How to remove a user from a shared Android device

Some of our loyal readers may remember my little mishap when I was able to track my wife by accident after inadvertently adding myself to her phone as a user. For exactly that reason we want to warn against sharing devices and at least show you how to remove other people’s accounts from your...

Scammers can easily phish your multi-factor authentication codes. Here’s how to avoid it

More and more websites and services are making multi-factor-authentication MFA mandatory, which makes it much harder for cybercriminals to access your accounts. Thats a great thing. But as security evolves, so do cybercriminals who are always looking for new ways to scam us. A type of phishing we...

Porn panic imperils privacy online, with Alec Muffett (re-air): Lock and Code S05E08

This week on the Lock and Code podcast… A digital form of protest could become the go-to response for the world’s largest porn website as it faces increased regulations: Not letting people access the site. In March, PornHub blocked access to visitors connecting to its website from Texas. It marke...

ChatGPT accused of breaking data protection rules

Italys Data Protection Authority GPDP has uncovered data privacy violations related to collecting personal data and age protections after an inquiry into OpenAI’s ChatGPT. OpenAI has 30 days to respond with a defense. ChatGPT is an artificial intelligence AI chatbot that can engage in conversatio...

A week in security (December 25 – December 31)

Last week on Malwarebytes Labs: How to recognize AI-generated phishing mails How ransomware operators try to stay under the radar 4 sneaky scams from 2023 The top 4 ransomware gang failures of 2023 Have a safe 2024! Our business solutions remove all remnants of ransomware and prevent you from...

A week in security (December 11 – December 17)

Last week on Malwarebytes Labs: PikaBot distributed via malicious search ads Chrome starts the countdown to the end of tracking cookies Apple to introduce new feature that makes life harder for iPhone thieves Recently-patched Apache Struts vulnerability used in worldwide attacks ALPHV ransomware...

PikaBot distributed via malicious search ads

During this past year, we have seen an increase in the use of malicious ads malvertising and specifically those via search engines, to drop malware targeting businesses. In fact, browser-based attacks overall have been a lot more common if we include social engineering campaigns. Criminals have...

Will ChatGPT write ransomware? Yes.

This morning I decided to write some ransomware, and I asked ChatGPT to help. Not because I wanted to turn to a life of crime, but because I wanted to see if anything had changed since March, when I last tried the same exact thing. In short: ChatGPT has helped me, worryingly so. But more on that...

Announcing NEW Malwarebytes Identity Theft Protection

We’ve always been committed to keeping you safe and secure online. But these days, cybersecurity isn’t just about defending you from malware; it’s about protecting your—and your family’s—entire digital identity. We know that people are worried. In fact, in our latest report, titled “Everyone’s...

1Password reports security incident after breach at Okta

Password manager 1Password says it’s been affected by a breach at Okta, but it reports no user data has been stolen. In a security incident report, 1Password says that a member of its IT team received an unexpected email suggesting they had initiated an Okta report of a list of admins. They hadnt...

Stalkerware activity drops as glaring spying problem is revealed

North America has a spying problem. Its perpetrators are everyday people. According to recent research from Malwarebytes, 62 percent of people in the United States and Canada admitted to monitoring their romantic partners online in one form or another, from looking through a spouses or significan...

CISA catalog passes 1,000 known-to-be-exploited vulnerabilities. Celebration time, or is it?

On September 18, 2023, the Cybersecurity & Infrastructure Security Agency CISA announced that its Known Exploited Vulnerabilities KEV catalog has reached the milestone of covering more than 1,000 vulnerabilities since its launch in November 2021. This may seem like a lot, but with over 25,000 new...

Multi-factor authentication has proven it works, so what are we waiting for?

Recently, Amazon announced that it will require all privileged Amazon Web Services AWS accounts to use multi-factor authentication MFA, starting in mid-2024. Our regular readers will know that we feel that passwords alone are not adequate protection, especially not for your important accounts. So...

Compromised Free Download Manager website was delivering malware for years

In a public announcement, Free Download Manager has acknowledged that a specific web page on its site was compromised by a Ukrainian cybercrime group, exploiting it to distribute malware. Free Download Manager is--unsurprisingly--a download manager for Windows, macOS, Android, and Linux that allo...

A week in security (September 11 - September 17)

Last week on Malwarebytes Labs: Europol lifts the lid on cybercrime tactics Malwarebytes wins every Q2 MRG Effitas award & scores 100% on new phishing test Watch out, this LastPass email with "Important information about your account" is a phish iPhone 15 launch: Wonderlust scammers rear their...

A week in security (August 28 - September 3)

Last week on Malwarebytes Labs: 2.6 million DuoLingo users have scraped data released Google strengthens its Workplace suite protection Meal delivery service PurFoods announces major data breach Cisco VPNs without MFA are under attack by ransomware operator "An influx of Elons," a hospital visit,...

Cisco VPNs without MFA are under attack by ransomware operator

The Cisco Product Security Incident Response Team PSIRT has posted a blog about Akira ransomware targeting VPNs without Multi-Factor Authentication MFA. The Cisco team states that it is aware of reports of the Akira ransomware group going specifically after Cisco VPNs that are not configured for...

Meal delivery service PurFoods announces major data breach

An organisation that provides home delivery meals has revealed that around 1.2 million people's personal data may be at risk, after the company suffered a ransomware attack earlier in the year. PurFoods, which offers up a service called Moms Meals, helps to provide meals for folks in a variety of...

Google strengthens its Workplace suite protection

Google has announced the strengthening of safeguard measures for its Workspace customers. You may well be using Workspace without realising it. If youre using a Google product such as Gmail, Calendar, Drive, or Google Docs Editors Suite among other apps, then congratulations: you are fully inside...

Old exploit kits still kicking around in 2023

The year is 2023 and there still are some people using Internet Explorer on planet Earth. More shocking perhaps, is the fact there are still threat actors maintaining exploit kit infrastructure and dropping new malware. In this quick blog post, we review two well-known toolkits from the past,...

Voter data stolen in UK Electoral Commission systems breach

The UK's Electoral Commission has revealed it suffered a compromise which has the potential to expose aspects of registered voters' data. While much of this data may already be public, there are some privacy and safety concerns to consider. First of all, lets take a look at whats been affected. T...

TikTok facing fines for violating children’s privacy

The European Data Protection Board is expected to fine TikTok for violating the privacy of young children within the next four weeks. The European Data Protection Board said a binding decision has been reached over TikTok's processing of childrens data, after the ByteDance-owned app submitted leg...

A week in security (July 24 - July 30)

Last week on Malwarebytes Labs: Zimbra issues awaited patch for actively exploited vulnerability Patch now! Ivanti Endpoint Manager Mobile Authentication vulnerability used in the wild 60,000 Androids have stalkerware-type app Spyhide installed Ransomware groups claim responsibility for...

Spy vs. spy: Exploring the LetMeSpy hack, with maia arson crimew

The language of a data breach, no matter what company gets hit, is largely the same. There's the stolen data--be it email addresses, credit card numbers, or even medical records. There are the users--unsuspecting, everyday people who, through no fault of their own, mistakenly put their trust into...

New technique can defeat voice authentication "after only six tries"

Voice authentication is back in the news with another tale of how easy it might be to compromise. University of Waterloo scientists have discovered a technique which they claim can bypass voice authentication with "up to a 99% success rate after only six tries". In fact this method is apparently ...

Spyware app LetMeSpy hacked, tracked user data posted online

Stalkerware-type app LetMeSpy says it has been hacked, with the attacker taking user data with it. From the message posted to the login screen on the LetMeSpy website: On June 21, 2023, a security incident occurred involving obtaining unauthorized access to the data of website users. As a result ...

Criminal secure messaging system takedown: 6500+ arrests and €900 million+ seized

In 2020, we reported on how law enforcement managed to compromise a secure communications system set up by and for criminals. Now, Europol has published a progress report showing the enormous impact the infiltration of the encrypted communications tool EncroChat made. EncroChat, a company based i...

Understanding ransomware reinfection: An MDR case study

Ransomware is like that stubborn cold that you thought you kicked, but creeps back up determined to run amok again. The question is what medicine is available to kick this nasty infection for good. In this post, we'll break down the idea of ransomware reinfection and share a real-life episode whe...

Baby monitor safety: What you need to know

Do you have an impending new arrival in your family of the small and very noisy variety? If so, youre probably going to invest in a baby monitor for peace of mind both at night and during the day. But do you know what kind of monitor youre going to buy? Will it be audio only, or have images? Will...

How Coffee County Schools safeguards 7500 students and 1200 staff

We're excited to announce that our much-anticipated 4th edition of the Byte Into Security webinar series is now available on-demand. Originally aired on May 31st, this session is a goldmine for those facing the unique challenges of K-12 cybersecurity. The webinar is free, and you can watch it rig...

Facebook clickbait leads to money scam for users

Online criminals are notorious for lurking on social media sites and tricking users into visiting malicious links. We recently observed a scheme where Facebook users are clicking on posts that lead to external websites set up for the sole purpose of scamming them out of hundreds of dollars via fa...

US hospital forced to divert ambulances after cyberattack

The Idaho Falls Community Hospital fell victim to a cyberattack on Monday May 29, 2023. As a result, the hospital had to divert ambulances to other nearby hospitals and close some of its clinics. The hospital is keeping the public updated through its website and Facebook page. "Our commitment to...

ChatGPT: Cybersecurity friend or foe?

If you havent heard about ChatGPT yet, perhaps youve just been thawed from cryogenic slumber or returned from six months off the grid. ChatGPT--the much-hyped, artificial intelligence AI chatbot that provides human-like responses from an enormous knowledge base--has been embraced practically...

Child safety app riddled with vulnerabilities: Update now!

An app designed to restrict screen time and add a "kids' mode" for children on smart devices has been found to have a broad range of security issues. The app, "Parental Control - Kids Place" is an Android app which is incredibly popular, sporting 5M+ downloads on its Google Play page. In terms of...

New Discord username policy raises user privacy fears

Discord, the Voice over IP VoIP and instant message communications tool, is changing how usernames function in a major way soon. Many users are not keen on this change at all. What is going on over there, and why are so many people concerned about the upcoming alterations? When Discord launched...

The rise of "Franken-ransomware," with Allan Liska: Lock and Code S04E11

Ransomware is becoming bespoke, and that could mean trouble for businesses and law enforcement investigators. It wasn't always like this. For a few years now, ransomware operators have congregated around a relatively new model of crime called "Ransomware-as-a-Service." In the...

Apple releases first Rapid Security Response update for iOS, iPadOS, and macOS users

On Monday, Apple released its first batch of Rapid Security Response RSR patches, iOS 16.4.1 a, iPadOS 16.4.1 a, and macOS 13.3.1 a, for iPhone and iPad, and macOS devices, respectively. RSR is a new type of software patch delivered between Apple's regular, scheduled software updates. Previously,...

Ransomware in France, April 2022–March 2023

This article is based on research by Marcelo Rivero, Malwarebytes' ransomware specialist, who monitors information published by ransomware gangs on their dark web sites. In this report, "known attacks" are attacks where the victim opted not to pay a ransom. This provides the best overall picture ...

New tool allows you to opt out of Facebook's targeted advertising

After Meta Facebook and Instagram switched the legal basis for targeting advertising from automatic consent to opt-out, privacy watchdog noyb has built a tool for users to opt out of targeted advertising and various other claims made by Meta in an easy and legally sound way. After losing several...

A week in security (March 27 - April 2)

Last week on Malwarebytes Labs: Solving the passwords hardest problem with passkeys, featuring Anna Pobletts Food giant Dole reveals more about ransomware attack Bogus Chat GPT extension takes over Facebook accounts Ransomware gunning for transport sector's OT systems next GitHub accidentally...

3 tips for creating backups your organization can rely on when ransomware strikes

Backups are an organization's last line of defense against ransomware, because comprehensive, offline, offsite backups give you a chance to restore or rebuild your computers without paying a criminal for a decryption key. Unfortunately, many organizations don't realize how important it is to make...

Bogus Chat GPT extension takes over Facebook accounts

If youre particularly intrigued by the current wave of interest in AI, take care. Theres some bad things lurking in search engine results waiting to compromise your Facebook account. A rogue Chrome extension deployed in a campaign targeting Facebook users is "hitting thousands a day" according to...

ChatGPT leaks bits of users' chat history

New gadgets and software come with new bugs, especially if they're rushed. We can see this very clearly in the race between tech giants to push large language models LLMs like ChatGPT and its competitors out the door. In the most recently revealed LLM bug, ChatGPT allowed some users to see the...

USB bombs sent to news organizations

We've warned about the possible dangers arising from plugging in unknown USB sticks before, but the dangers we're concerned with are normally confined to your data. However, this week we learned a far more serious threat. No fewer than five different news agencies in Ecuador were sent parcels...

How to avoid potentially unwanted programs

If youve ever downloaded software onto your computer, chances are youve unknowingly cluttered your machine with PUPs. Heres what you need to know about these sneaky programs. What are PUPs? If you're thinking baskets of doe-eyed baby dogs, then you're sadly mistaken. PUPs is the acronym for...

Facebook illegally processed user data, says court

The Amsterdam court has ruled that Facebook illegally processed user data in a case started by the Dutch Data Privacy Stichting DPS, a foundation that acts on behalf of victims of privacy violations in the Netherlands. According to the ruling, Facebook used personal data for advertising purposes ...

A week in security (March 6 - 12)

Last week on Malwarebytes Labs: 8 cybersecurity tips to keep you safe when travelling National Cybersecurity Strategy Document: What you need to know Intel CPU vulnerabilities fixed. But should you update? Warning issued over Royal ransomware Play ransomware gang leaks City of Oakland data...

8 cybersecurity tips to keep you safe when travelling

The best way to keep your devices safe when you're travelling is to be unplugged. If you don't need it, don't take it with you. But since that is not always an option, here are some tips to keep you safe while you travel. 1. Backup before you go The consequences of losing your device or having it...

How to work from home securely, the NSA way

People working remotely is no longer unusual, so the National Security Agency NSA has produced a short Best Practices PDF document detailing how remote workers can keep themselves safe from harm. In fact, the guide can also be applied to people using computers at home generally and is written in ...

TikTok probed over child privacy practices

The privacy protection authorities for Canada, Quebec, British Columbia, and Alberta have announced they will start an investigation into TikTok's privacy practices, especially in relation to its younger users. The investigation will include whether the company obtained valid and meaningful conse...