> How to download and read ebooks safely | Kaspersky official blog

Contrary to a common misconception, people haven’t stopped enjoying books in the digital age. The truth is that for a while now, reading on paper hasn’t been the only way to enjoy written word. At first glance, what cybersecurity risks could there possibly be? Unfortunately, as readers are a huge audience and demand for ebooks is high, cybercriminals are bound to try to cash in. We spoke with Andrey Sidenko, Head of Child Online Safety at Kaspersky, to learn how criminals exploit interest in ebooks and what to look out for so you don’t become a victim. Malware instead of a book Most often, scammers target computer and smartphone users who try to download an ebook from a pirate site. For example, our experts recently discovered a miner spreading this way: it was tapping the processing power of infected computers to generate various cryptocurrency tokens. Several of these sites let visitors read ebook excerpts for free. In reality, the attackers were stealing passwords and using a malicious script to swap links, so users got an archive with malware named exactly like the book they wanted. What’s more, links to these sites sat at the top of search results, so the risk of taking the bait was very high. A year ago, we also wrote about fake ebooks in Turkish and Arabic. These files were actually malicious executables disguised as ordinary PDFs. Once launched, they installed infostealers on the victim’s device: malware that sent chat app session tokens, browser files, saved passwords and crypto wallet data to the cybercriminals. Traps in search results Sites that engage in search spam pose a danger of their own. Picture this: you search for “The Lord of the Rings free download” — and suddenly land on a page that repeats your search phrase word for word and supposedly offers that very book for download. But instead of the book you were hoping for, you may be redirected to yet another sketchy site and treated to a malicious file. By the way, this scam can work even if you search for a made-up author and a made-up book. Such sites can automatically generate plausible download pages for just about any query. Book phishing There are also phishing scams aimed squarely at book lovers. For example, one group of scammers sent out fake emails to users in the name of the popular book community Goodreads, offering various bogus services: becoming a moderator, taking part in book events, or buying paid promotion. That’s how the scammers squeezed money out of people while hiding behind a well-known brand. Here’s another example: ads supposedly from Orell Füssli, a well-known Swiss bookstore chain, circulated on social media. The ads offered books at hefty discounts. To place an order, users had to follow a link and enter their bank card details. Our regular readers have no doubt guessed that the link led to a fake site, which simply set up a paid subscription billed to the victim’s card. Finally, scammers often create phishing sites that pose as pirate libraries. These libraries no longer cater only to fiction readers: people go there for textbooks, academic papers, studies, rare editions, and other material that’s hard to find publicly available. Because such libraries get blocked regularly and have to keep changing domains, it can be hard for users to tell the real site from a fake one. Attackers take advantage of exactly this by promoting their own sites as official mirrors. These fake sites are often fully functional: you can search for and download books just like on the real thing, and the design is almost indistinguishable from the original. In 2024, for example, data on almost 10 million users of a phishing site mimicking Z-Library, a platform providing free downloads of access-restricted books and publications, was leaked online. The leak included names, email addresses, countries of residence, password hashes, purchase details, and even crypto wallet addresses. With data this detailed, it’s easy to plan the next attack: say, posing as a police officer to accuse the person of visiting an illegal site and demand money to drop the criminal case. Can an e-reader get infected? For attackers, e-readers aren’t the juiciest target: it’s hard to predict which device someone uses, or whether that person even has internet access. Besides, most e-readers are basic models — essentially a flash drive with a screen. More advanced devices also exist, with internet access, browsers, and the ability to download third-party apps and use cloud storage. These are more likely targets, but let’s be honest: most of the time, it’s cybersecurity researchers who hack them, not criminals. For example, in 2025, researchers discovered a vulnerability in the Kindle that could let an attacker hijack the linked Amazon account. Data leaks and other less obvious risks Some e-readers let you highlight quotes, take notes on books you liked, and share both with other users. Attackers can use this data for doxing, especially if a person wants to keep quiet about reading a particular book — something like, say, Fifty Shades of Grey or anything personal that isn’t meant for the public. In 2020, a Guardian journalist requested a copy of her personal data from Amazon and received more than 20 000 records about how she’d used her e-reader. These included which books she read and when, how long she spent reading, which passages she highlighted or copied, and which words she looked up in the dictionary. So it’s worth treating your reading history as personal data too. If a book service leaks data or your account gets hacked, a bad actor could learn not just your email address but far more personal details. So how do you read ebooks safely? One of the simplest tips is to use official bookstores — and not just for copyright reasons. These platforms value their reputation, and their content is vetted, so the files are more trustworthy. Another essential tip is to update all your devices regularly, even the basic e-reader: if it runs an operating system and any software, keep those updated. Timely updates close vulnerabilities that attackers could exploit, which lowers the risk of being hacked. The same goes for apps for reading and cataloging ebooks: this year, researchers found serious vulnerabilities in Calibre and Koodo Reader. Note that installing unofficial firmware on your devices, such as closed-ecosystem e-readers like Kindle, may not be the best idea. The risks include bricking the device and losing your warranty. The device may die or lock up during flashing or later, when an automatic over-the-air update installs official firmware. The manufacturer may also block your account if it detects the modified firmware when the device goes online. And, naturally, the firmware itself may carry malware, such as stealers that siphon off your personal data and passwords. The fact that there’s no way to install an antivirus on your e-reader only exaggerates the potential problem. It’s also a good idea to back up your digital library from time to time. Buying a book doesn’t guarantee you’ll keep access to it in your account forever. A title may become unavailable because of changes to licensing terms, platform policies, or other restrictions. Plus, some formats can only be bought and read inside the e-reader’s closed ecosystem. So we recommend keeping a backup copy on your computer or another device, where you can get to it quickly offline. That way, you’ll keep access to your content even if something goes wrong with the book service or your device. Every time you download an ebook, be sure to check the file extension. A regular ebook filename should definitely not end in .exe or .bat. You can read more about the most common extensions of malicious files here. With scammers, sadly, getting better and better at disguising malware, perhaps the best all-around advice is this: don’t visit dubious websites, and certainly don’t download unknown files. This is where Kaspersky Premium comes in — one of its main features is protection against phishing and malware. The application will warn you if you try to visit an untrustworthy site or download a potentially dangerous file. This keeps your data and money safe, and you can download and read your favorite books with peace of mind. Love the written word? Check out our other posts about books: Into the rabbit hole: AI slop is flooding Amazon Books on cybersecurity: 5+ recommendations from our experts Information security in Dune