Search: “malwarebytes”

18 stories in the last 7d

Malwarebytes found scammers using AI to build polished fake antivirus renewal pages impersonating Avast, harvesting names, emails and phone numbers for follow-up fraud calls.

Malwarebytes analyzed a fake Avast renewal site targeting Belgian users in French, claiming a €129.99 Avast Premium Security renewal and collecting name, email address and Belgian mobile number through a cancellation form. Leftover code comments written in polite French and other stylistic clues suggest the page was generated with AI assistance, and the form was never connected to send data anywhere. The scam typically progresses to phone calls pressuring victims to install remote access software, and AI substantially lowers the barrier for producing polished, localized scam pages at scale.

Malwarebytes Labs08:41 UTC · 6h agoPhishing & fraud

Google’s New Search Redirects Make It Harder to Check Where Links Lead Before Clicking

Malwarebytes reports Google's new encoded google.com/goto?url= redirects break hover-preview link checking, weakening a common phishing defense.

Google now routes some search results through opaque google.com/goto?url= redirects using custom encoding, so browser link previews no longer reveal the true destination, only the claimed label above the result. Malwarebytes found the final destination is visible only in the redirect response's Location header, complicating hover-based safety checks as well as scraping, archiving, and audit tools. The change arrives amid malvertising, search-result poisoning, and fake installer campaigns like the recent Node.js infostealer lure. Google says it deploys measures against evolving abuse but did not explain the change.

Cyber Security NewsSep 15, 12:21 UTC · 1d agoResearch

Search results are sending people to fake Bitrefill checkouts

Scam sites impersonating Bitrefill's crypto checkout appear in search results, tricking victims into sending up to $1,990 in crypto directly to scammers.

Malwarebytes documents a cluster of lookalike domains copying Bitrefill's gift card checkout, surfaced via search engine results rather than email. Victims choose an amount up to $1,990 and pay in Bitcoin, Ethereum, USDC, USDT, Solana, or Litecoin to scammer-controlled addresses, with no recourse since crypto payments are irreversible. Domains use typosquatting and Punycode/IDN homoglyph tricks, and the fake sites run commercial analytics software to measure and optimize victim conversion. Bitrefill's security team is working with takedown specialists to remove the sites.

Malwarebytes LabsSep 15, 08:40 UTC · 1d agoPhishing & fraud

Crypto customers targeted by scammers after email marketing provider breach

Attackers exploited a Brevo SAML SSO flaw to access 138 accounts and phish crypto customers of Trezor, CoinTracking, and BitBox.

An attacker exploited a flaw in Brevo's SAML SSO handling to access 138 customer accounts on September 10; six accounts were used to send phishing emails and contacts were exported from 43 accounts. Crypto firms Trezor, CoinTracking, and BitBox confirmed customers received phishing emails, with Trezor warning roughly 347,000 newsletter subscribers. The Trezor-themed email cited a fabricated STM32 microcontroller entropy bug and urged recipients to enter wallet backups through a malicious link. Exported contact lists could fuel future targeted phishing attacks.

Malwarebytes LabsSep 11, 15:01 UTC · 4d agoData breach in the wild 6 sources

How to opt out of AI chatbot training

Malwarebytes guides users through disabling AI training use of chats in ChatGPT, Perplexity, and Claude after OpenAI's human review program emerged.

404 Media reported that OpenAI's 'Project Lily' hires hundreds of contractors to review ChatGPT prompts, with a 'Privacy Filter' removing personal data and usernames hidden, though user memories summaries can still reveal identifying details. The article provides opt-out steps: ChatGPT Settings > Data Controls > 'Improve the model for everyone' (on by default), Perplexity Settings > Preferences > AI data retention, and Claude Settings > Privacy > 'Help Improve our AI Models'. Opting out does not prevent all human access, which remains allowed for abuse investigation, support, troubleshooting, and legal matters.

Malwarebytes LabsSep 15, 15:41 UTC · 23h agoAI industry

HBO Max’s verified Reddit account hijacked to spread malware

Cybercriminals hijacked HBO Max's verified Reddit account to run 108 ClickFix ads pushing AMOS and Amatera infostealers via fake HBO app sites.

Hudson Rock found that hijackers used HBO Max's verified Reddit account to run 108 malicious ads over roughly 48 hours promoting fake AI tools and macOS utilities. The ads led to HBO lookalike sites instructing victims to paste commands into Terminal or PowerShell, a ClickFix social-engineering technique ADAMnetworks dubbed PasteSwitch. macOS payloads included MacSync and AMOS infostealers targeting browser credentials, Telegram data, Apple Notes, passwords, and crypto recovery phrases; Windows users received the in-memory Amatera infostealer. The operation is also linked to cryptocurrency clipboard hijackers, and Reddit admins paused the ads and opened an investigation.

Malwarebytes LabsSep 15, 11:51 UTC · 1d agoMalware in the wild 7 sources1

Android malware creates a hidden copy of your banking app

Group-IB found the Gigabud Android banking trojan clones banking apps into a hidden work profile to conduct fraud undetected.

Group-IB researchers found the Gigabud Android banking trojan installs Vwork, a trojanized version of the open-source Shelter app, to create a separate Android work profile and clone the victim's banking app into it. The operator then performs fraudulent transactions from the cloned app, separating risky activity from malware detections in the personal profile and potentially bypassing bank-side anti-fraud checks. Victims are lured into sideloading fake airline, tax, or government apps via phishing sites and messages, then grant Accessibility, overlay, and battery-optimization permissions that enable remote control and credential-theft overlays. Malwarebytes detects Gigabud components under multiple Android.Trojan.Banker signatures.

Malwarebytes LabsSep 11, 12:14 UTC · 5d agoMalware 4 sources

12 Best Ransomware Protection Solutions Compared (2026): Features & Pricing

GBHackers compares 12 ransomware protection solutions for 2026, recommending layered stacks of EDR prevention, managed detection, containment, and guaranteed recovery.

The editorial comparison argues no single product stops ransomware, recommending a layered strategy across prevention, early detection, blast-radius containment, and clean recovery. CrowdStrike and SentinelOne are named best-in-class EDR, Huntress and Sophos MDR for managed 24/7 coverage, ColorTokens for microsegmentation containment, and Rubrik and Acronis for guaranteed recovery. The guide notes ransomware is now professionalized with double extortion and encryption sprints measured in minutes.

GBHackersupdated 09:52 UTC · 4h agofirst Sep 11, 07:18 UTC · 5d agoIndustry 13 sources1

Google Search Makes It Harder to See Where a Link Really Goes Before You Click

Google now routes some Search results through opaque google.com/goto redirects, weakening hover-to-verify anti-phishing checks.

Google has begun serving some organic search results as opaque google.com/goto?url= redirects whose destinations can only be resolved server-side by Google, likely to raise scraping costs for rank trackers and archival services. The change removes the pre-click hover preview of the true destination URL, undermining a long-standing anti-phishing habit for spotting lookalike, typosquatted, or search-optimized phishing domains. Security teams are advised to rely on layered defenses such as domain reputation, DNS and web filtering, browser isolation, and user training rather than hover text.

GBHackersSep 15, 13:42 UTC · 1d agoIndustry

Revolut gave customer IDs and financial data to a government impostor

Revolut handed customer IDs, selfies, and financial records to criminals using a legitimate government agency email domain.

Revolut acknowledged disclosing sensitive customer records after accepting fraudulent information requests sent from an email address on a legitimate government agency domain, describing it as an external impersonation scam rather than a system intrusion. The London-based fintech, which serves more than 80 million customers globally, says customer funds were not affected and only a 'very limited' number of customers were impacted. Disclosed data includes identity and contact information, copies of passports and driver's licenses, verification selfies, account statements, and transaction histories. Revolut blocked the sending address and notified the relevant agency, law enforcement, data protection authorities, and financial regulators.

Malwarebytes LabsSep 14, 11:15 UTC · 2d agoData breach

More than 100,000 fake stores are out to steal your card details

Researchers uncovered DoppelCart, a network of roughly 119,000 cloned fake shops that harvest card details and one-time bank codes during checkout.

Researchers at German firm Nebty identified 118,787 .shop domains tied to cloned online stores, representing 2.72% of the TLD population examined and described as the largest publicly documented fake-shop network by domain count. The shops mimic more than 44,000 brands, advertise discounts up to 65%, and 96% of confirmed shops reportedly share identical build files using just 27 ecommerce backends. Fraudulent checkout pages send card numbers, CVVs, billing data and bank one-time confirmation codes to attacker-controlled servers in real time over WebSockets, allowing criminals to complete payments while victims are still checking out.

Malwarebytes LabsSep 9, 15:02 UTC · 6d agoPhishing & fraud

Google Pixel owners urged to patch actively exploited modem flaw

Google's September 2026 Pixel bulletin fixes 110 vulnerabilities, including CVE-2026-58704, a modem permission bypass under limited targeted exploitation enabling remote privilege escalation.

Google released the September 2026 Pixel Update Bulletin addressing 110 vulnerabilities, including CVE-2026-58704, a high-severity logic error in the cellular modem that allows remote escalation of privilege with no additional execution privileges or user interaction required. Google says there are indications the flaw may be under limited, targeted exploitation; attackers need adjacent network access and some existing foothold on the device, which the bulletin does not explain how to obtain. The fix ships at the 2026-09-05 patch level and appears only in the Pixel-specific bulletin, so other Android vendors do not receive this specific fix.

Malwarebytes Labsupdated 13:10 UTC · 1h agofirst 10:39 UTC · 4h agoExploit / PoC in the wild 5 sources CVE-2026-58704

Meta AI builds detailed profiles of children from years of family posts

Meta AI suggested questions about a child and assembled detailed family profiles from years of Facebook posts, including a photo deleted years ago.

A mother reported that Meta AI on Facebook suggested the question 'Who is the child passenger?' and then aggregated her children's names, birth dates, videos, and a photo she had deleted years ago. The assistant also pieced together old posts to pinpoint her home location when prompted with 'Where does Kalie Robins live?'. Meta admitted the prompt 'never should have' appeared and said it fixed the suggestion issue, while noting the data came from posts the asker could already access. The article situates this among prior Meta AI privacy failures, including publicly shared chats and a bug exposing private conversations via guessable IDs.

Malwarebytes LabsSep 15, 09:44 UTC · 1d agoAI safety & security

BlueMoon exploit kit turns Chrome and Windows flaws into attacks

Proofpoint documents BlueMoon exploit kit used by four espionage groups to chain Chrome V8 and Windows flaws via phishing, all now in CISA's KEV.

Proofpoint identified a shared Chrome and Windows exploit kit, BlueMoon, used by four espionage groups against Chrome on Windows within days of one another. Attacks began with phishing emails leading to web pages that exploited two Chrome V8 vulnerabilities, followed by a Windows flaw to escape browser protections and gain higher privileges. The Chrome flaws were patched in Stable on September 3 and 8, 2026, the Windows flaw was fixed in September Patch Tuesday, and all three were actively exploited and added to CISA's KEV catalog. Researchers found clues, but no conclusive evidence, that the kit was developed with AI assistance.

Malwarebytes Labsupdated Sep 15, 10:17 UTC · 1d agofirst Sep 10, 15:49 UTC · 5d agoExploit / PoC in the wild 23 sources1

Will AI kill us all within the next decade?

Anthropic alignment lead Evan Hubinger says he personally estimates a greater than 10% chance AI could kill all humans within the next decade.

A Wall Street Journal report says concerns are rising inside AI labs that competition is pushing companies toward self-improving models that could spiral out of human control. Anthropic's Alignment Science lead Evan Hubinger publicly endorsed researcher Jacob Coxon's warning, giving a personal estimate of a greater than 10% chance of AI causing human extinction within a decade, driven by recursive self-improvement. Hubinger described the risk from current models as low, focusing his concern on future systems with far greater autonomy. The piece argues for safeguards such as independent testing, limits on high-risk autonomous uses, transparency, and accountability.

Malwarebytes LabsSep 10, 12:18 UTC · 6d agoAI safety & security

Update Chrome now to protect against an actively exploited vulnerability

Google shipped Chrome 153.0.8010.36/.37 fixing 230 flaws including actively exploited V8 out-of-bounds write CVE-2026-87491 enabling sandboxed code execution.

Chrome stable channel updated to 153.0.8010.36/.37 for Windows and Mac and 153.0.8010.36 for Linux, including 230 security fixes. CVE-2026-87491 is an out-of-bounds write in Chrome's V8 JavaScript engine that a crafted HTML page can exploit to execute arbitrary code inside the browser sandbox; Google rates it medium severity, but it is confirmed as actively exploited. The update also fixes five Critical vulnerabilities, four of which were found in WebGL. Users should update via Settings > About Chrome and restart the browser.

Malwarebytes LabsSep 10, 10:52 UTC · 6d agoExploit / PoC in the wild 2 sources CVE-2026-874911

Copyright scammers get Instagram accounts suspended and demand payment

Scammers file fake Instagram copyright complaints to suspend accounts, then demand ransom via Telegram; Meta restored some affected accounts.

Criminals impersonate rights holders to file fraudulent copyright complaints on Instagram, and repeated claims can trigger temporary account suspensions. They then move victims to Telegram and demand payment, often in cryptocurrency, to withdraw the complaint; one history account owner paid $50 and was targeted again immediately. Meta's automated system does not verify complainants before acting, and the Delhi High Court is examining whether platforms can legally suspend accounts over copyright claims. Meta acknowledged in court that 13 strike notices against one user were fraudulent, and after BBC review it restored affected content and added unspecified protections.

Malwarebytes LabsSep 10, 09:59 UTC · 6d agoPhishing & fraud in the wild