The Cyber Threats I Watch For That Rarely Make the Warning Lists

The Cyber Threats I Watch For That Rarely Make the Warning Lists

Most of the cyber safety advice out there covers the same five or six threats: phishing emails, malware, data breaches, identity theft, ransomware. I've written about those categories separately, and they matter, but they're not the whole picture. The threats that actually worry me most these days are the ones that rarely make it onto a typical warning list, because they're harder to explain in a single sentence and they don't fit the "don't click the link" template that most advice defaults to. If you consider yourself reasonably careful online already, these are the ones I'd actually spend your remaining attention on.

SIM Swapping That Bypasses the Two-Factor Codes I Rely On

I used to think two-factor authentication by text message was close to bulletproof. Then I learned about SIM swapping, where someone convinces your mobile provider to move your number onto a SIM card they control, usually with a stolen bit of personal information and a plausible enough story. Once they have your number, every text-message code meant to protect your accounts gets sent straight to them instead of you. It's a low-probability attack for most people, but a high-value one for anyone with meaningful savings or a business account, and the fix isn't complicated: switch from text-message codes to an authenticator app wherever the option exists, and ask your mobile provider about adding a PIN or passcode to your account specifically to stop a number transfer without it.

Browser Extensions That Quietly Ask For More Access Than They Need

I still see people install browser extensions the way they'd install an app on their phone, without a second look at what permission they're granting. A shopping-discount extension or a note-taking tool asking for permission to "read and change all your data on all websites you visit" is asking for far more than it needs to do its actual job, and a surprising number of extensions get sold to new owners after they've built up a user base, at which point that broad permission can quietly start being used for something else entirely. I go through my installed extensions every few months now, the same way I review which apps still have access to my accounts, and remove anything I can't immediately justify keeping. It takes minutes and it's one of the easiest wins available.

Session Hijacking Through a Stolen Cookie, Not a Stolen Password

This one surprised me when I first understood how it worked. Even with a strong, unique password and two-factor authentication switched on, a piece of malware or a malicious script can steal the small file your browser uses to prove you're already logged in, called a session cookie, and use it to access your account without ever needing your password at all. It's the reason logging out of accounts on shared or public devices actually matters, and why keeping your browser and operating system updated matters more than people assume, since those updates close off a lot of the specific techniques used to grab a session cookie in the first place. A password manager doesn't directly stop this one, but it does mean you're not reusing the same session-adjacent habits across every site, which limits how far a single stolen cookie can actually reach.

Software Updates That Arrive From a Compromised Supplier

This is the threat that changed how I think about updates generally. A supply-chain attack happens when someone compromises a piece of software you trust at the source, so the update you install is malicious before it ever reaches your device, meaning the usual advice of "keep everything updated" briefly stops being enough. These attacks are rare and usually aimed at larger organisations rather than individuals, but they've hit widely-used consumer software before, and there's genuinely very little an individual user can do to catch one in the moment. What I can control is limiting how much software I install in the first place, sticking to well-established tools with a track record rather than something new and unvetted, and keeping backups current enough that a bad update doesn't cost me more than the time it takes to restore.

Credential Stuffing That Doesn't Need to Guess My Password at All

Credential stuffing doesn't try to guess your password, it takes a password that's already been exposed in a completely different breach and tests it automatically against thousands of other sites, betting that you've reused it somewhere else. This is the single biggest reason password reuse is worse than people assume, because it means a breach at a site you barely remember signing up for years ago can still compromise an account you actually care about today, with no phishing, no malware, and no mistake on your part in the moment it happens. A password manager generating a genuinely unique password for every account is the direct fix, since it means a credential-stuffing attempt built on an old breach simply doesn't work anywhere else.

Why I Still Think the Basics Come First

None of this means the standard advice is wrong, it's still where most people actually get caught, and getting the fundamentals right closes off the vast majority of real-world attacks before any of this becomes relevant. But if you've already got the basics handled, these five are where I think the next layer of attention is actually worth spending, because they're the ones that slip past someone who's doing everything the standard checklist tells them to. The NCSC publishes more technical guidance for anyone who wants to go deeper on any of these, and my free Safety Toolkit still covers the account-level fundamentals that make most of these threats far less effective even when they do land. Staying ahead of this stuff isn't about knowing every possible attack, it's about not assuming that ticking the standard boxes means you're covered against everything.