An internal CyberSloth project, shared in public

Calm security help for people, families and small teams.

Pick the task in front of you. You get plain steps and official downloads, never a scan, a score or a sales pitch.

Start with a task

Most asked

Start here

Four doors, four short plans

Pick the one that sounds like today. Each plan is a few steps, in order. Scams are engineered to work on everyone, so there is no shame in any of these.

I clicked something

A link, an attachment or an app you weren't sure about. Do these in order.

If someone else might be monitoring this phone, stop and read Safety first: removing apps or changing passwords can alert them.

  1. Close it. Don't type anything else, and don't allow notifications or downloads.
  2. If you typed a password, change it now, from a different device if you can. Then change it anywhere else you used it.
  3. If you gave card or bank details, call your bank on the number on the back of your card.
  4. If you installed something, don't open it. Delete it, restart, and install any waiting updates.
  5. Report it, even if nothing seems wrong: Scamwatch or ReportCyber.

If you only do one thing: change the password for anything you typed in, from a different device.

Open the scam check

I think I'm hacked or tracked

Safety first. If someone might be monitoring your phone, removing an app or resetting it can alert them and destroy evidence. Read this on a device they can't see.

  1. Use a safe device (a friend's phone, a library computer) to read, search and call for help.
  2. Don't reset, uninstall or confront anyone yet. Look first, and change things with support.
  3. Talk to someone. 1800RESPECT: 1800 737 732, or text 0458 737 732. In immediate danger, call 000.
  4. If it's your accounts, not a person (login alerts, password-reset emails): from a device you trust, change your email password first and turn on two-step sign-in.
  5. Work through the phone check to see which situation fits.

If you only do one thing: get help from a device nobody else can see before you change anything on this phone.

Open the phone check Leave this page quickly

I got a scary message

A text, email, call or DM that wants you to act fast.

If someone else might be monitoring this phone, stop and read Safety first: removing apps or changing passwords can alert them.

  1. Don't reply, click or call the number in it. Don't scan a QR code or read out a code.
  2. Check it a second way. Contact the organisation yourself, using a number or app you already trust, such as the back of your card.
  3. If it's someone you know asking for money, call them on their usual number and ask for your family safe word.
  4. Report it, then delete it and block the sender.
  5. If you already paid or shared details, call your bank first.

If you only do one thing: contact the organisation yourself, using a number or app you already trust.

Open the scam check

I want to get ahead

Small steps, in a sensible order. You don't need to do them all today.

  1. Check your email on Have I Been Pwned to see which passwords to change first.
  2. Start a password manager and let it make a unique password for each account.
  3. Turn on passkeys, then two-step sign-in, starting with email and banking.
  4. Switch on automatic updates for your phone, computer and apps.
  5. Agree a family safe word, and keep one backup that you've tested restoring.

If you only do one thing: move your email and banking passwords into a password manager, and make each one unique.

The password ladder Find a tool

Helper · three steps

Scam check

For a suspicious text, email, call or message: pause, verify, report. This checklist can't tell you whether a message is real. It helps you decide what to do next. Nothing you choose here is stored or sent anywhere.

Pause. Nothing here is urgent enough to skip the checks.

Scams are engineered to work on everyone, and they work by rushing you. Before anything else: don't click, don't reply, don't call the number in the message, don't scan a QR code and don't read out any code. Then pick what has happened so far.

Verify it through a second channel

If someone else might be monitoring this phone, stop and read Safety first: removing apps or changing passwords can alert them.

  1. Ignore the contact details in the message. They lead back to the sender.
  2. Contact the organisation yourself. Type its website address in, open its official app, or use the number on the back of your card, a bill or a statement you already hold.
  3. If it claims to be someone you know, call them on the number you already have, or ask them in person.
  4. Treat these as warning signs: a deadline, secrecy, a prize or fine, a request to move money to a "safe account", or to install software.
  5. If it checks out, waiting cost you nothing. If it doesn't, don't engage: report it, then delete it and block the sender.

A checklist can't prove a message is genuine. If you're unsure, treat it as a scam until the organisation confirms through a channel you chose.

Next: where to report

You clicked or opened something

You can't tell from the page alone whether anything happened, so do these in order.

If someone else might be monitoring this phone, stop and read Safety first: removing apps or changing passwords can alert them.

  1. Close the page or file. Don't type anything, and don't allow notifications or downloads if it asked.
  2. If it asked you to sign in, you may have given that password to someone else. Go to the real site by typing its address yourself, and change the password. Use a different device if you can.
  3. If you downloaded or installed something, don't open it. Delete it, restart the device and install any waiting updates. Your built-in security scan (such as Windows Security or Google Play Protect) is worth running, but a clean result is not proof that nothing happened.
  4. If you did give details, a code or money, go back and choose that option instead.

Next: where to report

You shared details, a code or a password

Act in this order. Speed helps, and so does being kind to yourself: these scams are built by professionals.

If someone else might be monitoring this phone, stop and read Safety first: removing apps or changing passwords can alert them.

  1. Bank or card details: call your bank now, on the number on the back of your card. Ask them to block the card and watch the account.
  2. A password: change it from a trusted device, then change it anywhere else you used it. A password manager makes that quicker. Turn on two-step sign-in.
  3. A one-time code: someone may be signing in as you. Change the password, and sign out of all other devices from the account's security page. Never read a code to someone who contacts you.
  4. ID documents or personal details (licence, passport, Medicare): call IDCARE on 1800 595 160. For a small business or organisation, call 1800 595 170.

Next: where to report

You've sent money

Move quickly, and be kind to yourself. These scams are built by professionals, and they work on everyone.

  1. Call your bank first, now, on the number on the back of your card. Ask them to stop or recall the payment and to flag the account. The sooner they know, the more options there are.
  2. Stop all contact with the scammer. Don't send more, even if they say it will release funds or fix a problem.
  3. Keep the evidence: screenshots, receipts, phone numbers and account details. Don't delete the conversation.
  4. Be wary of anyone who offers to get your money back for a fee. People who have already lost money can be targeted again.
  5. Get support: IDCARE on 1800 595 160 can help you plan the next steps.

Next: where to report

It sounds like someone you know

A familiar voice, video or message is no longer proof. Voices can be imitated with AI tools, and accounts can be taken over.

  1. Hang up or stop replying. Don't send money, gift cards or codes.
  2. Call the person back on the number you already have, or ask someone close to them.
  3. Ask for your family safe word. If you haven't agreed one, set one up today (see the card beside this check).
  4. If you already sent money, call your bank first, on the number on the back of your card.

Next: where to report

A new bank account for a payment

Paying a new bank account? Call back on a known number first.

  1. Don't pay yet. Changed bank details in an email, message or invoice are a classic way to trick a business. Email compromise is a large share of business cybercrime reports (ASD Cyber Threat Report 2024-25).
  2. Call the supplier or manager back on a number you already hold, not one in the email. Confirm the account details out loud.
  3. Ask a second person to approve any change to payee details.
  4. If you've already paid, call your bank immediately, then use ReportCyber. Small businesses can call IDCARE on 1800 595 170, and the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).

Next: where to report

Report it, then lower the risk of a repeat

Reporting is your choice. It helps authorities spot patterns and warn other people, and it can open up help for you.

If someone else might be monitoring this phone, stop and read Safety first: removing apps or changing passwords can alert them.

Australia

  • Your bank. Use the number on the back of your card. Call first, and fast, if money was sent or card details were shared.
  • Scamwatch Report a scam.
  • ReportCyber Report cybercrime.
  • IDCARE 1800 595 160 (individuals), 1800 595 170 (small business and organisations). For identity theft, scams and compromised accounts.
  • Australian Cyber Security Hotline. 1300 CYBER1 (1300 292 371). Help with a cyber incident.

Outside Australia

Contact your bank, then your country's national scam or cybercrime reporting service (in the United States, that is the FTC). Search for your government's official reporting page rather than following links in messages.

Afterwards

Delete the message and block the sender. Turn on two-step sign-in for email and banking. Keep an eye on your bank and account activity over the following weeks.

Helper · three steps

Phone check

For a phone that is acting strangely, or when you're worried someone is watching or tracking you. A checklist can't detect spyware. It helps you decide what to do next. Your answers are never stored.

Safety first: read this before you change anything

If someone you live with, or a current or former partner, could be monitoring your phone, removing an app or resetting the phone can alert them and destroy evidence. Use a device they can't see (a friend's phone, a library computer), and talk to someone first.

Leave this page quickly

Leaving quickly doesn't erase your browser history. If someone else can see it, use a private browsing window or a different device.

What's closest to what you're seeing?

Options start with the most common causes. Pick the nearest match. You can go back at any time.

Slow, hot or short on battery: start with the ordinary causes

Ordinary causes are the most common reason a phone misbehaves, and these checks are safe to do.

If someone else might be monitoring this phone, stop and read Safety first: removing apps or changing passwords can alert them.

  1. Restart the phone, then install waiting system and app updates.
  2. Check storage. A nearly full phone gets slow. Remove what you don't need.
  3. Look at battery use in Settings. If one app uses far more than the rest, update it or remove it.
  4. Review app permissions (location, microphone, camera and, on Android, accessibility and device administrator access). Remove access an app doesn't need.
  5. Remove apps you don't use or don't remember installing. If there's any chance someone else installed one to watch you, stop and read "Someone I know might be watching" first.
  6. If it keeps happening, an old battery is a common reason. Ask the manufacturer or a repair shop.

Next: help routes

Account activity you didn't do points to an account problem first

Do these from a device you trust. It doesn't have to be this phone. If you think a person you know has access to your accounts, read "Someone I know might be watching" before you change anything.

If someone else might be monitoring this phone, stop and read Safety first: removing apps or changing passwords can alert them.

  1. Start with your email account, because it can reset all the others. Change its password to a new, unique one.
  2. Turn on two-step sign-in or a passkey, then sign out of all other sessions and devices from the account's security page. Stolen sign-in sessions can sidestep a code, so signing out everywhere matters.
  3. Check recovery email addresses and phone numbers, forwarding rules and connected apps. Remove any you don't recognise.
  4. Change the password on any account that shared it. A password manager makes this quicker.
  5. Check your email on Have I Been Pwned to see which breached passwords to change first.
  6. If money, ID or a business account is involved, call your bank, and IDCARE on 1800 595 160 (small business: 1800 595 170).

Next: help routes

You clicked something or installed an app

If someone else might be monitoring this phone, stop and read Safety first: removing apps or changing passwords can alert them.

  1. If a person might have installed it, go to "Someone I know might be watching" first.
  2. Otherwise, don't open the app. Remove it (touch and hold its icon, or look in Settings, Apps).
  3. Look for things you didn't set up. On iPhone, check Settings, General, VPN & Device Management for profiles you don't recognise. On Android, check which apps have accessibility or device administrator access.
  4. Install system and app updates, then change any passwords you entered after the click, from a different device.
  5. If you entered banking details, call your bank on the number on the back of your card.
  6. Use the scam check for what to report and where.

Next: help routes

Someone I know might be watching or tracking me

Don't remove anything yet. Removing monitoring software can tell the person who installed it, and can erase evidence.

  1. Get support first. 1800RESPECT (1800 737 732, or text 0458 737 732) helps with stalking and monitoring. eSafety explains how to collect evidence safely.
  2. Use a safe device for searching, calling and changing passwords: a phone or computer the person has never touched or had access to.
  3. Look, but don't remove. It's reasonable to look at who can see your location (Find My, Google Maps sharing, family-sharing apps) and which devices are signed in to your Apple or Google account. Changing these can be noticed, so get advice first.
  4. Think about your safety plan: when and how you'll make changes, and where you'll go if the reaction isn't safe. A support worker can help.
  5. In immediate danger, call 000.

A checklist can't detect stalkerware, and finding nothing odd isn't proof there's nothing there. A support worker can help you decide whether and when to remove or reset anything.

Next: help routes Leave this page quickly

You might be personally targeted

Targeted spyware is rare and aimed at specific people. These steps reduce your exposure and point you to expert help. They are not a way to check yourself.

  1. Update everything now. Spyware often relies on bugs that updates fix.
  2. Turn on the built-in protection made for people who may be targeted: Lockdown Mode on iPhone, iPad and Mac, or Android Advanced Protection (Android 16 or later). Both limit features on purpose.
  3. Contact the Access Now Digital Security Helpline if you're in civil society (journalists, activists, human-rights defenders). It serves people who may be targeted. It is not a general tech-support line.
  4. Leave forensic tools to experts. Amnesty's MVT is a command-line forensic tool for technical users, used with the device owner's consent. It is not a consumer self-check, and a clean result doesn't prove a phone is clean.
  5. If you own a supported Pixel and your risk is high, GrapheneOS is an option. Try the fit check first.

If you received a threat notification from Apple, follow what it says and treat it as a reason to get expert help.

Next: help routes

Next steps and help routes

If you can't tell what's happening, that's normal. These checks can't confirm or rule out spyware, and they can't tell you who is responsible. What they can do is point you to the right person to talk to.

Tools

Find a privacy tool

Each tool shows who it's for, what it costs, how hard it is and where it falls short before the official link. We link to official sources only. CyberSloth hosts no binaries. There are no affiliate links, no sponsorships and no paid placement, and following a link takes you to that site's own privacy rules.

How tools are chosen
  • Official sources only. Every link goes to the project's own site, its official store listing or its official code repository.
  • Open source or independently audited where possible. Where a tool is closed or proprietary, the entry says so.
  • Honest about limits. Each entry says who it's for and where it falls short.
  • Different kinds of thing are labelled differently. An app, an operating-system replacement, a built-in setting and an expert tool are not the same, so each gets its own label.
  • No affiliate links, no sponsorships, no paid placement. Nobody pays to be listed or ranked.
  • Versions are snapshots. We show the latest recorded release with the date it was checked. If a snapshot is more than 14 days old, we say "check the official release notes" instead.
How to check a file's checksum

App stores sign and update apps for you, so that is the easiest route. For a file from a website, compare its checksum or signature with the value on the project's own page. Each tool's "Verify this download" drawer says which method it supports.

Commands to compute a SHA-256 checksum, by operating system
SystemCommand (replace file with your file's name)
macOSshasum -a 256 file
Linuxsha256sum file
Windowscertutil -hashfile file SHA256

The result should match the project's published value exactly. If it doesn't, don't open the file: download it again from the official page.

Showing 23 of 23 tools

Talk privately

Messages and calls only the people in the conversation can read.

Signal

App

End-to-end encrypted messaging, voice and video calls from a US non-profit.

Works on
  • Android
  • iOS
  • Windows
  • macOS
  • Linux
Effort
Easy
Cost
Free

Who it's for. Everyone: private messages, voice and video calls.

Limitations. Needs a phone number to register (you can hide it behind a username). Desktop needs the phone app set up first.

Latest recorded

  • Android (stable) v8.30.3 released
  • iOS (App Store) v8.32 released
  • Desktop (stable) v8.30.0 released

Checked · Release notes: Desktop · Android · iOS

Official sources

Official download page (official site)

Verify this download

Mobile: install from the app stores. Android APK from signal.org: check signing certificate with apksigner against the SHA-256 fingerprint on the APK page. Linux: signed APT repo, AppImage with GPG signature.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. Phone number required to register. Operated by Signal Messenger LLC (US); cannot read message content per its privacy policy.

Licence: AGPL-3.0 · Source code: Android · iOS · Desktop

Molly

App

Independent hardened fork of Signal for Android, adding database encryption at rest, auto-lock and RAM shredding.

Works on
  • Android
Effort
Moderate
Cost
Free

Who it's for. Android users who want a hardened Signal client.

Limitations. Independent fork: updates lag official Signal (latest stable recorded 31 Jul 2026). Android only.

Good to know. Two builds exist: Molly, and Molly-FOSS, which drops Google dependencies. It is an unofficial, independently maintained fork, not made by Signal.

Latest recorded

  • Android, stable v8.19.2-4 released

Molly trails official Signal by many versions. Check the release notes before relying on it.

Checked · Release notes

Official sources

Official download page (official site)

Verify this download

Compare the APK signing certificate fingerprints in the project README using apksigner. Reproducible builds are supported so anyone can rebuild and compare the release APK.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. Uses the Signal network, so a phone number is still needed. Not made by Signal; Molly-FOSS drops Google dependencies.

Licence: AGPL-3.0-only · Source code: Molly

Briar

App

Peer-to-peer messenger that works over Tor, Bluetooth or Wi-Fi, with no central server.

Works on
  • Android
Effort
Moderate
Cost
Free

Who it's for. People who need messaging that can work without internet servers.

Limitations. Android only. In maintenance mode since July 2026: security fixes only, no new features.

Good to know. The project lists high battery use, unreliable background operation on Android and no account backup as known limits.

Latest recorded

  • Android, stable v1.5.21 released

Checked · Release notes: Android

Official sources

Official download page (official site)

Verify this download

Prefer F-Droid or Google Play. F-Droid lists a PGP signature, a build log and a source tarball for each version. No signature or checksum guide was found for the direct APK.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. No central server; devices sync directly over Bluetooth, Wi-Fi or Tor. Maintenance mode since 2026-07-09: security fixes only.

Licence: GPL-3.0-or-later · Source code: Briar

Harden your phone

Stronger protection for people who may be targeted.

Helper · four short questions

Is GrapheneOS right for you, and how do you install it safely?

This is a checklist, not a verdict. It helps you decide your next step before you wipe anything.

Do you have a supported Google Pixel?

GrapheneOS runs only on supported Pixel phones and tablets. The project recommends the Pixel 8 series and newer. Avoid carrier variants: carriers can block the bootloader unlocking that installation needs. OEM unlocking must be switched on in the phone's original OS first.

Check your exact model first

On the phone, look under Settings, About phone for the model name. Then compare it with the supported list below, or with the official FAQ.

Supported devices (from the official list, checked 11 Oct 2026)
  • Pixel 10a
  • Pixel 10 Pro Fold
  • Pixel 10 Pro XL
  • Pixel 10 Pro
  • Pixel 10
  • Pixel 9a
  • Pixel 9 Pro Fold
  • Pixel 9 Pro XL
  • Pixel 9 Pro
  • Pixel 9
  • Pixel 8a
  • Pixel 8 Pro
  • Pixel 8
  • Pixel Fold
  • Pixel Tablet
  • Pixel 7a
  • Pixel 7 Pro
  • Pixel 7
  • Pixel 6a
  • Pixel 6 Pro
  • Pixel 6

GrapheneOS FAQ: supported devices (official site)

Can you wipe this phone?

Installing GrapheneOS unlocks and relocks the bootloader and wipes the phone, so everything on it is erased. Back up what you need first. If this is the only phone you rely on right now, wait until you can spare it.

If you're doing this because someone might be monitoring you, read the safety note in the phone check first. Wiping a phone can alert that person and destroy evidence.

Do you depend on banking, wallet or work apps?

Some banking and wallet apps may not work on GrapheneOS. Ask your bank or check the app before you wipe the phone.

Check those apps before you commit

Look up whether your banking and wallet apps work on GrapheneOS, and ask your bank. If you can't be sure, keep your current phone for those apps and consider GrapheneOS on a second Pixel, or use a built-in setting instead.

Next steps: install it safely

Nothing in this check is a verdict. It only means none of the common blockers came up. If you go ahead:

If you're doing this because someone might be monitoring you, stop and read Safety first: wiping a phone can alert them and destroy evidence.

  1. Back up first. Installation wipes the phone.
  2. Use only the project's own installer. That is the web installer on grapheneos.org, or its command-line guide. The project advises against third-party install guides. Type the address yourself rather than following a link from a message or search ad.
  3. Check the phone first. It must be a supported model that is not a carrier variant, and OEM unlocking must be switched on in the phone's original OS.
  4. Follow the guide in order. It unlocks the bootloader (which wipes the phone), then installs GrapheneOS.
  5. Lock the bootloader again when the guide says to. This wipes the phone again, and it is what turns on full verified boot.

Then verify. Compare the verified-boot key hash shown at start-up with the hash for your device on the install page. The Auditor app can check the phone's hardware attestation. If you used the command line, also check the factory image signature as the guide describes. Set the phone up fresh and install apps only from sources you trust.

GrapheneOS reduces risk for people who may be targeted. It does not remove it, and it cannot protect an account whose password is weak or reused.

Official web install guide (official site) Command-line guide (official site) Release channels (official site)

Next steps: wait until you can spare the phone

Nothing here is urgent. Back up, pick a quiet time and come back to this check. In the meantime, update the phone, and consider Android Advanced Protection (Android 16 or later), a built-in setting that needs no wipe.

Next steps: GrapheneOS isn't the next step for you

Built-in protections still help. iPhone, iPad and Mac users can use Lockdown Mode. Android users on Android 16 or later can use Android Advanced Protection. For everyone, the basics matter most: keep devices updated, use a password manager and turn on passkeys or two-step sign-in.

GrapheneOS

OS replacement

Hardened, privacy-focused Android-compatible operating system for supported Google Pixel phones.

Works on
  • Google Pixel (supported models only)
Effort
Advanced
Cost
Free

Who it's for. People at higher risk who own a supported Google Pixel.

Limitations. Supported Pixel phones only. Installing wipes the phone. Some banking and wallet apps may not work.

Good to know. Avoid carrier variants: carriers can block the bootloader unlocking that installation needs. OEM unlocking must be switched on in the phone's original OS first. The project recommends only its own web or command-line installer and advises against third-party install guides.

Latest recorded

  • Stable channel 2026100600 released

Checked · Release notes

Official sources

Official install guide (official site)

Is it right for you? Take the fit check

Verify this download

Web installer path: after install, compare the verified-boot key hash shown at boot with the per-device hash on the install page, and use the Auditor app for hardware attestation. Command-line path: verify the factory image signature with ssh-keygen -Y verify against the project's allowed_signers file.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. No analytics or telemetry per its FAQ; only device model and OS version go to update servers. Pixel hardware only.

Licence: Per-repository licences (AOSP-derived) · Source code: GrapheneOS

Apple Lockdown Mode

Built-in setting

Extreme optional protection built into iPhone, iPad, Apple Watch and Mac for people at risk of targeted attacks.

Works on
  • iOS 16+
  • iPadOS 16+
  • watchOS 10+
  • macOS Ventura+
Effort
Easy
Cost
Free (built in)

Who it's for. iPhone, iPad and Mac users who may be personally targeted by spyware.

Limitations. Some features, attachments and websites stop working by design.

Good to know. Turn it on separately on each iPhone, iPad and Mac. Turning it on for an iPhone also turns it on for a paired Apple Watch.

Latest recorded

Built-in setting: there is no separate version. Update the device to the latest system release first.

Official sources

Official guide: how to turn it on (official site)

How to turn it on

Nothing to download. Update the device to the latest OS first, then turn on at Settings > Privacy & Security > Lockdown Mode (System Settings on Mac).

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. Built-in setting, not an app. Blocks most message attachments, complex web tech and unknown FaceTime callers; set per device.

Android Advanced Protection

Built-in setting

Single Android setting that enforces stronger anti-attack protections for apps, USB, calls, Chrome and 2G networks.

Works on
  • Android
Effort
Easy
Cost
Free (built in)

Who it's for. Android users at higher risk who want Google's built-in Advanced Protection switched on.

Limitations. Needs Android 16 or later. Some features are restricted by design.

Good to know. Not the same as Google's Advanced Protection Program for accounts, which protects the account rather than the device. While it is on, installing apps from unknown sources is blocked.

Latest recorded

Built-in setting: there is no separate version. Update the device to the latest system release first.

Official sources

Official guide: how to turn it on (official site)

How to turn it on

Nothing to download. Needs Android 16 or later and a screen lock. Go to Settings › Security & privacy › Other settings › Advanced Protection, then turn on Device protection. Alternative path: Settings › Google › All services › Personal and device safety › Advanced Protection.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. Built-in; optional Intrusion Logging backs up encrypted logs to a Google Account you choose. Requires a screen lock.

Check a device

Look for signs of compromise, and get expert help if you need it.

Mobile Verification Toolkit (MVT)

Expert tool

Source-available forensic toolkit maintained with Amnesty International's Security Lab that checks phones for spyware traces.

Works on
  • macOS
  • Linux
  • Windows (via WSL only)
Effort
Advanced
Cost
Free

Who it's for. Technical investigators examining a phone with the owner's consent.

Limitations. Forensic command-line tool, not a consumer scanner. Consensual-use licence. A clean result does not prove a device is clean.

Good to know. It runs on a computer and examines an iPhone or Android phone. If you think you are targeted, contact the Access Now Digital Security Helpline rather than self-triage.

Latest recorded

  • Release v2026.10.5 released

Checked · Release notes

Official sources

Official install guide (official site)

Verify this download

Install from PyPI with pipx (pipx install mvt) or from the official git repository. The install docs publish no signature or checksum procedure.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. Command-line forensic tool for technical users; licence requires the device owner's consent. Project says it is not for end-user self-assessment.

Licence: MVT License (modified MPL 2.0 with a Consensual Use Restriction; not clearly OSI open source) · Source code: Mobile Verification Toolkit (MVT)

iVerify Basic

App

Mobile security app that runs on-demand scans for signs of compromise and gives hardening guidance.

Works on
  • iOS
  • iPadOS
  • Android
Effort
Easy
Cost
Low cost (price varies by store)

Who it's for. Phone owners who want a guided security check-up.

Limitations. No app can prove a phone is free of spyware. Treat it as a check-up, not a verdict.

Good to know. A commercial product from iVerify LLC. Check the price in your own store before you buy.

Latest recorded

  • Latest 71 released

Checked · App Store listing

Official sources

Official App Store listing (official site)

Verify this download

Install only from the App Store or Google Play listing published by iVerify (seller iVerify LLC). No separate signature or hash process is published.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. App Store labels: usage analytics, device ID and crash data collected, not linked to you. $0.99 on iOS (US store).

Licence: Proprietary

LuLu

App

Free open-source macOS firewall that alerts you when apps try to make outgoing connections.

Works on
  • macOS 10.15+
Effort
Moderate
Cost
Free

Who it's for. Mac users who want to see and block apps connecting to the internet.

Limitations. macOS only. Its prompts need some judgement at first.

Good to know. Apple's built-in firewall blocks only incoming connections. LuLu is meant to complement it.

Latest recorded

  • macOS v4.5.1 released

Checked · Release notes

Official sources

Official download page (official site)

Verify this download

Compare the SHA-256 hash listed on the product page with your downloaded DMG (shasum -a 256 file.dmg).

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. Checks objective-see.org for updates (no user data collected, can be disabled). VirusTotal lookups only when you click.

Licence: GPL-3.0 · Source code: LuLu

KnockKnock

App

Free open-source macOS tool that lists software set to run persistently, helping expose hidden malware.

Works on
  • macOS 10.15+
Effort
Moderate
Cost
Free

Who it's for. Mac users who want to see what starts automatically, where malware likes to hide.

Limitations. macOS only. It lists items; deciding what is malicious takes care.

Latest recorded

  • macOS v4.1.0 released

Checked · Release notes

Official sources

Official download page (official site)

Verify this download

Compare the hash listed on the product page with your downloaded zip. At time of check the page listed a SHA-1 only, so also confirm you came from objective-see.org.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. Queries VirusTotal with binary hashes by default (can be disabled); update check reads products.json from objective-see.org.

Licence: GPL-3.0 · Source code: KnockKnock

BlockBlock

App

Free open-source macOS tool that alerts when something installs a persistent item, so you can block it.

Works on
  • macOS 10.15+
Effort
Moderate
Cost
Free

Who it's for. Mac users who want an alert when something installs itself to run at startup.

Limitations. macOS only. Alerts need judgement.

Latest recorded

  • macOS v2.5.2 released

Checked · Release notes

Official sources

Official download page (official site)

Verify this download

Compare the SHA-256 hash listed on the product page with your downloaded zip (shasum -a 256 file.zip).

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. Needs Full Disk Access (Endpoint Security); alert decisions are logged locally. VirusTotal opens in your browser only on click.

Licence: GPL-3.0 · Source code: BlockBlock

Access Now Digital Security Helpline

Service

Free 24/7 expert help line for civil society, journalists and activists facing targeted digital attacks.

Works on
  • Web
  • Email (PGP supported)
Effort
Easy
Cost
Free

Who it's for. Journalists, activists and human-rights defenders who may be targeted.

Limitations. Serves civil society. It is not a general tech-support line.

Good to know. Support is given after a mandate check, and Access Now may decline requests outside its scope.

Latest recorded

Service, not software: there is no version to track.

Official sources

Official helpline page (official site)

How to check you are on the real site

Nothing to install. Contact the Helpline only through the request options on accessnow.org/help; a PGP public key is offered there for encrypted email.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. Vetted service: civil society only, age 18+. PGP key offered for encrypted contact. Stated response time is two hours.

Lock down accounts

A password manager first, then passkeys and two-step sign-in.

Bitwarden

App

Open-source password manager with apps, browser extensions, a CLI and a web vault.

Works on
  • Windows
  • macOS
  • Linux
  • iOS
  • Android
  • Browser extensions
  • CLI
  • Web
Effort
Easy
Cost
Free (paid plans available)

Who it's for. Most people: syncs passwords and passkeys across all your devices.

Limitations. Cloud-synced with end-to-end encryption. Protect the account with a strong master password and two-step sign-in.

Latest recorded

  • Desktop v2026.9.1 released

Checked · Release notes

Official sources

Official download page (official site)

Verify this download

Download from the matching GitHub release, hash it with CertUtil or sha256sum, and compare with the SHA-256 shown beside that file on GitHub. Mobile: official stores, or the F-Droid repo fingerprint on the download page.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. Email account required. Mobile apps use Firebase for push and some crash reports; the F-Droid build omits it.

Licence: GPL-3.0 plus separate Bitwarden License for the bitwarden_license folder · Source code: Bitwarden

KeePassXC

App

Offline, open-source password manager that keeps your vault in a local encrypted KDBX file.

Works on
  • Windows
  • macOS
  • Linux
Effort
Moderate
Cost
Free

Who it's for. People who want passwords kept in a local file they control.

Limitations. No built-in sync: you handle backups and syncing. Desktop only (compatible mobile apps exist).

Good to know. A pre-release (2.8.0-beta1) exists. CyberSloth records the stable release only.

Latest recorded

  • Stable v2.7.12 released

Checked · Release notes · Project blog

Official sources

Official download page (official site)

Verify this download

Each download has a PGP .sig and a SHA-256 .DIGEST file. Import the KeePassXC release key and run gpg --verify; compare the fingerprint on the verification page.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. No account; the database is a local file you can store anywhere. Browser integration and icon downloads use the network.

Licence: GPL-2.0 or GPL-3.0 · Source code: KeePassXC

Browse without being followed

Block trackers, or hide who you are online.

Tor Browser

App

Browser that routes your traffic through the Tor network to hide your IP address and resist fingerprinting.

Works on
  • Windows
  • macOS
  • Linux
  • Android
Effort
Easy
Cost
Free

Who it's for. Anyone who needs to browse anonymously or reach blocked sites.

Limitations. Slower, and some sites block Tor. Logging in to accounts that identify you undoes the anonymity.

Good to know. An alpha channel exists. It is not recommended for general use.

Latest recorded

  • Stable v15.0.24 released date not recorded

On 12 Oct 2026 the official download page still offered 15.0.20 for Windows while other platforms were on 15.0.24. Check the version the page offers and verify its signature.

Checked · Release posts · Full changelog file

Official sources

Official download page (official site)

Verify this download

Download the .asc signature next to each file and verify it with GnuPG against the Tor Browser Developers signing key.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. No account or sign-in; traffic relays through volunteer nodes. Expect slower speeds and some sites blocking Tor.

Source code: Tor Browser

Mullvad Browser

App

Privacy browser built with the Tor Project to resist fingerprinting; designed for use with a VPN, not Tor.

Works on
  • Windows 10+ (64-bit)
  • macOS 14+
  • Linux (64-bit)
Effort
Easy
Cost
Free

Who it's for. People who want Tor Browser-style anti-tracking without the Tor network.

Limitations. Designed to be used with a trustworthy VPN; on its own it does not hide your IP address.

Latest recorded

  • Stable v15.0.24 released

Checked · Release notes

Official sources

Official download page (official site)

Verify this download

Download the matching .asc GPG signature and verify it with GnuPG; builds are signed by the Tor Browser Developers key.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. Mullvad states no telemetry. Does not route through Tor; README advises pairing with a trustworthy VPN.

Licence: MPL-2.0 · Source code: Mullvad Browser

uBlock Origin

Browser extension

Efficient open-source content blocker for ads and trackers, best supported in Firefox.

Works on
  • Firefox (desktop and Android)
  • Microsoft Edge
  • Opera
  • Thunderbird
  • Chromium (manual MV2 build)
Effort
Easy
Cost
Free

Who it's for. Firefox users who want to block ads and trackers.

Limitations. No longer available for Chrome. Chrome users: use uBlock Origin Lite.

Latest recorded

  • Stable v1.75.0 released

Checked · Release notes

Official sources

Official project page (official site)

Verify this download

Install from your browser's official add-on store, which handles signing and updates. GitHub builds are manual installs and usually do not auto-update.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. Open-source extension, no account. Chromium users: Chrome Web Store build removed 2026-08-31; see uBlock Origin Lite.

Licence: GPL-3.0 · Source code: uBlock Origin

uBlock Origin Lite

Browser extension

Manifest V3 content blocker from the uBlock Origin project for Chrome, Edge, Firefox and Safari.

Works on
  • Chrome
  • Microsoft Edge
  • Firefox
  • Safari
Effort
Easy
Cost
Free

Who it's for. Chrome and Chromium-based browser users who want to block ads and trackers.

Limitations. Fewer advanced filtering options than uBlock Origin.

Latest recorded

  • Stable v2026.1006.1931 released

Checked · Release notes

Official sources

Official project page (official site)

Verify this download

Install from the official browser store listing linked from the project README.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. Works declaratively: the browser applies the rules, so no persistent process. Open source, no account.

Licence: GPL-3.0 · Source code: uBlock Origin Lite

Encrypt files

Keep drives, USB sticks and cloud files unreadable to others.

VeraCrypt

App

Free open-source disk and file-container encryption, derived from TrueCrypt 7.1a with security fixes.

Works on
  • Windows
  • macOS (12+)
  • Linux
Effort
Advanced
Cost
Free

Who it's for. Encrypting whole drives, USB sticks or file containers.

Limitations. Forget the password and the data is gone. There is no recovery.

Latest recorded

  • Stable v1.26.29 released

Checked · Release notes

Official sources

Official download page (official site)

Verify this download

PGP-verify the .sig next to each file against the VeraCrypt public key (fingerprint listed on the signatures page); SHA-256 and SHA-512 sum files are published per release. Windows installers also carry an X.509 signature.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. Local encryption software, no account. Copyright holder is AM Crypto; IDRIX appears in earlier notices.

Licence: Custom licence; see License.txt in the repository · Source code: VeraCrypt

Cryptomator

App

Open-source client-side encryption for files you store in Dropbox, Google Drive, OneDrive or other cloud storage.

Works on
  • Windows
  • macOS
  • Linux
  • Android
  • iOS
Effort
Easy
Cost
Free on desktop (mobile apps may cost)

Who it's for. Encrypting files before they go into cloud storage.

Limitations. Hides file contents and names, not how many files you have or their approximate sizes.

Good to know. The "portable" Windows build linked from Cryptomator's downloads page is community-made, so CyberSloth does not link to it.

Latest recorded

  • Desktop v1.19.3 released

Checked · Release notes

Official sources

Official download page (official site)

Verify this download

GPG-verify the .asc file with the Cryptobot key. Windows installers are Authenticode-signed by Skymatic GmbH and the docs list valid thumbprints. On macOS check codesign output for the expected TeamIdentifier.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. No account needed. Operated by Skymatic GmbH (Germany); update checks send OS and app version plus IP address.

Licence: GPL-3.0 (commercial licence also offered) · Source code: Cryptomator

Hide your traffic

What a VPN does, and what it doesn't.

Mullvad VPN

App

Swedish VPN service with open-source apps; accounts are anonymous numbers, no email required.

Works on
  • Windows
  • macOS
  • Linux
  • Android
  • iOS
Effort
Easy
Cost
Paid (flat monthly fee)

Who it's for. People who want a privacy-focused VPN with no account details required.

Limitations. A VPN moves trust to the provider. It does not stop scams, malware or tracking by sites you log in to.

Good to know. Card, PayPal and bank payments go through third parties and are not anonymous. Mullvad also accepts cash and Monero.

Latest recorded

  • Desktop v2026.5 released
  • Android v2026.12 released

Checked · Release notes

Official sources

Official download page (official site)

Verify this download

Download the matching .asc GPG signature (linked beside each installer) and verify with GnuPG against the Mullvad code signing key; fingerprint is on the guide.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. No email or username; random account number. States no activity logs. Swedish company; cash and Monero accepted.

Licence: GPL-3.0 · Source code: Mullvad VPN

Proton VPN

App

Swiss VPN service with open-source apps and a free tier; sign-in uses a Proton Account.

Works on
  • Windows
  • macOS
  • Linux
  • Android
  • iOS
  • Browser extension
Effort
Easy
Cost
Free tier (paid plans available)

Who it's for. People who want a reputable VPN with a free tier.

Limitations. The iPhone and iPad app can be used as a guest without an account; other apps need a Proton account. A VPN does not stop scams, malware or tracking by sites you log in to.

Latest recorded

  • Stable v5.1.8 released
  • Android v5.20.57.0 released
  • iOS v7.3.0 released
  • macOS v6.5.0 released

Checked · Release notes: Windows · macOS · Linux · Android · iOS

Official sources

Official download page (official site)

Verify this download

Android: compare the APK signing certificate SHA-256 with the values Proton publishes (apksigner verify --print-certs). Linux: Proton publishes a checksum for the repository setup package. No signature guide found for Windows, macOS or iOS; use the official site or stores.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. Operated by Proton AG, Geneva; states no-logs policy; VPN account data stored in Switzerland, Germany or Norway.

Licence: GPL-3.0 · Source code: Windows · Android · iOS and macOS · Linux GUI

Check for breaches

See whether your email turned up in a known data breach.

Have I Been Pwned

Service

Website that shows which known data breaches exposed your email address, plus a breached-password check.

Works on
  • Web
Effort
Easy
Cost
Free

Who it's for. Anyone checking whether their email appeared in a known data breach.

Limitations. Only knows breaches that became public. Not being listed is not a guarantee.

Latest recorded

Service, not software: there is no version to track.

Official sources

Open haveibeenpwned.com (official site)

How to check you are on the real site

Nothing to install. Use the exact domain haveibeenpwned.com. Pwned Passwords uses k-anonymity: only the first five characters of the password's SHA-1 hash leave your device.

We link to official sources only. CyberSloth hosts no binaries.

Privacy note. No personal data stored on search (server logs up to 31 days); notifications store your email. Run from Queensland, Australia.

Answers

Answers to the questions people ask most

Each answer leads with the action, then the reason and the limits. All were last checked on . There are no affiliate links in any of them.

Was my email in a data breach?

If you only do one thing: check your email address at haveibeenpwned.com, then sign up for its breach notifications.

If someone else might be monitoring this phone, stop and read Safety first: removing apps or changing passwords can alert them.

Do this
Type your email address into Have I Been Pwned, which is run from Queensland, Australia. For each breach that lists you, change that account's password and any other account that shared it. Turn on notifications to hear about future breaches.
Why
Breaches are how email addresses and passwords end up with criminals. Knowing which sites were affected tells you which passwords to change first. Australia's privacy regulator recorded a record 1,205 data breach notifications in 2025 (OAIC, notifiable data breaches statistics).
Limitations
It only knows breaches that became public, and not being listed is no guarantee. CyberSloth doesn't run a lookup. You enter your email on haveibeenpwned.com, not here.
Next step
Put your passwords in a password manager so each one is unique: Bitwarden or KeePassXC.

Last checked

Passwords, passkeys, two-step sign-in: where do I start?

If you only do one thing: use a password manager so every account has its own password, starting with your email and your bank.

Do this
  1. Password manager. Bitwarden syncs across devices. KeePassXC keeps a local file you control. Use a long, unique master password.
  2. Passkeys. Where a site offers one (myGov does), use it. A passkey is tied to the real site, so a fake one can't collect it.
  3. Two-step sign-in. For accounts without passkeys, use an authenticator app or a security key. Text-message codes are better than nothing, but weaker.
Why
One reused password turns a single breach into many. In the CybSafe and National Cybersecurity Alliance "Oh Behave" report for 2025/26, 77% of people knew about multi-factor authentication but 53% used it regularly.
Limitations
A password manager is one more account to protect, so guard it with a long master password and two-step sign-in. Malware that steals your signed-in session can sidestep two-step codes, so keep devices updated.
Next step
Pick a manager in the tools list.

Last checked

Do I need a VPN?

If you only do one thing: don't buy a VPN to stop scams or malware. It won't.

Do this
Decide what you want it for. A VPN helps if you want to hide your browsing from your Wi-Fi network or internet provider, or appear to be in another country. If that's you, choose a provider whose apps are open source: Mullvad VPN is paid, and Proton VPN has a free tier.
Why
A VPN moves trust from your internet provider or the café Wi-Fi to the VPN company. Most websites already encrypt your connection, so a VPN adds less than the advertising suggests.
Limitations
A VPN doesn't stop phishing, malware, scams or tracking by sites you sign in to, and it doesn't make you anonymous. A free VPN from an unknown company can be a risk of its own.
Next step
Compare options under Hide your traffic. For anonymity rather than privacy, look at Tor Browser.

Last checked

What not to paste into an AI chatbot

If you only do one thing: before you paste, ask whether you'd be comfortable with a stranger reading it. If not, leave it out or swap in placeholders.

If someone else might be monitoring this phone, stop and read Safety first: removing apps or changing passwords can alert them.

Do this
Keep out passwords, recovery codes, API keys, card and bank details, tax file and ID numbers, health or legal details about you or anyone else, and workplace or client documents you aren't allowed to share. Use placeholders ("Client A", "$X") when you want help with wording. Check the provider's data and training settings, and use a temporary chat mode where one is offered.
Why
What you paste may be stored and, depending on the provider and your settings, reviewed or used to improve the model. Trust is low: in Australia's 2026 privacy survey (OAIC ACAPS) only 4% trusted AI companies with their data, and 71% of US adults surveyed by Pew Research Center in June 2026 expect AI to make their personal data less secure.
Limitations
Settings differ between providers and change over time, and deleting a chat doesn't guarantee every copy is gone. This is general guidance, not advice for your workplace. Check your employer's rules before using a chatbot with work material.
Next step
If you've already pasted a password or key, change it now.

Last checked

Signal or WhatsApp?

If you only do one thing: open "Linked devices" in the app you use, and remove any you don't recognise.

Do this
Use whichever your people will actually use, and set it up properly. Pick Signal if you want the least data held about you and your contacts can install it. WhatsApp is fine for everyday chat when everyone you talk to is already there. In either app, never approve a new linked device, scan a QR code or read out a pairing code because someone asked you to.
Why
Both encrypt personal messages and calls end to end by default. WhatsApp's cloud backups are only end-to-end encrypted if you turn that on. The bigger differences are who runs the service, how much it knows about you, and what you can inspect.
Limitations
Both can be hijacked if you're tricked into linking an attacker's device (the "GhostPairing" trick links an attacker's browser to WhatsApp using a pairing code). Neither protects a phone that already has spyware on it.
Next step
Get Signal from its official source in the tools list, and check the latest recorded version there.
Signal and WhatsApp, side by side
FeatureSignalWhatsApp
Personal messages and calls encrypted end to endYes, by defaultYes, by default. Cloud backups are only end-to-end encrypted if you turn that on.
Run bySignal Messenger LLC, a US non-profitMeta
Code you can inspectYes (AGPL-3.0 licence)No, closed source
Phone number to sign upYes. You can hide it behind a username.Yes
What the company can readCannot read message content, per its privacy policyMessage content is encrypted. It still collects data about how you use the service.

Signal facts come from the Signal entry in the tools list. WhatsApp's own help pages are the place to confirm its current settings.

Last checked

For small teams

Exploited flaws worth asking your IT provider about

CISA's catalogue lists software flaws that attackers are already using against real systems. Most small teams don't run any of these directly, but a supplier or IT provider might. Each entry below says who it applies to and what to do. The CVE ID comes last, for whoever needs it.

Source: CISA Known Exploited Vulnerabilities catalogue (official site), catalogue version 2026.10.08 (1,739 entries). Checked . Showing the 5 newest entries. CyberSloth does not scan anything: these are public listings.

  1. ISC BIND

    Added to the catalogue

    DNS server software. The flaw: errors in how the software handles data that attackers can abuse.

    Applies if
    Your team, IT provider or a supplier runs ISC BIND. Mostly run by internet providers and IT teams that host their own DNS. Most small teams use a hosted DNS service instead.
    What to do
    Ask whoever looks after your IT whether they use it. If they do, install the vendor's update or follow its mitigation steps now. If the product is no longer supported or has no fix, take it off the internet or stop using it.

    CVE ID CVE-2015-5477 (NVD entry, external site) Ransomware use: none recorded

  2. Apache Struts

    Added to the catalogue

    A framework for building business web applications. The flaw: it lets an attacker run their own commands on the server.

    Applies if
    Your team, IT provider or a supplier runs Apache Struts. Usually found inside custom or older business web applications. Ask whoever built or hosts yours.
    What to do
    Ask whoever looks after your IT whether they use it. If they do, install the vendor's update or follow its mitigation steps now. If the product is no longer supported or has no fix, take it off the internet or stop using it.

    CVE ID CVE-2016-3081 (NVD entry, external site) Ransomware use: none recorded

  3. Strapi

    Added to the catalogue

    A content management system for websites and apps. The flaw: it leaves sensitive information stored without protection.

    Applies if
    Your team, IT provider or a supplier runs Strapi Strapi. Applies if your website or app is built on Strapi, or your web developer uses it.
    What to do
    Ask whoever looks after your IT whether they use it. If they do, install the vendor's update or follow its mitigation steps now. If the product is no longer supported or has no fix, take it off the internet or stop using it.

    CVE ID CVE-2023-22894 (NVD entry, external site) Ransomware use: none recorded

  4. ONLYOFFICE Docs

    Added to the catalogue

    An online document-editing server. The flaw: it lets an attacker read files they should not be able to reach.

    Applies if
    Your team, IT provider or a supplier runs ONLYOFFICE Docs. Applies if you host ONLYOFFICE Docs yourself, or a file-sharing product you use includes it.
    What to do
    Ask whoever looks after your IT whether they use it. If they do, install the vendor's update or follow its mitigation steps now. If the product is no longer supported or has no fix, take it off the internet or stop using it.

    CVE ID CVE-2021-3199 (NVD entry, external site) Ransomware use: none recorded

  5. ProFTPD

    Added to the catalogue

    An FTP file-transfer server. The flaw: it lets an attacker use features or data without the right permission.

    Applies if
    Your team, IT provider or a supplier runs ProFTPD ProFTPD. Applies if you or a supplier run an FTP server to send or receive files.
    What to do
    Ask whoever looks after your IT whether they use it. If they do, install the vendor's update or follow its mitigation steps now. If the product is no longer supported or has no fix, take it off the internet or stop using it.

    CVE ID CVE-2015-3306 (NVD entry, external site) Ransomware use: none recorded

One-pager

Small business: four habits to start with

Business email compromise is a large share of the cybercrime reports made by businesses, and in 2024-25 the average cost per report for a small business was $56,600, up 14% (ASD Cyber Threat Report 2024-25, published 14 October 2025, which counted about 84,700 cybercrime reports). These habits are cheap compared with that.

  1. Two-step sign-in where it matters

    Turn it on for email, accounting and payroll, banking, and every account with admin rights. Use an authenticator app or a security key where you can.

    Check: could a stolen password alone get someone into your email?

  2. Backups you've actually restored

    Keep at least one copy that your everyday network can't reach, so ransomware can't encrypt it too. Then restore from it once, so you know it works, and again on a schedule you'll keep.

    Check: when did you last get a file back from a backup?

  3. Call back before paying a changed account

    If a supplier, client or manager sends new bank details, call them back on a number you already hold before you pay. Ask a second person to approve changes to payee details.

    Check: who is allowed to change bank details, and how do they confirm it?

  4. Know your insurance basics

    Ask your broker what a cyber policy covers (including funds-transfer fraud and business interruption), which security measures it requires (such as two-step sign-in), who to call first and any deadline for telling them. Keep the policy details somewhere you can reach if email is down.

    Check: do you know the number to call, and what you'd need to have in place?

If something has gone wrong

General guidance from CyberSloth, not legal or insurance advice. Last checked .

About

An internal project, run slowly on purpose

CyberSloth started as an internal project: a calm place to keep the checks, tools and plain answers we kept repeating, now shared so anyone can use them. The approach is calm, sceptical and practical: slow down, check the facts, then act. No fear marketing, no hype, and nothing sold through this site.

The sloth is the mascot. It's a reminder that most security decisions go better with a pause.

Get in touch

Have a question, a correction, or a tool we should look at? Send a short note.

hello@cybersloth.us

CyberSloth isn't an emergency service and can't diagnose a phone or account from a message. For an incident, use the help routes above. In immediate danger, call 000.