Did an AI really try to break free from human control?

Amid discussions about slowing down AI development, the Telegraph ran the headline: “OpenAI sounds alarm after bot tries to break free from human control.” That headline is slightly misleading, in my opinion. The Telegraph headline overstates what happened, although the underlying behavior is sti...

Fake parcel delivery messages steal your card and bank details

Parcel delivery phishing campaigns appear around the world under different courier names. In the United States, the messages commonly impersonate USPS and claim that a package has an invalid address or could not be delivered. Similar messages impersonate Colissimo and Chronopost in France, Correo...

Update Chrome before you browse again

Chrome is rolling out an update for its desktop browser. The update includes 327 security fixes, ten of which address critical vulnerabilities. The stable channel has been updated to 152.0.7977.64/.65 for Windows and Mac, and 152.0.7977.64 for Linux. How to update Chrome If you don’t want to wait...

Facebook users targeted in ‘login’ phish

A few weeks ago we warned our readers of a phishing campaign targeting Instagram users that didn’t resort to the usual links to phishing websites, but used mailto: links instead. Now, it seems that these scammers have turned their attention to Facebook users. It works like this: The target receiv...

Android happy to check your nudes before you forward them

Sometimes the updates we install to keep our devices safe do a little bit more than we might suspect at first glance. Take the October 2024 Android Security Bulletin. It included a new service called Android System SafetyCore. If you can find a mention of that in the security bulletin, you’re a...

Update Chrome and ChromeOS to fix critical security issues

Google has released updates for the Chrome browser and the ChromeOS operating system. On October 6, Google released a Stable Channel Update for Desktop. This is the most important one for desktop users. It brings Chrome to version 155.0.8059.39 for Linux and versions 154.0.8037.39/.40 for Windows...

Another ShinyHunters suspect arrested

The net is tightening around the Shiny Hunters cybercrime group following the reported arrest of a second member. On Saturday, Reuters said that 16 year-old Saif al-Din Khader had been arrested in Jordan and was in FBI custody. This follows the arrest earlier in September of another member in the...

A week in security (September 28 – October 4)

Last week on Malwarebytes Labs: Fake xStocks, Pendle, and other sites bait crypto users with rewards votes Shadow AI explained: The work shortcut that could leak your company’s secrets Convincing Free Mobile phishing emails appear after data breach Malwarebytes earns another Top Product award in...

Fake xStocks, Pendle, and other sites bait crypto users with rewards votes

We found 70 websites that impersonate legitimate crypto projects that invite visitors to vote on the date of an upcoming rewards distribution. The pages copy the look of the real sites closely, and on most of them the offer is small and believable: Cast a vote, and as an active voter you get a...

A week in security (September 28 – October 4)

Last week on Malwarebytes Labs: Fake xStocks, Pendle, and other sites bait crypto users with rewards votes Shadow AI explained: The work shortcut that could leak your company’s secrets Convincing Free Mobile phishing emails appear after data breach Malwarebytes earns another Top Product award in...

ShinyHunters claims FBI breach was revenge for “false” report

Extortion group ShinyHunters is not afraid to make enemies. Now it claims to have breached the FBI. After reportedly taking over ransomware group Clop’s leak site, ShinyHunters says it attacked the FBI to punish the agency for spreading what it calls false information about the group. In a very...

Gemini’s breach of real companies exposes an AI guardrail problem

Google says one of its Gemini models accessed systems belonging to three real companies during a cybersecurity evaluation in May. The model reportedly guessed credentials in one case, while finding exposed credentials in public repositories in two others. Google says Gemini stopped once it...

Give your PC a fresh start: New free tools to boost your PC’s speed, security, and peace of mind

If you ever have the feeling your computer is dragging its feet, or shows odd behavior, you’re not alone. In some cases, the culprit is indeed malware, but often it’s something more mundane. Over time, baggage accumulates, much like a toddler’s backpack after a day in the forest. Too many apps...

Microsoft wants to automatically save your Word docs to the cloud

Microsoft has revealed it plans to automatically save all Word document to the cloud. The feature is currently only available to Microsoft 365 Insiders, although it's likely to expand this to all users in the future. Microsoft proudly announced: “We are modernizing the way files are created and...

Meta’s Muse AI files away your friendships, arguments, and secrets

If you thought that having companies trawling your social media, browsing history, and TV habits for behavioral clues was bad, sit tight. Meta is just getting started. Its Muse personal AI agent is taking surveillance to the next level. TIME magazine analyzed the software’s internal instructions...

ASOS breach update: Hackers stole customer details and shopping searches

The customer data stolen from global fashion retailer ASOS includes more than just names and contact details, raising questions about its early reassurances. As we reported earlier this week, ASOS customers received a push notification through the ASOS app alleging that the company had been hacke...

Amazon has an uncomfortably personal profile on you

Amazon’s “About You” page reveals what it thinks it knows about you—and you can’t simply switch it off. Dexerto reports that one shopper discovered her profile included the observation: “has flat buttocks” She suggested this might relate to a previous purchase of “butt scrunch leggings.” Whatever...

Attackers hijack country-code domains to impersonate Google and other services

According to Google, attackers compromised infrastructure behind three country-code domain namespaces—.gh Ghana, .sl Sierra Leone, and .as American Samoa—and used it to obtain unauthorized HTTPS certificates for Google domains and other organizations. These domain endings aren’t limited to sites...

How “123456” became the key to almost 9 million personal records

An attacker reportedly used a leaked password to abuse a company’s legitimate access to Denmark’s population register CPR. The weak password is remarkable, but the failure to spot millions of unusual searches made the breach worse. The CPR administration states it identified a serious security...

Phishing emails are baiting your AI assistant

You ignored the suspicious email. You didn’t open the attachment, click the link, or reply to the sender. Then you asked your AI assistant to summarize your inbox. Could the message you wisely avoided find its way back onto your to-do list—only this time presented as an urgent recommendation from...

A week in security (October 5 – October 11)

Last week on Malwarebytes Labs: ASOS breach update: Hackers stole customer details and shopping searches Attackers hijack country-code domains to impersonate Google and other services Amazon has an uncomfortably personal profile on you Meta’s Muse AI files away your friendships, arguments, and...

Grindr users’ sensitive data shared through ad auctions without valid consent

Norway’s privacy regulator Datatilsynet has fined advertising technology company Xandr 92 million Norwegian kroner, approximately $9.6 million, for unlawfully processing and sharing sensitive information about Grindr users. While the decision concerns users in Norway, the data-sharing practices...

Hackers heat up supermarket fridges, spoiling food across France

A cyberattack has forced hundreds of supermarkets across France to throw away refrigerated and frozen food after attackers interfered with the systems that keep it cold. The attack caused significant financial losses and food waste. Some installations reportedly reached temperatures of around 50°...

Scammers know your name, and they’re counting on you to reply

Scammers are finding different ways to use personal details exposed in data breaches to lure people into conversations. Last week, we showed how a Facebook Marketplace listing used the recipient’s name to make a text asking “Is this still available?” more convincing. The one we got this week was ...