Fraud & Scams

The push to stop algorithms controlling social media feeds has begun

Australia is proposing a law that gives people a choice over what fills their feeds. It may not be long before other countries dem…

Greatness Phishing Kit Can Now Launch Sophisticated Attacks

Researchers at ZeroBEC are tracking a phishing platform called “Greatness” that’s been significantly upgraded since it surfaced in…

Why Your Security Program Needs a Quantum Upgrade Now

Quantum Readiness Day on 24 September is a useful reminder that the security work we do today is not only about preventing breache…

Grindr settles HIV status data-sharing lawsuit for $35 million

Grindr has settled a UK lawsuit alleging that it shared sensitive user data, including HIV status, with advertising companies.

FTC Takes Action Against Payment Processor Humboldt Merchant Services for Knowingly Facilitating Payment Processing for Sham Merchants

Payment processing company Humboldt Merchant Services will pay $12 million and be permanently banned from processing payments for…

MikroTik router flaws allow takeover without a password

Attackers are exploiting critical RouterOS flaws to take control of routers with SSH exposed to the internet.

Loyalty points fraud is funding hacker holidays (Lock and Code S07E18)

This week on the Lock and Code podcast, we speak with Kim Sutherland about loyalty points fraud and how everyday people can stay s…

LG TV flaws could let attackers listen in, even in standby mode

Testing found that LG smart TVs can track viewing and scan home networks, while security flaws could let attackers record conversa…

Flirty OnlyFans promoters on X may be using AI to appear human

Personalized replies and voice notes make it increasingly difficult to tell whether you’re talking to a human, chatbot, or AI agen…

A week in security (August 31 – September 6)

Last week on Malwarebytes Labs: Stay safe!

Bypassing the Gatekeepers: How a Global Phishing Campaign Turns Google's Infrastructure into a Trust Proxy

Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal, Karthikeyan Dharmaraj and Sripathi Kumar

The hidden work of modernizing Malwarebytes

Why disciplined dependency modernization is one of the highest-leverage engineering investments a security product can make.

X Money rollout linked to password-reset attacks

As X expands into payments, users are receiving password-reset emails they didn’t request. Here’s what may be happening and how to…

Payment Processor Nuvei Must Implement Robust Merchant Screening Practices and Pay $4.85 Million to Settle FTC Charges that the Firm Facilitated Merchant Fraud

Global payment processor Nuvei will pay $4.85 million to settle the Federal Trade Commission’s charges that the firm opened and ma…

Free streaming boxes may be routing criminal traffic through your home

Researchers found that apps available on SuperBox devices could add your household connection to a residential proxy network.

StreamRat Android malware spreads through Meta and TikTok ads

Social media ads for a free streaming service exposed roughly 570,000 people to StreamRat, a banking Trojan that can take control…

FTC Extends Public Comment on Proposed Policy Statement Regarding Personalized Pricing

The Federal Trade Commission extended by seven days the public comment period on the proposed enforcement policy statement regardi…

Your phone or computer may soon ask how old you are

California and Colorado will require operating systems to collect users’ ages, but open-source software like Linux may be exempt.

Recruitment-Themed Phishing Campaign Targets Enterprise Users

Researchers at Zimperium are tracking widespread phishing campaigns that use Browser-in-the-Browser (BitB) attacks to trick users…

New Phishing Kit Uses AI to Fully Automate Vishing Attacks

A new phishing kit is using generative AI to fully automate voice phishing (vishing) attacks, according to researchers at Group-IB…

Tech support scams look different now. Here’s what to watch for

Tech support scams have evolved beyond fake virus warnings. Here’s how scammers reach their targets now, and how to stay safe.

Scammers are getting smarter about where they target you

New Malwarebytes research reveals how different scams are tailored to different platforms.

Two critical Chrome flaws put users at risk on malicious websites

Update Chrome now: Two critical vulnerabilities could allow a malicious website to run code on your device.

Hacking the Healers: New KnowBe4 Whitepaper Highlights Record Security Breaches in Healthcare

When an organization has a security breach, it can cause significant financial, reputational and logistical damage. But in healthc…

Dark web site puts 153 million driver’s licenses and millions more IDs up for sale

The FBI is investigating a possible breach of idscan.net linked to 153 million driver’s license scans for sale online.

Your AI chats could be used in court

What you tell an AI chatbot could come back to haunt you in court. The Washington Post found chat histories already used in 12 leg…

Fake GTA 6 leaked copy drains your crypto wallet

A fake GTA 6 leak is using wallet-draining code to steal cryptocurrency, tokens, and NFTs from eager fans.

Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing

CyberheistNews Vol 16 #35 [New Report] Phishing Is Still the No. 1 Initial Threat Access Vector

Warning: Chameleon SEO Poisoning Spreads Phishing Pages

Cloaked SEO poisoning attacks surged by 40% in the second quarter of 2026, according to researchers at Fortra. This tactic, also k…