Malwarebytes Labs

Criminals are tricking WhatsApp users into linking an attacker’s browser to their account using fake login pages and routine-looking prompts.

The extension disclosed its AI data collection, but not in a way most users would recognize—or knowingly agree to.

Google’s patched two flaws in Chrome, both of which can be triggered remotely when a user loads specially crafted web content.

A “purchase order” PDF blocked by Malwarebytes led to a credential-harvesting phishing site. So we analyzed the attack and where the data went next.

We compared three incidents that surfaced today to show why the impact of a breach depends less on who was hit and more on what was taken.

Malwarebytes threat research reveals spike in adware and malicious malware families Triada and MobiDash heading into the holiday season.

A security researcher says a basic website flaw at a photo booth operator may have exposed hundreds of private customer photos.

Google will discontinue its dark web report early next year, prompting mixed reactions. How does dark web monitoring actually help keep you safe?

This week on the Lock and Code podcast, we speak with Erin West about pig butchering scams and the efforts to stop this new, global crisis.

Scammers exploited a PayPal subscriptions feature to send legitimate emails from service@paypal.com, using fake purchase notifications to push tech support scams.

A list of topics we covered in the week of December 8 to December 14 of 2025

By making social accounts public, the new policy exposes private data that attackers can use for targeting, impersonation, or extortion.

Criminals make malicious ChatGPT and Grok conversations appear at the top of common Google searches—leading users straight to the Atomic macOS Stealer.

After years of trying VPNs for myself, privacy-minded family members, and a few mission-critical projects, here’s what I wish everyone knew.

Researchers have found Android malware that holds your files and your device hostage until you pay the ransom.

Say hello to the upgraded Malwarebytes for Mac, with stronger protection and more control.

If we’re lucky, this update will close out 2025’s run of Chrome zero-days. This one is a V8 type-confusion issue already being exploited in the wild.

The update patches three zero-days and introduces a new PowerShell warning meant to help you avoid accidentally running unsafe code from the web.

GhostFrame uses dynamic subdomains and hidden iframes to help attackers slip past basic security tools.

The NCSC warns that prompt injection is unlikely to be mitigated in the same way SQL injection was. How do they compare?