{"id":36924,"date":"2026-10-31T03:06:18","date_gmt":"2026-10-30T16:06:18","guid":{"rendered":"https:\/\/www.kaspersky.com.au\/blog\/?p=36924"},"modified":"2026-10-31T03:06:18","modified_gmt":"2026-10-30T16:06:18","slug":"how-to-download-and-read-ebooks-safely","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.au\/blog\/how-to-download-and-read-ebooks-safely\/36924\/","title":{"rendered":"Reading between the lines: how to read ebooks safely"},"content":{"rendered":"

Contrary to a common misconception, people haven\u2019t stopped enjoying books in the digital age. The truth is that for a while now, reading on paper hasn\u2019t been the only way to enjoy written word.<\/p>\n

At first glance, what cybersecurity risks could there possibly be? Unfortunately, as readers are a huge audience and demand for ebooks is high, cybercriminals are bound to try to cash in. We spoke with Andrey Sidenko, Head of Child Online Safety at Kaspersky, to learn how criminals exploit interest in ebooks and what to look out for so you don\u2019t become a victim.<\/p>\n

Malware instead of a book<\/h2>\n

Most often, scammers target computer and smartphone users who try to download an ebook from a pirate site. For example, our experts recently discovered<\/a> a miner spreading this way: it was tapping the processing power of infected computers to generate various cryptocurrency tokens. Several of these sites let visitors read ebook excerpts for free. In reality, the attackers were stealing passwords and using a malicious script to swap links, so users got an archive with malware named exactly like the book they wanted. What\u2019s more, links to these sites sat at the top of search results, so the risk of taking the bait was very high.<\/p>\n

A year ago, we also wrote<\/a> about fake ebooks in Turkish and Arabic. These files were actually malicious executables disguised as ordinary PDFs. Once launched, they installed infostealers on the victim\u2019s device: malware that sent chat app session tokens, browser files, saved passwords and crypto wallet data to the cybercriminals.<\/p>\n

Traps in search results<\/h2>\n

Sites that engage in search spam pose a danger of their own. Picture this: you search for \u201cThe Lord of the Rings free download\u201d\u00a0\u2014 and suddenly land on a page that repeats your search phrase word for word and supposedly offers that very book for download. But instead of the book you were hoping for, you may be redirected to yet another sketchy site and treated to a malicious file.<\/p>\n

By the way, this scam can work even if you search for a made-up author and a made-up book. Such sites can automatically generate plausible download pages for just about any query.<\/p>\n

Book phishing<\/h2>\n

There are also phishing scams aimed squarely at book lovers. For example, one group of scammers sent out<\/a> fake emails to users in the name of the popular book community Goodreads, offering various bogus services: becoming a moderator, taking part in book events, or buying paid promotion. That\u2019s how the scammers squeezed money out of people while hiding behind a well-known brand.<\/p>\n

Here\u2019s another example: ads supposedly from Orell F\u00fcssli, a well-known Swiss bookstore chain, circulated<\/a> on social media. The ads offered books at hefty discounts. To place an order, users had to follow a link and enter their bank card details. Our regular readers have no doubt guessed that the link led to a fake site, which simply set up a paid subscription billed to the victim\u2019s card.<\/p>\n

Finally, scammers often create phishing sites that pose as pirate libraries. These libraries no longer cater only to fiction readers: people go there for textbooks, academic papers, studies, rare editions, and other material that\u2019s hard to find publicly available. Because such libraries get blocked regularly and have to keep changing domains, it can be hard for users to tell the real site from a fake one.<\/p>\n

Attackers take advantage of exactly this by promoting their own sites as official mirrors. These fake sites are often fully functional: you can search for and download books just like on the real thing, and the design is almost indistinguishable from the original. In 2024, for example, data on almost 10 million users of a phishing site mimicking Z-Library, a platform providing free downloads of access-restricted books and publications, was leaked<\/a> online.<\/p>\n

The leak included names, email addresses, countries of residence, password hashes, purchase details, and even crypto wallet addresses. With data this detailed, it\u2019s easy to plan the next attack: say, posing as a police officer<\/a> to accuse the person of visiting an illegal site and demand money to drop the criminal case.<\/p>\n

Can an e-reader get infected?<\/h2>\n

For attackers, e-readers aren\u2019t the juiciest target: it\u2019s hard to predict which device someone uses, or whether that person even has internet access. Besides, most e-readers are basic models\u00a0\u2014 essentially a flash drive with a screen.<\/p>\n

More advanced devices also exist, with internet access, browsers, and the ability to download third-party apps and use cloud storage. These are more likely targets, but let\u2019s be honest: most of the time, it\u2019s cybersecurity researchers who hack them, not criminals. For example, in 2025, researchers discovered<\/a> a vulnerability in the Kindle that could let an attacker hijack the linked Amazon account.<\/p>\n

Data leaks and other less obvious risks<\/h2>\n

Some e-readers let you highlight quotes, take notes on books you liked, and share both with other users. Attackers can use this data for doxing<\/a>, especially if a person wants to keep quiet about reading a particular book\u00a0\u2014 something like, say, Fifty Shades of Grey<\/em> or anything personal that isn\u2019t meant for the public.<\/p>\n

In 2020, a Guardian journalist requested a copy of her personal data from Amazon and received<\/a> more than 20\u00a0000 records about how she\u2019d used her e-reader. These included which books she read and when, how long she spent reading, which passages she highlighted or copied, and which words she looked up in the dictionary.<\/p>\n

So it\u2019s worth treating your reading history as personal data too. If a book service leaks data or your account gets hacked, a bad actor could learn not just your email address but far more personal details.<\/p>\n

So how do you read ebooks safely?<\/h2>\n

One of the simplest tips is to use official bookstores\u00a0\u2014 and not just for copyright reasons. These platforms value their reputation, and their content is vetted, so the files are more trustworthy.<\/p>\n

Another essential tip is to update all your devices regularly, even the basic e-reader: if it runs an operating system and any software, keep those updated. Timely updates close vulnerabilities that attackers could exploit, which lowers the risk of being hacked. The same goes for apps for reading and cataloging ebooks: this year, researchers found serious vulnerabilities in Calibre<\/a> and Koodo Reader<\/a>.<\/p>\n

Note that installing unofficial firmware on your devices, such as closed-ecosystem e-readers like Kindle, may not be the best idea. The risks include bricking the device and losing your warranty. The device may die or lock up during flashing or later, when an automatic over-the-air update installs official firmware. The manufacturer may also block your account if it detects the modified firmware when the device goes online. And, naturally, the firmware itself may carry malware, such as stealers that siphon off your personal data and passwords. The fact that there\u2019s no way to install an antivirus on your e-reader only exaggerates the potential problem.<\/p>\n

It\u2019s also a good idea to back up your digital library from time to time. Buying a book doesn\u2019t guarantee you\u2019ll keep access to it in your account forever. A title may become unavailable because of changes to licensing terms, platform policies, or other restrictions. Plus, some formats can only be bought and read inside the e-reader\u2019s closed ecosystem. So we recommend keeping a backup copy on your computer or another device, where you can get to it quickly offline. That way, you\u2019ll keep access to your content even if something goes wrong with the book service or your device.<\/p>\n

Every time you download an ebook, be sure to check the file extension. A regular ebook filename should definitely not end in .exe or .bat. You can read more about the most common extensions of malicious files here<\/a>.<\/p>\n

With scammers, sadly, getting better and better at disguising malware, perhaps the best all-around advice is this: don\u2019t visit dubious websites, and certainly don\u2019t download unknown files. This is where Kaspersky Premium<\/a>\u00a0comes in\u00a0\u2014 one of its main features is protection against phishing and malware. The application will warn you if you try to visit an untrustworthy site or download a potentially dangerous file. This keeps your data and money safe, and you can download and read your favorite books with peace of mind.<\/p>\n

Love the written word? Check out our other posts about books:<\/p>\n