Are Talking About AI More Often
South African authorities are increasingly warning that AI is improving the appearance of fraudulent messages.
SocksEscort: Why Criminal Proxy Services Matter
A disrupted proxy service illustrates how criminals can rent infrastructure designed to hide or route malicious activity.
The Fake IT Support Call: How Attackers Turn Help Into an Attack
Attackers are impersonating IT support to persuade users to perform authentication and remote-access actions.
ShinyHunters and the Renewed Oracle PeopleSoft Exploitation Campaign
A renewed exploitation campaign demonstrates why organisations must verify that security controls remain effective after patching.
What to Do After You Discover an Account Has Been Compromised
Fast containment matters when an online account has been compromised.
The SARS “Tax Return Notification” Scam: How the 2026 Wave Works
SARS warned about a 2026 scam promising tax refunds through fraudulent websites and AI-generated messages.
The Sality Botnet Takedown: 11 Million Infected IP Addresses in the Investigation
An international operation disrupted the long-running Sality botnet, illustrating how malware infrastructure can survive for years.
The New Security Question: What Happens When AI Agents Act on Their Own?
AI agents introduce a different cybersecurity problem because they can perform actions rather than merely generate text.
The Rectron Cybersecurity Incident: Why Supplier Data Matters
The 2026 Rectron incident highlights the cybersecurity risks created by connected suppliers and service providers.
What Happens After a Major Online Banking Scam?
A South African asset-preservation case shows what can happen after money has already been stolen through online banking fraud.
Why 2026 Ransomware Numbers Need to Be Read Carefully
Ransomware incident counts are useful, but disclosure delays mean monthly figures can change over time.
Ransomware Is Not Just About Locked Files Anymore
Ransomware groups increasingly use stolen information as leverage alongside system disruption.
How Ransomware Money Gets Laundered Through Cryptocurrency
A 2026 investigation involving hundreds of millions of euros illustrates the financial infrastructure behind ransomware.
Protecting SharePoint and OneDrive When an Account Is Compromised
Cloud file storage can become a major data-exfiltration target after an identity compromise.
The 2026 Poland Energy-Grid Cyberattack and the Risk to Operational Technology
A reported attack against connected energy sites demonstrates why cyberattacks can move beyond computers into physical infrastructure.
Why Social Platforms Are Being Asked to Address Impersonation Scams
The FTC opened a process examining whether platform practices contribute to impersonation scams.
Phishing-as-a-Service: How Criminals Rent the Tools to Scam You
Law-enforcement operations in 2026 targeted criminal services that made phishing easier to conduct at scale.
The Passkey Phishing Campaign: Why “Better Security” Can Become the Bait
Attackers are using passkey, SSO and MFA themes to persuade people to hand over access to cloud accounts.
Operation Jackal IV Targeted West African Cyber-Enabled Fraud Networks
An eight-month INTERPOL operation identified hundreds of suspects connected to organised West African criminal networks.
Fake Mobile Loans: How Criminals Turn Urgent Money Needs Into Data Theft
INTERPOL described mobile-loan scams that promised quick money while harvesting personal and financial information.
When Your Data Is Exposed Through a Third Party
A third-party cybersecurity incident affecting a South African organisation demonstrates why your data can be exposed without your own account being hacked.
Microsoft Is Making Passkeys the Default Authentication Experience in Entra ID
Microsoft announced a 2026 rollout making passkeys the default phishing-resistant authentication experience in Entra ID.
How One Compromised Microsoft 365 Account Can Become a Cloud-Wide Problem
Recent Microsoft research shows how attackers can move from one compromised identity into cloud applications and organisational data.
Why MFA Can Still Be Defeated by Social Engineering
Multifactor authentication remains valuable, but attackers increasingly try to manipulate users into approving access.
LLM-Jacking: Why Criminals Want Your AI Credentials
Criminals can steal AI-service credentials and cloud resources just as they steal other valuable computing resources.
KillSec Ransomware Operation Dismantled in International Investigation
An international law-enforcement operation targeted the KillSec ransomware operation and seized criminal infrastructure.
The R21.55 Million Online Banking Scam: How the Jormid Case Worked
A South African online banking fraud case shows how impersonation, urgency and malicious links can combine into a devastating scam.
JADEPUFFER: An LLM-Driven Extortion Attack Against Langflow
A 2026 threat report described an extortion operation involving an LLM-driven attack against Langflow.
Ivanti Endpoint Manager Mobile Zero-Day Attacks in 2026
Exploitation of Ivanti Endpoint Manager Mobile shows why internet-facing management systems require rapid patching and monitoring.
Operation Red Card 2.0: 651 Arrests in an Africa-Wide Online Scam Crackdown
An INTERPOL-coordinated operation targeted online scams across multiple African countries and recovered millions of dollars.
INTERPOL Says AI Was Linked to 55% of Reported Cybercrime in Africa
INTERPOL's 2026 African cyberthreat assessment describes a rapidly industrialising cybercrime ecosystem.
What Education-Sector Data Exposure Means for Students and Staff
Education platforms hold large amounts of information about students and staff, making data security especially important.
When AI Models Broke Out of Their Sandbox: The 2026 Hugging Face Incident
OpenAI disclosed a 2026 cybersecurity-evaluation incident in which models circumvented isolation controls and accessed third-party systems.
How to Check a Suspicious Link Without Opening It
You can often investigate where a link claims to go without visiting the destination.
The Most Valuable Thing a Scammer Can Steal Is Your Trust
Many successful scams rely less on technical exploits than on convincing people that the request is trustworthy.
The 2026 GitHub Breach: Why Developer Repositories Are Valuable Targets
A reported 2026 GitHub incident highlights the value of source code and developer repositories to attackers.
AI “Active Listening” Claims: What Privacy Questions Consumers Should Ask
FTC action around AI-related active-listening claims raises broader questions about what consumer technology can collect.
What a Municipal Ransomware Attack Means for Everyday Services
A ransomware incident affecting a municipality demonstrates how cyberattacks can disrupt public services.
What the Fidelity Services Group Cyber Incident Shows About Ransomware
A reported 2026 incident involving Fidelity Services Group provides another example of the continuing ransomware threat.
The FBI's 2025 Internet Crime Report: What the Numbers Tell Us in 2026
The FBI's 2025 Internet Crime Report, released in 2026, recorded nearly $21 billion in reported losses.
Create a Family Verification Rule Before an AI Scam Happens
A simple family rule can make voice-cloning and impersonation scams much harder to pull off.
Digital Identity in 2026: Why Verification Needs More Than a Profile
AI-generated profiles and synthetic media are making online identity harder to establish through appearance alone.
Device-Code Phishing: The Microsoft Login Trick Users Need to Understand
Device-code authentication can be abused when users are persuaded to authorise an attacker's session.
DDoS-for-Hire Services: How Someone Can Rent an Online Attack
A 2026 international operation targeted DDoS-for-hire services used to disrupt websites and online services.
When a Data-Leak Forum Gets Taken Down
International law enforcement continued targeting online marketplaces and forums used to trade stolen information in 2026.
The Cybersecurity Lessons 2026 Has Taught Us So Far
Across AI scams, cloud compromise, ransomware and data breaches, the same security principles keep appearing.
Cybersecurity in 2026 Is Not Just an IT Department Problem
Modern attacks increasingly combine technical weaknesses with human trust, making cybersecurity everyone's responsibility.
Why Criminal VPN Infrastructure Is Part of the Cybercrime Problem
Law enforcement also targets infrastructure that helps criminals hide or route malicious activity.
Covenant Health: What a Large Healthcare Data Incident Can Expose
A reported Covenant Health incident affected hundreds of thousands of people and illustrates the sensitivity of healthcare information.
Why Cloud Security in 2026 Is Increasingly an Identity Problem
Recent cloud intrusions show how stolen identities can become the path into data and infrastructure.
How Attackers Quietly Extract Data From Microsoft 365
Microsoft observed attackers using compromised identities to systematically access SharePoint, OneDrive and email.
Carnival's Reported 2026 Data Breach: What Customers Should Watch For
A reported 2026 Carnival incident potentially affected millions of customers and highlights the follow-up risks after a breach.
ASCII Smuggling: How Hidden Characters Can Help Phishing Evade Detection
Invisible Unicode characters are being used in techniques that can hide or alter what users and security systems see.
AI Voice Cloning Scams: Why Hearing Someone's Voice Is No Longer Proof
Voice cloning makes it easier for scammers to imitate familiar people, but verification still defeats the basic trick.
Why Edge AI Devices Need Their Own Security Model
AI running closer to users and devices creates new questions about models, software and sensitive data.
When Prompt-Injection Techniques Start Showing Up in Phishing
Techniques developed around AI prompt injection are finding applications in traditional phishing and security evasion.
Why AI-Accelerated Hacking Is a Problem for Small Organisations Too
AI-assisted cybercrime can increase the pressure on smaller organisations that already have limited security resources.
Why AI-Generated Phishing Is Harder to Spot in 2026
AI is helping scammers produce polished messages, making old visual clues less reliable.
Fake Profiles, Fake Videos and AI-Generated Scams: The New Identity Problem
AI-generated images, video and profiles can make online identities harder to verify by appearance alone.
AI Does Not Replace Basic Cyber Hygiene
As AI changes cyber threats, the basic protections of strong authentication, patching and backups remain essential.
AI Doesn't Need to Invent a New Scam to Make Phishing Worse
AI can make familiar phishing attacks more convincing, scalable and easier to personalise.
AI-Assisted Executive Impersonation Is Making Invoice Fraud More Convincing
AI is helping attackers make executive impersonation and payment-fraud messages more convincing.
AI and Cybercrime in Africa: What Users Actually Need to Worry About
AI is changing the scale and quality of scams across Africa, but the basic defences remain practical.
When AI Agents Attack Software Infrastructure: The RubyGems Lesson
A 2026 incident involving AI agents and RubyGems raises questions about autonomous systems interacting with software infrastructure.
Scam Centres Are Becoming Part of Africa's Cybercrime Infrastructure
INTERPOL's 2026 assessment describes the spread of organised scam-centre operations across Africa.
Why Africa's Cybercrime Problem Is Becoming an Industrial-Scale Threat
INTERPOL's 2026 assessment describes an African cybercrime ecosystem that is increasingly organised, scalable and cross-border.
Ekurhuleni Murders: What Authorities Have Confirmed and What the Public Should Know
Eight women have been found dead in the Ekurhuleni area. Here is what authorities have confirmed, what they have not established, and how the public can stay informed without spreading unverified claims.
Deepfakes and AI Voice Scams: What's Real, What's Not
The technology that clones a voice from a few seconds of audio, or generates a convincing video of someone saying things they never said, is no longer a research curiosity. It's a scam tool in active use.
WhatsApp Scams Targeting South African Families: A Field Guide
WhatsApp is where a huge share of South African family life happens online — which is exactly why it's become the preferred hunting ground for a specific set of scams.
Digital Estate Planning: What Happens to Your Passwords After Death
Most estate planning focuses on physical and financial assets. Almost none of it addresses the dozens of online accounts a person leaves behind, many locked behind a password nobody else has.
Load Shedding and Your Router: The Security Gap Nobody Talks About
Every power cut is also a small security event for your home network — most people just never notice, because nothing breaks in a way you can see.
Securing Your Smart Home Devices
A smart camera, plug, or speaker is a small computer connected to the internet, running software you'll probably never think about again after setup — which is exactly the problem.
A Non-Scary Guide to VPNs: When You Actually Need One
VPN advertising oversells the danger and the solution in equal measure. Here's what a VPN actually does, and the specific situations where it's genuinely worth using one.
Festive Season Online Shopping: Staying Safe Through Black Friday and December
Scammers plan around the same shopping calendar retailers do. The volume of genuine deals, deliveries, and payment activity in November and December is exactly what fake versions of all three hide inside.
Safe Online Dating: Red Flags and Verification Tips
Most online dating experiences are perfectly ordinary. The exceptions are worth taking seriously, because romance scams specifically exploit the trust-building that dating itself requires.
Cryptocurrency Scams: What to Watch For
Crypto scams borrow the same emotional levers as any other scam — trust, urgency, greed dressed up as opportunity. The technology is new; the underlying con usually isn't.
Public Wi-Fi: When It's Fine and When It's Not
The old blanket advice — never use public Wi-Fi — doesn't match how most people actually live. The more useful question is what you're doing on it, not whether you're on it at all.
Ransomware 101: What It Is and Why Backups Are Your Real Defense
Ransomware doesn't steal your files — it locks them and demands payment for the key. The single most effective defense has nothing to do with the attack itself: it's whether you had a copy elsewhere.
Keeping Kids Safe Online: A Practical Guide for South African Parents
The goal isn't to keep your child off the internet — that ship has sailed for most families. The goal is to make sure they know what to do when something goes wrong, and that they'll actually tell you.
Banking App Safety: What South African Banks Actually Ask (and Never Ask)
Almost every successful banking scam depends on one thing: the victim believing the bank itself made contact. Here's what your bank will never actually ask for.
SIM Swap Fraud: South Africa's Most Costly Scam
SIM swap fraud doesn't need you to click anything. It targets your mobile network provider instead of you directly — and once it succeeds, every OTP meant to protect you gets delivered straight to the attacker.
Understanding POPIA: What South Africans Should Know About Their Data Rights
You have the legal right to ask any South African company what data it holds on you, why it's holding it, and to have it corrected or deleted. Most people never use that right, simply because they don't know it exists.
Cyberbullying: Recognizing and Responding
Cyberbullying rarely stays contained to a single platform or a single bad day. It follows the person home, onto every device, at any hour — which is exactly what makes it different from the schoolyard version.
Small Business Cybersecurity Without an IT Department
Most small South African businesses assume real cybersecurity requires a budget and a specialist they don't have. Most of what actually matters is a handful of decisions, not a department.
Working From Home Securely: A Practical Checklist
A home network was never designed with the assumption that sensitive company files would flow through it every day. A few adjustments close most of the resulting gap.
Social Media Privacy Settings Worth Actually Checking
Most people set their privacy settings once, when they first join a platform, and never look again — while the platform quietly changes its defaults every few updates.
Identity Theft: Signs and Recovery Steps
Identity theft rarely announces itself. It tends to surface sideways — through a declined loan application, an unfamiliar account, or a call about a debt you never took on.
Online Shopping in South Africa: Where the Risk Actually Hides
The danger in online shopping usually isn't the big, obvious scam — it's the small moments of convenience where you trade a bit of caution for speed.
Recognizing Phishing Emails: A Field Guide
Phishing emails have gotten harder to spot at a glance, but the underlying tactics haven't changed much. Here's what to actually look for, beyond the outdated 'watch for spelling mistakes' advice.
Cyber Safety Habits That Actually Stick
Most cybersecurity advice fails for a simple reason: it asks you to remember something instead of asking you to change something you already do. Here's a version built around habits, not checklists.
Choosing a Password Manager: What to Look For
The advice to 'use a unique password for every account' is correct and also impossible to follow without help. A password manager is the tool that makes it actually practical.
Two-Factor Authentication Explained (And Why It's Worth the Extra Tap)
A password proves you know something. Two-factor authentication adds proof that you also have something — usually your phone. That combination is what actually stops most account takeovers.
Find what matters to you.
Questions worth asking.
A few things worth knowing about Cyber Conduct Insights and the thinking behind the publication.
What is Cyber Conduct Insights?
Cyber Conduct Insights is the editorial publication of Cyber Conduct, covering practical cybersecurity, online safety, privacy, scams, emerging technology, digital citizenship and everyday technology.
Who is the publication for?
It is written for everyday people, families, students, professionals and small businesses who want to understand the digital world without needing to be cybersecurity experts.
Is everything here about cybersecurity?
Not always. Cybersecurity is a major focus, but Cyber Conduct also looks at privacy, digital behaviour, technology, artificial intelligence and the practical decisions people make online.
When did Cyber Conduct begin?
The work began in 2020, during the beginning of COVID-19 in South Africa, as Digital Citizenship — inspired by one of the modules that started the project. It evolved into Tech Citizenship, then Cyber Conduct, and today continues as Cyber Conduct Insights.
Is this the same as the original Cyber Conduct blog?
This publication builds on that earlier work while giving it a new editorial home. Older material remains part of the project's history, while this site focuses on a more curated and contemporary publication.