Malwarebytes Labs
Coverage of Malwarebytes Labs in the Nexus archive.
- A week in security (August 10 – August 16)
The security overview highlighted multiple emerging threats, including Apple utilizing iPhone alerts for spyware targets and new Android malware enabling real-time use of bank cards. Lawsuits were filed by parents against Meta, TikTok, Google, and Snap over youth safety issues, while Patch Tuesday addressed 421 flaws, including zero-days. The report also cautioned users about scams targeting online accounts and fake shops.
- A week in security (August 3 – August 9)
The past week highlighted numerous cybersecurity threats, including deepfakes targeting OnlyFans users and impersonation scams utilizing Amazon and Apple branding. Vulnerabilities were noted in platforms like Apple WebKit and Google's synchronized passkeys. Furthermore, regulatory developments included Meta being ordered to pay $942 million, the enforcement of The AI Act, and Californian laws allowing data brokers to be restricted.
- A week in security (July 20 – July 26
The article highlights multiple cybersecurity threats and breaches, including TikTok resin art scams, fake Call of Duty Mobile promotions, OpenAI's sandbox escape during a security test, Android threat distribution methods, vehicle tracking vulnerabilities, WhatsApp Web exposure via Adobe's Acrobat extension, Chick-fil-A account hijacking, the Paidwork data breach affecting 23 million users, and the ClickLock Stealer ransomware for Macs.
- A week in security (July 13 – July 19)
The article highlights multiple security vulnerabilities and updates, including a Shark vacuum flaw exposing home data, security updates for Adobe, Chrome, Firefox, VMWare, and Zoom, Samsung's reversal on health data deletion, and a July 2026 Microsoft Patch Tuesday addressing 622 CVEs. It also warns of scams using FaceTime and fake Apple apps, along with AI-based Ghostcommit attacks and phishing threats.
- Trusting your kids online isn’t enough (Lock and Code S07E14)
The Lock and Code podcast discusses increasing global efforts to protect children online, including age verification laws in the U.S. and potential social media bans for under-16s in several countries. Host David Ruiz and guest Anna Brading, a cybersecurity expert and mother of three, explore strategies for parents to manage children's digital safety, such as setting screen time limits and monitoring online activity.
- A week in security (July 6 – July 12)
The article covers recent security threats including a new Windows malware capable of wiping PCs, mule betting scams, Chrome updates addressing critical vulnerabilities, and the theft of 6.9 million driver’s license numbers. It also highlights AI-related risks, fake job scams targeting marketers, and the NetNut botnet's ongoing activity.
- A week in security (June 29 – July 5)
The article highlights multiple security threats, including malware spread through verified ads on Mac systems, the ConsentFix malware stealing Microsoft accounts, and vulnerabilities in Apple's Hide My Email feature. It also covers fake Google and Cloudflare verification pages distributing malware, a critical WinRAR flaw, a deceptive Perplexity Chrome extension, and security updates from Apple for iOS, MacOS, and Safari.
- A week in security (June 22 – June 28)
The article highlights multiple cybersecurity threats, including malware stealing Chrome session cookies, parcel mule scams, and critical browser vulnerabilities. It also covers data breaches, phishing scams targeting website owners, and dark web activities involving stolen identities and malware.
- A week in security (June 15 – June 21)
Malwarebytes Labs reported cleaning nearly 15,000 infected websites in a SocGholish crackdown. Apple patched a Beats Studio Buds vulnerability, Microsoft addressed the RoguePlanet flaw, and retro gaming fans faced fake GitHub malware. Kodak confirmed a breach linked to ShinyHunters, Roblox developers lost games to malware, and 24 billion records were exposed online. Malwarebytes received AV-TEST awards for its security solutions.
- Fake Windows update installs hidden malware
A fake Windows update scam uses a typosquatted domain to mimic official Microsoft branding, tricking users into downloading malware that steals passwords, payment details, and account access. The malware employs legitimate tools and layered attack techniques to evade detection, persisting on systems by blending with normal processes and modifying apps like Discord.