CVE-2024-9329

In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal...

CVE-2024-7941

An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials...

Researchers Expose PWA JavaScript Attack That Redirects Users to Adult Scam Apps

Cybersecurity researchers have discovered a new campaign that employs malicious JavaScript injections to redirect site visitors on mobile devices to a Chinese adult-content Progressive Web App PWA scam. "While the payload itself is nothing new yet another adult gambling scam, the delivery method...

PsyScam: a Benchmark for Psychological Techniques in Real-World Scams

Online scams have become increasingly prevalent, with scammers using psychological techniques PTs to manipulate victims. While existing research has developed benchmarks to study scammer behaviors, these benchmarks do not adequately reflect the PTs observed in real-world scams. To fill this gap, ...

Police Shut Down Fake Trading Platform That Scammed Hundreds

Police in Europe have shut down a fake online trading platform that scammed hundreds of victims out of…...

The Internet’s Biggest-Ever Black Market Just Shut Down Amid a Telegram Purge

Following a WIRED inquiry, Telegram banned thousands of accounts used for crypto-scam money laundering, including those of Haowang Guarantee, a black market that enabled over $27 billion in transactions...

North Korean IT Workers Are Being Exposed on a Massive Scale

Security researchers are publishing 1,000 email addresses they claim are linked to North Korean IT worker scams that infiltrated Western companies—along with photos of men allegedly involved in the schemes...

Google Is Using On-Device AI to Spot Scam Texts and Investment Fraud

Android’s “Scam Detection” protection in Google Messages will now be able to flag even more types of digital fraud...

A week in security (May 4 – May 10)

Last week on Malwarebytes Labs: The AI chatbot cop squad is here Lock and Code S06E09 Android fixes 47 vulnerabilities, including one zero-day. Update as soon as you can! "Your privacy is a promise we don’t break": Dating app Raw exposes sensitive user data FBI issues warning as scammers target...

Tired of Google sponsored ads? So are we! That’s why we’re introducing the option to block them on iOS

Sponsored ads on Google search don’t just irritate users—they also provide a dangerous opportunity for cybercriminals to spread malware and scams to their unsuspecting victims. What looks like a harmless search result can be a carefully disguised trap. At Malwarebytes, our researchers have...

FBI issues warning as scammers target victims of crime

The FBI has issued a warning about an ongoing fraud scheme where criminal scammers are impersonating FBI Internet Crime Complaint Center IC3 employees in order to scam people. Between December 2023 and February 2025, the FBI received over 100 reports of scams involving people posing as IC3...

ClickFix Scam: How to Protect Your Business Against This Evolving Threat

Cybercriminals aren’t always loud and obvious. Sometimes, they play it quiet and smart. One of the tricks of…...

Microsoft partners with Global Anti-Scam Alliance to fight cybercrime

Being the victim of a scam can be devastating. Unfortunately, the number of people who can attest to the truth of this statement, either because they themselves have been scammed or because it has happened to someone they know, is growing. The Global Anti-Scam Alliance GASA reports that in 2024...

Microsoft partners with Global Anti-Scam Alliance to fight cybercrime

Being the victim of a scam can be devastating. Unfortunately, the number of people who can attest to the truth of this statement, either because they themselves have been scammed or because it has happened to someone they know, is growing. The Global Anti-Scam Alliance GASA reports that in 2024...

Phishing Emails Impersonating Qantas Target Credit Card Info

Fake Qantas emails in a sophisticated phishing scam steal credit card and personal info from Australians, bypassing major…...

North Korean Hackers Use Fake Crypto Firms in Job Malware Scam

Silent Push reveals a complex scheme where North Korean hackers posed as crypto companies, using AI and fake…...

Iran-Linked Hackers Target Israel with MURKYTOUR Malware via Fake Job Campaign

The Iran-nexus threat actor known as UNC2428 has been observed delivering a backdoor known as MURKYTOUR as part of a job-themed social engineering campaign aimed at Israel in October 2024. Google-owned Mandiant described UNC2428 as a threat actor aligned with Iran that engages in cyber...

Booking.com Phishing Scam Uses Fake CAPTCHA to Install AsyncRAT

Fake Booking.com emails trick hotel staff into running AsyncRAT malware via fake CAPTCHA, targeting systems with remote access…...

“I sent you an email from your email account,” sextortion scam claims

In a new version of the old “Hello pervert” emails, scammers are relying on classic email spoofing techniques to try and convince victims that they have lost control of their email account and computer systems. Email spoofing basically comes down to sending emails with a false sender address, a...

“Follow me” to this fake crypto exchange to claim $500

A type of crypto scam that we reported about in 2024 has ported over to a new platform and changed tactics—a bit. Where the old scams mostly reached me on WhatsApp, the same group of scammers is now using Direct Messages on X. However, the same old trick of "accidentally" sending you login detail...