Malwarebytes Labs

By making social accounts public, the new policy exposes private data that attackers can use for targeting, impersonation, or extortion.

Criminals make malicious ChatGPT and Grok conversations appear at the top of common Google searches—leading users straight to the Atomic macOS Stealer.

After years of trying VPNs for myself, privacy-minded family members, and a few mission-critical projects, here’s what I wish everyone knew.

Researchers have found Android malware that holds your files and your device hostage until you pay the ransom.

Say hello to the upgraded Malwarebytes for Mac, with stronger protection and more control.

If we’re lucky, this update will close out 2025’s run of Chrome zero-days. This one is a V8 type-confusion issue already being exploited in the wild.

The update patches three zero-days and introduces a new PowerShell warning meant to help you avoid accidentally running unsafe code from the web.

GhostFrame uses dynamic subdomains and hidden iframes to help attackers slip past basic security tools.

The NCSC warns that prompt injection is unlikely to be mitigated in the same way SQL injection was. How do they compare?

The core problem persists: anyone can still buy a ‘verified’ checkmark from X, so don’t take their authenticity for granted.

Attackers are blending automation, impersonation, and social engineering to get inside organizations. Here’s how to spot the signs.

We found a campaign that hosts fake login pages on Cloudflare Pages and sends the stolen info straight to Telegram.

Family photos pulled from social media are being used as “proof-of-life” in virtual kidnapping scams, the FBI warns.

A list of topics we covered in the week of December 1 to December 7 of 2025

A fresh investigation uncovers how Predator spyware still reaches victims through high-priced, newly bought zero-days.

We follow the trail of a simple insurance text scam to show how it can spiral into full-blown identity theft.

Facial recognition software has long been criticized for accuracy issues and past wrongful arrests.

Google has pushed out a Chrome update with 13 security fixes, including a high-severity flaw in Digital Credentials.

Researchers are seeing a rise in Evilginx to steal session cookies, letting them bypass the need for a multi-factor authentication (MFA) token among educational institutions.

We’ve seen a new wave of attacks exploiting legitimate Remote Monitoring and Management (RMM) tools to remotely control victims’ systems.