Search/MalwareBytes

● Source

MalwareBytes

Connections

850 relationships

Fake PDF and search tools hijacked searches for 13.4 million Chrome users

Ads promoted browser extensions as tools to find manuals, convert PDFs, or make searches safer. But many of these extensions sent users’ search queries through servers controlled by their operators. Socket researcher John Tuckner identified 319 extensions with an estimated 13.4 million installs over a decade. The extensions hijacked users’ default search settings and routed their searches through servers controlled by the operators before sending them to Yahoo or Bing. This gave the operators access to users’ queries and let them earn referral payments. Socket says the extensions were promoted through ads on networks including Google Ads, promoting tools such as “manual finders,” “PDF converters,” “safe search,” and “AI search.” The extensions were listed in Google’s official store, but most were unlisted. That means people with a direct link could visit a listing and install an extension, while ordinary searches in the store would not show it. An ad offered help with an immediate task, a landing page encouraged installation, and the official store provided a familiar place to complete it. Search hijacking The main risk was that operators could see what users searched for. Searches can reveal health worries, financial problems, workplace interests, or other personal matters. Socket says queries were often associated with a unique identifier, which could let the operators link a user’s searches over time. The proxy could also choose where to send a search. Socket says this could potentially direct users to phishing or malware pages, but it did not find evidence that the extensions had done so. What should users do? If your searches start going astray, or you installed a search, PDF-converter, manual-finder, or security extension after clicking an ad, check what’s installed. Review your extensions. Enter chrome://extensions in Chrome’s address bar. Remove extensions you don’t recognize, no longer use, or don’t trust. To remove one, select Remove and confirm. If you’re unsure about an extension, check it against the list at the end of Socket’s blog . Check your search settings. In Chrome, at the top right, select More (the three-dot menu), then Settings > Search engine. If Chrome says an extension is controlling a setting, review or remove that extension. The absence of this notice doesn’t confirm that all your extensions are safe. Run a Malwarebytes scan to check for malicious extensions and other malware that could be affecting your device. From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by  downloading Malwarebytes today .

malwarebytes.comOct 30, 2026source

Photo ID, bank checks, face scan? The UK’s age-check options

As preparation for the UK’s planned social media ban, Ofcom has set out four ways social media platforms could check whether users are aged 16 or over. The government and Parliament will decide how the ban works in practice. Ofcom is the regulator for the communications services in the UK. The BBC reports that Ofcom identified four ways to check someone’s age that it considers “highly effective.” Here’s what those checks would involve: Photo ID matching : Comparing a live image of you with the photo on an identity document, such as your passport, and checking the age information on that document. Bank-based checks: Using age information your bank already holds about you, with your consent. Facial age estimation : Using technology to estimate your age from your face. Ofcom says this technology has improved recently. Digital ID services : Using a digital identity service to prove your age, rather than presenting a physical document. Let’s think through what those checks could mean. Challenges The challenge isn’t simply checking someone’s age. It’s doing so without turning everyday internet use into an identity check. Photo ID matching brings highly sensitive documents and facial images into the process, which raises questions about how that information is handled and protected. The risks aren’t hypothetical: as I reported last year , a breach at a third-party support provider for Discord exposed government ID images belonging to around 70,000 users. Banking-based checks can be more privacy-preserving if they return only confirmation that someone meets the age threshold, rather than exposing financial information. But the important questions are what information each party receives, what gets retained, and whether the check can be linked to someone’s activity. Facial age estimation can avoid uploading an identity document, but it still processes a sensitive image and makes an imperfect prediction. Ofcom acknowledges that some technologies can be wrong by a few years around age 16, so people near the threshold may face an additional verification check. I would expect these checks to stop some underage access but not eliminate it. Previous restrictions have been followed by workarounds, including increased VPN use , borrowed credentials, and migration to services outside the restrictions. The danger is treating a successful age gate as proof that children are now safe, when it might push them into less regulated spaces. The effectiveness depends on how the checks are implemented. A VPN may help someone avoid a check triggered by their apparent location; it won’t, by itself, bypass an identity or facial check that is still required. Similarly, Ofcom says matching a live image to an ID is intended to make it harder to borrow someone else’s document. We shouldn’t assume every workaround defeats every method. But Ofcom accepts that some motivated children will get through. The meaningful test is how much harm these measures prevent, weighed against the privacy risks and barriers they introduce— not whether every user has completed a check. My personal preference is double-blind verification: a provider confirms that you meet the age requirement without learning which service you’re accessing, while the service receives proof of age without learning your identity. Proving you’re old enough shouldn’t mean revealing who you are. Scammers don’t need to hack you. They just need you to click once.   Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

malwarebytes.comOct 30, 2026source

Binance hit by largest-ever crypto theft, with $6.3 billion stolen

malwarebytes.comOct 30, 2026source

Hackers steal and publish data on 41,000 Homeland Security workers

malwarebytes.comOct 30, 2026source

Malicious Firefox extensions impersonate popular crypto wallets

Socket’s threat researchers found three malicious Firefox extensions that impersonated the Phantom, Jupiter, and Bitget crypto wallets. Once installed, the malicious extensions stole recovery phrases and private keys, which would provide the attacker with full control of a wallet. A crypto wallet is an app, browser extension, or physical device that lets you manage cryptocurrency such as Bitcoin. Despite its name, it doesn’t actually hold your coins. Those are recorded on a blockchain , a shared digital record of transactions. Instead, the wallet manages the secret digital keys that let you access and spend them. When you create a wallet, you may be given a recovery phrase: a list of words you can use to restore access. Write it down and store it offline. It’s a backup of your keys, not just an ordinary password. Anyone who gets hold of it can take control of your funds, which is why fake wallet extensions try to steal it. Cybercriminals listed three fake wallet extensions on Firefox Add-ons, impersonating Phantom, Jupiter, and Bitget. The genuine wallets offer extensions for other browsers: Jupiter lists Chrome, Brave, and Edge; Bitget’s extension is for Chrome; and Phantom says its Firefox extension is no longer supported . The malicious extensions looked for 12-, 15-, 18-, and 24-word recovery phrases, as well as Ethereum and Solana private keys. They could read input fields, detect pasted text, and scan screens displaying recovery phrases. A recovery phrase or private key is a bearer secret: whoever holds it controls the wallet and can move its assets. The Phantom variant’s backend logged captured secrets, sent them to a Telegram bot , and automatically moved funds to hardcoded payout addresses. Those addresses covered Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana, and Bitcoin. The Phantom variant could read a phrase both when it was typed during import and when it was displayed on a reveal screen. How to stay safe Socket says all three listings were live on Firefox Add-ons during its analysis and have since been removed. But if you find one of these extensions in your Firefox browser, you should: Remove the extension. Use the three-dot menu next to it and choose Remove . If you ever entered a phrase or key, create a new wallet on a clean device and move your assets immediately. Treat the old wallet as compromised. In the future, install wallets only from the vendor’s official website link, not from store search results. The fake Phantom listing asked to access data on all websites and had no privacy policy. These are warning signs to look out for. Use an up-to-date, real-time anti-malware solution that blocks malicious websites. Malwarebytes blocks bonto.io subdomains Never enter your recovery phrase on a website. Enter it only in the official wallet app when restoring. Wallet support will never ask for it. IOCs The malicious extensions: Phantom impersonator: add-on ID 3092199 Jupiter impersonator: add-on ID 3092666 Bitget impersonator: add-on ID 3092059 Subdomains: bonto[.]io phantom[.]bonto[.]io jupiter[.]bonto[.]io bitget[.]bonto[.]io coinbase[.]bonto[.]io exodus[.]bonto[.]io IP addresses: 104.21.34[.]69 172.67.155[.]198 From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by  downloading Malwarebytes today .

malwarebytes.comOct 29, 2026source

Have an older iPhone or iPad? Apple has a security update for you

malwarebytes.comOct 29, 2026source

Banks are blocking AI agents from customer accounts

This week, Axios reported that major US banks were detecting third-party AI agents operating inside customer accounts. In many cases, customers have given the agents their usernames and passwords so they could act on their behalf. This kind of access can violate a bank’s rules. Bianco Research president Jim Bianco raised the question during Unchained’s Bits + Bips livestream on October 26: “Are you protecting me, or are you protecting your own profits?” Bianco described traditional finance’s business model as “based on laziness.” Customers may leave idle cash in low- or no-interest bank accounts rather than move it into a money market fund. An AI agent could make that move for them. “Now that you’re able to do it, the banks are afraid they’re gonna lose that revenue stream,” he said. The banks offer a different explanation. JPMorgan Chase CEO Jamie Dimon said the bank wouldn’t allow just any outside agent into its systems because doing so was “too risky for clients and for JPMorgan.” Both explanations can be true: banks can want to retain deposits while also facing real security problems when software acts through customers’ accounts. Handing over your banking login introduces another service into the security chain. A vulnerability in that service could expose your credentials or allow your account to be misused. And as Bank of America reportedly pointed out:  “If you do share your credentials, keep in mind that you’re responsible for activity resulting from that access.” That’s the bank’s stated position, not a universal ruling on consumers’ legal rights. Still, it’s a warning worth taking seriously. Pros and cons An AI agent with permission to make purchases might find and buy an item at a lower price. But giving an agent access to your bank account also means sharing sensitive banking information with a third party. We’ve seen shared AI chats become searchable online too. Axios reported that many banks allow, or are moving toward allowing, read-only access. This can let a tool analyze transactions without giving it permission to move money. That’s an important boundary, but it doesn’t make the information harmless. An agent that can read bank statements may still disclose them if it’s compromised or manipulated. Preventing transactions and protecting confidentiality are separate security goals. How to keep control of your money For consumers, the practical question is not whether banks have perfectly selfless motives. It’s what access you’re giving away, and what could happen if the agent makes a mistake. Don’t paste banking passwords or security codes into a general-purpose AI assistant. Major banks have explicitly warned customers against sharing their credentials. Use your bank’s approved connection methods rather than giving an agent your login. Where supported, choose read-only access if all you need is analysis or budgeting help. Give agents access to as little sensitive information as possible. An assistant comparing publicly advertised savings rates doesn’t need your bank statements. OpenAI recommends limiting agents to the data and credentials they need for the task. Review consequential actions yourself. If an agent asks for confirmation, check exactly what it intends to do and what information it will share. Don’t treat a confirmation prompt as a formality. AI can make it easier to compare financial products and spot opportunities you might otherwise miss. But an assistant that finds a better rate and an agent that can act inside your account are different propositions. Let it help with the homework, but be cautious about handing it the keys. Let’s face it, an incognito window can only do so much.     Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection  monitors for all of it, alerts you fast, and comes with identity theft insurance. 

malwarebytes.comOct 28, 2026source

Chrome and Firefox updates fix serious security flaws. Install them now

On October 27, Google issued a new Stable channel update for Chrome. Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions  156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux . The update includes 52 security fixes, including four rated Critical. On the same day, Mozilla issued Security Advisory 2026-118 , which fixes 167 vulnerabilities. Firefox 159 also introduces several new features. Both updates will roll out over the coming days and weeks. How to update Chrome The easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update. If you don’t want to wait for the rollout to reach you, manually updating is easy. Open  About Google Chrome  from Chrome’s settings or Help menu. Chrome will check for updates. If one is available, click  Relaunch  to apply it. Chrome version 156.0.8078.74 is up to date You can find an explanation of the version numbering system and step-by-step instructions in our guide:  How to update Chrome on every operating system . How to update Firefox To update Firefox, open the browser and click the menu button at the right side of the Firefox toolbar, then go to Help and select About Firefox . The About Mozilla Firefox window will open. Firefox will automatically check for updates. If one is available, it will be downloaded. Once done, you’ll be prompted to click Relaunch . After Firefox restarts, it will be up to date. After the update, the version should be 159.0 or later Technical details These Chrome and Firefox updates address a familiar problem: browser code mishandling memory while processing web content. Both releases fix use-after-free vulnerabilities, including flaws in page layout, JavaScript processing, and SVG graphics. A use-after-free vulnerability occurs when a program attempts to access a memory location after it has been freed. That can cause crashes or, in some cases, allow an attacker to run their own code. There’s another connection between these updates: both Google and Mozilla credit OpenAI Codex Security with finding bugs fixed in these releases. AI can help security teams examine browser code for weaknesses, alongside human code reviews and automated tests that check how software handles unexpected inputs. Mozilla’s collaboration with Anthropic shows how AI-discovered findings can lead to fixes: researchers validated vulnerabilities before reporting them, giving Mozilla’s team reproducible bugs to investigate, repair, and deliver to users. Browse like no one’s watching.   Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal.  Try it free →  

malwarebytes.comOct 28, 2026source

Five election scams to watch out for

Elections give scammers plenty to work with: urgent deadlines, familiar faces, passionate supporters, and messages asking people to take action. Some want you to “fix” your voter registration. Others want a donation, an answer to a survey, or payment for merchandise supposedly endorsed by your favorite politician. The details change, but the objective stays the same: get your money, your personal information , or both. Here are five election-themed scams to watch out for. Scam 1. “We’ll help you vote” Not every election-themed lure starts with a threat. Some offer to make voting easier. “Get your ballot on autopilot,” reads one text message we reviewed. It encourages recipients to join a permanent absentee list so their ballots arrive at home for every election, adding the reassuring words: “Verified. Tracked. Counted.” A voting-assistance text message reviewed by Scam Guard The message is a scam, though it borrows the language of a real Minnesota voting service. Minnesota does have a permanent absentee voter list, but the link in this text is fraudulent. To check or sign up, go directly to your election authority’s official website. Other messages take the opposite approach: instead of offering convenience, they warn that you could lose your chance to vote. A message might say you are not registered to vote, your details are incomplete, or your registration is about to be cancelled. Then it offers a link to sort everything out. The FBI recently warned about messages that send recipients to fraudulent voter-registration pages. Instead of helping people vote, these sites collect personal information that criminals can use for further fraud. In Brazil, scammers used a fake WhatsApp account with the Superior Electoral Court’s logo. It claimed to be the court’s “Customer Service Department” (which doesn’t exist) and told people to download an app called “Soluciona Pendência,” roughly translated as “Resolve an outstanding issue.” The message falsely warned that people could lose access to banking or government services. Scam 2. “Donate now to help your candidate win” A fundraising appeal arrives just as an election reaches a critical moment. It uses the candidate’s photograph, familiar campaign language, and an urgent request for money. That does not necessarily mean the campaign sent it. The FBI warns that scammers impersonate candidates and political fundraising organizations to collect supposed campaign contributions. Victims believe they are supporting a legitimate organization, but the money goes to criminals instead. Before donating, find the campaign or organization’s official website yourself and check who will receive the payment. Don’t let a countdown, a matching-donation claim, or a message about an impending defeat rush your decision. The Better Business Bureau (BBB) advises researching political fundraising requests and resisting pressure to act immediately. Scam 3. “Take our political survey and claim your reward” Not every political poll is suspicious. But a request for your opinion can also be an opening for a scam. The BBB warns about fraudulent polling calls that promise a prize in exchange for answering questions. After the “survey,” the caller asks for credit card information to cover shipping, taxes, or other costs associated with the supposed reward. At that point, the questions about candidates have served their purpose: keeping you engaged long enough to introduce a payment request. Other election-themed messages ask people to complete surveys through links. Treat those links with the same caution you would an unexpected donation or registration request. A familiar political organization’s name does not establish who operates the website. You can decline an unsolicited poll. You should not need to hand over payment details simply to share your political views or claim a surprise reward. Unsure where a link goes? We’ll check it. Check now Scam 4. “Pay this electoral fine” or “Report for election duty” Few things make a message feel urgent quite like an official-looking demand backed by a possible penalty. Brazil’s Superior Electoral Court (TSE) has warned about messages falsely claiming people had an unresolved voting issue. The messages link to fake government websites designed to steal personal information or trick people into paying. Brazil does have legitimate electoral fines, which can be paid through official channels, including Pix. So a fine or Pix request alone doesn’t prove a message is a scam. If a message says you owe money or must perform election duty, check with the relevant authority using contact details from its official website. Don’t use the message’s phone number, link, or QR code . Scam 5. Your favorite politician “wants you to buy this” A politician’s name can be used to sell more than a political message. Criminals use candidates’ names, photographs, logos, and slogans to advertise merchandise that never arrives. What looks like a way to support a candidate becomes an ordinary shopping scam wrapped in campaign branding. Apply the same skepticism to a “commemorative,” “patriotic,” or supposedly collectible product advertised using a politician’s name. Before buying, ask: Is the seller actually affiliated with the politician or campaign? What, exactly, are you buying? Is there evidence for claims about the product’s quality, usefulness, or future value? What are the total price, refund terms, and any recurring charges? A product does not become useful, valuable, or a sound investment because an ad places it beside a politician’s photograph. Nor does a photograph prove that the politician endorsed it. There is also a difference between a product you consider poor value and a fraudulent offer. A product being poor value doesn’t automatically make it a scam. Look for clear deception: a fake endorsement, false claims, hidden fees, or an order that never arrives. How to stay safe from election scams You don’t need to work out every detail of a suspicious message before deciding whether to act on it. Verify the message through a route the sender does not control. Go directly to official election websites to check registration, voting requirements, deadlines, and alleged penalties. Verify donation requests independently. Find the campaign or organization yourself and confirm where your money will go. Keep payment details out of unsolicited surveys. A political poll that turns into a request to pay for a prize is a red flag. Check sellers before buying political merchandise. A candidate’s name or logo does not authenticate the shop. Don’t mistake personal details for proof. A message can contain accurate information about you and still be a scam. Keep political choices separate from requests for money or personal information. You can support a cause without responding to an unexpected message. Use real-time web protection to help block known malicious websites. Malwarebytes blocks integmn.com Pro tip: Unsure whether a message is a scam? Check it with Malwarebytes’ Scam Guard for an assessment and advice on what to do next. Something feel off? Check it before you click.    Malwarebytes Scam Guard  helps you analyze suspicious links, texts, and screenshots instantly.   Available with  Malwarebytes Premium Security  for all your devices, and in the  Malwarebytes app for iOS and Android .   Try it free →  

malwarebytes.comOct 27, 2026source

Artificial Intimacy: Love and lies in the age of AI

AI is becoming a third wheel in relationships, increasingly playing a role in the most intimate parts of our lives.   It shows up in the flirty first text, the polished dating profile, the therapized language we use with a partner after a fight, the strength we gather after heartbreak, and everywhere in between. For some, AI is a source of companionship itself. And even if you’re not personally an AI user, you may still be dating, loving, arguing with, or trusting someone who is.  As AI moves deeper into our relationships, it’s reshaping connection, blurring what feels authentic, and creating new ways for intimacy to be exploited.  AI is starting to replace human interaction   AI is moving into emotional territory once reserved for other people. For some, it’s no longer just a tool, but a source of support, companionship, and even romantic connection.  According to our recent research, about one in six have turned to a chatbot for companionship or emotional support. That climbs to about one in five among Gen Z and Millennials, and nearly one in four among regular AI users (those who use AI daily or multiple times a week). The more time people spend with AI, the more likely they are to humanize its role, making room for it as a friend, confidant, advisor, or even partner.    As AI takes on more intimate roles, it’s also starting to challenge the boundaries of real human relationships. More than one in three (37%) say having a romantic relationship with an AI chatbot while already in a committed relationship isn’t the same as cheating. That view is more common among men (46% versus 30% of women), Gen Z and Millennials (43% and 45%), and regular AI users (48%).  Whether the relationship is platonic or romantic, the more AI is treated like a human, the more personal the stakes become. Just like you have to be cautious when telling a human your deepest, darkest secrets, the experience is similar when using AI. Nearly two-thirds (65%) worry that private conversations they’ve had with AI could be exposed.   One survey respondent said: “I have used a chatbot…for emotional support, and it is worrying to think those conversations could be leaked.” The technology may be artificial, but the relationships people form with AI can feel very real. And as with any relationship, that means there are boundaries to work out, privacy to protect, and vulnerabilities to manage.  AI is creating new ways to weaponize intimacy   AI’s growing role in human intimacy also has a darker side. The same technology that can offer comfort, advice, or companionship can also be used to violate the most intimate parts of our lives.  Non-consensual image abuse, sextortion, and other forms of sexual abuse have long been part of the internet’s dark side. Generative AI has made that content easier to create. Someone trying to exploit another person no longer needs an actual intimate photo, video, or private exchange. A regular photo—or even just someone’s likeness—can be transformed into sexual content they never made, never shared, and never consented to.  Most people draw a clear line against that, but not everyone does. About one in six people say it’s acceptable to generate explicit images of someone without their permission for personal use. Another 14% are neutral, bringing the share who do not explicitly oppose the behavior to nearly one in three (31%).   Views differ sharply by age and sex:  Younger adults are more accepting of someone using AI to generate non-consensual content: nearly one in four Gen Z (24%) and Millennials (23%) say it’s okay, compared with 13% of Gen X and just 5% of Boomers+  Men are also more permissive: more than one in five (22%) say it’s okay, compared with 14% of women  Attitudes toward the behavior may vary, but the fear of becoming a target is far more widespread. Overall, nearly two-thirds of people (62%) worry someone could create fake nude or sexually explicit photos or videos of them. Women feel this threat more acutely: nearly seven in ten (69%) are concerned, compared with 57% of men.  For some, this fear has already become a reality:   One in ten say AI has been used to generate nude or sexually explicit imagery of them without permission  One in ten say someone has threatened to release AI-generated compromising or explicit imagery of them  As one respondent recounted:  “I had someone make fake nudes of me using AI on my photos from my social media and threaten to post them on Facebook…[it] made me more cautious about AI.” The intimate material may be fake, but the fear, coercion, and potential for reputational, emotional, and financial damage are completely real.  AI is making it harder to know who you’re really talking to    The threat doesn’t stop with fabricated sexual content. AI is also making it harder to know whether the person on the other side of a screen is who they claim to be.  Humans have always edited themselves for other people. We choose the most flattering photo, write and rewrite the text before sending it, and present our most interesting selves—especially when forming new relationships. AI dramatically expands what that kind of self-editing can look like, and people aren’t shy about using it:  54% say AI helps them present the best version of themselves   47% say using AI to present your “best self” to employers, friends, or romantic partners does not present a false identity  That rises to 58% of both Gen Z and Millennials and 64% of regular AI users  But where does enhancement end and deception begin? Is an AI-polished dating profile still authentically you? What about a message you didn’t write? A photo that looks like you, only better?  There’s a flipside to using AI to make ourselves look or sound better: If we can do it, so can everyone else. And people are much less comfortable when they’re not the ones controlling the technology. Two-thirds (67%) worry that an online friend or romantic interest could use AI-generated images, videos, or other content to deceive them.   Catfishing , fake photos, and lies on dating profiles aren’t new. AI just makes the deception easier. Someone’s photos, backstory, messages, and even their voice can all be faked.   One person described leaving dating apps after realizing the person they were talking to had gone well beyond simply polishing their profile:  “[The] dating profile had fake pictures…[it] wasn’t just making true events sound interesting and more flirty, but creating completely false photos and information. Left the dating apps again and needed to reset.” AI can distort identity in the other direction, too. It can also create a version of us we never chose to put into the world.   76% worry about someone creating a fake profile pretending to be them  70% worry about fake images or videos of themselves being created  71% worry AI-generated content could be used to damage their reputation  Relationships are built on mutual trust. AI can distort both sides of the connection: who we think the other person is, and who they think we are.     AI is quietly finding its way into the space between people    Not all of AI’s influence on intimacy is so dramatic. Much of it happens quietly, showing up in how people communicate with each other and navigate relationships:  More than one in three have used AI to help write or edit a message  About one in seven have turned to it for advice about a relationship or personal decision  One in ten say it has already changed how they date or communicate romantically—rising to nearly one in five among Gen Z  The survey responses show what this looks like in real life. For example, one respondent described using AI with their partner as a way to step outside their own point of view:  “Personally, it has helped me. We use AI in our relationship as a reflection tool, and it has sometimes helped us take on the perspective of the other.” For another, AI helped them work through jealousy:   “So, I used to accuse my partner, and I got really territorial about them but once I talked to AI about it, they gave helpful advice and now we are stronger than ever.” AI is also showing up in other difficult relationship moments. One person said it helped them “stay calm and communicate” when problems came up with their partner; another said it allows them “to pause and refine [their] thoughts” before responding.  Sometimes the role is simpler. One respondent said AI gives them “new romantic words” for their partner, while another said they’ve asked AI for advice on how to make their partner smile. AI’s growing role in relationships may be unsettling, but the benefits people describe are definitely there.  AI isn’t just helping people find the right words. It’s also helping them decide what version of themselves to put forward in the first place. More than one in three say it’s okay to use AI to create or improve a dating profile; nearly two-thirds aren’t opposed. One respondent described using AI as a “creative advisor” to polish their profile and come up with conversation starters.  AI doesn’t have to replace a relationship to help shape it. It can influence how people communicate, what advice they take, and how they choose to present themselves.   AI’s intimacy problem is ultimately a trust problem   From connection to deception to outright harm, the same question keeps surfacing: Can I trust what’s in front of me? And would I know if I couldn’t?  Nearly nine in ten people (88%) say AI is making it harder to tell what online content is genuinely human or real. And 84% say even convincing video evidence no longer necessarily feels like proof. That uncertainty follows people into dating and relationships, where knowing what—and who—to trust is deeply personal.  AI may make it easier to start a conversation, smooth over a hard one, or feel connected when you’re lonely. But relationships and intimacy of all kinds still come down to trust, and AI is making that trust a little harder to take at face value.  About the research   The research in this article is based on a March 2026 survey about AI, identity, and the collapse of digital trust and was conducted among 1,500 respondents in the United States, United Kingdom, Germany, Austria, and Switzerland. The research was prepared by an independent research consultant and distributed via Forsta.  Something feel off? Check it before you click.    Malwarebytes Scam Guard  helps you analyze suspicious links, texts, and screenshots instantly.   Available with  Malwarebytes Premium Security  for all your devices, and in the  Malwarebytes app for iOS and Android .   Try it free →  

malwarebytes.comOct 27, 2026source

The web’s having a rough week. Here’s how to browse safely

You recognize the website. You’ve visited it before. You may even have it bookmarked. Then it asks you to do something unusual: install an update, allow notifications, or run a command to prove you’re human. Stop and check first. A website you trust can still display instructions you shouldn’t follow. Our researchers have documented attacks in which criminals hacked legitimate websites and used them to deliver fake verification pages that trick visitors into installing malware. Within the same week, serious problems emerged in several parts of the web’s security infrastructure. Attackers were exploiting two flaws in PHP , researchers disclosed a critical flaw in Brotli software used by Node.js, and eight compromised security certificates raised concerns about how browsers and apps verify websites. The incidents have different causes and levels of risk, but their timing makes this an unusual cluster. PHP is used by about 7 in 10 websites whose underlying programming language is known. Node.js is used by 7.4% of websites with an identified web-server technology, according to W3Techs . Both run websites behind the scenes, so flaws in them can put the sites that rely on them at risk. Most browsers have blocked the certificates, though updates may still be needed for other software and devices. These problems don’t mean you need to stop browsing. But keep your software and security protection up to date, and be wary of unexpected requests. How to stay safe when browsing Check the website’s address, but remember that even the genuine site may have been compromised. The important question is whether the page’s instructions make sense. A familiar website may earn your visit, but that doesn’t mean you should automatically let it run software on your device. In documented campaigns, malicious instructions appeared on legitimate, hacked WordPress websites, not just lookalike domains . Safer. Cleaner. Ad-free browsing. INSTALL BROWSER GUARD A secure connection doesn’t guarantee that a page is safe, either. HTTPS protects the connection between your browser and the site. Browser protections against dangerous content are a separate layer. A page asking you to install software or enter sensitive information still deserves scrutiny, even when the connection is encrypted. Ask yourself: “Does this request make sense for what I came here to do?” Reading an article shouldn’t require opening PowerShell. Watching a video shouldn’t require following a website’s instructions to “repair” your computer. These are familiar themes in ClickFix attacks , which disguise malicious commands as routine verification or troubleshooting steps. You can’t patch someone else’s web server, but you can keep the software on your own device updated. Turn on automatic updates for your operating system, browser, and applications where available, and don’t repeatedly postpone installing them. Updates fix security flaws that criminals could otherwise use to access your files or accounts. Keep your browser’s phishing and malware protection enabled, too. Free browser extensions like Malwarebytes Browser Guard warn about known dangerous websites, malicious downloads, and clipboard hijacking. Treat those warnings as a reason to leave, not as another obstacle to get round. These checks are a useful layer of protection, but they can’t certify that every unflagged page is safe. Use strong, unique passwords stored in a password manager , and enable multifactor authentication on important accounts. These measures help protect your accounts from unauthorized access. If a request involves running code or making changes to your device, verify it independently. If a website claims your browser needs updating, close the prompt and check through the browser’s own settings. If it says an account or service needs attention, check through the official app, help page, or support channel that you open yourself. Criminals often present the harmful step as the thing that will let you do what you came to do: fix the connection, enable the player, or complete the security check. The frustration of being blocked can make it tempting to follow their instructions. Use up-to-date, real-time anti-malware protection on your devices to help stop malware from wreaking havoc or stealing your information. Watch for unexpected content, downloads, redirects, and repeated login requests, even on familiar sites. If something looks wrong, leave the page. If you’re unsure, use Malwarebytes Scam Guard to check whether a request may be a scam and get possible next steps. From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by  downloading Malwarebytes today .

malwarebytes.comOct 27, 2026source

Samsung TVs without mics may listen through soundbars, researcher says

A reverse engineer claims that their Samsung smart TV has been collecting audio without their consent. The researcher, who calls themselves “log4j,” said in an X thread that their 2025 Samsung TV was delivering ads that seemed suspiciously relevant to them. Investigating, they claim to have found a package called “always on voice,” which uses the TV’s built-in microphone to collect sounds from the room. The software logged events such as dogs barking and babies crying, log4j said, adding that these events are counted and reported back to Samsung. Samsung advertises similar features on some of its AI-enabled TVs. The company says its Pet Care and Family Care features use on-device AI to detect a dog barking or a baby crying and alert users. This doesn’t confirm log4j’s claims about the package or the data it reports. However, log4j says that on TVs without microphones, the software searches for connected devices such as soundbars or Bluetooth microphones and uses those to listen instead. The TV was also collecting geolocation data and mapping local networks, they said, adding that it ran a service on the TV that analyzes traffic on the local network. log4j also says that the system uses a neural network tailored to a particular region to analyze your viewing habits. A neural network is a type of machine-learning model. log4j said : “…in youtube it’s looking for videos you watch, ads you skip, progress in a video, etc.” The tracking that’s on the record While log4j’s claims haven’t been independently verified, Samsung has used automatic content recognition (ACR), a system that identifies what’s on screen. Earlier this year, Texas Attorney General Ken Paxton settled with Samsung, getting the company to agree that it would get Texans’ express consent before collecting or processing ACR viewing data. A class action complaint filed in New York in January also accused Samsung of using ACR to record video and audio passing through the TV. The complaint accused Samsung of using machine-learning algorithms to analyze and link this data back to consumers. This includes information displayed when the TV is used as a computer monitor, it said, adding that the information can be linked to different people using the TV. The case was voluntarily dismissed in July. The New York complaint added: “Samsung exploits this Sensitive Information by (a) selling targeted advertisements to its corporate advertising clients, and (b) providing it to third-party advertising companies such as Google and X (f/k/a Twitter) for targeted advertising.” A separate class action complaint filed in California this month accuses Samsung Electronics America of not being transparent about its ACR data collection. This isn’t the first time that Samsung has been criticized for allegedly picking up in-room audio. In 2015, privacy group EPIC filed a complaint with the FTC, accusing Samsung of recording conversations and relaying them elsewhere. The nonprofit said at the time: “Everything a user says in front of the Samsung SmartTV is recorded and transmitted over the internet to a third party regardless of whether it is related to the provision of the service.” EPIC identified text-to-speech company Nuance as the third party. What you can do We can’t confirm all of log4j’s allegations, and Samsung doesn’t appear to have commented. But there have been multiple complaints about the data smart TVs collect. You can turn off features such as ACR, internet-based advertising, and voice recognition where possible. log4j has also raised concerns about whether monitoring services are truly off. They said : “ACR off via your preferences menu on samsung TVs should not be assumed to actually disable ACR telemetry. i’ve found several instances where the checks (whether deliberate or not) are either incorrectly implemented or not checked at all.” log4j says disconnecting your TV from Wi-Fi is the best option for immediate peace of mind, though that also means losing internet-based TV features. They also suggest using an Apple TV or a modifiable Android TV box with open-source software. What do cybercriminals know about you? Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online. SCAN NOW

malwarebytes.comOct 27, 2026source

Popcorn Time’s forgotten updater left millions of devices exposed to hijacking

You may have forgotten about Popcorn Time. Unfortunately, its updater didn’t forget about your device. Security researchers have intervened to disable an abandoned update mechanism in Time4Popcorn, a version of the once-popular streaming app. If left running in the background, the updater could have allowed attackers to take control of Windows and Mac computers, even if their owners hadn’t opened the app in years. Eye Security estimates that the vulnerable updater was present on millions of devices worldwide, including 2.5–3 million Windows computers and around 250,000–350,000 Macs. Popcorn Time made watching movies and TV shows through BitTorrent look more like browsing Netflix. Rather than making users find torrent files and open them in a separate client, it wrapped the process in a familiar streaming-style interface. Amid concerns about copyright infringement and its possible consequences, the original developers abandoned it shortly after its launch in 2014. But because its source code was publicly available, other developers could pick it up and create their own versions, known as forks. One of those was Time4Popcorn, which was also distributed under the name “Popcorn Time.” That shared branding matters because people may have installed the affected software without ever seeing the Time4Popcorn name. The problem at hand Time4Popcorn was eventually abandoned too. But its update infrastructure was left behind, and at some point the domains associated with the software became available for others to register. In other words, the people maintaining the software had gone away. The software’s ability to accept instructions had not. Time4Popcorn’s updater used unencrypted HTTP connections and accepted executable updates without checking digital signatures to verify their authenticity. So, someone who controlled an update domain or was able to tamper with the unencrypted traffic could supply their own program instead. That combination created a remote code execution vulnerability, tracked as CVE-2026-30612 , which could let an attacker run malicious software on a device. An attacker wouldn’t need to persuade someone to watch a movie or click a suspicious attachment. The forgotten updater could do the work for them. Although Android was affected too, users had an extra layer of protection. Its updater checked for updates when the application was opened, but installing an attacker-supplied APK required the user to approve the installation. It was not the same silent, background takeover route researchers found on Windows and macOS. What the researchers did Eye Security registered an abandoned update domain and used the vulnerable mechanism to distribute an update that disabled the updater itself. On Windows, it stopped and disabled the service; on macOS, it prevented the update process from starting. The researchers say their intervention did not delete users’ files or collect host data. By March 2026, Eye Security reported more than two million downloads of its updater-disabling fix, and update requests to its domains had fallen by 98%. Later that month, it transferred the 15 domains it controlled to the nonprofit Shadowserver Foundation . Researchers could not remotely disable the Android updater in the same way. And the desktop application still contained other weaknesses, including an obsolete Chrome engine dating from 2014 and disabled sandbox protections, which normally help contain malicious code. What users should do If you used Popcorn Time years ago, check the devices on which you installed it. Don’t assume that no longer using an application means its background components have stopped running. Check your list of installed applications for Popcorn Time or Time4Popcorn. Pay particular attention to older Windows PCs, Macs, and Android devices where you may have forgotten about installing it. The affected fork was distributed under both names. Remove the old application. There is no vendor security update for the abandoned Time4Popcorn software. Disabling the updater addresses one vulnerability, not the application’s other security weaknesses. On Windows and macOS, check that the background updater is no longer running. Eye Security identifies the Windows component as Updater.exe , normally inside a Popcorn Time folder under Program Files or Program Files (x86), running through a service called Update Service. On macOS, the component is /Library/PrivilegedHelperTools/PT.updd , with a launch daemon at /Library/LaunchDaemons/PT.updd.plist . Its advisory provides instructions for disabling these components if needed. On Android, uninstall the affected app rather than accepting an update prompt from it. The updater is part of the main application and cannot easily be disabled separately. Use an up-to-date, real-time anti-malware solution to detect and block any attempts to install malware on your devices. As we saw recently , cybercriminals can use software updates to distribute malware. Remove abandoned apps and check for any background updaters they leave behind. From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by  downloading Malwarebytes today .

malwarebytes.comOct 26, 2026source

AI Halloween videos: Who’s getting your photos?

malwarebytes.comOct 26, 2026source

Patient records exposed in Quest breach: What you need to know

Quest Diagnostics has confirmed that an unauthorized party accessed a system healthcare providers use to order laboratory tests and view results, affecting personal information and patient records. Quest is a major US laboratory testing company whose services help healthcare professionals diagnose and monitor medical conditions. Those services range from routine laboratory testing to specialized testing in areas such as cancer, infectious diseases, and neurology. What happened and what was stolen? The company learned of unauthorized access to its Quanum Lab Services Manager, or LSM, on October 21. The compromised platform lets healthcare professionals order tests, access results, review historical trends, and order supplies. Quest paused access to the platform and began investigating. Quest says its core business operations remain up and running. An investigation is ongoing. Quest has not yet published a count of affected patients or a complete list of the information accessed. It says it will notify affected patients, healthcare providers, and health plans. The company said: “personal information and patient records were affected.” It confirms that health information and personally identifiable information were involved, but has not specified whether these included Social Security numbers, insurance identifiers, payment information, particular test results, or account passwords. What patients can do now Quest says it will send notification letters to affected patients once its investigation is complete. Those letters will describe available resources, including credit and identity monitoring. If you receive one, read it carefully and follow the instructions. You can also check the FAQs posted in Quest’s breach notice for updates. Someone’s watching your accounts. Make sure it’s us. PROTECT YOUR IDENTITY A breach does not automatically mean someone has misused your information, but you can take these precautions while you wait for more details: Verify unexpected messages independently. Don’t let a message about the breach rush you into clicking a link, sharing sensitive information, or making a payment. Go to Quest’s official website yourself or use contact details you already trust. Review medical bills and insurance statements. Look for appointments, tests, prescriptions, or services you did not receive. The Federal Trade Commission (FTC) identifies unfamiliar medical bills and unexpected items on an Explanation of Benefits statement, which explains how your insurer processed a claim, as warning signs of medical identity theft. Report discrepancies to your healthcare provider and your insurer. Review your credit reports. Look for unfamiliar accounts or debts and dispute errors. Free reports are available through AnnualCreditReport.com . Act if you find signs of identity theft. Visit IdentityTheft.gov for a recovery plan. If someone has received care in your name, ask the providers involved for copies of your medical records and request corrections in writing. Medical identity theft is not just a financial problem; it can also affect your care. Someone using your identity to obtain treatment or submit insurance claims could introduce incorrect information into your health records. Checking medical statements and reporting anything unfamiliar can help you catch that misuse. Let’s face it, an incognito window can only do so much.     Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection  monitors for all of it, alerts you fast, and comes with identity theft insurance. 

malwarebytes.comOct 26, 2026source

A week in security (October 19 – October 25)

Last week on Malwarebytes Labs: Resident Evil maker Capcom warns of phishing after 11.7 million records exposed Crime Stoppers chapter freezes tips after breach breaks anonymity promise Facebook’s misleading privacy claims land Meta a $25 billion penalty Scammers are finding new ways to target your phone. Here are 5 ways to protect yourself Woman faces years in prison over a Cash App account she says she never opened Delivery bots accused of illegally scanning customers WhatsApp’s chatbot was given hidden instructions to not mention privacy regulators PHP2Shell: Why many websites had to go offline Fake Amazon Music x YouTube deal lures creators into a Google login trap Signal bug could let someone keep listening after you hang up Google may add your number to all your accounts: How to stop it Meta glasses caught recording conversations without wake phrase Man seeking love travels 2,000 km to meet an AI-generated woman AOMEI Backupper update servers hijacked to push malware: Check your PC A sextortion conspiracy killed his son (Lock and Code S07E21) Millions of California students’ sensitive data stolen in breach Stay safe! What do cybercriminals know about you? Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online. SCAN NOW

malwarebytes.comOct 26, 2026source

Resident Evil maker Capcom warns of phishing after 11.7 million records exposed

malwarebytes.comOct 23, 2026source

Crime Stoppers chapter freezes tips after breach breaks anonymity promise

A breach exposed personal information in supposedly anonymous crime reports. Now one Crime Stoppers chapter has stopped accepting tips because it cannot guarantee anonymity. Toronto Crime Stoppers, which works with the community, police, and media to help solve crimes, has paused phone, website, and app submissions while it seeks a safer system. The breach occurred in March and involved P3 Global Intel, the Texas-based tip-management platform owned by Navigate360. Its software is used by Crime Stoppers programs and other organizations in the US and elsewhere. An October CBC investigation revealed the Canadian impact: More than 1.5 million tips spanning 25 years were exposed, with over 850,000 containing personal information. That included addresses, phone numbers, email addresses, and some banking details associated with rewards. The exposed details belonged to tipsters, people named in allegations, and others, including police and Crime Stoppers staff. Following CBC’s reporting, Toronto Crime Stoppers acknowledged that its promise of anonymity had been broken for some users. The organization stopped accepting tips, saying it could no longer guarantee users’ anonymity. In an October 21 statement , the organization says identifying details are normally removed before tips reach investigators, but some original submissions containing potentially identifying information were stolen from P3. For affected tipsters, exposure could create a risk of retaliation, intimidation, or extortion. Scammers could also use details of a genuine tip to make an approach more convincing. Unfortunately, the pause removes a reporting option for people afraid to approach police. Toronto police still accept reports directly, but warn that those channels are not anonymous. How to stay safe Toronto Crime Stoppers warned people worried about exposure to watch for impersonators. It says it will never contact them first to request a tip number, password, or other information. The statement did not describe an individual notification process or offer a way to check whether a particular tip was affected. For anyone wanting to submit a new tip, the organization’s message was clear: “Until we have a safer way to protect you, please do not send us tips by phone, online, or through the app.” Anyone in immediate danger should call 911. During the pause, non-emergency reports in Toronto should go directly to Toronto police, with the understanding that those channels are not anonymous. If you use a different Crime Stoppers program, check its official website for updates and advice about its reporting system. For more general advice if your information may have been exposed, read our blog “ Involved in a data breach? Here’s what you need to know .” What do cybercriminals know about you? Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online. SCAN NOW

malwarebytes.comOct 23, 2026source

Facebook’s misleading privacy claims land Meta a $25 billion penalty

Facebook’s Cambridge Analytica scandal may feel like very old news . But the consequences are still arriving, and the latest comes with a $25 billion price tag. Reuters reports that a New Mexico judge has ordered Meta to pay $25 billion in civil penalties after a jury found that Facebook misled consumers about its data practices and its handling of hate speech and misinformation. Meta says it expects to win on appeal. This case is about more than information ending up in the wrong hands. It concerns what Facebook told people about who could access their information, how much control users had, and how the company enforced its own rules. What Facebook told its users In September, jurors found that the company and its leadership made 26 misleading statements on data privacy, hate speech, and other subjects. For example , Mark Zuckerberg’s 2010 statement that: “We do not share your personal information with people or services you don’t want.” That assurance appeared in a statement the jury found misleading. The judge found that choosing who could see a Facebook post did not necessarily control what outside app developers could access. That access was governed by separate settings that many users did not know existed. New Mexico’s attorney general filed the lawsuit in 2021, following revelations that Cambridge Analytica obtained personal information from as many as 87 million Facebook users through a third-party app. But New Mexico’s case went beyond Cambridge Analytica. The state challenged Facebook’s representations to consumers about its data practices and its efforts to address misinformation and hate speech. The case centered on misleading consumers under New Mexico’s Unfair Practices Act , the state’s consumer protection law. The state argued that third parties had broad access to users’ information and that Facebook tolerated harmful content when doing so benefited its business. Meta disputed the allegations, denied selling users’ information, and said the state had taken statements out of context. New Mexico’s Department of Justice says the jury found 43,899,725 violations of state law. That does not mean nearly 44 million individual New Mexicans had their data taken. The count reflected the estimated audience for each misleading statement, rather than the number of individual people affected. State law allows penalties of up to $5,000 per violation. Judge Francis Mathew found that a penalty exceeding $219 billion was warranted under the law but reduced the amount to $25 billion. The judge said earlier penalties had failed to stop Meta from misleading consumers, including a $5 billion FTC penalty in 2019 . The money is not earmarked for compensation payments to individual Facebook users. According to Attorney General Raúl Torrez, state law directs the penalties to New Mexico’s school system. Meta’s chief legal officer, C.J. Mahoney, said the company is confident it will prevail on appeal and characterized the lawsuit as an attempt to impose “a tax on speech.” Meta has also argued that a multibillion-dollar penalty risks violating constitutional protections concerning due process and excessive fines. How to stay safe on social media The case illustrates why privacy is not just a matter of choosing who can see a post. In a separate 2019 case , the Federal Trade Commission (FTC) alleged that Facebook had shared users’ information with third-party apps used by their friends, even when those users had chosen restrictive privacy settings. A few precautions can help you limit what you share, although settings alone cannot guarantee privacy: Share selectively. Leave optional profile details blank, limit who can see your posts, and avoid publishing sensitive details such as your address or live location. Ask permission before posting information or photos involving other people. Check app permissions. Does a social media app really need your contacts, precise location, or entire photo library? Turn off unnecessary access in your device settings. Review tracking and advertising settings. Look for controls covering personalized ads, activity outside the platform, and data sharing. Restrict what you can, but don’t assume opting out of personalized ads stops all collection. Be selective about connected apps. Before connecting a quiz, game, or other service to your account, check what information it requests. Decline access that seems excessive for what the service does. Remember what “private” means. Restricting your audience helps control who sees your posts. It does not stop the platform itself from collecting or using information about your activity. Scammers don’t need to hack you. They just need you to click once.   Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

malwarebytes.comOct 22, 2026source

Scammers are finding new ways to target your phone. Here are 5 ways to protect yourself

The warnings are everywhere these days. Don’t click this. Don’t open that. Don’t scan this. Don’t download that. These messages of caution, however well-intended, are so ubiquitous and constant that it should come as no surprise that some people have started to tune them out. How many people? About one in three, according to our recent study . Keeping up with every warning can feel exhausting. Meanwhile, scammers are finding new ways to target people and phones give them plenty of opportunities. Mobile phones give scammers multiple ways to reach people, from text messages and calls to social media posts. According to a 2022 Federal Communications Commission report cited by the Federal Trade Commission (FTC), texting is a more common communication method than voice or email. Criminals appear to be taking advantage of that fact. Consumers reported losing $470 million to text scams in 2024, up 26% from $373 million the year before and more than five times the amount reported in 2020. The FTC cites estimates that text message open rates run as high as 98%, compared to just 20% for email. People’s tendency to open and read their texts helps explain their appeal to scammers. Meanwhile, AI is making scams harder to detect, but better at impersonating people and companies to steal money, passwords, and identities. Voice phishing , or “vishing,” was a vanishingly small category of crime just a few years ago, but AI has made it considerably more convincing. Vishing doubled in the first half of 2026, according to CrowdStrike’s 2026 Threat Hunting Report. Meanwhile, 16% of adults in the Malwarebytes survey said they had received a voice-cloned phone call impersonating someone they knew in the past year. Our data also shows how difficult people find it to recognize scams: 85% of survey respondents said it’s hard to tell a scam from the real thing, up from 66% a year ago. And 84% said convincing video evidence no longer feels like the rock-solid proof it once was. Here are five ways to protect yourself 1. Treat unexpected texts and social media posts with suspicion   Legitimate institutions generally won’t ask for payment or personal information through unsolicited texts. And if the message is marked “urgent,” all the more reason to pause. Instead, go directly to the company’s official website and inquire there. AI-generated images and videos are making it harder to tell what’s real online, so don’t rely on what you see as proof that a request is legitimate. If the content involves someone you know, contact them directly using a number you already trust. 2. Keep your operating system updated This is one of the most effective things you can do to keep your phone safe. Security updates patch vulnerabilities that malware takes advantage of. Malwarebytes’ threat research found Android malware detections rose 151% in the first half of 2025. On both iPhone and Android, automatic updates help decrease risk. 3. Protect your accounts Use a strong, unique password for every account. A password manager can create and store them for you. Where available, use a passkey—a way to sign in using your device, often with your fingerprint, face, or PIN—that resists phishing. Turn on two-factor authentication, also called 2FA, for all your apps that allow it. This one step makes it harder for criminals who have your password to gain access to accounts on your phone. 4. Be skeptical of voice calls, even from your mom This can be the hardest one to get your head around, but also one of the most dangerous and fastest-growing. AI-synthesized audio fraud has made it easier for scammers to sound convincingly like a loved one in trouble. Agree on a private code word with family members and friends in case of doubt or emergency. If you’re unsure, hang up and call the person on a number you already have. If the caller claims to be your bank, hang up and call back on a number you look up independently. 5. Check links before you tap, including links in QR codes Before opening a link in a text, email, or social media post, check the web address for misspellings or an unfamiliar domain. You can also copy it into the free Malwarebytes Scam Link Check for help assessing it. QR codes can hide suspicious links, too. Scammers sometimes place fake sticker overlays on top of legitimate QR codes in public spaces, and QR code phishing is morphing so fast that the FBI issued an alert in January about North Korean hackers using QR codes to target think tanks and government officials. Look for signs of tampering and check the web address your phone displays before opening it. If you’re not sure, don’t open the link. Instead, go directly to the organization’s official website or app. Scammers rely on speed and pressure, so the best defense is to slow down. If a message or call feels off, step away and check it through a channel you already trust. “One of the best cybersecurity suites on the planet.”   According to CNET.  Read their review →

malwarebytes.comOct 22, 2026source

Woman faces years in prison over a Cash App account she says she never opened

A Cash App account opened in her name has left Amanda Smith facing criminal charges and potentially up to six years in prison. 404 Media reports that Smith says someone used her Social Security number (SSN) and date of birth to create an account that received money from a Facebook Marketplace scam. Allegedly, a buyer sent $1,000 for items that weren’t really for sale. A scammer had taken over someone else’s Facebook account and directed the buyer to pay a Cash App account in Smith’s name. Investigators obtained account information from Block, Cash App’s parent company. That information included Smith’s Social Security number and date of birth. Police subsequently arrested her in Pennsylvania over the alleged crime in Arkansas, a state she says she had never visited. She spent three nights in jail. But 404 Media’s review of account records found that several account details, including the address and network used, did not match her own. Smith also described a frustrating obstacle when she tried to investigate: “Cash App refused to provide me with any information about the account, because I couldn’t prove that I was the owner.” The account was associated with her closely enough to contribute to her arrest, yet she said she could not get information directly from the company. She later received account records through the criminal case. It’s a disturbing reminder that the consequences of identity theft can go well beyond an unfamiliar charge on your bank statement. You could also find yourself accused of a crime committed using your details. Breaches happen every day. Don’t be the last to know. SEE PLANS Smith suspects that information exposed in a data breach may have been used to impersonate her. When investigating, 404 Media found the phone number used for the account linked to an Amanda Smith in older breach data. They also found someone made a Venmo account using the same phone number but under another name entirely. The source of her Social Security number and date of birth hasn’t been established, and her case is ongoing. Her experience highlights why it matters to know which of your details have been exposed. How to protect yourself The practical lesson is to look beyond the headline that a company “lost customer data.” What matters is which information was exposed, because different exposures call for different responses. Our guide for how to handle being involved in a data breach recommends checking the affected company’s official information before deciding what to do next. The steps depend on the type of data that was stolen or leaked: Email addresses and phone numbers: Be alert for phishing messages and scam calls, including messages that refer to the breach. Passwords: Change the affected password and anywhere else you reused it. Enable multifactor authentication where available. Payment or banking details: Contact the relevant financial institution and review your accounts for unauthorized activity. Social Security numbers and other identifying information: Check your credit reports for unfamiliar accounts. In the US, you can freeze your credit for free with each of the three major credit bureaus: Equifax, Experian, and TransUnion. This helps prevent new credit accounts being opened in your name, but does not prevent every type of identity misuse. If you discover an account opened in your name , contact the company’s fraud department through its official website and report the identity theft (in the US you can do that at IdentityTheft.gov ). Keep copies of your reports and correspondence, and ask for written confirmation when the fraudulent account is closed. A breach-checking service can help you identify known exposures linked to your information. Malwarebytes’ Digital Footprint Scan , for example, checks for exposures associated with your email address. What do cybercriminals know about you? Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online. SCAN NOW

malwarebytes.comOct 22, 2026source

Delivery bots accused of illegally scanning customers

Two Chicago customers say robots delivering their groceries and takeout scanned their faces and hands without consent, stored the data alongside their names and addresses, and used the recordings to train AI . Their separate lawsuits accuse delivery robot operators Coco Robotics and Serve Robotics of violating Illinois’ biometric privacy law. Both companies dispute the claims. The plaintiffs filed the cases in the Circuit Court of Cook County, Illinois, alleging that the robots used their cameras along with light detection and ranging (LiDAR) sensors to scan them. LiDAR uses laser pulses to build a detailed 3D map of a robot’s surroundings. The lawsuits allege that, at close range, these sensors capture facial geometry in enough detail to support facial recognition. Mitchell Breidinger ordered DoorDash groceries in September 2025. A Coco robot, operated by Coco Robotics, made the delivery. To collect it, he had to stand within about a meter of the robot’s cameras and LiDAR sensor while he entered a PIN code in the DoorDash app, and a Coco remote pilot watched the live video, according to the complaint . Barry Schain filed a similar complaint against Serve Robotics, which sent one of its robots to deliver his Uber Eats order. The complaint against Cyan Robotics (the California-based company that does business as Coco Robotics) states that the robots record detailed 360-degree LiDAR data on the urban environments that they navigate. Coco has never said that it blurs, downsamples, or removes human faces or hands from that LiDAR data, the complaint adds. It also says the company: “gives no notice before a robot records a person, identifies no specific purpose or retention period for the data, obtains no written release, and has published no retention or destruction schedule.” Those who are scanned by Coco robots have no account to close with the robotics company and don’t get to choose whether they are served by a robot, the complaint points out. Cyan uses the data that the robots collect to train its AI, the complaint says, adding that it also has data-sharing partnerships with companies including ChatGPT creator OpenAI. Schain, who most recently took a delivery from a Serve robot on October 4, makes similar claims in his complaint. The company fulfills food delivery orders for both Grubhub and Uber Eats, it says, noting (unlike the complaint against Cyan) that these robots also collect audio. Serve Robotics licenses video and LiDAR data to third parties for model training, the complaint says, citing Serve’s own filings with the Securities and Exchange Commission. Both companies have pushed back, according to reports . Coco said it has not collected biometric data in Chicago, that the suit “fundamentally misunderstands our technology” and that “the data we share is navigational data used to make sidewalks safer for all users.” It called the case “frivolous.” Coco said that it doesn’t share data from the beginning and end of delivery runs. Serve said that the robot systems are “not designed to identify individuals or create biometric profiles.” Whether the data the robots capture qualifies as biometric information under BIPA is central to the lawsuits. Illinois’ biometric law Illinois’ biometric privacy law gives people the right to sue companies over the unlawful collection and use of their biometric data. Under that law, biometric identifiers include scans of hand and face geometry. Companies must tell people in writing what biometric information they’re collecting, what they’ll use it for, and how long they’ll keep it. They must also get each person’s written consent and publish a schedule for destroying the data, and they must not sell or otherwise profit from it. These class action suits were not delivered in a vacuum. Chicago residents had already mounted a petition against the delivery robots, citing collisions, interference with emergency vehicles, and concerns about potential surveillance. More than 4,550 Chicagoans have signed it, the petition says. Both suits were filed by the same Chicago law firm, Almeida Law Group. Each seeks $1,000 per class member for negligent violations or $5,000 for intentional or reckless ones. Each complaint says its proposed class “includes many thousands of persons.” Browse like no one’s watching.   Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal.  Try it free →  

malwarebytes.comOct 22, 2026source

WhatsApp’s chatbot was given hidden instructions to not mention privacy regulators

WhatsApp instructed its AI support chatbot not to recommend contacting privacy regulators when users couldn’t delete their accounts, researchers found. Privacy software company Redact discovered the hidden text on October 8. Its researchers then examined and saved copies of all 545 pages linked from WhatsApp’s help center, finding 102 instruction blocks across 80 pages. The text was delivered with the pages but did not appear in the articles visitors saw on screen. Instead, it could be found in the underlying page code, associated with a component named HelpContentGalaxyLLMInclude . Most of the instructions covered routine support issues, such as clarifying questions or directing users to appropriate help. But the researchers found two sets of instructions that stood out. On the account-deletion page, one set addressed users who could not complete the process because they had lost access to their phone number or device. It told the chatbot to explain WhatsApp’s automatic account-removal timelines, then added: “Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority.” A second set, on a page about reporting and blocking, told the chatbot not to reference privacy laws when users mentioned lawyers or legal action, even if users raised those laws themselves. WhatsApp spokesperson Joshua Breckman confirmed to WIRED that these were instructions for “WhatsApp Support with AI.” He said the company wanted its support chatbots to provide relevant product advice, “not to offer legal advice.” Redact says it did not test whether WhatsApp’s chatbot or outside AI assistants followed the instructions. WhatsApp attributed the exposure to a bug it said had been fixed. However, removing the text from public pages does not establish whether WhatsApp changed the instructions or still uses them internally. Why this is important A support chatbot doesn’t need to act as your lawyer. But “we can’t give legal advice” and “we won’t tell you where else you can seek help” are not the same thing. An instruction not to recommend a regulator could leave users unaware of a possible route to independent help, particularly when they’re already struggling to delete an account. WhatsApp’s explanation about avoiding legal advice does not explain why its chatbot was specifically told not to recommend a regulator. Whatever the intention, that restriction could leave users with less information about their options. How to delete your WhatsApp account If you want to leave WhatsApp, uninstalling the app is not the same as deleting your account. WhatsApp provides a separate account-deletion option inside the app. You must be logged in on your primary phone to complete this procedure. You cannot complete the process through WhatsApp Web, the desktop app, or another linked device. Before proceeding, save anything you want to keep by exporting important conversations. Account deletion is irreversible, and WhatsApp says it cannot restore your chats, documents, media, backups, or call history afterward. If you still have access to your account The steps are similar on Android and iPhone: Open WhatsApp on your primary phone. Open Settings . On Android, tap the three-dot menu first. On iPhone, tap Settings or your profile picture. Select Account , then Delete my account . Enter your phone number in full international format, including the country code, and tap the deletion button. On Android, select a reason when prompted, then confirm the deletion. Follow any remaining on-screen prompts. Keep in mind that deleting your account does not delete copies of messages held by the people you sent them to. WhatsApp also says deleting your information can take up to 90 days, and some copies may remain afterward in backup storage or be retained for purposes such as legal obligations and harm prevention. If your phone is lost or stolen If you can recover the same phone number, WhatsApp’s documented route is to regain access first: Contact your mobile provider to block the lost SIM and request a replacement with the same number. Activate the replacement SIM in another phone. Install WhatsApp and register with that number again. Once you have access, follow the account-deletion steps above. Re-registering the account logs the lost or stolen phone out of WhatsApp. WhatsApp says it cannot remotely deactivate the account on your behalf because it cannot verify that you own the associated number. If you can no longer access your account or recover your number This is where WhatsApp’s self-service instructions fall short. Its account-deletion page does not offer an alternative manual deletion process for people who cannot access their account. Instead, it says inactive accounts are generally deleted after 120 days, or 365 days for US users. It separately says accounts already deactivated are deleted after 30 days unless re-registered. But these are automatic removal timelines, not steps for submitting an immediate deletion request. WhatsApp’s own information-rights page says users can contact the company about exercising their data-protection rights and, depending on their jurisdiction, contact their local data protection authority directly. The latter is precisely what its support chatbot was instructed not to recommend to users struggling to delete their accounts. Browse like no one’s watching.   Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal.  Try it free →  

malwarebytes.comOct 21, 2026source

PHP2Shell: Why websites are going offline for emergency security updates

If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched. The vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2 out of 10. Why this matters PHP is a programming language that works behind the scenes to power a large part of the web. It underpins WordPress, Drupal, Joomla, Magento, and many other applications, including software whose users may not realize PHP is involved. Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor . The PHP team says all PHP installations serving web requests are at risk. In some configurations, an attacker can trigger an exploit before the website’s own code even runs. Cloudflare’s chief technology officer, Dane Knecht, has reported “early attacks emerging,” while warning that firewall mitigations are only a stopgap. Emergency patches are now available The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 , and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages. You may still encounter offline websites while administrators install the updates and check their systems. CERT-EU recommends identifying PHP-based applications and patching as soon as possible. Where an immediate fix is not feasible, it advises considering isolation of internet-facing applications from public networks. The risk may outlast today’s emergency The longer-term concern is forgotten infrastructure: abandoned websites, unsupported applications, and connected devices with PHP-based management interfaces. Vulnerable installations may remain exposed if nobody maintains them or a vendor no longer supplies updates. PHP 8.1 and older no longer receive routine security updates from the PHP project. Administrators using those versions should check whether their vendor supplies a fix or arrange an upgrade to a supported version. Website owners should establish who updates their underlying PHP installation. Updating WordPress or its plugins is not the same as updating PHP. Hosting providers or server administrators may need to apply the fix. For visitors, temporary downtime alone doesn’t mean a website has been breached. It may reflect a protective decision while its administrators install updates. However, consumers need to be extra careful as a “trusted website” may no longer be trustworthy, and not just because of PHP2Shell, but also because of eight compromised TLS certificates . Shahak Shalev, Global Head of Scam and AI Research at Malwarebytes, said: “This is a goldmine for hackers. They can hijack real websites to take advantage of the site’s reputation to do things like phish people, serve malicious software from the trusted channel. The opportunities are endless.” What to do If you’re a website visitor: Some websites may temporarily go offline while they are patched. Watch for unexpected content, downloads, or redirects, and repeated login requests, even on familiar sites. If something looks wrong, leave the page. You don’t need to install PHP updates on your own device. If you’re a website owner: Ask your hosting or IT provider to confirm PHP fixes are installed , not just scheduled, across all your websites and applications. If they can’t patch immediately, ask whether affected services should temporarily be taken offline. If you manage your own servers, follow PHP’s update instructions . Using unsupported PHP? Check for a vendor fix or upgrade to a supported version. What Malwarebytes is doing Helping keep you safe from hacked websites: Malwarebytes web protection and Browser Guard block known harmful sites, scam pages, and dangerous downloads. Our researchers are watching for websites compromised through these flaws so we can quickly add them to our block lists. Updating our own websites: We use a managed hosting provider and are working with them to install the PHP fixes. We are closely monitoring our websites until the updates are in place. Stop threats before they can do any harm. Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

malwarebytes.comOct 21, 2026source

Fake Amazon Music x YouTube deal lures creators into a Google login trap

malwarebytes.comOct 21, 2026source

Signal bug could let someone keep listening after you hang up

malwarebytes.comOct 21, 2026source

Google issues Android security updates: who can get them and how

malwarebytes.comOct 7, 2026source

AI-powered phishkit arms criminals with account-hijacking tools in 10 minutes

malwarebytes.comOct 7, 2026source

Update Chrome and ChromeOS to fix critical security issues

Google has released updates for the Chrome browser and the ChromeOS operating system. On October 6, Google released a  Stable Channel Update for Desktop . This is the most important one for desktop users. It brings Chrome to version  155.0.8059.39 for Linux  and versions  154.0.8037.39/.40 for Windows and Mac . The update includes 247 security fixes including four rated Critical. On the same day, Google released version  155.0.8059.39 for Android , to a small percentage of users. It may not be available on Google Play for everyone yet but keep an eye out for it. Google says it includes stability and performance improvements. How to update Chrome The easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update. If you don’t want to wait for the rollout to reach you, manually updating is easy. Open  About Google Chrome  from Chrome’s settings or Help menu. Chrome will check for updates. If one is available, click  Relaunch  to apply it. Version 155.0.8059.40 is up to date You can find an explanation of the version numbering system and step-by-step instructions in our guide:  How to update Chrome on every operating system . How to update ChromeOS You can update your Chromebook’s operating system by following these steps: Connect to the internet. Your Chromebook automatically checks for updates and downloads when it connects. At the bottom right, next to the date, find the “Update device” notification. To complete the update, restart your Chromebook. Technical details In the fixed vulnerabilities, we found three that are likely high-impact flaws. CVE-2026-106197 : This is a use-after-free vulnerability in the Browser module, rated critical. This is a strong priority candidate because of its location in browser functionality rather than a specialist feature. Exploitation would allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. A use-after-free vulnerability occurs when a program attempts to access a memory location after it has been freed. That can cause crashes or, in some cases, allow an attacker to run their own code. Chrome vulnerabilities that enable remote code execution outside the browser sandbox are particularly valuable to attackers because they can turn a visit to a malicious or compromised website into direct code running on the underlying operating system, often without requiring additional exploitation steps. CVE-2026-106358 : Another use-after-free vulnerability, this time in Navigation, also rated critical. Navigation is central to ordinary browsing, making this a potentially broadly exposed flaw if attacker-controlled pages or redirects can reach the vulnerable path. It also provides a remote attacker with the option to execute arbitrary code outside the sandbox via a crafted HTML page.  CVE-2026-106240 : A type confusion vulnerability in V8, Chrome’s JavaScript engine. This one is rated High but does offer a remote attacker after successful exploitation to execute arbitrary code inside the sandbox via a crafted HTML page. And a flaw in the JavaScript engine is always a plausible candidate for attacks delivered through malicious web content. Stop threats before they can do any harm. Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

malwarebytes.comOct 7, 2026source

Another ShinyHunters suspect arrested

The net is tightening around the Shiny Hunters cybercrime group following the reported arrest of a second member. On Saturday, Reuters said that 16 year-old Saif al-Din Khader had been arrested in Jordan and was in FBI custody. This follows the arrest earlier in September of another member in the Netherlands. Third party reports named him as 24 year-old Pepijn van der Stap, an offensive security lead at Dutch company Neo Security. The FBI posted a message following the Dutch arrest warning other ShinyHunter members that it was coming for them next. Cyber Division Assistant Director Brett Leatherman hinted that people already taken into custody had been talking. Then he said: “You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours.” According to security blogger Brian Krebs, Khader (who goes by the nickname ‘Rey’), was the technical operator and public face of Scattered LAPSUS$ Hunters, which he said was an amalgamation of three groups: Scattered Spider, LAPSUS$ and ShinyHunters. Active since at least 2019, ShinyHunters focused on data theft and extortion. The group commonly uses social engineering to gain access to victims’ accounts on third-party services, but also exploits flaws in software. Victims of the ShinyHunters group include Kodak , along with American healthcare and pharmaceuticals distributor McKesson . The gang also recently compromised rival cybercrime group Clop and defaced its leak site. Shortly after the Clop attack, ShinyHunters hacked the FBI. The group said that this wasn’t financially motivated, but instead was a response to a May FBI advisory about its activities. That announcement followed ShinyHunters’ own cyberattack on Instructure, which runs the Canvas online educational system. The FBI attack targeted the agency’s jobs site, and is said to have exploited a vulnerability in PeopleSoft, HR software owned by Oracle. The data breach, which ShinyHunters claimed amounted to Terabytes, is said to have included a wide array of information on employees, ranging from names, addresses, and phone numbers through to badge numbers, job titles, and information on spouses. Other information included fitness-for-work medical records along with blood and urine test results , and doctors’ notes.  This data is said to include sensitive information on agents investigating targets including Russia, China, and the drug cartels. It would be catastrophic for law enforcement efforts, national intelligence, and individuals if this information fell into the wrong hands. ShinyHunters has said that it won’t release the data, arguing that the intrusion wasn’t financially motivated. It criticized the FBI for what it said was disinformation in the May advisory. The FBI had said that the group had harassed victims’ family members and threatened to release embarrassing pictures. The FBI also removed an Accenture contractor this week after they failed to apply a security patch to third-party software that it had been using. Insiders identified this software as PeopleSoft.

malwarebytes.comOct 7, 2026source

ASOS “hackers” send push notifications to customers

Thousands of global fashion retailer ASOS customers have received a push notification through the ASOS app this morning alleging that the company has been hacked. The notification, addressed to ASOS’s data protection officer and IT, says: “ASOS HACKED Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it” What we know so far Snowflake is a cloud-based data platform that organizations use to store, process, and analyze data. We know that ASOS’s marketing team uses Simon AI from a blog posted by Simon . Simon AI specializes in personalization and runs on Snowflake. ASOS has described using Simon AI alongside Braze to personalize and trigger customer communications like push notifications to clients’ phones. The apparent delivery of the message through ASOS’s own app makes this more concerning than an unsupported social-media claim. It suggests unauthorized use of the notification infrastructure, but does not confirm that the claimed Snowflake compromise occurred or that customer data was stolen. According to Simon AI, typical customer profiles cover: browsing history and products viewed purchase history and customer value (first-time or high-value buyers) demographic data segments such as Premier status or customers who’ve stopped buying geolocation and local weather If the affected systems contain these profiles, a breach could expose a detailed picture of customers’ shopping habits and preferences. However, the published description of ASOS’s marketing setup does not establish what, if anything, the attackers accessed. The Guardian reports that the group claiming the breach calls itself the “Xuanye group.” The Telegram channel operated by the group carried the message “Regarding Asos, payment information is not affected,” and the “app is safe to use” but those claims have not been independently verified. Sky News reports that ASOS confirmed an “unauthorised customer notification” was sent at around 10 am today.  “We are investigating unauthorised activity involving third-party platforms that we use to communicate with customers,” it said in a statement. The retailer said it immediately restricted access to the notification platforms and is working with specialists and relevant authorities.  It added: “Basic personal information including name and contact details may have been accessed. We do not believe that payment-card information or account passwords, were impacted.” How to stay safe The website and app remain operational, and there is currently no verified evidence that customer databases, payment card information, passwords, etc. have been stolen. So, it’s too early to say if and how much ASOS customer data the attackers could get their hands on, but the potential scope is significant. Customer data could be used in targeted phishing attacks to add credibility. For the time being, postpone your purchases at ASOS until it’s clear what happened and whether ASOS has resolved the issue. Be wary of unsolicited messaging about the breach or other ASOS related issues. If you do not wish to see more push notifications from the Xuanye group, remove the ASOS app until their access has been removed. If it turns out your data was stolen in this breach, read the tips in our blog Involved in a data breach? Here’s what you need to know . What do cybercriminals know about you? Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online. SCAN NOW

malwarebytes.comOct 6, 2026source

Facebook Marketplace scam uses your name and number

Facebook users are reporting receiving a message with a fake Facebook Marketplace listing that has their name as the seller. It works like this. You receive a message (in this case iMessage) asking “Is this still available for purchase?” Attached to the message is a fabricated Facebook Marketplace listing. Tapping on the picture, you might notice that the seller’s name is the same as your name. This is known as a conversation lure , adding legitimacy to a message and giving you an additional reason to reply. Interestingly in the example we received, even though the name of the seller matched the person who received the message, the profile picture did not. When I researched the profile picture, it turned out that it belongs to another Facebook user with the exact same name. This likely means the attacker had a phone number associated with a name that they used to create the fake Marketplace listing. Receiving a message like that is very likely to provoke the natural corrective response: “That isn’t me.” Such a message will probably have a lot of receivers think that they are being impersonated by a scammer on Marketplace. This method of approach may seem like a lot of work with a low chance of success, and this would have been true a few years ago. But with an AI agent and a list of matching names and phone numbers from a breach, this can be done relatively easy at scale. And that changes the return on time invested dramatically. The name and phone number combination could come from any number of data breaches. On the dark web, cybercriminals buy and sell personal data for such purposes.   “For less than the cost of a cup of coffee, a cybercriminal can buy enough information to devastate someone’s financial life.” The personalized screenshot would work very well as a reply trigger. Its psychological function is well thought out and likely very effective: it combines curiosity, reputational concern, and the recipient’s impulse to correct an apparent mistake. But when you reply to a phishing text you are telling a scammer that this is a live number. Your phone number then increases in value for the scammer and can be resold to other scammers . Or it can be used in other cybercrimes, to download malware, to begin a relationship that leads to fraud, to take over your Facebook account, or many other reasons. How to stay safe While the exact motive behind this text is hard to establish without engaging, there are a few things you can do: Limit what you share publicly on social media. Scammers can use information about you to increase the credibility of their attempts. Do not respond to unsolicited messages of any kind when they come from people you don’t know. If you do know the sender, but don’t trust the message, double check with them via a different channel that it was them who sent it. Don’t click a link, call a number supplied in the conversation, scan a QR code, or share a one-time code or screenshot of a security message. Open Facebook independently and inspect Marketplace activity, recent logins, messages, email addresses, phone numbers, and recovery settings. Use facebook.com/hacked if you find any signs of compromise. If you find a profile truly impersonating you, preserve its URL and report the profile. Facebook says impersonating profiles violate its standards and provides an impersonation-reporting process . If you’re unsure whether a message is a scam, use Malwarebytes Scam Guard . It will assist you in determining if it’s real or fake, and advise you on follow-up steps.

malwarebytes.comOct 6, 2026source

Domino’s customers targeted in credential stuffing attacks

Domino’s Pizza customers tell us they have received emails saying they account has been accessed by a third party. Domino’s says its internal systems weren’t breached, but that individual accounts were logged into using a password and email combination stolen from another online account owned by the customer. This is known as credential stuffing. Here’s the email: “We’re getting in touch to let you know that we believe a very small number of Domino’s customer accounts were accessed by an unauthorised third party, and unfortunately your account is one of those affected. We want to reassure you that our security systems have not been breached. We also don’t store any payment details, so no financial information has been accessed. It appears that you have used a password for your Domino’s account which you have used on other sites, which was already out there because of a previous data breach unrelated to Domino’s. An unauthorised third party has used this to obtain access to your account. As a precaution, we’ve reset your account. You can still place orders as normal, but the next time you log in you’ll need to set a new password using the ‘Forgotten password’ link. We recommend choosing a strong, unique password that you haven’t used elsewhere. Please avoid reusing your previous password. Keeping your information safe is really important to us. We’ve reported this incident to the Information Commissioner’s Office and included some FAQs below if you’d like more detail. If you have any questions, our Customer Services team will be happy to help on 0800 640 9071. ” Credential stuffing is an attack where criminals take usernames and passwords stolen from one website and try them on many other websites. They don’t guess the passwords. They already have them, often millions at a time, from old data breaches, from malware that steals saved logins from people’s computers, or from phishing sites. These lists are bought and sold on criminal forums. Attackers then use automated tools that run through the list and try each email and password pair against a login page, such as a food delivery app, a web shop, or a streaming service. The attack works because so many people reuse the same password on different sites. If you used the same email and password for a small online forum that was breached years ago and for your pizza ordering account, the criminals don’t need to hack the pizza company at all. They just log in as you. To the company, it looks like a normal login with the correct password. That’s why these attacks often show up as “accounts were accessed” and not “the company was hacked.” Once they’re in, attackers can order food or goods using your saved payment card, use up loyalty points or gift card balances, or collect your name, address, and phone number. They can use those details for more convincing scams later, for example a text or email that seems to come from the company because it knows what you ordered. Accounts that are confirmed to work are also resold to other criminals, so one reused password can cause trouble long after the original breach. How to stay safe Use a different password for every account. That way, a breach at one site stays at that site. Use a password manager to remember those passwords. Nobody can remember dozens of unique passwords, but a password manager can store all these for you. Where it’s offered, turn on two-factor authentication (a code from an app or text message, or a passkey) so a stolen password alone isn’t enough to login to your account. If you’ve reused a password on an account that may have been affected, change it there and on every other site where you used it, starting with accounts that have payment details saved. Don’t follow links in emails or other unsolicited messaging. Log in directly on the official website or in the app. Please note: Unsolicited “update your account” emails claiming to be from Domino’s are frequently phishing attempts designed to steal personal or financial information. When in doubt, Malwarebytes Scam Guard can help you determine whether a message is a scam or not and suggest follow-up steps. What do cybercriminals know about you? Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online. SCAN NOW

malwarebytes.comOct 6, 2026source

Google pauses open source bug bounty program after rise in AI submissions

Companies like Google and Microsoft are finding much bigger numbers of vulnerabilities in their own products as a result of AI . But the same technology is leading to public reporting programs becoming overwhelmed by the mass submission of speculative, duplicated, or hallucinated findings. Now, Google’s announced it has temporarily stopped accepting submissions to its open source bug bounty program, OSS VRP. “Why is this happening? This pause is due to a significant rise in automated submissions, the vast majority of which are not valid.” We’ve seen this happen before. In early 2026, curl ended its HackerOne bounty program after low-quality, often AI-generated submissions overwhelmed its small security team. Intel also launched  a new bug bounty program  on Intigriti but there are no longer bounties available, reportedly in order to stop a flood of AI generated reports. Pros and cons Bounties can be an incentive for mass-submitting behavior when generative AI lowers the cost of producing polished-looking submissions. So, it’s understandable that companies want to limit the number of incoming reports. If most automated submissions are invalid, a temporary pause prevents Google engineers and open-source maintainers from spending disproportionate time disproving reports rather than fixing real issues. A pause gives Google the time and chance to introduce better controls, such as mandatory proof-of-concept requirements, evidence thresholds, and rate limits without letting the current queue keep growing. On the other hand, it may discourage legitimate researchers and make it harder for them to submit actual issues they’ve found. It is hard to draw a line of what you will accept, because an AI-assisted report can be valid, just like a low-quality report is not necessarily AI-generated. And as companies like Google and Microsoft have proven, AI assisted vulnerability discovery can also support real vulnerability discovery if it is coupled with validation, deduplication, and proof. What about the future? If we have learned anything it is that AI is not “breaking” vulnerability disclosure. It is exposing an older weakness in disclosure economics: the cost of filing a plausible report has fallen sharply, while the cost of proving or disproving it remains human-intensive. The solution seems obvious. Let AI handle the submissions and only hand over those it can validate to the engineering teams. This will definitely frustrate some bug bounty hunters, because it will be like convincing a chatbot that you have a valid point and want to “talk to a human,” but hopefully it will bring down the number of less serious bug bounty hunters and create more room for those who know what they are doing. Google has only promised an update in Q1 2027, so any redesign details would be speculative, but we do hope they find a way for responsible bug hunters to submit their findings. From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by  downloading Malwarebytes today .

malwarebytes.comOct 5, 2026source

Proposed anti-Flock bills could spell trouble for license plate readers

Automated license plate readers (ALPRs) are cameras that photograph passing vehicles, read their number plates, and typically log the time, location, and vehicle details. On their own, the images might be used to find a stolen car or locate a suspect. But lately there have been a lot of concerns raised about the way they are used . The main worry is caused by what happens when many cameras feed data into a shared, searchable network: it can create a detailed record of where ordinary people travel. Some agencies have already taken it upon themselves to act on these concerns , as well as those around inaccuracy. Data errors can have serious consequences. At a recent Senate hearing, Florida resident Lindsey Isaacs described being arrested and held for 13 days after data from an AI-enabled plate-reader system incorrectly implicated her in a fatal car crash. As a result of all this, US lawmakers from both major political parties have introduced proposals aimed at restricting automatic license plate reader networks. Most of the reasons brought up are about Flock Safety, one of the largest suppliers of these systems in the United States, but they would apply more broadly to other ALPR vendors as well. Flock says it deploys only 120,000 cameras operating across the country, while a researcher cited by the Senate described a much larger network of connected devices and cameras. The exact size may be disputed, but the central concern is clear: Data from a camera in one location can potentially be searched by an agency elsewhere. Two different approaches Reportedly , there are two different proposed laws in the making, while Flock says it supports a legal framework for license-plate readers and argues that the technology can improve public safety when it is used with strong oversight and accountability. The first proposal, the Stop Flock Abuse Act , doesn’t aim to banish ALPR systems outright, it would create rules for how government agencies and vendors can use them. Among other measures, the bill would require written approval and a record for every search, regular supervisor audits, encryption, and deletion of most vehicle-location data after ten days. It would also prohibit sharing or selling the data to non-governmental third parties, prevent ALPR networks from incorporating facial-recognition technology, and require data to stay in the US. A second proposal, the Ban Flock Act , takes a much harder line. It would prohibit US federal agencies from using ALPRs or accessing data they collect. It would also withhold federal grant money from state and local governments that use ALPR systems and allow people to sue the federal government if their rights are violated through ALPR deployment. Both bills are proposals, not enacted laws. In the US system, each would need to pass both the House of Representatives and the Senate in matching form, then be signed by the President. Going forward There is no guarantee either bill will receive a vote, let alone become law. But their introduction shows that ALPR technology is moving from a local procurement issue to a national privacy and civil-liberties debate. License plate data may seem less sensitive than phone-location data, but a long enough record can reveal a person’s routines, relationships, medical visits, religious activity, or attendance at protests. The debate is therefore not just about cameras on streets to fight crime and find criminals, it is about whether governments and private vendors should be able to build searchable records of everyday movement. So for consumers, the key question is not only whether a camera is installed on a street or near a business. It is also how long the resulting data is retained, who can search it, whether those searches are logged and reviewed, whether the information can be shared beyond the original agency, and what recourse exists when the system is wrong or abused. Your name, address, and phone number may already be for sale.    Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way.  SCAN NOW

malwarebytes.comOct 5, 2026source

A week in security (September 28 – October 4)

malwarebytes.comOct 5, 2026source

A week in security (September 28 – October 4)

malwarebytes.comOct 5, 2026source

Fake xStocks, Pendle, and other sites bait crypto users with rewards votes

We found 70 websites that impersonate legitimate crypto projects that invite visitors to vote on the date of an upcoming rewards distribution. The pages copy the look of the real sites closely, and on most of them the offer is small and believable: Cast a vote, and as an active voter you get a 1.25x boost when the rewards are paid out. However, the vote is fake and clicking the Vote now button opens a wallet connection prompt. It’s the first step toward requests that could trick visitors into authorizing access to their tokens. The brands being copied include xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, Firelight, and smaller platforms including Umia, Keeta, and NetNet. None of these pages are affiliated with the projects they imitate. Copies of familiar brands Each site is a close copy of the project it targets, down to the logo, menus, and colors. The Firelight copy even carries a real announcement about the protocol’s deposit cap, suggesting the pages were copied from the live sites rather than rebuilt from scratch. Most use the same wording about voting on the rewards date to earn a boost, though a few vary the pitch. The Pendle copy adds fake dates and a countdown to create urgency, the Keeta copy promises points instead of a boost, and the NetNet copy skips the vote and warns that unclaimed tokens will be burned after 48 hours. Why these brands The choice of targets does not appear to be random. Several of the impersonated projects have held a token launch, airdrop, or public token sale within the past year. Others run points or rewards programs. Their communities are used to hearing about rewards, claims, and allocations, and are primed to act on them. Zama ran a public token auction in January, and its token began trading in February. Kinetiq launched its governance token alongside an airdrop to early users in November 2025. Umia’s token auction ran from August 29 to September 2, only weeks ago. Firelight awards points to early depositors, and Pendle launched on Robinhood Chain on September 4. A message about rewards from one of these projects would not sound strange to someone who follows it. The lure appears designed to appeal to people who already hold the token or have used the protocol, because they’re the ones who might expect a distribution and want a bigger share. What happens when you click vote The Vote button does not lead to a ballot. It opens a Connect Wallet window that is the same regardless of which brand the page imitates. It lists WalletConnect, MetaMask, Trust Wallet, OKX Wallet, Binance Wallet, Bitget Wallet, and Rabby, along with an option to browse more than 28 others. This window resembles the connection prompts people see on legitimate crypto sites, which may make the request seem routine. Connecting a wallet on its own shares the wallet’s address, allowing the site to look up its holdings. At this point, it does not give the site permission to spend your tokens. The damage typically comes from what the site asks for next. In wallet-draining scams, a page may follow the connection with a request to sign a message or approve a transaction, presented as confirming the action the visitor came to take. A malicious approval or signature can give the attacker permission to move tokens out of the wallet without further confirmation. Blockchain transactions generally cannot be reversed, so stolen funds are very difficult to recover. Signs of a single operation Several details suggest a shared operation or phishing kit. All of the domains listed at the end of this article follow the same pattern: sitemu followed by a string of apparently random characters, on the .xyz top-level domain. The same templates are reused across several different brands, with the text appearing almost word for word whether the page is dressed up as Zama, Firelight, or Yield Basis—right down to writing the boost as 1,25x , with a comma in place of the decimal point. The wallet connection window behind the Vote button is identical across the brands as well. Random domain names spare the operator the work of coming up with a convincing lookalike address for each brand, and losing any single site costs them little. They also make the address bar one of the clearest giveaways on these pages. How to protect your wallet Check any claimed vote or rewards distribution through the project’s official channels before connecting your wallet. A familiar logo is easy to copy. Check the address, not the design.  These pages closely copy the real thing, so branding alone cannot establish that they are genuine. If the domain is not the one the project officially uses, close the tab. Go to the project directly.  If a vote or a reward is genuine, it will be on the project’s official site or announced on its established social accounts. Use a bookmark or type the address yourself rather than following a link from a message, ad, or reply. Read what your wallet asks you to sign.  Voting should not require you to approve spending of your tokens. If a signature or transaction request mentions approvals, permits, or transfers, reject it. Wallets that preview the outcome of a transaction can help, but do not approve a request you cannot understand. Be wary of boosts, bonuses, and deadlines.  Promises of extra rewards and warnings that unclaimed tokens will be burned can pressure you to act before checking. Keep most of your funds in a separate wallet.  Use a wallet with a small balance for unfamiliar sites, and keep long-term holdings in a wallet that you don’t use for those connections. If you already connected, disconnect from the site. If you also signed a message or approved a transaction, use your wallet’s approval-management feature or a trusted token approval checker to review and revoke suspicious permissions. Disconnecting alone does not revoke token approvals. If you suspect your recovery phrase or private key was exposed, move remaining funds to a new wallet created with a new recovery phrase. How Malwarebytes helps Malwarebytes Browser Guard can block known phishing and scam sites before you interact with them. That is useful in campaigns like this one, where the fake page closely resembles the real thing. If you receive a link to a rewards vote, claim page, or airdrop and are unsure about it, Malwarebytes Scam Guard can help assess the link before you connect your wallet. Check the offer through the project’s official channels too. Indicators of compromise sitemufl06qs0r4o[.]xyz sitemui6m6bbj1bd[.]xyz sitemui8go6g99bb[.]xyz sitemuicitd4jrtr[.]xyz sitemuidkr38kji0[.]xyz sitemuidlij5urd0[.]xyz sitemuif3pa5k4eh[.]xyz sitemuife3h91vjj[.]xyz sitemuioeefbyh3i[.]xyz sitemuioi7005ekb[.]xyz sitemuizkhpdbjnv[.]xyz sitemuj1xencnin8[.]xyz sitemuj7lzbasipw[.]xyz sitemujbcz1nas1x[.]xyz sitemujdi54aitrf[.]xyz sitemujejvp4tp0x[.]xyz sitemujffobdhxgj[.]xyz sitemuji07m137aw[.]xyz sitemujoqrmsm0et[.]xyz sitemujrfn7witew[.]xyz sitemujsm7brhwh0[.]xyz sitemujtcvh5q9fj[.]xyz sitemujtd8ingh2b[.]xyz sitemujtdkvy6c7n[.]xyz sitemujufht1ntj4[.]xyz sitemujufs1975v4[.]xyz sitemujug76lkyke[.]xyz sitemujumvtmjaf1[.]xyz sitemujuncdlpnng[.]xyz sitemujuno47vpud[.]xyz sitemujunzgjapds[.]xyz sitemujw19idqe01[.]xyz sitemujw1uspghl1[.]xyz sitemujwcvm5ufu8[.]xyz sitemujxjlv2lmhh[.]xyz sitemuk3jcm1olr8[.]xyz sitemuk3jpe1eph7[.]xyz sitemuk3z1hh2tvn[.]xyz sitemuk3zjrr2ufy[.]xyz sitemuk3zu5776gi[.]xyz sitemuk6zd201nsw[.]xyz sitemuk7f31386dx[.]xyz sitemuk7fi1dcrp4[.]xyz sitemuk7fvnvihra[.]xyz sitemuk7xbyszpzj[.]xyz sitemuk7y434m4om[.]xyz sitemuk7yi5eqn74[.]xyz sitemuk7ys6db9qj[.]xyz sitemuk9ayiwadjz[.]xyz sitemuk9c4oppeco[.]xyz sitemukh5awm67rj[.]xyz sitemukpy2hpmpwv[.]xyz sitemukrod1am6ez[.]xyz sitemukvxv7j5hmv[.]xyz sitemukvy7wudsqb[.]xyz sitemukww7ivnaji[.]xyz sitemukwxih8302f[.]xyz sitemul94tcv4l80[.]xyz sitemul95f18sowo[.]xyz sitemul95pxqgmm8[.]xyz sitemulaay8dbm66[.]xyz sitemulaucnbmnrd[.]xyz sitemulffos1qryn[.]xyz sitemuli8pd7qi9z[.]xyz sitemulpmt6if530[.]xyz sitemulpnff7964j[.]xyz sitemulpo7jkntfz[.]xyz sitemulr9d1dg77r[.]xyz sitemuls00qrsh0k[.]xyz sitemulszq4rm2yn[.]xyz

malwarebytes.comOct 1, 2026source

Shadow AI explained: The work shortcut that could leak your company’s secrets

Using an AI chatbot, assistant, or browser to speed up your work is tempting, but doing it without your employer’s knowledge can put sensitive data at risk. You’re swamped, so you paste a long email thread into a free chatbot and ask for a summary. It works, it saves an hour, and nobody notices. But the thread may contain customer details or confidential plans you’ve just shared with an outside service. If your employer hasn’t approved that tool or how you’re using it, that’s shadow AI. The UK’s National Cyber Security Centre (NCSC) defines shadow AI as: “the use of AI technology which isn’t captured in an organisation’s approved systems and processes.” A Microsoft study published in 2025 found that 71% of UK employees surveyed said they had used AI tools at work their employer hadn’t approved. Most people aren’t doing this to cause trouble. They want to get their work done faster, and the tools are right there. Shadow AI isn’t limited to chatbots. It can also be: A browser extension that “improves your writing.” A meeting-notes bot that joins your calls. An AI feature quietly switched on inside an app you already use. A small automation you built yourself that sends data to an AI service. AI features are appearing in search engines, email apps, and phones. Instead of a helpful list of links, Google now tries to answer your question. Microsoft’s Copilot drafts replies to your boss before you’ve had coffee. Your phone summarizes conversations you don’t even remember having. That makes it easy to start using one without checking whether it’s approved for work. Why it worries IT and security teams When you enter data into a public AI tool, it leaves your company’s control. The service may keep that data or use it to improve its models, unless specific privacy controls are in place. That can lead to data breaches, lost intellectual property, and regulatory problems. There is also a security angle. AI assistants and agents—tools that can take actions on your behalf—are complex software and can have serious vulnerabilities. If an attacker exploits one, they may gain access to the data and services the tool has. IBM’s 2025 Cost of a Data Breach research found that one in five organizations reported a breach linked to shadow AI. Only 37% had policies to manage AI or detect shadow AI. Organizations with a lot of shadow AI paid roughly $670,000 more per breach. In a survey of our newsletter readers, 90% of respondents said they were worried about AI using their data without consent. Company data deserves the same care as your own. How to use AI more safely at work You don’t need to avoid AI altogether. Think carefully about which apps and services you use before you share data. Start by talking to your employer, then follow these steps: Ask for an approved tool. Security leaders say the best way to reduce shadow AI is to offer something better and safer, such as an enterprise AI platform with guardrails. Use your work account, not a personal one. Work accounts are the ones your IT team can protect and govern. Find out what’s off-limits. Customer details, financial data, HR records, source code, and confidential meeting content may be restricted. Ask which kinds of data you may and may not use with AI. Check the privacy settings. Look at whether the tool stores your inputs or uses them to train its models. Register your use case. Many organizations keep a list of approved AI tools and uses. A quick approval process makes it easier to stay on the right side of the rules. Be careful with agents and plug-ins. Tools that connect to your email, files, or calendar should be reviewed by your IT or security team first. Speak up. If the approved tools aren’t meeting your needs, say so. The NCSC recommends open conversations about security to help reduce reliance on unapproved tools. If you manage a team, remember that banning AI outright tends to push the use further out of sight. Find out why people are turning to unapproved tools. Providing useful, approved options and clear rules can help staff work faster while protecting company data. Browse like no one’s watching.   Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal.  Try it free →  

malwarebytes.comOct 1, 2026source

Malwarebytes earns another Top Product award in independent testing

Every few months, Malwarebytes gets a chance to test its mettle against real-world threats in an independent laboratory setting. And the latest round of results gives us plenty to celebrate.   Malwarebytes earned a perfect 18 out of 18 and received another Top Product award from AV-TEST. We also achieved Level 1 Certification from MRG Effitas, and we stopped 100% of threats before they could run in the two latest tests from AVLab Cybersecurity Foundation.  AV-TEST Windows Consumer Security Product Test With 18 out of 18 points in AV-TEST’s latest Windows Consumer Security Product Test , Malwarebytes nabbed the organization’s Top Product award for the July/August test cycle. AV-TEST evaluates security products across three key areas: protection against malware , impact on device performance, and the frequency of false positives. Products need at least 17.5 out of 18 points to earn AV-TEST’s Top Product award, and Malwarebytes received full marks across the board. Since we first began participating in the test in 2018, we’ve secured the Top Product award more than a dozen times. MRG Effitas Consumer Assessment   Malwarebytes also received a Level 1 Certification in MRG Effitas’ July 2026 Consumer Assessment & Certification Programme , which tested eight security products against malware, phishing , and false positives.   The malware test used 300 live, in-the-wild samples, including Trojans, spyware , ransomware, backdoors, malicious scripts, and financial malware. Malwarebytes blocked every one of them, stopping 99% before they had the chance to run, and the remaining 1% after they began behaving maliciously.   Our product also generated zero false positives across 100 legitimate apps and blocked all five live phishing sites included in the test.  Malwarebytes was one of just two products to earn Level 1 Certification, the highest level awarded in the assessment.  AVLab Cybersecurity Foundation Advanced In-the-Wild Malware Test   Meanwhile, the results from AVLab Cybersecurity Foundation’s Advanced In-the-Wild Malware Test brought more good news: Malwarebytes keeps getting better at stopping threats before they can run.  As part of the test, AVLab Cybersecurity Foundation uses threats circulating online and delivers them in ways designed to replicate how people encounter attacks in the real world.  During both the May and July 2026 tests, Malwarebytes stopped 100% of threats before they could run.  These latest results join a growing list of honors , including a Best of CNET award and ZDNET’s Editor’s Choice award. Independent testing helps keep us sharp. We’re proud to see our work recognized, and even prouder to keep delivering the top-notch protection our customers have come to rely on.  “One of the best cybersecurity suites on the planet.”   According to CNET.  Read their review →

malwarebytes.comOct 1, 2026source

Loading 40 more…