Fraud & Scams

FTC and States Act Against Hims & Hers for Deceptive and Unlawful Privacy Practices

The Federal Trade Commission, joined by Utah and California, by and through Los Angeles County Counsel, today sued Hims & Hers all…

We found 120 fake Walmart stores trying to steal your credit card

Fake Walmart stores are offering unbelievable bargains on liquor to lure shoppers into entering their credit card details.

CyberheistNews Vol 16 #30 [Protect Your Users] AI Hallucinations Are Fueling Phishing Attacks

We rebuilt Malwarebytes Mobile Security for the scams of today

Your phone needs more than a lock screen to stay safe. We've rebuilt Malwarebytes Mobile Security to put scam protection first and…

Shared Claude chats were searchable on Google

Reddit users found that by using a specific search query, they could find shared Claude conversations in search results.

July Apple updates are especially important if you receive images

Apple issued a large July security update with several image processing related vulnerabilities that could compromise your device.

Vatican’s Click To Pray app exposed personal data from 700,000 users

Anyone could access other Click To Pray users' personal information. The flaw went unfixed for more than six months after it was r…

Aftercall ads are driving Android users crazy

A newly uncovered ad fraud campaign is spreading Android apps that display full-screen ads every time you end a phone call.

Sextortion scammers are exploiting ShinyHunters data leaks

Scammers are posing as ShinyHunters and using leaked email addresses to make their sextortion emails seem more credible.

What’s your data worth on the dark web? (Lock and Code S07E15)

This week on the Lock and Code podcast, we discuss just exactly why it is that hackers and scammers want your data—and how you're…

Majority of Organizations Hit by Targeted Impersonation Attacks

Fifty-three percent of organizations have had an executive or employee impersonated in targeted social engineering attacks over th…

FTC Takes Action Against Elite Events for Bypassing Ticket Purchase Limits in Violation of Better Online Ticket Sales Act

Ticket broker Elite Events and its operators will pay $300,000 in civil penalties to resolve Federal Trade Commission allegations…

A week in security (July 20 – July 26

A list of topics we covered in the week of July 20 to July 26 of 2026

The Open-Source Paradox: Navigating the New Frontier of AI Supply Chain Risk

The recent developments surrounding vulnerabilities in major AI repositories like Hugging Face serve as a critical wake-up call fo…

Don’t get fooled by TikTok resin art scams

Scammers are using stolen videos and fake artist profiles to trick people into buying resin art that never arrives. Here's how to…

Call of Duty Mobile scam uses fake free points to steal player accounts

A phishing site posing as a free Call of Duty Points giveaway is stealing Activision logins and two-factor authentication codes.

OpenAI’s agent escaped its sandbox during a security test

An OpenAI agent escaped its sandbox, stole credentials, and broke into Hugging Face. Here's what that actually means.

Google wants to store a selfie video of your face

A new selfie video verification feature could make recovering your Google Account easier. But it also creates new security and pri…

Introducing The Hybrid Nudge Experience: Outbound Email Security Built for Your Risk Appetite

When it comes to outbound email security, every organization operates under different operational constraints and security require…

Beyond the Play Store: How Android threats really spread

Some threats never pass through the Play Store. Others arrive later in seemingly legitimate updates. Here's how Malwarebytes detec…

Elevating the SOC Experience: Smarter Automation, Richer Threat Intelligence, and AI-Native Investigation

Security operations teams face a constant balancing act: stopping sophisticated email threats, maintaining visibility across their…

New Phishing Tools Enable Attackers to Easily Bypass Multifactor Authentication

Researchers at ReliaQuest are tracking two new phishing toolkits that are designed to bypass multifactor authentication (MFA). The…

From Inbox to Encryption: How Ransomware Delivery Has Evolved

Ransomware and phishing have always been linked, but the old model was blunt: a phishing email carried the payload, the recipient…

Millions of cars could be tracked and unlocked by a hidden security flaw

A hidden flaw in a dealer-installed car alarm could let attackers unlock vehicles and track their locations. Many owners don't kno…

WhatsApp Web chats exposed by Adobe’s Acrobat extension flaw

HermeticReader is a now-patched vulnerability in Adobe's popular Acrobat Chrome extension that could have been used to spy on What…

Attackers Exploit AI Hallucinations to Send Users to Phishing Sites

Threat actors are using a new technique called “phantom squatting” to trick AI tools into directing users to phishing sites, accor…

Warning: ARToken Phishing Kit Automates BEC Attacks

Researchers at Cisco Talos are tracking a sophisticated phishing-as-a-service operator panel called “ARToken” that’s built on the…

The New Face of AI Risk

Cybercrime used to have a ‘"tell." It was the digital equivalent of a villain stroking their cat - clunky grammar, misspelt links…

Chick-fil-A loyalty accounts hijacked using stolen passwords

If you have a Chick-fil-A One account, now is a good time to change your password—and make sure it's one you don't use anywhere el…

FTC Returns Money to Consumers Harmed by Trend Deploy’s Deceptive Marketing

The Federal Trade Commission is sending more than $672,000 to consumers deceived by the operator of Trend Deploy, Frank Romero. Th…