Fraud & Scams

OpenAI’s agent escaped its sandbox during a security test

An OpenAI agent escaped its sandbox, stole credentials, and broke into Hugging Face. Here's what that actually means.

Google wants to store a selfie video of your face

A new selfie video verification feature could make recovering your Google Account easier. But it also creates new security and pri…

Introducing The Hybrid Nudge Experience: Outbound Email Security Built for Your Risk Appetite

When it comes to outbound email security, every organization operates under different operational constraints and security require…

Beyond the Play Store: How Android threats really spread

Some threats never pass through the Play Store. Others arrive later in seemingly legitimate updates. Here's how Malwarebytes detec…

Elevating the SOC Experience: Smarter Automation, Richer Threat Intelligence, and AI-Native Investigation

Security operations teams face a constant balancing act: stopping sophisticated email threats, maintaining visibility across their…

New Phishing Tools Enable Attackers to Easily Bypass Multifactor Authentication

Researchers at ReliaQuest are tracking two new phishing toolkits that are designed to bypass multifactor authentication (MFA). The…

From Inbox to Encryption: How Ransomware Delivery Has Evolved

Ransomware and phishing have always been linked, but the old model was blunt: a phishing email carried the payload, the recipient…

Millions of cars could be tracked and unlocked by a hidden security flaw

A hidden flaw in a dealer-installed car alarm could let attackers unlock vehicles and track their locations. Many owners don't kno…

WhatsApp Web chats exposed by Adobe’s Acrobat extension flaw

HermeticReader is a now-patched vulnerability in Adobe's popular Acrobat Chrome extension that could have been used to spy on What…

Attackers Exploit AI Hallucinations to Send Users to Phishing Sites

Threat actors are using a new technique called “phantom squatting” to trick AI tools into directing users to phishing sites, accor…

Warning: ARToken Phishing Kit Automates BEC Attacks

Researchers at Cisco Talos are tracking a sophisticated phishing-as-a-service operator panel called “ARToken” that’s built on the…

The New Face of AI Risk

Cybercrime used to have a ‘"tell." It was the digital equivalent of a villain stroking their cat - clunky grammar, misspelt links…

Chick-fil-A loyalty accounts hijacked using stolen passwords

If you have a Chick-fil-A One account, now is a good time to change your password—and make sure it's one you don't use anywhere el…

FTC Returns Money to Consumers Harmed by Trend Deploy’s Deceptive Marketing

The Federal Trade Commission is sending more than $672,000 to consumers deceived by the operator of Trend Deploy, Frank Romero. Th…

Paidwork breach exposes data of 23 million users: Check if you’re affected

A reported breach at microtask platform Paidwork exposed personal and financial data of more than 23 million users. Here's how to…

Trust Nothing: Tips to Secure AI Tools and Agents

So, you have some AI tools or are thinking about deploying them and want to know a bit about securing them. You are not alone,…

What happens if you visit a WordPress site hacked through wp2shell?

Attackers started exploiting the critical wp2shell vulnerability chain within hours of patches being released, putting sites and t…

CyberheistNews Vol 16 #29 ClickFix Social Engineering is Now the Leading Malware Delivery Method

Beyond the Checkbox: How a Proactive Partnership Led to Turnkey Hazing Compliance

When we formed the global steering committee for our KnowBe4 Student Edition, our primary goal was to simply listen. That listenin…

Student Loan Forgiveness Scammer Permanently Banned from Debt Relief Industry and Telemarketing

Dennise Merdjanian, an operator of a student loan debt forgiveness scheme, will be permanently banned from the debt relief industr…

New ClickLock Stealer locks your Mac until you hand over your password

A new macOS infostealer tricks victims into revealing their system password and installs a persistent backdoor for future access.

Don’t trust that “FBI agent” in your DMs

The FBI is warning that fraudsters are using fake IC3 accounts and direct messages to target people who've already been scammed.

AI nudify apps spark legal scrutiny of Apple and Google’s profits

Instead of fighting over what app stores host, the San Francisco City Attorney is targeting how they make money from AI nudify app…

The Odyssey piracy scams appear within hours of the movie’s release

The release of The Odyssey has already sparked a wave of piracy scams, from fake browser errors to malware masquerading as movie f…

Healthcare giant Abbott probes two cyber incidents amid extortion claims

Extortion groups ShinyHunters and ShadowByt3$ claim they stole vast amounts of patient data. Those allegations have not been verif…

FBI Warns of Scammers Impersonating the IC3

Founders of Celsius Network Ordered to Pay $16.5 Million to Resolve FTC Charges

Alexander Mashinsky, the former CEO of cryptocurrency platform Celsius Network Inc. (Celsius), and his business partners, Shlomi D…

Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding

We look into how attackers are using the legitimate Ren'Py game engine to spread a malware loader that ultimately delivers Amatera…

A week in security (July 13 – July 19)

A list of topics we covered in the week of July 13 to July 19 of 2026

Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords

One compromised Shark robot vacuum could unlock remote access to many others.