CyberWatch Newsroom Live Intel

Moderate Malwarebytes Labs

2026-10-21 Malwarebytes Labs

Fake Amazon Music x YouTube deal lures creators into a Google login trap

.kadence-column476672_104e78-a1 > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column476672_104e78-a1 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column476672_104e78-a1 > .kt-inside-inner-col{flex-direction:column;}.kadence-column476672_104e78-a1 > .kt-inside-inner-col …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate CVE-2026-113380 Malwarebytes Labs

2026-10-21 Malwarebytes Labs

Signal bug could let someone keep listening after you hang up

A recently disclosed flaw in Signal’s calling software could allow another participant to keep hearing you after you hang up. The vulnerability, tracked as CVE-2026-113380 ( CVSS score 9.3 out of 10), affects RingRTC versions earlier than 2.72.0. RingRTC is the open-source library behind Signal’s voice and video calling functionality, providing calling compo…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Malwarebytes Labs

2026-10-20 Malwarebytes Labs

Google may add your number to all your accounts: How to stop it

As Android Central reports , users have received unexpected emails telling them their phone number has been verified for secondary Google accounts. Like me and many others, you may have one Google account for everyday use, another for work, and a third for things you would rather keep separate. But if you’re using an Android phone, those accounts may have so…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Malwarebytes Labs

2026-10-20 Malwarebytes Labs

Meta glasses caught recording conversations without wake phrase

Meta says it has resolved an issue after some Ray-Ban Meta owners reported that their glasses recorded conversations without the “Hey Meta” wake phrase. Users reported finding recordings and transcripts of conversations they did not knowingly save. Recording without anyone realizing raises privacy concerns for both the wearer and the people around them. The …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Malwarebytes Labs

2026-10-20 Malwarebytes Labs

Man seeking love travels 2,000 km to meet an AI-generated woman

A 49-year-old bricklayer sold his belongings before traveling 2,000 km by bus from his home in Brazil to meet “Jéssica,” an online influencer he had fallen for. Yet despite having a social media account with more than 300,000 followers, she never existed. Edimar Rocha Martins lives in Imperatriz, a city in northeastern Brazil. He says he struck up an online …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Important Malwarebytes Labs

2026-10-19 Malwarebytes Labs

AOMEI Backupper update servers hijacked to push malware: Check your PC

The Google Threat Intelligence Group (GTIG) reports that attackers compromised AOMEI Technology’s update and notification infrastructure in a campaign investigated between April and July. AOMEI Backupper is backup software that the company says is used by more than 100 million people worldwide. It lets users back up files, copy entire drives, and recover dat…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Malwarebytes Labs

2026-10-19 Malwarebytes Labs

A sextortion conspiracy killed his son (Lock and Code S07E21)

This week on the Lock and Code podcast… At just 17 years old, Jordan DeMay was murdered by strangers online. That’s how Jordan’s father, John DeMay, described what happened to his son four years ago. At home in Michigan, Jordan was readying for a weekend trip when he received a friend request on Instagram. The invite was sent by a user named “dani.robertts” …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Critical Malwarebytes Labs

2026-10-19 Malwarebytes Labs

Millions of California students’ sensitive data stolen in breach

Personal information belonging to millions of current and former California public school students has been stolen from a system operated by Educational Testing Service (ETS). ETS is a nonprofit organization that helps run the state’s standardized tests under contract with the California Department of Education (CDE). It has begun notifying students and fami…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Malwarebytes Labs

2026-10-19 Malwarebytes Labs

A week in security (October 12 – October 18)

Last week on Malwarebytes Labs: Eiliko robot companion exposes private chats and can be hijacked “Spray and pray” job applications could make it harder for you to spot a scam OpenAI sued over children safety and data use Update Chrome: Google fixes 37 security flaws, including seven critical bugs Is this link safe? Find out with Malwarebytes Scam Link Check …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Important Malwarebytes Labs

2026-10-16 Malwarebytes Labs

Eiliko robot companion exposes private chats and can be hijacked

The Verge reports that Eiliko, a small AI robot companion made by Energize Lab, has serious security flaws that expose private conversations and let an attacker remotely change what the toy says. According to The Verge, researcher Sammy Azdoufal could access 13 million conversations and what appeared to be the entire active worldwide fleet of 68,000 robots. …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Malwarebytes Labs

2026-10-16 Malwarebytes Labs

“Spray and pray” job applications could make it harder for you to spot a scam

AI can help you send more job applications. But when you lose track of where you’ve applied, a fake recruiter’s message can start to look like the reply you’ve been waiting for. Job hunting can feel like shouting into the void. You send applications, rewrite cover letters, and wait for replies that may never arrive. Then a message lands on your phone: someon…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Malwarebytes Labs

2026-10-16 Malwarebytes Labs

OpenAI sued over children safety and data use

OpenAI is facing separate legal challenges over how ChatGPT interacts with children. The Guardian reports that eight US states accuse the company of misleading parents about the chatbot’s safety and exposing vulnerable users to dangerous conversations. Separately, CNET reports that a mother suing on behalf of her two children alleges that OpenAI collected an…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Critical CVE-2026-110152 Malwarebytes Labs

2026-10-15 Malwarebytes Labs

Update Chrome: Google fixes 37 security flaws, including seven critical bugs

On October 13 and 14, Google issued several Chrome updates . Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 for Linux . The update includes 37 security fixes, including seven rated Critical. On the same day, Google released version 155.0.8059.79 for Android . It …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Important Malwarebytes Labs

2026-10-15 Malwarebytes Labs

Is this link safe? Find out with Malwarebytes Scam Link Check

Maybe it’s a text saying your package couldn’t be delivered, with a link to reschedule. Or an email from your bank asking you to verify your account. Or perhaps it’s an invitation from someone you know to view a document. The message looks real enough, but something about the link feels fishy. Do you click it? Malwarebytes Scam Link Check is a new free tool …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Malwarebytes Labs

2026-10-15 Malwarebytes Labs

Sextortion “help” firm took $60 million from victims, FTC alleges

The Federal Trade Commission (FTC) has filed a complaint accusing Digital Forensics Corporation of exploiting people already targeted by sextortionists . We have talked about sextortion and recovery scams in the past, but we never looked specifically at the combination. Apparently, there is a lot of money to be made for those ruthless enough to take money fr…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Malwarebytes Labs

2026-10-15 Malwarebytes Labs

Raven AI lets cops find your home from a photo taken inside

Photos you take with your phone and some digital cameras can contain hidden information, including where they were taken. You can strip that data out before sharing a photo with someone, which would help to protect your location. But the image itself may still give you away. A company called Graylark says its Raven AI tool can match an indoor photo to a spec…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Malwarebytes Labs

2026-10-14 Malwarebytes Labs

AI worms could spread across your smart devices, Anthropic warns

Your streaming box might not look like much of a computer. But connect enough inexpensive devices together, and they can run an AI model. Researchers at Anthropic demonstrated this by running a Google Gemma model across 15 off-brand Android TV boxes. They warn that small models could soon spread across vulnerable internet-of-things (IoT) devices, including s…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Critical CVE-2026-96951 Malwarebytes Labs

2026-10-14 Malwarebytes Labs

Update Windows: Record Patch Tuesday fixes flaw already under attack

Microsoft’s October Patch Tuesday release addresses a record-breaking 1,413 vulnerabilities , including an actively exploited Windows Shell zero-day and two other publicly disclosed flaws. Just when you thought a previous record would stand for a while, Microsoft comes out again with the largest monthly Patch Tuesday release. Microsoft has said its growing u…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Malwarebytes Labs

2026-10-14 Malwarebytes Labs

Fake Calendly “Meta Careers” pages steal Facebook and Google logins

We found a wave of websites posing as Calendly booking pages for job interviews at Meta. Visitors pick a slot for a 30-minute phone call with a recruiter, fill in their details, and pass what looks like a CAPTCHA. Then the page asks them to log in to Facebook. The interview is fake. The pages are designed to steal the visitor’s Facebook login details, includ…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Malwarebytes Labs

2026-10-14 Malwarebytes Labs

Police receive fake murder tip from Anthropic’s Claude AI

Police tip hotlines already have their fair share of crank callers. Apparently they now have to contend with crank AI agents as well. AI agents have already been caught hacking software companies , breaching an Australian government portal , and trying to hack a Canadian government website . Now Anthropic’s Claude has added a made-up murder tip to the list. …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Malwarebytes Labs

2026-10-13 Malwarebytes Labs

Grindr users’ sensitive data shared through ad auctions without valid consent

Norway’s privacy regulator Datatilsynet has fined advertising technology company Xandr 92 million Norwegian kroner, approximately $9.6 million, for unlawfully processing and sharing sensitive information about Grindr users. While the decision concerns users in Norway, the data-sharing practices were not confined to Norwegian users. BleepingComputer reports t…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Important Malwarebytes Labs

2026-10-13 Malwarebytes Labs

Hackers heat up supermarket fridges, spoiling food across France

A cyberattack has forced hundreds of supermarkets across France to throw away refrigerated and frozen food after attackers interfered with the systems that keep it cold. The attack caused significant financial losses and food waste. Some installations reportedly reached temperatures of around 50°C (122°F), with damaged equipment and reports of fires adding t…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Malwarebytes Labs

2026-10-13 Malwarebytes Labs

Scammers know your name, and they’re counting on you to reply

Scammers are finding different ways to use personal details exposed in data breaches to lure people into conversations. Last week , we showed how a Facebook Marketplace listing used the recipient’s name to make a text asking “Is this still available?” more convincing. The one we got this week was a lot simpler. No suspicious link. No overdue payment. No warn…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Malwarebytes Labs

2026-10-12 Malwarebytes Labs

How “123456” became the key to almost 9 million personal records

An attacker reportedly used a leaked password to abuse a company’s legitimate access to Denmark’s population register (CPR). The weak password is remarkable, but the failure to spot millions of unusual searches made the breach worse. The CPR administration states it identified a serious security incident. By abusing a Danish company’s authorized access to th…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory