What’s there to save about social media? (Lock and Code S06E20)

This week on the Lock and Code podcast … "Connection" was the promise—and goal—of much of the early internet. No longer would people be separated from vital resources and news that was either too hard to reach or made simply inaccessible by governments. No longer would education be guarded behind...

A week in security (September 29 – October 5)

Last week on Malwarebytes Labs: From threats to apology, hackers pull child data offline after public backlash Your Meta AI conversations may come back as ads in your feed Scam Facebook groups send malicious Android malware to seniors Sendit tricked kids, harvested their data, and faked messages,...

Sex offenders, terrorists, drug dealers, exposed in spyware breach

We've covered spyware and stalkerware leaks many times before, but we don't often see such exposure in software used by law enforcement. According to a report by Straight Arrow News SAN, the hacker “wikkid” said the intrusion against RemoteCOM was “one of the easiest” they’d ever carried out...

Grok, ChatGPT, other AIs happy to help phish senior citizens

If you are under the impression that cybercriminals need to get their hands on compromised AI chatbots to help them do their dirty work, think again. Some AI chatbots are just so user friendly that they can help the user craft phishing text, and even malicious HTML and Javascript code. A few week...

Roblox introduces age checks to use communication features

Roblox is an online platform that allows users to build, play and share online worlds and 3D games. Unfortunately, it’s also a popular platform among predators reaching out to kids and seducing them using game features such as messaging, avatar customization, and role-play. Over the years, the...

Popular Android VPN apps found to have security flaws and China links

People use VPNs for different security and privacy reasons, to access content anonymously, or to bypass content controls and age verification by pretending to be in different places. But not all VPNs are created equal. A recent report has revealed that many of them might allow others to sniff you...

Google settles YouTube lawsuit over kids’ privacy invasion and data collection

Google has agreed to a $30 million settlement in the US over allegations that it illegally collected data from underage YouTube users for targeted advertising. The lawsuit claims Google tracked the personal information of children under 13 without proper parental consent, which is a violation of...

Weight loss scams, or why ‘Jodie Foster’ wants me to lose weight

It seems like it's hard to move on social media without some kind of mention of weight-loss injections these days. And, sure, these drugs can have a positive affect for many people, but not all these cases of weight loss are real, nor are the people promoting them who they say they are. Weight-lo...

WeTransfer walks back clause that said it would train AI on your files

File sharing site WeTransfer has rolled back language that allowed it to train machine learning models on any files that its users uploaded. The change was made after criticisms from its users. The company had quietly inserted the new language in the terms and conditions on its website. Sometime...

Amazon warns 200 million Prime customers that scammers are after their login info

Amazon has sent out an alert to its 200 million customers, warning them that scammers are impersonating Amazon in a Prime membership scam. In the email, sent earlier this month, Amazon said it had noticed an increase in reports about fake Amazon emails: What 's happening: Scammers are sending fak...

CNN, BBC, and CNBC websites impersonated to scam people

Researchers have uncovered a large campaign impersonating news websites, such as those from CNN, BBC, CNBC, News24, and ABC News, to promote investment scams. Adding a well known brand to your scammy site is a tale as old as time, and gives it an air of legitimacy that increases the likelihood th...

Microsoft, PayPal, DocuSign, and Geek Squad faked in callback phishing scams

Microsoft, DocuSign, Adobe, McAfee, NortonLifeLock, PayPal, and Best Buy’s Geek Squad are being impersonated online through malicious emails that contain fake telephone support numbers and dangerous QR codes that can ensnare victims into phishing scams. The brands and their products are frequentl...

Facial recognition: Where and how you can opt out

Our remote team recently took a trip to our Estonian office. When we arrived from our various destinations, we started chatting about how our travel had been. Our senior privacy advocate, David Ruiz, mentioned that he'd opted out of facial recognition while at San Francisco International Airport...

44% of people encounter a mobile scam every single day, Malwarebytes finds

It’s become so troublesome owning a phone. Malicious texts pose as package delivery notifications, phishing emails impersonate trusted brands, and unknown calls hide extortion attempts, virtual kidnapping schemes, or AI threats. Confusingly, even legitimate businesses now lean on outreach tactics...

Google Chrome will use AI to block tech support scam websites

Google has expressed plans to use Artificial Intelligence AI to stop tech support scams in Chrome. With the launch of Chrome version 137, Google plans to use the on-device Gemini Nano large language model LLM to recognize and block tech support scams. Users already have the ability to chose...

1 in 10 people do nothing to stay secure and private on vacation

This year, Spring Break vacationers are packing more than their flip-flops, bucket hats, and sunglasses—they’re also packing a few cybersecurity anxieties for the trip. According to new research from Malwarebytes, 52% of people said they “worry about being scammed while traveling,” while another...

PayPal scam abuses Docusign API to spread phishy emails

PayPal scammers are using an old Docusign trick to enhance the trustworthiness of their phishing emails. We've received several reports of this recently, so we dug into how the scam works. The Docusign Application Programming Interface API allows “customers” to send emails that come from genuine...

Background check provider data breach affects 3 million people who may not have heard of the company

Employment screening company DISA Global Solutions has filed a data breach notification after a cyber incident on their network. DISA says a third party had access to its environment between February 9, 2024, and April 22, 2024. The attacker may have accessed over three million files containing...

Macs targeted by infostealers in new era of cyberthreats

The latest, major threats to Mac computers can steal passwords and credit card details with delicate precision, targeting victims across the internet based on their device, location, and operating system. These are the dangers of “infostealers,” which have long plagued Windows devices but, in the...

DNA testing company vanishes along with its customers’ genetic data

.kb-row-layout-wrap.wp-block-kadence-rowlayout.kb-row-layout-id12063564d0c4-23margin-top:0px;margin-bottom:var--global-kb-spacing-sm, 1.5rem;.kb-row-layout-id12063564d0c4-23 .kt-row-column-wrapalign-content:center;:where.kb-row-layout-id12063564d0c4-23 .kt-row-column-wrap...

Comcast and Truist Bank customers impacted by debt collector’s breach

A data breach at Financial Business and Consumer Solutions FBCS, a US debt collection agency, has led to the loss of data of some Comcast Cable Communications and Truist Bank customers. FBCS is in the business of collecting unpaid debts on behalf of its customers. The data breach occurred in...

A week in security (August 12 – August 18)

Last week on Malwarebytes Labs: Dozens of Google products targeted by scammers via malicious search ads Microsoft patches bug that could have allowed an attacker to revert your computer back to an older, vulnerable version We’re making it easier for you to protect your identity X accused of...

A week in security (November 27 – December 3)

Last week on Malwarebytes Labs: Explained: Domain fronting Will ChatGPT write ransomware? Yes. Associated Press, ESPN, CBS among top sites serving fake virus alerts Meta sued over forcing users to pay to stop tracking Update now! Chrome fixes actively exploited zero-day vulnerability Many major...

Many major websites allow users to have weak passwords

A new study that examines the current state of password policies across the internet shows that many of the most popular websites allow users to create weak passwords. For the Georgia Tech study, the researchers designed an algorithm that automatically determined a website’s password policy. With...

FBI warns of multiple ransomware attacks on same victim

The Federal Bureau of Investigation FBI has released a notification that highlights two trends emerging across the ransomware environment. The trends the FBI says it's noticed since July 2023 are: Multiple ransomware attacks on the same victim in close date proximity. New data destruction tactics...

Child health data stolen in registry breach

Canadian healthcare organization Better Outcomes Registry & Network BORN has disclosed a data breach affecting client data. BORN--an Ontario perinatal and child registry that collects, interprets, shares, and protects critical data about pregnancy, birth, and childhood--says it was attacked on Ma...

Victim records deleted after spyware vendor compromised

Anonymous hackers have breached the servers of spyware app "WebDetetive", accessing the user database. However, this doesnt appear to be a typical compromise along the lines of stealing the data, according to Tech Crunch. Instead, its part of a slow move toward "spying" apps being attacked and...

Ransomware in Germany, April 2022 – March 2023

This article is based on research by Marcelo Rivero, Malwarebytes' ransomware specialist, who monitors information published by ransomware gangs on their Dark Web sites. In this report, "known attacks" are attacks where the victim opted not to pay a ransom. This provides the best overall picture ...

Woman tracks down and turns table on Airbnb scammer

The internet is full of Airbnb scams and accounts told by victims. But there is a twist in this latest story-gone-viral that is usually lacking in most narratives: The victim evens the score. Airbnb host and scammer "Mr. Tyler" met his match when his would-be guest, TikTok user Olivia @livvoogus,...

IoT garage door exploit allows for remote opening attack

A popular and reasonably cheap garage door controller is making waves in the news, and not in a good way. Ars Technica reports that the $80 devices created by Nexx are suffering from a number of security issues which could compromise the safety of your home. A Medium post by researcher Sam Sabeta...

Should you share passwords with your partner?

To share or not to share? When it comes to love and romance, that is the password question, isn't it? This Valentine's Day, we attempt to lift the lid on this steamy cybersecurity subject to see if two people in a romantic relationship are both on board on the matter of exchanging passwords with...

How the CISA catalog of vulnerabilities can help your organization

The Cybersecurity and Infrastructure Security Agency CISA maintains a "known exploited vulnerabilities catalog" which can be useful if you need help prioritizing the patching of vulnerabilities. In essence it is a long list of vulnerabilities that are actually being used by criminals to do harm,...

A week in security (November 28 - December 4)

Last week on Malwarebytes Labs: Fraudster site iSpoof shut down, 142 arrested internationally 3 threats to watch out for this Cyber Monday Twitter user data leaks continue to drip from the faucet China-made equipment banned by FCC due to national security threat Sensitive police records stolen an...

Teen talk: What it's like to grow up online, and the role of parents: Lock and Code S03E21

Growing up is different for teens today. Issues with identity, self-expression, bullying, fitting in, and trusting your friends and family--while all those certainly existed decades ago, they were never magnified in quite the same way that they are today, and that's largely because of one enormou...

Romance scammer given 25 years of alone time

Romance scams are often low risk, high reward strategies for ciminals, who use them to steal large sums of money from vulnerable people in the cruellest ways possible. Once the victim wires the cash, theres a good chance that its never coming back. The perpetrator has almost certainly covered the...

Donut breach: Lessons from pen-tester Mike Miller: Lock and Code S03E17

When Mike Miller was hired by a client to run a penetration test on one of their offices, he knew exactly where to start: Krispy Kreme. Equipped with five dozen donuts the boxes stacked just high enough to partially obscure his face, Miller said, Miller walked briskly into a side-door of his...

The Quad commits to strengthening cybersecurity in software, supply chains

The United States, Australia, and its Asian partners—India and Japan—have agreed to work on several cybersecurity initiatives on software, supply chain, and user data. The countries leaders, who convened in Tokyo on May 24, 2022, have met annually four times since the revival of the...

Why MITRE matters to SMBs

Running a small- to medium-sized business SMB requires expertise in everything, from marketing and sales to management and hiring, but in the ever-expanding list of executive responsibilities, one particular item demands attention: Cybersecurity. Cyberattacks can—and have—shuttered entire...

Looking over your shoulder: when small mistakes have big consequences

People up to no good get themselves caught in an endless number of ways. This has always been the case in the real world, and continues to be true online. No matter how talented, how daring the schemes, greed and the desire for fame often win out. This has disastrous consequences for those caught...

“Threatening and coercive” cold-callers who targeted the elderly hit with big fines

Every so often, fines hit the news as a result of phone/communication spam. Much of it targets older members of society. Sometimes folks say these calls are “just” irritants and nothing to particularly worry about. But it can be really serious, resulting in big chunks of people’s savings being...

Ransomware gangs are recruiting breached individuals to persuade companies to pay up

Youve heard about ransomware, where attackers lock up your files and demand a payment for the decryption key. You may also have heard about ransomware attackers not only locking up your files, but also threatening to release the stolen data in an attempt to get you to pay up. What you may not hav...

Nintendo warns of imitation websites and suspicious hardware

Brave indeed is the soul who decides to take on Nintendo with scam-filled behaviour online. The console legends have a long history of crunching down on fraud, as well as gaming past-times some would consider to be harmless. Whether you create fan-made games, offer up plundered ROMs for use in...

REvil ransomware gang busted by Russian Federal Security Service

Eight members of the REvil ransomware group have been arrested in Russia and will be pressed with criminal charges. Russias intelligence bureau, the FSB, announced on Friday that it had conducted an operation together with the Interior Ministry in Moscow, St. Petersburg, and the regions of Moscow...

Watch out for the Steam skin “free knife” scam

Have you ever had someone run up to you in the street and insist you take their free knife? I hope not, because that’s a good way to wind up in a 60-minute police procedural drama. In video game land, however, anything goes. A certain type of scam is showing signs of activity at the moment and it...

Google Play sign-ins can be abused to track another person’s movements

Even people that have been involved in cybersecurity for over 20 years make mistakes. I’m not sure whether that is a comforting thought for anyone or whether everyone should be worried now. But it is what it is and I make it a habit of owning my mistakes. So here goes. With the aid of Google I wa...

Proposed anti-Flock bills could spell trouble for license plate readers

Automated license plate readers ALPRs are cameras that photograph passing vehicles, read their number plates, and typically log the time, location, and vehicle details. On their own, the images might be used to find a stolen car or locate a suspect. But lately there have been a lot of concerns...

Microsoft fixes record 964 flaws, including 2 exploited zero-days

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs, including 104 rated Critical and 860 rated Important, making it the company’s largest Patch Tuesday release on record. Microsoft lists 974 CVEs in its full September security release. However, 10 of those affect cloud services or involv...

A week in security (August 31 – September 6)

Last week on Malwarebytes Labs: The hidden work of modernizing Malwarebytes X Money rollout linked to password-reset attacks Free streaming boxes may be routing criminal traffic through your home StreamRat Android malware spreads through Meta and TikTok ads Your phone or computer may soon ask how...

Your phone or computer may soon ask how old you are

First, the good news: If you use a Linux-based operating system, you may not be asked your age in a few months. The bad news is that Windows, macOS, iOS, and Android users in California will be. California has passed a law that requires a range of operating systems to start collecting your age wh...

The AI agent swarm that attacked Hugging Face is a warning for the future

The hacking incident involving OpenAI evaluation agents and Hugging Face offers an unusually concrete look at what advanced AI-assisted intrusion can mean in practice: not a single clever exploit, but thousands of automated decisions, rapid experimentation, lateral movement, credential theft,...