ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Malwarebytes Scam Guard”

5 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllPhishing & fraud 2Data breach 1Exploit / PoC 1Malware 1
SeverityAllcritical 1high 1medium 2low 0info 1

Crypto customers targeted by scammers after email marketing provider breach

Attackers exploited a Brevo SAML SSO flaw to access 138 accounts and phish crypto customers of Trezor, CoinTracking, and BitBox.

An attacker exploited a flaw in Brevo's SAML SSO handling to access 138 customer accounts on September 10; six accounts were used to send phishing emails and contacts were exported from 43 accounts. Crypto firms Trezor, CoinTracking, and BitBox confirmed customers received phishing emails, with Trezor warning roughly 347,000 newsletter subscribers. The Trezor-themed email cited a fabricated STM32 microcontroller entropy bug and urged recipients to enter wallet backups through a malicious link. Exported contact lists could fuel future targeted phishing attacks.

Malwarebytes Labs · 4d agoData breach in the wild 6 sources

X Money rollout linked to password-reset attacks

X is investigating bulk unsolicited password-reset emails as its X Money payments service expands, with no confirmed breaches or account takeovers yet.

X users began reporting unexpected password-reset emails and codes on September 1, and product engineer Mridul Singhai said attackers appear to believe newly widespread X Money access makes accounts worth targeting. X says it has found no evidence of any breach or successful account takeover, and completing a reset still requires access to the account's email or phone number. X Money offers eligible US users interest-bearing accounts, a Visa debit card, and P2P payments, with Cross River Bank providing banking infrastructure. Malwarebytes warns the reset flood can serve as cover for phishing and urges reset protection, 2FA, and unique passwords.

Malwarebytes Labs · 11d agoPhishing & fraud in the wild

StreamRat Android malware spreads through Meta and TikTok ads

Malwarebytes reports StreamRat Android banking trojan spread via Meta and TikTok ads reaching roughly 570,000 users, mostly in Spain.

Malwarebytes researchers uncovered a malicious advertising campaign on Meta and TikTok promoting a fake free TV-streaming service that delivered the StreamRat Android banking trojan and infostealer. The ads, aimed at Spanish-speaking users with most victims in Spain, reached approximately 570,000 Meta users in a campaign running June 11 through July 3, 2026. The download site detected Android devices and the referral source, then coached users through sideloading steps including enabling installs from unknown sources. StreamRat can monitor the screen, capture typed credentials, display fake login screens, and give attackers remote control, including black-screen and fake Android update overlays.

Malwarebytes Labs · 12d agoMalware in the wild

Scammers have figured out the best time to text you

Malwarebytes threat data shows scammers tailor platforms per scam, with the web as top channel, Friday midday peaks, and MrBeast the most impersonated person.

Malwarebytes analyzed its threat data from April 15 to July 14, 2026 across more than 20 scam categories, finding scammers match platforms to scam types: job scams via email, romance scams via social media, and tech support scams via phone. The web is the top delivery channel ahead of email and SMS, and Malwarebytes says it blocks about 500,000 phishing sites a day. Scam texts peak at 12:00 pm ET, roughly 874% above the quietest hour, with volume peaking on Fridays about 50% higher than the start of the week. MrBeast (Jimmy Donaldson) appears in about 30% of impersonation scams, and the most impersonated brands are Google, Microsoft, Apple, Roblox and Amazon.

Help Net Security · 12d agoPhishing & fraud in the wild