Malware Bytes
As seen in:
Medium,
wikiHow,
Business Wire,
Benzinga,
Gizchina,
Morningstar,
Mic,
What's Next with Aki Anastasiou,
MyBroadband,
SiliconANGLE
and
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Malware Bytes
Fake iPhone Duo preorder scam triggers DarkSword attack
Table of Contents How to stay safe Apple announced its first foldable iPhone on September 9, and scammers were ready to ‘deliver’ one before anyone could buy it. Most of what we found around the launch of the iPhone Duo and iPhone 18 Pro was familiar fraud. But one fake preorder page was different. The fake Apple-style page offers a $500 voucher and a ticking preorder deadline.
Malware Bytes
Remember when social media was filled only with posts from your friends, rather than what an algorithm decided you wanted to see? So does the Australian government, and it wants that internet back. Yesterday, the government released draft legislation outlining a Digital Duty of Care.
Deepfake sextortion forces schools to remove student photos from websites
Schools love a good photo, whether it’s from a trip to a castle, a science prize ceremony, or sports day shot from three angles. For two decades, celebratory images like these have gone straight onto school websites, captioned with a name and a grade. But those days are gone, because it’s the internet in 2026 and we can’t have nice things. As first reported by the Guardian, experts are now urging schools to take those pictures down.
The World’s Most “Dangerous” AI, Anthropic’s Mythos, found only one flaw in curl
The world’s most “Dangerous” AI, Anthropic’s Mythos, found only one flaw in curl Pierluigi Paganini May 12, 2026 In April, Anthropic made considerable noise announcing Mythos, a new artificial intelligence model described as so effective at identifying vulnerabilities in code as to be, in the company’s own words, “dangerously good.” So good, in fact, that Anthropic decided against releasing it to the general public, instead distributing access to a small group of major organizations to give...
This old-school scam is still working
Table of Contents How to stay safe When we read about this new malware tactic, or that novel social engineering approach, it’s easy to forget that there are scammers out there making a living from ancient methods. Recently, one of our researchers received this variation on the good old Nigerian advance-fee scam. From: Mrs.Inga-Britt Ahlenius. Internal Audit, Monitoring, Consulting and Investigations Division UNITED NATIONS SCAM VICTIMS COMPENSATIONS PAYMENTS.
“Your shipment has arrived” email hides remote access software
An attachment in an email impersonating DHL about a shipment contains a link to a preconfigured SimpleHelp remote access tool—an ideal starting point for attackers to explore a network, steal data, and drop additional malware. A German industrial spare parts and equipment supplier received an email pretending to be from DHL, claiming a shipment had arrived. Given their line of business, I imagine they get this type of email all the time.
Credit Resources Vault: Why this credit email set off our scam alarms
If there is anything that annoys me more than a scammer, it’s companies that behave like one, while staying just on the right side of the law. They manage to linger and disappoint customers for years. It’s also why sometimes people think that Malwarebytes Scam Guard can be overly cautious when flagging websites. Some sites sit in a grey area where even seasoned researchers have to look twice to figure out whether something is an outright scam. That’s exactly what happened here.
A fake Slack download is giving attackers a hidden desktop on your machine
Table of Contents How to stay safe A trojanized Slack download from a typosquatting website is giving attackers something most users wouldn’t even know to look for: a hidden desktop running on their machine. The installer looks legitimate and even launches a working copy of Slack. But in the background, it can create an invisible session where attackers can browse, access accounts, and interact with your system without anything appearing on your screen.
“iCloud storage is full” scam is back, and now it wants your payment details
A few months ago, we reported on a fake cloud storage alert that triggered a redirect chain to an app that has since been delisted from the Apple Store. The threat of losing your photos is a powerful lure, so scammers are now using it to steal personal and financial details. The Guardian warns about an iCloud-themed campaign that start with a few “your iCloud storage is full’ messages, then escalates to threats.
Browser Guard gets even better with Access Control
Have you ever been on a website when a pop-up suddenly asked for access to your camera, microphone, location, or notifications? Whether you clicked “allow,” dismissed it, or just wondered why it appeared, those permission requests aren’t always harmless. Some sites can abuse those permissions. With Access Control, a new feature in Browser Guard, you decide exactly which websites can access your device and stop the rest.
Booking.com breach gives scammers what they need to target guests
Travel companies love telling you your data is safe. Booking.com just reminded everyone why that’s a hard promise to keep. The Amsterdam-based booking giant began notifying customers on April 13 that “unauthorized third parties” had accessed guest reservation data. The compromised information includes booking details, names, email addresses, physical addresses, and phone numbers—essentially everything you’d need to convincingly impersonate a hotel contacting a guest.
April Patch Tuesday fixes two zero-days, including one under active attack
This month’s patch Tuesday looks to remediate 167 security vulnerabilities including two zero-day vulnerabilities, one of which is known to be actively exploited in the wild. This makes April one of those months where “Patch Tuesday” looks more like “patch the entire stack,” from servers and endpoints to network gear, browsers, and mobile devices. But the alternative is leaving a long list of well‑documented doors open for attackers to walk through.
From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere
Table of Contents How to stay safe We’ve uncovered multiple campaigns distributing an infostealer we track as NWHStealer, using everything from fake VPN downloads to hardware utilities and gaming mods. What makes this campaign stand out isn’t just the malware, but how widely and convincingly it’s being spread. Once installed, it can collect browser data, saved passwords, and cryptocurrency wallet information, which attackers may use to access accounts, steal funds, or carry out further attacks.
AI clickbait can turn your notifications into a scam feed
Pushpaganda is the name researchers have given to an AI-assisted ad fraud, social engineering, and scareware operation targeting mobile users. For most people, Pushpaganda starts as something that looks completely normal. For example, a recommended article in your Google Discover feed (the personalized news stream on your phone) or one of the suggested stories you see when you open a new Chrome tab.
Fake YouTube copyright notices can steal your Google login
A convincing phishing campaign is going after YouTube creators, and if it works, attackers don’t just steal your Google login. They can take over your entire Google account, including Gmail, your files, and payments, then hijack your YouTube channel and use your audience to run scams. The lure is a fake copyright strike notification that’s so convincing even security-aware users could fall for it.
ChatGPT under scrutiny as Florida investigates campus shooting
Chatbots don’t kill people. But they can help others do so. On April 9, Florida Attorney General James Uthmeier announced that his office is investigating OpenAI over the role ChatGPT might have played in a deadly shooting at Florida State University, saying: “Subpoenas are coming.” The campus attack, which happened a year ago, killed two people and injured five.
Omnistealer uses the blockchain to steal everything it can
A new infostealer dubbed Omnistealer is turning the blockchain into a permanent malware hosting platform, which is bad news for both companies and everyday users. It’s pretty common for malware to store its payload on a public platform, ideally one that adds some trustworthiness to the download location, like Google docs, OneDrive, GitHub, npm, PyPI, and so on. The problem for malware peddlers is that these can be taken down. It can sometimes take a while and a lot of trouble, but it’s possible.
Simply opening a PDF could trigger this Adobe Reader zero-day
Opening the wrong PDF in Adobe Reader was enough to let criminals quietly spy on your computer and unleash more attacks, even though everything looked normal. A researcher analyzed a malicious PDF and found that it abused a previously unknown flaw (a “zero‑day”) in Adobe Acrobat Reader. When a victim simply opens this PDF, hidden code inside it can read files that Acrobat Reader should not be allowed to access and send them to an attacker’s server.
A week in security (April 6 – April 12)
Last week on Malwarebytes Labs: Stay safe! We don’t just report on scams—we help detect them Cybersecurity risks should never spread beyond a headline. If something looks dodgy to you, check if it’s a scam using Malwarebytes Scam Guard. Submit a screenshot, paste suspicious content, or share a link, text or phone number, and we’ll tell you if it’s a scam or legit. Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.
ClickFix finds a new way to infect Macs
ClickFix campaigns are looking for alternatives now that many Mac users have been made aware of the dangers of pasting certain commands into Terminal. Researchers found that ClickFix has kept the same social engineering playbook but completely sidestepped Terminal by using the applescript:// URL scheme to auto‑open Script Editor with a ready‑to‑run script that pulls Atomic Stealer. ClickFix is a social engineering method that tricks users into infecting their own device with malware.
Fake Claude site installs malware that gives attackers access to your computer
Table of Contents How to stay safe Claude’s rapid growth—nearly 290 million web visits per month—has made it an attractive target for attackers, and this campaign shows how easy it is to fall for a fake site. We discovered a fake website impersonating Anthropic’s Claude to serve a trojanized installer. The domain mimics Claude’s official site, and visitors who download the ZIP archive receive a copy of Claude that installs and runs as expected.
NSFW app leak exposes 70,000 prompts linked to individual users
MyLovely.AI, an AI “artwork” generation platform, has reportedly been compromised, affecting 106,362 registered users. The AI girlfriend app allows users to generate personalized NSFW content and engage in real-time conversations with AI-generated personas, often sharing highly personal prompts and interactions.
This fake Windows support website delivers password-stealing malware
A fake Microsoft support website is tricking people into downloading what looks like a normal Windows update. Instead, it installs malware designed to steal passwords, payment details, and account access. Because the file looks legitimate and avoids detection, it can slip past both users and security tools. We spotted the campaign at microsoft-update[.]support, a typosquatted domain dressed up to look like an official Microsoft support page.
Timeshare owners warned to watch out for cartel-linked scams
If you own a timeshare and have been searching for a way out, you need to know who may be targeting you. In February, the US Treasury Department announced sanctions against a timeshare fraud network linked to a major Mexican drug cartel, the Jalisco New Generation Cartel (CJNG). These aren’t your typical scammers. They’re more organized, more convincing, and in some cases more dangerous than the smooth-talking salesperson who sold you the timeshare in the first place.
Russian hacking group targets home and small office routers to spy on users
British security officials found that a group linked to the Russian military is spying on users of compromised Small Office/Home Office (SOHO) routers in a broad cyber espionage campaign. A Microsoft blog goes into the technical details of these attacks.
Killer robots are here. Now what? (Lock and Code S07E07)
Big news: Lock and Code is nominated for a Webby Award! You can help us win the People’s Voice Award by voting here. This week on the Lock and Code podcast… We have to talk about killer robots. No, not the Terminator, and not some Boston Dynamics robot run amok. We have to talk instead about a technological reality that is very much already here.
That dream job offer from Coca-Cola or Ferrari? It’s a trap for your passwords
As layoffs surge and job seekers flood the market, phishing campaigns impersonating major brands, including Coca-Cola and Ferrari, are ramping up—and they’re more sophisticated than ever. The first scam we found uses a convincing booking page to collect personal details, then tricks victims into handing over their Google work account credentials through a fake sign-in page disguised inside what looks like a real Chrome browser window.
Blocking children from social media is a badly executed good idea
While we can probably all agree that there is more than enough proof that social media is bad for the mental health of our children, the methods we are trying to block or ban them seem to do more harm than good. Across the world, lawmakers are tripping over each other to be seen “doing something” about kids and social media.
Apple expands “DarkSword” patches to iOS 18.7.7
Apple widened its latest iOS 18 security update to cover far more iPhones and iPads, specifically to stop real‑world DarkSword attacks that can compromise a device from a single website visit. After researchers published their findings about the DarkSword attacks and an exploit kit abusing the vulnerabilities appeared on GitHub, Apple quietly updated its March 24 security bulletin.
Wikipedia’s AI agent row likely just the beginning of the bot-ocalypse
Table of Contents What’s next? The Internet is filled with people who insist on being right. In the past, at least they could be reasonably sure that they were arguing with other humans. Those days are gone, apparently. Wikipedia just had to ban an AI that was making edits on its own. Apparently, the AI took it personally. The AI, named Tom-Assistant, was writing articles on Wikipedia.
WhatsApp on Windows users targeted in new campaign, warns Microsoft
Microsoft researchers found a campaign that abuses WhatsApp attachments to sneak a script onto Windows machines which will lead to the attacker gaining remote control. WhatsApp offers a desktop application for Windows and macOS, which users can synchronize with their mobile devices. Desktop versions of WhatsApp are generally used as extensions of mobile apps rather than primary platforms.
Why we’re still not doing April Fools’ Day
People lost an estimated $442 billion to scams last year worldwide, according to the Global Anti-Scam Alliance. The scale of that is hard to picture, but people’s day-to-day scam experience is easier to recognize: Our research found that 44% of people say they encounter mobile scams every single day. Two in three say it’s hard to “tell apart a scam from the real thing” and only 15% strongly agree they could detect a scam. A year ago, we said we were stepping away from April Fools’ Day.
Asking AI for personal advice is a bad idea, Stanford study shows
Stanford computer scientists just proved what therapists already suspected: AI chatbots will agree with almost anything you say to keep you happy. The researchers caught these systems validating dangerous decisions just to maintain user engagement. That’s a worrying development, especially given Pew research figures showing nearly one in eight (12%) of American teenagers have turned to chatbots for emotional support.
Axios supply chain attack chops away at npm trust
Researchers found that compromised Axios versions installed a Remote Access Trojan. Axios is a promise-based HTTP Client for node.js, basically a helper tool that developers use behind the scenes to let apps talk to the internet. For example, Axios makes requests such as “get my messages from the server” or “send this form to the website” easier and more reliable for programmers and it saves them from having to write a lot of low‑level networking code themselves.
New macOS security feature will alert users about possible ClickFix attacks
Rumor has it that Apple deployed a new security feature in the fight against ClickFix. The new feature will be available for macOS Tahoe 26.4 and it will warn Mac users if they paste certain commands into the Terminal app that might be harmful. If such a command is pasted, macOS will warn the users with a prompt saying: “Possible malware, Paste blocked. Your Mac has not been harmed. Scammers often encourage pasting text into Terminal to try and harm your Mac or compromise your privacy.
A week in security (March 23 – March 29)
Last week on Malwarebytes Labs: Stay safe! We don’t just report on scams—we help detect them Cybersecurity risks should never spread beyond a headline. If something looks dodgy to you, check if it’s a scam using Malwarebytes Scam Guard. Submit a screenshot, paste suspicious content, or share a link, text or phone number, and we’ll tell you if it’s a scam or legit. Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.
Criminals are renting virtual phones to bypass bank security
Researchers at Group-IB warn about criminals using virtual Android devices to bypass modern security solutions. Cloud phones are virtual Android devices that can fully mimic real device fingerprints (model, hardware, IP, timezone, sensor data, behavior). This allows them to undermine banks’ device‑based fraud detection. Originally, phone farms were made up of physical devices and were set up for testing.
Infiniti Stealer: a new macOS infostealer using ClickFix and Python/Nuitka
Table of Contents Acknowledgements A previously undocumented macOS infostealer has surfaced during our routine threat hunting. We initially tracked it as NukeChain, but shortly before publication, the malware’s operator panel became publicly visible, revealing its real name: Infiniti Stealer. This malware is designed to steal sensitive data from Macs. It spreads through a fake CAPTCHA page that tricks users into running a command themselves: a technique known as ClickFix.
'Roblox' Developer Warns Parents To Monitor Kids '24/7' — Or Keep Them off the Platform Entirely
A "Roblox" developer and safety monitor identified only as Sam is urging parents to supervise their children at all times while using the popular gaming platform, or to keep them off it entirely, citing disturbing content and dangerous interactions he has personally witnessed.
Landmark verdicts put Meta’s “addiction machine” platforms on trial
Meta faced two major legal setbacks this week as courts in New Mexico and California both found the company liable for harm to children. A New Mexico jury just ordered Meta to pay $375 million for misleading parents about child safety on Instagram and Facebook. Jurors found the company violated consumer protection laws by claiming its platforms were safe while knowing they exposed children to danger.
Table of Contents The real danger On Monday, the Federal Communications Commission (FCC) updated its list of insecure equipment, outlining its reasons for adding all consumer-grade routers made outside the US.
Scam compounds hiring “AI models” to seal the deal in deepfake video calls
Scam compounds in Southeast Asia have already become modern slave farms, trapping victims and forcing many of them to become scammers for them. Now they’ve added another type of worker to the mix: so-called AI models. These professional scammers conduct video calls with their targets, charming them into handing over their cash.
The March Madness scam playbook
March Madness is the annual men’s and women’s NCAA Division I basketball tournament, where 68 teams play in a single-elimination bracket for the US national championship. But March Madness doesn’t just bring buzzer beaters and busted brackets. It also kicks off a short, intense season for scammers who know fans are distracted, emotional, and often in a hurry.
FriendlyDealer mimics official app stores to push unvetted gambling apps
We’ve identified a huge social-engineering campaign designed to steer people into online gambling sites under the impression they’re installing a legitimate app. We’re calling it FriendlyDealer. It’s been observed across at least 1,500 domains, each hosting a website that impersonates the Google Play or Apple App Store. Users think they’re downloading a gambling app from a trusted source, with all the checks, reviews, and safeguards that implies.
Advanced Flow will make Android sideloading safer
Google has announced the introduction of Advanced Flow, designed to let Android users install apps from unverified developers more safely than before. This process is known as sideloading.
A week in security (March 16 – March 22)
Last week on Malwarebytes Labs: Stay safe! We don’t just report on threats—we help safeguard your entire digital identity Cybersecurity risks should never spread beyond a headline. Protect your, and your family’s, personal information by using identity protection. Source link
This is all it takes to stop a train (Lock and Code S07E06)
This week on the Lock and Code podcast… Forget the runaway train thrillingly shot in Buster Keaton’s 1926 film “The General,” and never mind the charging locomotive rescued by actors Denzel Washington and Chris Pine in the 2010 film “Unstoppable,” as there’s a far more frequent (and far less heart-pounding) railcar drama happening across California’s Bay Area: The repeated breakdown of the Bay Area Rapid Transit (BART) system, all because of a few networking errors.
That “job brief” on Google Forms could infect your device
We’ve identified a campaign using business-related lures, such as job interviews, project briefs, and financial document, to distribute malware, including the PureHVNC Remote Access Trojan (RAT). It’s not the malware that’s new, but how the attack starts. Instead of the usual phishing email or fake download page, attackers are using Google Forms to kick off the infection chain. The attack typically begins when a victim downloads a business-themed ZIP file linked from a Google Form.
Could your face change what you pay? NYC wants limits on biometric tracking
Table of Contents What to do? New York City lawmakers are pushing to ban private businesses from using biometric tools like voice and facial recognition software to track the public. While the desire to use surveillance technology in stores to fight shoplifting is understandable, lawmakers and privacy advocates are worried that the data could be repurposed to profile customers.
Your tax forms sell for $20 on the dark web
Tax season is also peak season for identity theft. Criminals use stolen personal data to file fake tax returns and claim refunds before the real taxpayer does. Here’s how the fraud works, and how to protect yourself. What is Stolen Identity Refund Fraud (SIRF)?
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Malware
Contact Malware, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack