A week in security (November 24 – November 30)

Last week on Malwarebytes Labs: How CVSS v4.0 works: characterizing and scoring vulnerabilities Millions at risk after nationwide CodeRED alert system outage and data breach Holiday shoppers targeted as Amazon and FBI warn of surge in account takeover attacks Fake LinkedIn jobs trick Mac users in...

Holiday shoppers targeted as Amazon and FBI warn of surge in account takeover attacks

The FBI has issued a public service announcement warning about a surge in account takeover ATO fraud, and the timing lines up with a major alert Amazon has just sent to its 300 million customers about brand impersonation scams. How ATO fraud works Account takeover fraud is just what it says:...

A week in security (November 17 – November 23)

Last week on Malwarebytes Labs: AI teddy bear for kids responds with sexual content and advice about weapons Fake calendar invites are spreading. Here’s how to remove them and prevent more Budget Samsung phones shipped with unremovable spyware, say researchers What the Flock is happening with...

Holiday scams 2025: These common shopping habits make you the easiest target

Every year, shoppers get faster, savvier, and more mobile. We compare prices on the go, download apps for coupons, and jump on deals before they disappear. But during deal-heavy periods like Black Friday, Cyber Monday, and the December shopping rush, convenience can work against us. Quick...

Scam USPS and E-Z Pass Texts and Websites

Google has filed a complaint in court that details the scam: In a complaint filed Wednesday, the tech giant accused "a cybercriminal group in China" of selling "phishing for dummies" kits. The kits help unsavvy fraudsters easily “execute a large-scale phishing campaign,” tricking hordes of...

A week in security (November 10 – November 16)

Last week on Malwarebytes Labs: Be careful responding to unexpected job interviews Your passport, now on your iPhone. Helpful or risky? 1 million victims, 17,500 fake sites: Google takes on toll-fee scammers Are you paying more than other people? NY cracks down on surveillance pricing We opened a...

Malicious code in teate-thy-sonic-ucuwaz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66e22526584efeb8a7cbf9ea2c1978ceb89a493f9ea66fcbaa0d254302fcea71 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-122518 Malicious code in plastic_dragon_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a21a1704e6d0184997584a8926fdcf2a11ad856c831613a52ab6580101200f4e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-120231 Malicious code in gilang-bubursumsum39-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 942a689d7b8a42e3f7885abe011ea9a51a43afdb180e8f78a0934d72c324ac8f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dizzy_wildebeest_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbd3a1cab61a0b1cc491f561b818284208479869b242dd06a6d30647bf32f749 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114409 Malicious code in hadi-kepok23-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fda33c8528769212a9efb9df2c3134201a9f9936688d8076c3558f303a62305 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-106286 Malicious code in new_cougar_0xrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f92909ba5c1b5a04e1e44f0b924ff0e799c410c9ea6b6d7cef7067739636b968 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in secure_elk_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 782c34775f209f41a8dc8cb35790c1469c0a375c5c7f535db9a035b0b36c785f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-67067 Malicious code in bright-cyan-mollusk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e624eb7541389ca5048b028459307b1e998c0bdcc290fda59e290b5083c63662 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in budi-kupang33-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d5b3558d4fbbd4aa111c5722f37c8f35091b0f32c1a9310c69f7c16db9e2809 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Google Launches New Maps Feature to Help Businesses Report Review-Based Extortion Attempts

Google on Thursday said it's rolling out a dedicated form to allow businesses listed on Google Maps to report extortion attempts made by threat actors who post inauthentic bad reviews on the platform and demand ransoms to remove the negative comments. The approach is designed to tackle a common...

A week in security (October 27 – November 2)

Last week on Malwarebytes Labs: Update Chrome now: 20 security fixes just landed How scammers use your data to create personalized tricks that work Ransomware gang claims Conduent breach: what you should watch for next Fake PayPal invoice from Geek Squad is a tech support scam Atlas browser’s...

Google's Built-In AI Defenses on Android Now Block 10 Billion Scam Messages a Month

Google on Thursday revealed that the scam defenses built into Android safeguard users around the world from more than 10 billion suspected malicious calls and messages every month. The tech giant also said it has blocked over 100 million suspicious numbers from using Rich Communication Services...

Social Engineering People’s Credit Card Details

Good Wall Street Journal article on criminal gangs that scam people out of their credit card information: Your highway toll payment is now past due, one text warns. You have U.S. Postal Service fees to pay, another threatens. You owe the New York City Department of Finance for unpaid traffic...

A week in security (October 20 – October 26)

Last week on Malwarebytes Labs: Is AI moving faster than its safety net? Thousands of online stores at risk as SessionReaper attacks spread Apple may have to open its walled garden to outside app stores Meta boosts scam protection on WhatsApp and Messenger Home Depot Halloween phish gives users a...