Malwarebytes

Lab testing giant Quest Diagnostics confirms patients’ personal info and health data was compromised during a data breach. Quest Diagnostics has not yet disclosed how many people are impacted.

Forget the zombie infested streets of Raccoon City. The real threat is in your inbox.

Scammers are targeting YouTube creators with a fake Amazon Music partnership offer designed to steal Google login credentials. The scam uses creators’ real channel stats, convincing payout estimates, and a fake Google sign-in page to make the offer look legitimate. Read our latest threat research.

Facebook’s misleading privacy claims land Meta a $25 billion fine, it's largest ever.

Imagine facing prison time over an account you say you never opened. Here’s what happened, and why protecting your personal information matters, especially after becoming the victim of a data breach.

A 49-year-old man sold his belongings and traveled 2,000 km by bus to meet a woman he had fallen for. But despite her having a social media account with more than 300,000 followers, she never existed.

UPDATE YOUR PHP UPDATE YOUR PHP UPDATE YOUR PHP https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates?utm_campaign=brandsocial&utm_medium=social&utm_source=bluesky

If you use an Android phone, Google may try to link your phone number to all of your Google accounts, even ones you'd rather keep separate. Here's how to stop it.

Privacy invading glasses known for invading privacy continue to invade privacy.

Attackers hijacked AOMEI Backupper’s update servers to push malware during brief windows between April and July 2026. The attack installed a persistent backdoor, potentially enabling remote access and further infections. If you used Backupper during this period, you should scan for infection.

Millions of California students’ sensitive data stolen in breach, including name, date of birth, and address.

OpenAI is facing legal challenges over how ChatGPT interacts with children.

You had one Chrome update this month, yes. But what about second update?

Is this link safe? Now you can find out before you click! Introducing Malwarebytes Scam Link Check, a simple way to check suspicious links for scams without visiting the site.

We discovered fake “Meta Careers” sites posing as legitimate Calendly scheduling pages that target job seekers to steal their Facebook and Google logins. Read our research.

Smart-device botnets are already a problem, but AI-powered worms could soon infect your home's smart devices.

Microsoft’s October update fixes a record-breaking 1,413 vulnerabilities. The most ever (so far).

Got a text pretending to be a wrong number or is just your name with a question mark? Think twice before replying. Scammers use personal data to start conversations, build trust, and eventually steal money or information.

Grindr users’ sensitive data exposed without consent.

AI is making phishing faster and easier to scale. BlueKit gives cybercriminals convincing fake login pages, AI-generated scam messages, and tools to hijack accounts, including by stealing active sessions. Our researchers explain the threat and how to stay safer online.

Phishing emails containing hidden instructions aimed at AI assistants are growing in popularity.

Update: The Asos breach exposed more customer data than originally thought.

According to Google, attackers compromised infrastructure behind three country-code domain namespaces and used it to obtain unauthorized HTTPS certificates for Google domains and other organizations.

Amazon built an uncomfortably personal profile about you. Here's how to check yours.

You're probably tired of hearing this, but it's time to update Chrome.

You get a text asking if your listing is still available. Plot twist: you never listed anything. Scammers are using your name + phone number to make phishing messages feel legit.

Stuff my pizza, not my credentials.

AI slop is flooding bug bounty programs.

Nature is healing.

Revolut customers received phishing texts only days after the digital bank acknowledged disclosing customer data to a government imposter.

The best protection for you and all your devices. 🛡️

New fake iPhone pre-order scams are leading to Darksword attacks. Read our latest research. https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-iphone-duo-preorder-scam-triggers-darksword-attack?utm_campaign=brandsocial&utm_medium=social&utm_source=bluesky

A Facebook Marketplace buyer arrived at a seller’s apartment to pick up a keyboard. The seller wasn’t home and didn’t know anyone was coming. Meta’s AI assistant Muse shared the seller's address and arranged the visit without telling him.

Apple has released updates for iPhones, iPads, and Macs to fix a flaw that could let an attacker run code when a device processes a malicious file.

Open AI broke containment (again).

It's time to update Chrome (again).

We're introducing two new features in Browser Guard. 🛡️ Search Reputation helps you spot potentially unsafe sites in Google, DuckDuckGo, Brave, and Bing search results. 🔎 Scam Guard Lite analyzes webpages directly in Chrome to help identify signs of a scam—without leaving the page. Learn more.

Google has been fined €403 million by Ireland’s Data Protection Commission after an investigation found that users were not clearly informed about how their location data could be used to infer their interests and customize advertisements.

ShinyHunters says it attacked the FBI to punish the agency for spreading what it calls false information about the group.

AI assistants like Muse increasingly require permissions to carry out actions like adding calendar events and using connected services. While these capabilities make assistants more useful, they also create an attractive target for cybercriminals, who may attempt to use them for malicious purposes.

AI vs AI: OpenAI just got Inception’d. A cybersecurity startup used Anthropic’s Claude to hack OpenAI and claim a bug bounty.

Hackers hacked the hackers as a feud between two cybercrime groups escalated, leaving ShinyHunters with the upper hand over rival Clop.

RatHat can navigate infected phones while stealing bank logins, authentication codes, and screen-lock PINs. Because of its persistence, the only way to remove it is a full factory reset of your device.

The Manhattan District Attorney’s Office has seized the domains of 12 deepfake websites that hosted AI-generated videos of over 1,200 individuals.

‼️Google Pixel users, update now‼️ Google has released an update that fixes 110 vulnerabilities, including one that could give an attacker who already has access to a phone more power than they should have.

Cybercriminals hijacked HBO Max’s verified Reddit account to distribute ClickFix ads that tricked users into running malicious commands, infecting devices with infostealers and cryptocurrency malware.

A mother says Meta AI pieced together names, birth details, photos, and location information about her young daughters from years of family posts she shared on Meta's platforms.

Scammers copy Bitrefill’s branding on lookalike sites that appear in search results. Victims think they’re buying gift cards, but payments go directly to the scammers’ crypto wallets.

Revolut confirmed it accidentally shared sensitive customer data after being tricked by fake government requests from a legitimate agency domain, but says no systems were breached and funds are safe.