Security News Malwarebytes Labs: A week in security

[Gandalf_The_Grey]

A week in security (November 3 – November 9)

Last week on Malwarebytes Labs:

• Malwarebytes scores 100% in AV-Comparatives Stalkerware Test 2025
• Fake CAPTCHA sites now have tutorial videos to help victims install malware
• Hackers commit highway robbery, stealing cargo and goods
• Android malware steals your card details and PIN to make instant ATM withdrawals
• Take control of your privacy with updates on Malwarebytes for Windows
• Cyberattacks on UK water systems reveal rising risks to critical infrastructure
• Should you let Chrome store your driver’s license and passport?
• Apple patches 50 security flaws—update now
• “Sneaky” new Android malware takes over your phone, hiding in fake news and ID apps
• Sling TV turned privacy into a game you weren’t meant to win
• Attack of the clones: Fake ChatGPT apps are everywhere
• Would you sext ChatGPT? (Lock and Code S06E22)
• Malwarebytes aces PCMag Readers’ Choice Awards and AVLab Cybersecurity Foundation tests

On the ThreatDown blog:

• Inside EDR-Freeze: How ThreatDown stops the attack before it spreads

A week in security (November 3 - November 9)

A list of topics we covered in the week of November 3 to November 9 of 2025

www.malwarebytes.com

 

[Gandalf_The_Grey]

A week in security (November 10 – November 16)

Last week on Malwarebytes Labs:

• Be careful responding to unexpected job interviews
• Your passport, now on your iPhone. Helpful or risky?
• 1 million victims, 17,500 fake sites: Google takes on toll-fee scammers
• Are you paying more than other people? NY cracks down on surveillance pricing
• We opened a fake invoice and fell down a retro XWorm-shaped wormhole
• Phishing emails disguised as spam filter alerts are stealing logins
• Update now: November Patch Tuesday fixes Windows zero-day exploited in the wild
• How Malwarebytes stops the ransomware attack that most security software can’t see
• Samsung zero-day lets attackers take over your phone
• How credentials get stolen in seconds, even with a script-kiddie-level phish
• Stolen iPhones are locked tight, until scammers phish your Apple ID credentials
• Fantasy Hub is spyware for rent—complete with fake app kits and support
• Watch out for Walmart gift card scams

A week in security (November 10 - November 16)

A list of topics we covered in the week of November 10 to November 16 of 2025

www.malwarebytes.com

 

[Gandalf_The_Grey]

A week in security (November 17 – November 23)

Last week on Malwarebytes Labs:

• AI teddy bear for kids responds with sexual content and advice about weapons
• Fake calendar invites are spreading. Here’s how to remove them and prevent more
• Budget Samsung phones shipped with unremovable spyware, say researchers
• What the Flock is happening with license plate readers?
• Holiday scams 2025: These common shopping habits make you the easiest target
• [Correction] Gmail can read your emails and attachments to power “smart features”
• Mac users warned about new DigitStealer information stealer
• Attackers are using “Sneaky 2FA” to create fake sign-in windows that look real
• Sharenting: are you leaving your kids’ digital footprints for scammers to find?
• Chrome zero-day under active attack: visiting the wrong site could hijack your browser
• Thieves order a tasty takeout of names and addresses from DoorDash
• Why it matters when your online order is drop-shipped
• The price of ChatGPT’s erotic chat? $20/month and your identity
• Your coworker is tired of AI “workslop” (Lock and Code S06E23)
• Scammers are sending bogus copyright warnings to steal your X login

A week in security (November 17 - November 23)

A list of topics we covered in the week of November 17 to November 23 of 2025

www.malwarebytes.com

 

[Zero Knowledge]

you MB news posts, I find them really good summary of weekly news. Thanks!

 

[Gandalf_The_Grey]

A week in security (November 24 – November 30)

Last week on Malwarebytes Labs:

• How CVSS v4.0 works: characterizing and scoring vulnerabilities
• Millions at risk after nationwide CodeRED alert system outage and data breach
• Holiday shoppers targeted as Amazon and FBI warn of surge in account takeover attacks
• Fake LinkedIn jobs trick Mac users into downloading Flexible Ferret malware
• New ClickFix wave infects users with hidden malware in images and fake Windows updates
• WhatsApp closes loophole that let researchers collect data on 3.5B accounts
• The hidden costs of illegal streaming and modded Amazon Fire TV Sticks
• Black Friday scammers offer fake gifts from big-name brands to empty bank accounts
• Matrix Push C2 abuses browser notifications to deliver phishing and malware

A week in security (November 24 - November 30)

A list of topics we covered in the week of November 24 to November 30 of 2025

www.malwarebytes.com

 

[Gandalf_The_Grey]

A week in security (December 1 – December 7)

Last week on Malwarebytes Labs:

• Leaks show Intellexa burning zero-days to keep Predator spyware running
• How scammers use fake insurance texts to steal your identity
• Canadian police trialing facial recognition bodycams
• Update Chrome now: Google fixes 13 security issues affecting billions
• Attackers have a new way to slip past MFA in educational orgs
• How attackers use real IT tools to take over your computer
• Fileless protection explained: Blocking the invisible threat others miss
• “Sleeper” browser extensions woke up as spyware on 4 million devices
• Air fryer app caught asking for voice data (re-air) (Lock and Code S06E24)
• Whispering poetry at AI can make it break its own rules
• Google patches 107 Android flaws, including two being actively exploited
• New Android malware lets criminals control your phone and drain your bank account
• Malwarebytes joins Global Anti-Scam Alliance (GASA) as supporting member

A week in security (December 1 - December 7)

A list of topics we covered in the week of December 1 to December 7 of 2025

www.malwarebytes.com

 

[Gandalf_The_Grey]

A week in security (December 8 – December 14)

Last week on Malwarebytes Labs:

• The US digital doxxing of H-1B applicants is a massive privacy misstep
• Google ads funnel Mac users to poisoned AI chats that spread the AMOS infostealer
• How private is your VPN?
• DroidLock malware locks you out of your Android device and demands ransom
• Malwarebytes for Mac now has smarter, deeper scans
• [updated]Another Chrome zero-day under attack: update now
• December Patch Tuesday fixes three zero-days, including one that hijacks Windows devices
• GhostFrame phishing kit fuels widespread attacks against millions
• Prompt injection is a problem that may never be fixed, warns NCSC
• EU fines X $140m, tied to verification rules that make impostor scams easier
• Deepfakes, AI resumes, and the growing threat of fake applicants
• How phishers hide banking scams behind free Cloudflare Pages
• Scammers harvesting Facebook photos to stage fake kidnappings, warns FBI

On the ThreatDown blog:

• Tracking remote ransomware attacks at their source

A week in security (December 8 - December 14)

A list of topics we covered in the week of December 8 to December 14 of 2025

www.malwarebytes.com

 

[Gandalf_The_Grey]

A week in security (December 15 – December 21

Last week on Malwarebytes Labs:

• CISA warns ASUS Live Update backdoor is still exploitable, seven years on
• The ghosts of WhatsApp: How GhostPairing hijacks accounts
• Chrome extension slurps up AI chats after users installed it for privacy
• Two Chrome flaws could be triggered by simply browsing the web: Update now
• Inside a purchase order PDF phishing campaign
• SoundCloud, Pornhub, and 700Credit all reported data breaches, but the similarities end there
• Android mobile adware surges in second half of 2025
• Photo booth flaw exposes people’s private pictures online
• Google is discontinuing its dark web report: why it matters
• Pig butchering is the next “humanitarian global crisis” (Lock and Code S06E25)
• PayPal closes loophole that let scammers send real emails with fake purchase notices

On the ThreatDown blog:

• AI-orchestrated cyberattacks

A week in security (December 15 - December 21)

A list of topics we covered in the week of December 15 to December 21 of 2025

www.malwarebytes.com

 

[Gandalf_The_Grey]

A week in security (December 22 – December 28)

Last week on Malwarebytes Labs:

• Pornhub tells users to expect sextortion emails after data exposure
• Hacktivists claim near-total Spotify music scrape

A week in security (December 22 - December 28)

A list of topics we covered in the week of December 22 to December 28 of 2025

www.malwarebytes.com

 

[Gandalf_The_Grey]

A week in security (December 29 – January 4)

Last week on Malwarebytes Labs:

• How AI made scams more convincing in 2025
• In 2025, age checks started locking people out of the internet
• 2025 exposed the risks we ignored while rushing AI
• Malware in 2025 spread far beyond Windows PCs

A week in security (December 29 - January 4)

A list of topics we covered in the week of December 29 2025 to January 4 of 2026

www.malwarebytes.com

 

[Gandalf_The_Grey]

A week in security (January 5 – January 11)

Last week on Malwarebytes Labs:

• pcTattletale founder pleads guilty as US cracks down on stalkerware
• Are we ready for ChatGPT Health?
• CISA warns of active attacks on HPE OneView and legacy PowerPoint
• Lego’s Smart Bricks explained: what they do, and what they don’t
• Fake WinRAR downloads hide malware behind a real installer
• One million customers on alert as extortion group claims massive Brightspeed data haul
• Phishing campaign abuses Google Cloud services to steal Microsoft 365 logins
• Disney fined $10m for mislabeling kids’ YouTube videos and violating privacy law
• ALPRs are recording your daily drive (Lock and Code S06E26)
• Grok apologizes for creating image of young girls in “sexualized attire”

A week in security (January 5 - January 11)

A list of topics we covered in the week of January 5 to January 11 of 2026

www.malwarebytes.com

 

[Gandalf_The_Grey]

A week in security (January 12 – January 18)

Last week on Malwarebytes Labs:

• WhisperPair exposes Bluetooth earbuds and headphones to tracking and eavesdropping
• Dutch police sell fake tickets to show how easily scams work
• “Reprompt” attack lets attackers steal data from Microsoft Copilot
• Phishing scammers are posting fake “account restricted” comments on LinkedIn
• Online shoppers at risk as Magecart skimming hits major payment networks
• How real software downloads can hide remote backdoors
• Data broker fined after selling Alzheimer’s patient info and millions of sensitive profiles
• Why iPhone users should update and restart their devices now
• Received an Instagram password reset email? Here’s what you need to know
• Regulators around the world are scrutinizing Grok over sexual deepfakes
• Celebrating reviews and recognitions for Malwarebytes in 2025

A week in security (January 12 - January 18)

A list of topics we covered in the week of January 12 to January 18 of 2026

www.malwarebytes.com

 

[Gandalf_The_Grey]

A week in security (January 19 – January 25)

Last week on Malwarebytes Labs:

• Spammers abuse Zendesk to flood inboxes with legitimate-looking emails, but why?
• Fake LastPass maintenance emails target users
• Under Armour ransomware breach: data of 72 million customers appears on the dark web
• Can you use too many LOLBins to drop some RATs?
• Malicious Google Calendar invites could expose private data
• Fake extension crashes browsers to trick users into infecting themselves
• Google will pay $8.25m to settle child data-tracking allegations
• Firefox joins Chrome and Edge as sleeper extensions spy on users

On the ThreatDown blog:

• How to prevent a rootkit attack

A week in security (January 19 - January 25)

A list of topics we covered in the week of January 19 to January 25 of 2026

www.malwarebytes.com

 

[Gandalf_The_Grey]

A week in security (January 26 – February 1)

Last week on Malwarebytes Labs:

• Match, Hinge, OkCupid, and Panera Bread breached by ransomware group
• TikTok’s privacy update mentions immigration status. Here’s why.
• Meta confirms it’s working on premium subscription for its apps
• Microsoft Office zero-day lets malicious documents slip past security checks
• Clawdbot’s rename to Moltbot sparks impersonation campaign
• Malicious Chrome extensions can spy on your ChatGPT chats
• WhatsApp rolls out new protections against advanced exploits and spyware
• Watch out for AT&T rewards phishing text that wants your personal details
• A WhatsApp bug lets malicious media files spread through group chats
• TikTok narrowly avoids a US ban by spinning up a new American joint venture
• Get paid to scroll TikTok? The data trade behind Freecash ads
• One privacy change I made for 2026 (Lock and Code S07E02)

A week in security (January 26 - February 1)

A list of topics we covered in the week of January 26 to February 1 of 2026

www.malwarebytes.com

 

[oldschool]

Brave Search was the choice in "One privacy change I made in 2026". Not quite up to par with Google in search results but overall the best option.

 

[LinuxFan58]

Brave Search was the choice in "One privacy change I made in 2026". Not quite up to par with Google in search results but overall the best option.

Are you sure you posted in the correct thread? Seems like a post for Poll - What is Your Favorite Search Engine?

 

[oldschool]

Are you sure you posted in the correct thread? Seems like a post for Poll - What is Your Favorite Search Engine?

I'm sure. My post was in reference to the last link in the OP.

 

[Gandalf_The_Grey]

A week in security (February 2 – February 8)

Last week on Malwarebytes Labs:

• Apple Pay phish uses fake support calls to steal payment details
• Open the wrong “PDF” and attackers gain remote access to your PC
• Flock cameras shared license plate data without permission
• Grok continues producing sexualized images after promised fixes
• Firefox is giving users the AI off switch
• An AI plush toy exposed thousands of private chats with children
• AT&T breach data resurfaces with new risks for customers
• Apple’s new iOS setting addresses a hidden layer of location tracking
• [updated] A fake cloud storage alert that ends at Freecash
• How Manifest v3 forced us to rethink Browser Guard, and why that’s a good thing
• Scam-checking just got easier: Malwarebytes is now in ChatGPT
• How fake party invitations are being used to install remote access tools

A week in security (February 2 - February 8)

A list of topics we covered in the week of February 2 to February 8 of 2026

www.malwarebytes.com

 

[Gandalf_The_Grey]

A week in security (February 9 – February 15)

Last week on Malwarebytes Labs:

• How to find and remove credential-stealing Chrome extensions
• Fake shops target Winter Olympics 2026 fans
• Outlook add-in goes rogue and steals 4,000 credentials and payment data
• Child exploitation, grooming, and social media addiction claims put Meta on trial
• Apple patches zero-day flaw that could let attackers take control of devices
• Criminals are using AI website builders to clone major brands
• February 2026 Patch Tuesday includes six actively exploited zero-days
• Malwarebytes earns PCMag Best Tech Brand spot, scores 100% with MRG Effitas
• Discord will limit profiles to teen-appropriate mode until you verify your age
• How safe are kids using social media? We did the groundwork
• Man tricked hundreds of women into handing over Snapchat security codes
• Is your phone listening to you? (re-air) (Lock and Code S07E03)
• AI chat app leak exposes 300 million messages tied to 25 million users
• Fake 7-Zip downloads are turning home PCs into proxy nodes

A week in security (February 9 - February 15)

A list of topics we covered in the week of February 9 to February 15 of 2026

www.malwarebytes.com

 

[Gandalf_The_Grey]

A week in security (February 16 – February 22)

Last week on Malwarebytes Labs:

• Age verification vendor Persona left frontend exposed, researchers say
• Facebook ads spread fake Windows 11 downloads that steal passwords and crypto wallets
• AI-generated passwords are a security risk
• Intimate products maker Tenga spilled customer data
• Meta patents AI that could keep you posting from beyond the grave
• Betterment data breach might be worse than we thought
• Job scam uses fake Google Forms site to harvest Google logins
• Scammers use fake “Gemini” AI chatbot to sell fake “Google Coin”
• Chrome “preloading” could be leaking your data and causing problems in Browser Guard
• Scam Guard for desktop: A second set of eyes for suspicious moments
• Update Chrome now: Zero-day bug allows code execution via malicious webpages
• Hobby coder accidentally creates vacuum robot army
• ClickFix added nslookup commands to its arsenal for downloading RATs

A week in security (February 16 - February 22)

A list of topics we covered in the week of February 16 to February 22 of 2026

www.malwarebytes.com