The AI Act kicks into action, forces companies to be clear about AI chatbots

The European Union EU has started enforcing key parts of the AI Act, with immediate, visible consequences for chatbots, deepfakes and other consumer‑facing Artificial Intelligence AI systems. From August 2, what you'll likely notice are more "this is AI" labels, clearer rules for powerful...

Californians can tell data brokers to DROP their information

California has launched the Delete Request and Opt‑out Platform DROP, a state‑run portal that lets residents send deletion and opt‑out requests to all registered data brokers in one place. DROP was created under California’s Delete Act, which forces data brokers to register with the California...

A week in security (July 27 – August 2)

Last week on Malwarebytes Labs: Fake Fortnite rewards are stealing players’ accounts Fake Flash Player installs AtlasRAT Malwarebytes for Windows, now available on the Microsoft Store Hims & Hers sued over alleged health data privacy failures Hidden prompt turns Microsoft Copilot into an AI worm...

Fake Fortnite rewards are stealing players’ accounts

Fortnite scam pages like the ones below appear by the dozen every day, recycled endlessly under different names and designs. One version promises $50 from a fake superhero collaboration. Another claims it can calculate what your locker is worth. Both lead to the same destination: a fake Epic Game...

Fake Flash Player installs AtlasRAT

Researchers have described a campaign that delivers a remote access Trojan RAT called AtlasRAT through a fake Flash Player installer. People still go looking for “Flash player” because a surprising amount of content and software was built around Flash and never properly migrated. Users often just...

Malwarebytes for Windows, now available on the Microsoft Store

When you’re setting up a new PC or looking for an app you already know, the Microsoft Store is often the easiest place to start. It’s built into Windows and lets you find, install, and update apps in one place. Malwarebytes for Windows is now available there too. Malwarebytes for Windows is still...

Hims & Hers sued over alleged health data privacy failures

The US Federal Trade Commission FTC, together with Utah and California, has filed a lawsuit against telehealth provider Hims & Hers. The FTC alleges that the company shared consumers’ sensitive health information with third‑party advertising platforms despite promising strong privacy protections...

Hidden prompt turns Microsoft Copilot into an AI worm

A security researcher has demonstrated how Microsoft Copilot for Word can be tricked into spreading a self‑propagating prompt‑injection “AI worm.” The attack silently alters documents and embeds its own hidden instructions into newly created files, allowing it to spread through normal...

Hidden prompt can make Microsoft Copilot spread itself through your Word docs

A security researcher has demonstrated how Microsoft Copilot for Word can be tricked into spreading a self‑propagating prompt‑injection “AI worm.” The attack silently alters documents and embeds its own hidden instructions into newly created files, allowing it to spread through normal...

Apple accused of letting fake crypto app steal $1.8 million

Apple's tagline for its App Store says, "The apps you love. From a place you can trust." You might love the apps, but can you trust the store? A federal lawsuit filed in the Northern District of California last week suggests not. Three people have accused Apple of promoting a fake version of the...

Buying TikTok views or followers? Here’s what you’re really getting

A whole industry has sprung up around selling TikTok "growth." Cheap views by the hundred, pre-made ad accounts, and polished sales pages promising a repeatable path to serious revenue. None of it is officially sanctioned by TikTok, and depending on what you're buying, you could end up wasting...

AI robocalls: Why caller ID is still lying to you

If you feel like your phone has turned into a scam megaphone, you’re not alone. Robocalls have been a problem for years. Artificial intelligence AI is making them slicker, faster, and harder to spot. A new investigation by Transaction Network Services TNS shows that while the big telecom players...

OpenAI explains how its AI agent breached Hugging Face

On July 28, OpenAI published an update on the agent that escaped its sandbox and hacked into Hugging Face during an internal cybersecurity evaluation. In the update, OpenAI reiterates that the “rogue” system was a more capable, pre‑release research model, not something intended for public...

We found 120 fake Walmart stores trying to steal your credit card

Shoppers browsing on their phones are landing on convincing Walmart lookalike sites offering name-brand liquor at 40% to 70% off, only to be led straight to a checkout page asking for a full credit card number, expiry date, and CVV. The sites have no connection to Walmart. They're part of a netwo...

We rebuilt Malwarebytes Mobile Security for the scams of today

Nearly half of people encounter a scam on their phone every single day. Malwarebytes is doing something about it. That figure comes from a 2025 Malwarebytes survey of 1,300 respondents across the US and Europe. The results paint a troubling picture. A quarter of the victims surveyed reported bein...

Shared Claude chats were searchable on Google

Reddit users found that by using a specific Google search query, it was possible to find Claude conversations that users had shared. This exposed sensitive material, including crypto wallet keys, names, addresses, work notes, and even erotic or otherwise policy-violating chats. Fortune says...

Update your iPhone, iPad and Mac to fix Apple security holes

Apple has shipped a hefty round of July security patches, headlined by iOS/iPadOS 26.6, macOS Tahoe 26.6, and Safari 26.6, with dozens of vulnerabilities squashed across kernel, WebKit, media frameworks, and core apps. These updates are primarily about improving security rather than adding new...

Vatican’s Click To Pray app exposed personal data from 700,000 users

A prayer app launched by Pope Francis in 2019 contained a security flaw that exposed the personal information of hundreds of thousands of users before it was finally fixed this year. The app, Click To Pray, was developed by La Machi Communication for Good Causes for the Pope's Worldwide Prayer...

Aftercall ads are driving Android users crazy

Aftercall is a wave of deceptive Android apps on Google Play that pose as everyday tools while bombarding users with pop-up ads after every phone call. When an unexpected ad pops up every time you hang up a call, it will slowly drive you crazy, especially if you can’t figure out what's causing it...

Sextortion scammers are exploiting ShinyHunters data leaks

Sextortion scammers are using email addresses from data leaked by the ShinyHunters hacking group to add some credibility to their feeble attempts to convince people they have embarrassing information about them. Sextortion emails are messages claiming that the scammer recorded you through your...

What’s your data worth on the dark web? (Lock and Code S07E15)

This week on the Lock and Code podcast… Twenty years ago, a British mathematician named Clive Humby popularized a phrase that came to describe data's relationship with the entire global economy: "Data is the new oil." Pithy as the phrase sounds, it is undeniably true. Data steers decisions at...

A week in security (July 20 – July 26)

Last week on Malwarebytes Labs: Don’t get fooled by TikTok resin art scams Call of Duty Mobile scam uses fake free points to steal player accounts OpenAI’s agent escaped its sandbox during a security test Google wants to store a selfie video of your face Beyond the Play Store: How Android threats...

Don’t get fooled by TikTok resin art scams

Resin art has become a popular corner of TikTok, with some videos attracting millions of views. But not every glossy, colorful post is what it claims to be. Scammers are using the look of handmade resin art to trick buyers, collectors, and even fellow artists into sending money for work that eith...

Call of Duty Mobile scam uses fake free points to steal player accounts

Call of Duty Mobile players should watch out for a phishing campaign disguised as a free Call of Duty Points giveaway. Victims are asked to log in with their email address and password to claim free Call of Duty Points CP, the game's premium currency. They're then redirected to a second page aski...

OpenAI’s agent escaped its sandbox during a security test

During an internal OpenAI security evaluation, a chain of AI models escaped its sandbox, reached the internet, and then accessed Hugging Face infrastructure to complete the test objective. OpenAI is a leading artificial intelligence AI research and deployment company. Its best-known product is...

Google wants to store a selfie video of your face

Google has started rolling out a new way to recover access to your account if you’ve lost your phone or forgotten your password: a “selfie video” verification option. After recording a short video of your face during setup, you can later submit another video during account recovery to prove you a...

Beyond the Play Store: How Android threats really spread

You probably think of your phone's security the way you think of your front door: as long as you're downloading apps from the Play Store, you're safe. And for the most part, that's true. Google reviews apps before they’re published. But some apps reach your phone without ever passing through the...

Millions of cars could be tracked and unlocked by a hidden security flaw

A car alarm vendor's coding mistake has left millions of vehicles vulnerable to theft and location tracking. Thanks to the way dealers sell car alarms, many affected drivers don't even know they have one installed. The device is the KARR Security System, a Bluetooth-enabled aftermarket alarm buil...

WhatsApp Web chats exposed by Adobe’s Acrobat extension flaw

HermeticReader is the name given to a recently disclosed vulnerability in the Adobe Acrobat PDF extension for Chrome, tracked as CVE-2026-48294. Researchers discovered the issue in early June 2026 and reported it to Adobe, which patched the flaw over a single weekend. They found that a single vis...

Chick-fil-A loyalty accounts hijacked using stolen passwords

Fast-food chain Chick-fil-A is warning customers after attackers hijacked loyalty accounts using stolen passwords in a credential stuffing attack. Chick-fil-A says it detected suspicious login activity against some Chick-fil-A One accounts in June and launched an investigation. The company later...

Paidwork breach exposes data of 23 million users: Check if you’re affected

A data breach at Paidwork, a platform that pays people small amounts to complete online microtasks, has exposed personal and financial information of more than 23 million users. According to public breach reports, the intrusion took place in March 2026, with the stolen database first advertised o...

What happens if you visit a WordPress site hacked through wp2shell?

WordPress has patched a serious core vulnerability chain known as wp2shell, and site owners are understandably focused on updating their own sites. But there’s another question worth asking: what happens to ordinary visitors when they land on a compromised site? Because a hacked website becomes a...

New ClickLock Stealer locks your Mac until you hand over your password

ClickLock Stealer is a new, modular macOS infostealer delivered via ClickFix-style phishing pages that can lock a victim’s Mac, steal their macOS password, browser and password manager data, cryptocurrency wallets, and then leave behind a persistent backdoor. The malware was discovered by Group-I...

Don’t trust that “FBI agent” in your DMs

The Federal Bureau of Investigation’s FBI Internet Crime Complaint Center IC3 is warning that scammers are impersonating the bureau on social media and on messaging apps, targeting people who’ve already been victims of cybercrime. The FBI has issued warnings like this before, but scammers posing ...

AI nudify apps spark legal scrutiny of Apple and Google’s profits

You expect all kinds of apps on Apple's App Store and Google's Play Store, from weather monitors to home automation apps and games. What you might not expect are apps that can create non-consensual nude imagery from ordinary photos. But they exist, and the City of San Francisco has had enough. On...

The Odyssey piracy scams appear within hours of the movie’s release

Christopher Nolan's The Odyssey is one of the biggest movie releases of the year and scammers wasted no time taking advantage of it. Within hours of the film's release, we found scams targeting people looking for pirated copies. Some used fake browser warnings on piracy sites, while others...

Healthcare giant Abbott probes two cyber incidents amid extortion claims

Abbott Laboratories, one of the world's largest healthcare and medical device companies, is investigating two apparently unrelated cyber incidents after confirming unauthorized access to internal systems. While Abbott says there has been no impact on manufacturing, laboratory operations, or patie...

Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding

We have detected several campaigns using fake downloads of games, mods, cracks, and software to spread RenPy Loader. Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer. Amatera is ...

A week in security (July 13 – July 19)

Last week on Malwarebytes Labs: Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords How to use GitHub safely The backlash against Flock cameras is spreading Security updates available for Adobe, Chrome, Firefox, VMWare, and Zoom Samsung backs down on threat to delete health data Clau...

Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords

Shark’s cloud-connected robot vacuums are currently exposed by an unpatched AWS Amazon Web Services IoT Internet of Things policy flaw that could turn one compromised device into a remote-control skeleton key for many others in the same region, with access to cameras, maps, and Wi‑Fi passwords. A...

How to use GitHub safely

GitHub is rapidly becoming the go-to platform for sharing software. Originally built for developers to collaborate on code, it now hosts millions of projects ranging from hobby scripts to widely used applications. That popularity, however, has also made it an attractive delivery platform for...

The backlash against Flock cameras is spreading

Flock-style ALPR systems carry serious privacy and civil-liberties risks, and the backlash is now starting to show up in agency decisions too. For those not yet familiar with Flock, Flock Safety operates an automated license plate recognition ALPR system that uses cameras and computer vision to...

Security updates available for Adobe, Chrome, Firefox, VMWare, and Zoom

Security updates are not just for enterprises with a dedicated security team and a change-management calendar. For consumers and small businesses, they are one of the simplest ways to shut down known attack paths before criminals get a chance to use them. That matters because attackers love these...

Samsung backs down on threat to delete health data

If you pay for something, you expect it to work as intended. The vendor shouldn't start turning features off just because you won't accept its new rules. Someone should tell Samsung, which just upset users of its health app by threatening exactly that—before changing course after a user backlash...

Claude for Chrome flaw could let rogue extensions access your Gmail

First reported in May, ClaudeBleed is basically a “fake remote control” problem. A sneaky browser extension can pretend to be Claude’s own website and secretly drive the Claude for Chrome extension to read your data and take action in your accounts. The Claude for Chrome browser extension is an...

July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days

Just one month ago, June 2026 Patch Tuesday broke Microsoft’s previous record with 206 CVEs and three zero‑days. July now triples that count, reinforcing that the era of “small” Patch Tuesdays may be over as AI‑driven vulnerability discovery ramps up. The update includes 59 critical...

This fake Apple app can unlock your Mac’s password vault

CrashStealer is a new macOS infostealer that masquerades as Apple’s CrashReporter component, uses an Apple‑notarized installer to slip past Gatekeeper, tricks users into handing over their password, and then systematically loots browsers, password managers, crypto wallets, and Keychain secrets...

Warning: Scammers are using FaceTime to empty bank accounts

Apple is urging users to treat any suspicious FaceTime call or message as untrusted, especially if it involves payments, refunds, password resets, or requests for personal information. This warning appears in a broader Apple support article about scams that target iPhone and iPad users through...

The inside job that cost ransomware victims millions

When a ransomware crew locks up your servers, the outside negotiator you hire has to know everything about you so that they can negotiate a smaller ransom payment. You tell them what your cyber-insurance covers and what your board is willing to pay. You have to. That's the whole reason you hire...

Trusting your kids online isn’t enough (Lock and Code S07E14)

This week on the Lock and Code podcast … There is a lot going on right now regarding the safety of kids online. In the United States, the majority of state legislatures have passed age verification laws requiring a variety of websites to more rigorously verify the age of their visitors. In the...