Consumer News: Consumer sentiment hit an all-time low in May

Cybercriminals are using fake Microsoft login requests to bypass multi-factor security

By Mark Huffman of ConsumerAffairs

• The FBI warned on May 21 that cybercriminals are increasingly targeting Microsoft 365 users with sophisticated phishing .

• The scam uses a tool called Kali365 to steal account access tokens and bypass multi-factor authentication protections.

• Officials say the attacks rely on fake Microsoft login requests and social engineering tactics designed to trick users into handing over access.

The FBI is warning Microsoft users to be on alert after identifying a fast-growing phishing campaign that allows scammers to bypass common account security protections and gain access to sensitive information.

In a public service alert, the FBI said cybercriminals are using a phishing-as-a-service platform called Kali365 to target Microsoft 365 accounts. The tool enables attackers to steal OAuth access tokens, giving them persistent access to accounts without needing passwords or repeatedly triggering multi-factor authentication (MFA).

According to the FBI, the service first appeared in April and is being distributed through Telegram channels. The agency said the platform lowers the barrier for cybercrime by offering automated phishing templates, AI-generated scam emails, and dashboards that track victims in real time.

It starts with an email

The typically begin with an email that appears to come from a trusted cloud service or document-sharing platform. Victims are instructed to visit a legitimate Microsoft verification page and enter a device code supplied in the email. Once the code is entered, attackers can capture authentication tokens and gain access to services such as Outlook, Teams, and OneDrive.

Because the attacks exploit Microsofts legitimate authentication workflow, they can be difficult for users and security systems to detect. Cybersecurity experts say the method is especially dangerous because it bypasses MFA protections that many users rely on to secure their accounts.

The potential damage

The FBI warned that compromised accounts can expose sensitive business information, personal data, and financial records. Attackers may also use stolen access to launch additional phishing attacks from legitimate accounts, making future appear more credible.

Microsoft recently reported a separate sophisticated phishing campaign that targeted more than 35,000 users across 13,000 organizations in 26 countries, with most victims located in the United States. Researchers said attackers used polished corporate-style emails and fake internal communications to trick recipients into surrendering credentials and authentication tokens.

Federal authorities are urging users to avoid clicking links in unsolicited emails, verify login requests independently, and never enter device codes unless they initiated the request themselves. The FBI also recommends enabling phishing-resistant MFA methods, monitoring account activity, and reporting suspicious messages to the FBIs Internet Crime Complaint Center.

The warning reflects a broader trend toward increasingly sophisticated phishing operations that rely more on social engineering than traditional malware. Security researchers say these are becoming more convincing through the use of AI-generated messages, professional-looking templates, and legitimate cloud infrastructure.

SKS Copack reports that a supplier warned of a tainted ingredient

By Mark Huffman of ConsumerAffairs

• SKS Copack has recalled dozens of specialty beverage powders because they may be contaminated with Salmonella.

• The affected products were sold under brands including Angel Specialty Products, Royal Gold, Boba Time, Fanale, and Denda in 25 states.

• Consumers are urged not to consume the recalled products and may return them for a full refund.

SKS Copack, a California-based beverage manufacturer, is recalling a wide range of specialty beverage powders after a supplier warned that an ingredient may be contaminated with Salmonella, according to the Food and Drug Administration (FDA).

The Cerritos, Calif., company said the recall affects powdered beverage mixes sold under several brands, including Angel Specialty Products, Royal Gold, Boba Time, Fanale, and Denda. The products were distributed through cafes, restaurants, and direct online sales in 25 states, including California, Texas, Florida, Illinois, New York, and Virginia.

The recall was initiated after SKS Copack received notice from supplier California Dairies Inc. that a lot of low-heat nonfat dry milk powder tested positive for Salmonella during routine testing.

No illnesses had been reported as of the FDA announcement.

Salmonella can cause serious and sometimes fatal infections, particularly in young children, older adults, and people with weakened immune systems. Symptoms can include fever, diarrhea, nausea, vomiting, and abdominal pain. In rare cases, the infection can spread into the bloodstream and cause more severe complications.

What to do

Among the recalled products are matcha green tea powder, taro drink mix, horchata mix, milk tea powder, vanilla smoothie base, cappuccino mixes, yogurt powder, and ice cream mix. Affected lot codes and best-by dates are listed on the FDA recall notice.

Consumers are advised to stop using the recalled products immediately and return them to the place of purchase for a refund. SKS Copack said it has halted distribution of the affected products and is cooperating with the FDA during the investigation.

Consumers with questions can contact SKS Copack at (562) 404-8158 weekdays between 8 a.m. and 4 p.m. Pacific time.

Here are some ways to keep those bills in check

By Mark Huffman of ConsumerAffairs

• U.S. households are expected to pay an average of $778 for summer cooling this year, up 8.5% from 2025 and nearly 37% higher than in 2020.

• Southern states are projected to see the steepest increases, with cooling bills in the South Atlantic region rising more than 13%.

• NEADA says one in six households is already behind on utility bills, with total energy debt reaching about $25 billion.

Now that we are at the unofficial start of summer, its time to start thinking about how to tame air conditioningbills, because electric utility rates are climbing.

The National Energy Assistance Directors Association (NEADA) projects the average household will spend about $778 on electricity for home cooling during the summer months, an increase of 8.5% from last years estimated $717. The organization said cooling costs are now nearly 37% higher than they were in 2020.

Families are squeezed from both directions, said Mark Wolfe, executive director of NEADA. They are paying more for electricity, and they need more of it to stay safe during increasingly hot summers.

The report attributes the increase to two primary factors: electricity prices continuing to rise faster than inflation and higher summer temperatures driving greater air-conditioning use. NEADA said households are not only paying more per kilowatt-hour but are also consuming more electricity because air conditioners are running longer and more frequently.

Southern households may feel the most pain

The largest increases are expected in Southern states, where air-conditioning use is widespread and summer temperatures are typically highest. NEADA projects cooling costs in the South Atlantic region will rise by more than $100, or about 13.5%, this summer. The West South Central region is expected to see an 11.5% increase, while the East South Central region could face an 8.5% jump.

Midwestern households are expected to experience smaller increases of roughly 4.8%, while New England and Mid-Atlantic states are projected to see increases ranging from about 6.7% to 7.8%.

NEADA said the rising costs come as many consumers are already struggling to keep up with utility payments. The organization estimates that one in six U.S. households is behind on energy bills, with total utility debt reaching approximately $25 billion.

Cutting electric bills without sacrificing comfort

Consumers can lower summer cooling costs without sacrificing comfort by combining low-cost home improvements, smarter thermostat use, and changes in daily habits. Energy experts say even small adjustments can add up during periods of extreme heat.

Here are some of the most effective strategies:

• Raise the thermostat slightly: The Department of Energy (DOE) recommends setting the thermostat to 78 degrees when people are home and awake. Raising the temperature by even one to twodegrees can noticeably reduce electricity use while remaining comfortable for most households. Programmable and smart thermostats can automatically adjust temperatures when no one is home, helping avoid unnecessary cooling.
• Use ceiling fans correctly: Ceiling fans can make a room feel about fourdegrees cooler by improving air circulation. Fans use far less electricity than air conditioning, allowing consumers to raise thermostat settings without losing comfort. During summer, ceiling fans should rotate counterclockwise to push cool air downward.
• Block sunlight during the hottest hours: Sunlight streaming through windows can dramatically increase indoor temperatures. Closing blinds, curtains, or shades during the afternoon can reduce heat gain, especially on south- and west-facing windows. Blackout curtains and reflective window films can further cut cooling demands.
• Avoid heat-producing appliances during peak heat: Ovens, clothes dryers, and dishwashers generate additional indoor heat. Running them in the evening or early morning can help keep homes cooler. Outdoor grilling and microwave cooking also reduce heat buildup indoors.
• Seal air leaks: Cool air escaping through gaps around doors, windows, and ductwork forces air conditioners to work harder. Weatherstripping and caulking are relatively inexpensive improvements that can improve efficiency immediately. Adding insulation in attics can also help maintain indoor temperatures.
• Maintain the air conditioner: Dirty filters and clogged outdoor units reduce efficiency. Experts recommend replacing HVAC filters every one to three months during heavy-use periods. Keeping outdoor condenser units free of debris and scheduling annual maintenance can improve performance and lower operating costs.

Reducing cooling costs should never come at the expense of health and safety. Older adults, young children, and people with medical conditions are especially vulnerable to heat-related illness.

On extremely hot days, consumers should stay hydrated, use fans carefully, and seek cooling centers or public air-conditioned spaces if home cooling is inadequate.

From fake visas to bogus crypto coins, scammers are using AI and official-looking branding to target excited soccer fans

• Cybersecurity researchers warn that World Cup 2026 scammers are using AI-generated images, fake websites, and official-looking branding to make harder to detect than ever before.

• Fans are being targeted through fake World Cup visas, bogus LEGO and Panini collectible stores, and fraudulent crypto coins designed to steal money, personal data, and digital wallet access.

• Experts say consumers should avoid clicking links from ads or social media, double-check website URLs, and be wary of high-pressure sales tactics, countdown timers, and deals that seem too good to be true.

As excitement builds for the 2026 FIFA World Cup, cybersecurity experts are warning that scammers are already gearing up.

While fake ticket sales have long been a concern surrounding major sporting events, researchers at Malwarebytes say criminals are now using far more sophisticated tactics to target fans money, personal information, and even cryptocurrency wallets.

ConsumerAffairs spoke with Shahak Shalev, Global Head of Scam and AI Research at Malwarebytes, who explained that scammers are creating convincing fake websites, AI-generated images, and official-looking branding tied to the World Cup to trick consumers into letting their guard down.

The range from bogus travel visas and fake collectible stores to fraudulent crypto tokens and unregulated betting platforms all designed to capitalize on the hype surrounding one of the worlds biggest sporting events.

The are getting harder to spot

Shalev explained that the most current World Cup arent as easy for consumers to spot.

Previously, consumers would see more obvious red flags like typos, awkward phrasing or pixelated imagery, he said. AI has helped scammers step up their game.

Today, AI-generated images, text, and cloned websites are making , including these new examples from the World Cup, significantly harder to spot. Year-round, cybercriminals are leveraging AI tools to generate deepfakes, storefronts and advertisements that mimic legitimate companies flawlessly. Scammers leverage cultural moments and seasons to target consumers in new ways.

Some other signs to look out for:

• High-pressure tactics

• Fake inventory counters

• Unrealistic deals

• Malicious ads

• Complex site redirects that send users to a different domain than the one they clicked

Integrating with popular brands, big events

These can take many forms, and scammers have gotten creative at incorporating popular brands and working around major events, like the World Cup, to start their schemes.

Shalev broke down three of the most popular geared towards the World Cup right now the fake World Cup Visa scam, LEGO and Panini , and World Cup crypto .

World Cup Visa Scam

Heres how it works:

• Sites like "WC2026 Visa" are charging a fake $270 fee under the guise of an expedited tournament entry document.

• The reality is that there is no special tournament visa.

• The US government has confirmed that visitors must use standard B1/B2 visas or the Visa Waiver Program with an ESTA authorization.

Beyond the $270 financial loss, the long-term risks are serious, Shalev said. By filling out these forms, fans hand over personal data like their full name, passport numbers, date of birth, travel logistics, and payment information. This gives cybercriminals the information to use for their own gain or package and sell for additional identity fraud activities.

LEGO and Panini

LEGO announced a partnership with FIFA in late 2025, so that part of the scam is legitimate and what can confuse unassuming consumers.

However, where things get dicey is that scammers take advantage of consumers looking for collectible jerseys, trophies, and other World Cup memorabilia. Scammers exploit this by spinning up targeted storefronts that pretend to sell these niche products.

These sites often use quiz-funnel to secure contact info or hide subscription billing flows disguised as shipping fees. Fans click on sponsored ads or social links looking for a hard-to-find item, only to have their credit card harvested by a site that will vanish shortly after the tournament ends.

Similarly, Panini is the international distributor for stickers, trading cards, and other sports memorabilia. Scammers create websites that are lookalike versions of the legitimate Panini site, often with countdowns to inventory running out and other urgency tactics. If consumers order items from these sites, not only is there risk that they may never come, but their information is also stored for future .

Crypto

While FIFA has a real digital ecosystem (FIFA Collect, Right-to-Buy NFTs), it is strictly documented on FIFA-controlled domains, not third-party community token sites, Shalev said.

The first red flag is the claim itself. If a token claims to be an official community coin or product of FIFA, stop right there. Once a fan engages, they either receive nothing, receive something they cant sell, or sign a transaction that gives the operator access to their entire digital wallet.

Protect your identity and your money

Shalev shared his top tips to help consumers protect their identities and their money during the height of these World Cup :

• Go direct, and check URLs: Never click a link from an ad, text, or email. Look closely at the website address. Type FIFA.com or LEGO.com directly into your browser and avoid URLs like "official-worldcup-tickets.com.

• Ignore the clock: If a site has a countdown timer or says "only 100 left" to pressure you into buying, its likely a scam.

• Watch out for Facebook groups: Facebook groups have been a hotbed for scammers. There is no reason to buy from Facebook groups, as they are very hard to authenticate.

• Use a guard: Use free tools like Malwarebytes Scam Guard or Browser Guard to help you verify sites and offers in real time.

• If youve been scammed: If you realize youve been compromised, do not wait. If you shared financial details, alert your bank immediately. If you shared personal data, drop an immediate credit/fraud alert on your profile and report the incident straight to the authorities.