Malwarebytes Labs

From agentic browsers to chat assistants, the same tools built to help us can also expose us.

A Magento bug called SessionReaper is doing the rounds, and researchers warn it’s letting attackers hijack real shopping sessions.

The UK’s competition watchdog says Apple’s “walled garden” gives it too much control—and may soon force it to allow rival app stores on iPhones.

This is part of its broader push to fight impersonation and fraud, after removing more than 21,000 fake customer-support pages from Facebook.

The add-ons abuse WhatsApp Web to blast bulk messages, sidestepping both Chrome’s extension policies and WhatsApp’s anti-spam rules.

Boo! A Home Depot Halloween “giveaway” isn’t a treat—it’s a phishing trick. Fake links, tracking pixels, and compromised sites are the real prizes.

The bug, tracked as CVE-2025-54957, could let attackers run code via audio files.

Microsoft’s October update disabled USB keyboards and mice in Windows Recovery Mode, leaving unlucky users with two problems for the price of one.

Anthropic’s new research shows how easy it could be to poison AI models—proof that even small manipulations can have big effects.

This week on the Lock and Code podcast… Google is everywhere in our lives. It’s reach into our data extends just…

Chinese gangs are using US SIM farms and money mules to run industrial-scale text scams that steal and launder Americans’ card data.

A list of topics we covered in the week of October 13 to October 19 of 2025

While Prosper says no funds or accounts were accessed, the stolen data could lead to targeted phishing and identity theft.

It might surprise some that a security company would choose WordPress as the backbone of its digital content operations. Here’s what we considered when choosing it.

Privacy left the chat. A misconfigured Kafka broker effectively undid the anonymity many users rely on.

The fashion retailer says a breach at a marketing partner exposed limited contact details—but no financial data or passwords.

Florida claims Roku ignored clear signs its users were minors, collecting and selling viewing habits, voice recordings and precise locations.

We dive into the “last goodbye” messages sent via TikTok that lead victims to a crypto paywall scam.

Fake alerts claim your Robinhood account is at risk. The link leads to a convincing copy of the site—but it’s built to steal your login.

Scientists have revealed a gaping hole in global telecom security, intercepting personal and business data from geostationary satellites.