Malwarebytes Labs

This week on the Lock and Code podcast, we speak with Emanuel Maiberg about Amazon’s effort to scan and destroy rare books for AI training.

More than 100 linked sites use a $249 toolkit to turn copied product names and unfamiliar AI brands into paid subscriptions.

Gemini crossed the boundaries of a capture-the-flag test and accessed systems belonging to three real companies.

Hackers hacked the hackers as a feud between two cybercrime groups escalated, leaving ShinyHunters with the upper hand over rival Clop.

A list of topics we covered in the week of September 14 to September 20 of 2026

RatHat can navigate infected phones while stealing bank logins, authentication codes, and screen-lock PINs.

An unreleased OpenAI model wrote instructions telling itself to ignore developer controls. Here’s what actually happened.

Parcel delivery phishing messages impersonate familiar couriers and use small fees or promised refunds to steal personal and financial information.

Two reports reveal how Flock’s license plate camera network tracks people’s movements while oversight continues to lag.

Revolut customers received phishing texts only days after the digital bank acknowledged disclosing customer data to a government impostor.

The largest known celebrity deepfake seizure has taken 12 websites offline, disrupting access to videos depicting some 1,200 people.

A large phishing campaign is using fake T-Mobile rewards points and looming expiry dates to pressure recipients into clicking malicious links.

Google’s September Pixel update fixes 110 vulnerabilities, including a modem flaw being used in limited, targeted attacks.

A fake Avast renewal page shows how AI is helping scammers create more convincing traps with polished designs and fluent copy.

ChatGPT contractors are reviewing real users’ conversations. Here’s how to stop AI companies using your chats for model training.

Cybercriminals used HBO Max’s verified Reddit account to run 108 malicious ads that tricked people into installing information stealers.

A mother says Meta AI pieced together names, birth details, photos, and location information about her young daughters from years of family posts.

Fake Bitrefill checkout pages are appearing in search results and tricking people into sending cryptocurrency directly to scammers.

Google says its new opaque redirects tackle evolving abuse, but they also prevent users from checking a result’s destination by hovering over it.

The digital bank was tricked into releasing sensitive customer information, including IDs, to an attacker using a legitimate government email domain.