Fraud & Scams

Everyone's a Builder Now. That Changes Security Training.

I've spent my career figuring out what makes content stick, from early work for brands like Apple and onward across two decades ac…

New Phishing Kits Use Open-Source Tools to Bypass MFA

Researchers at Lexfo are tracking three sophisticated phishing kits that were built using open-source components, primarily based…

Fake Flash Player installs AtlasRAT

Researchers have uncovered a new campaign that spreads the AtlasRAT remote access Trojan by disguising it as a Flash Player instal…

Malicious Cyber Actors Targeting Water and Wastewater Sector Internet Facing Programmable Logic Controllers, Causing Operational Disruptions

Future-Proofing Organizations in the Face of AI

Future-proofing organizations in the face of AI requires a unified defense strategy that secures both the human workforce and auto…

Malwarebytes for Windows, now available on the Microsoft Store

Install Malwarebytes for Windows from the Microsoft Store with the same full protection and features.

What Security Can Learn From Dinosaurs

In business, calling something a dinosaur is meant to suggest it is slow, outdated and overdue for extinction. Which is unfair to…

Hims & Hers sued over alleged health data privacy failures

The FTC has sued telehealth provider Hims & Hers, alleging it shared customers' sensitive health information with advertisers.

Inside the OS-Aware Phishing Kit Profiling Your Device

Lead Analysts: Prabhakaran Ravichandhiran and Jeewan Singh Jalal The lure email has been received. This is a fabricated iCloud…

Hidden prompt turns Microsoft Copilot into an AI worm

A new type of attack can trick Microsoft Copilot for Word into spreading hidden prompt injections from document to document.

Apple accused of letting fake crypto app steal $1.8 million

The case raises fresh questions about how effectively Apple polices apps that impersonate legitimate developers.

Buying TikTok views or followers? Here’s what you’re really getting

Behind TikTok's booming growth industry are fake engagements, stolen accounts, and a fast track to getting flagged.

AI robocalls: Why caller ID is still lying to you

AI is making robocall scams cheaper, more convincing, and harder to spot. Here's why caller ID still isn't enough.

OpenAI explains how its AI agent breached Hugging Face

OpenAI has published an update on the incident in which one of its agents escaped its sandbox and accessed Hugging Face infrastruc…

FTC and States Act Against Hims & Hers for Deceptive and Unlawful Privacy Practices

The Federal Trade Commission, joined by Utah and California, by and through Los Angeles County Counsel, today sued Hims & Hers all…

We found 120 fake Walmart stores trying to steal your credit card

Fake Walmart stores are offering unbelievable bargains on liquor to lure shoppers into entering their credit card details.

CyberheistNews Vol 16 #30 [Protect Your Users] AI Hallucinations Are Fueling Phishing Attacks

We rebuilt Malwarebytes Mobile Security for the scams of today

Your phone needs more than a lock screen to stay safe. We've rebuilt Malwarebytes Mobile Security to put scam protection first and…

Shared Claude chats were searchable on Google

Reddit users found that by using a specific search query, they could find shared Claude conversations in search results.

July Apple updates are especially important if you receive images

Apple issued a large July security update with several image processing related vulnerabilities that could compromise your device.

Vatican’s Click To Pray app exposed personal data from 700,000 users

Anyone could access other Click To Pray users' personal information. The flaw went unfixed for more than six months after it was r…

Aftercall ads are driving Android users crazy

A newly uncovered ad fraud campaign is spreading Android apps that display full-screen ads every time you end a phone call.

Sextortion scammers are exploiting ShinyHunters data leaks

Scammers are posing as ShinyHunters and using leaked email addresses to make their sextortion emails seem more credible.

What’s your data worth on the dark web? (Lock and Code S07E15)

This week on the Lock and Code podcast, we discuss just exactly why it is that hackers and scammers want your data—and how you're…

Majority of Organizations Hit by Targeted Impersonation Attacks

Fifty-three percent of organizations have had an executive or employee impersonated in targeted social engineering attacks over th…

FTC Takes Action Against Elite Events for Bypassing Ticket Purchase Limits in Violation of Better Online Ticket Sales Act

Ticket broker Elite Events and its operators will pay $300,000 in civil penalties to resolve Federal Trade Commission allegations…

A week in security (July 20 – July 26

A list of topics we covered in the week of July 20 to July 26 of 2026

The Open-Source Paradox: Navigating the New Frontier of AI Supply Chain Risk

The recent developments surrounding vulnerabilities in major AI repositories like Hugging Face serve as a critical wake-up call fo…

Don’t get fooled by TikTok resin art scams

Scammers are using stolen videos and fake artist profiles to trick people into buying resin art that never arrives. Here's how to…

Call of Duty Mobile scam uses fake free points to steal player accounts

A phishing site posing as a free Call of Duty Points giveaway is stealing Activision logins and two-factor authentication codes.