Malware Bytes

Two people shopping for the same product shouldn’t have to wonder whether one is paying more because a company knows more about them.

That’s the concern behind a bill passed by the New York City Council on November 12. The legislation targets surveillance pricing, defined as using personal data and algorithms to offer different people different prices for the same goods or services.

Introduction 891-A would prohibit these practices in transactions with consumers in New York City. It would also restrict collecting, selling, or sharing personal data to facilitate surveillance pricing. The bill is at the mayor’s desk and would take effect one year after becoming law.

For consumers, the issue goes beyond an unexpectedly expensive shopping cart. It’s about companies turning information about your life and online behavior into a tool for deciding what to charge you.

Learn more about surveillance pricing in this episode of our podcast Lock & Code:

Large-scale data collection also creates risks beyond pricing, including sensitive inferences about people and unauthorized disclosure of their information.

What exactly is surveillance pricing?

Surveillance pricing uses information about you, or a profile a company has built about you, to help determine the price you see for a specific product or service.

That information can include your location, browsing history, shopping habits, and demographic characteristics. In initial findings published in January 2025, the Federal Trade Commission (FTC) said pricing tools could draw on surprisingly detailed behavior, including mouse movements and the products people leave unpurchased in their online shopping carts.

This is not some conspiracy theory. There is evidence that the tools and data pipelines exist. The FTC’s findings drew on documents from pricing and technology intermediaries. Staff reported that the intermediaries examined worked with at least 250 clients across sectors including groceries and apparel. The published examples were hypothetical to protect confidential business information.

Surveillance pricing should not be confused with dynamic pricing. Dynamic pricing can respond to changing market conditions, such as demand or availability. Surveillance pricing uses personal information to differentiate between customers. While the two can overlap, they aren’t interchangeable.

A personalized price isn’t automatically a higher price. Some shoppers might receive discounts. The concern is that an opaque pricing system gives sellers detailed insight into customers while those customers are unable to see how they’re being assessed.

Another form of unequal pricing that the bill allows is qualifying loyalty and other discounts. The bill preserves genuine discounts, including qualifying loyalty and rewards programs and discounts for clearly defined groups such as veterans, seniors, and teachers. But those exceptions come with conditions.

Surveillance pricing doesn’t necessarily charge wealthy shoppers more and give everyone else a break. Pricing tools can estimate what you’re willing to pay, which may have little to do with what you can comfortably afford. Perceived price sensitivity is a deciding factor, so a wealthy bargain hunter could receive a discount, while someone with less money but an urgent need or few alternatives could be judged willing to pay more.

For consumers, the underlying question about surveillance pricing is straightforward: How much does the price reflect what’s being sold, and how much does it reflect what a company thinks it can get out of you?

New York City’s bill aims to limit how companies use your personal information to make that calculation.

Your name, address, and phone number may already be for sale.  

Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way. 

SCAN NOW

On November 11, Google issued a security update to Chrome’s Stable channel for Windows, Mac, and Linux. The update is rolling out over the coming days and weeks.

Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 157.0.8103.78/.79 for Windows and Mac and 157.0.8103.78 for Linux. It includes 83 security fixes, five of which are rated Critical—the highest severity level. This update came out only two days after the previous one.

How to update Chrome

The easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update.

If you don’t want to wait for the rollout to reach you, you can update manually. Open About Google Chrome from Chrome’s Settings or Help menu. Chrome will check for updates and download any available update. If prompted, click Relaunch to apply it.

Chrome 157.0.8103.79 is up to date

You can find an explanation of the version numbering system and step-by-step instructions in our guide: How to update Chrome on every operating system.

Technical details

Since all five Critical vulnerabilities patched in this update are use-after-free flaws, let’s have a closer look at what causes this type of vulnerability.

A use-after-free (UAF) vulnerability happens when software accesses memory after it has released that memory for reuse. The program still has a reference to the old location, but the original object is no longer valid, and something else may now occupy that space.

The leftover reference is called a “dangling pointer” and is caused by a mistake in managing how long an object remains available. One part of a program may release it while another still expects to use it. That can happen because of confused ownership, faulty error handling, or a timing issue between tasks running simultaneously.

The consequences range from crashes and corrupted data to information leaks and, in some cases, execution of attacker-controlled code. The dangerous possibility is that an attacker can influence what replaces the freed object, then trick the program into treating that replacement as legitimate data or instructions for what to do next.

That explains why UAF flaws can receive critical severity ratings. However, the label describes a class of memory-management bugs, not a guaranteed outcome: the actual impact depends on the affected component, how reliably an attacker can exploit the mistake, and the protections in place.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

This is a developing story. We’ll update this article as more information becomes available.

.kadence-column488461_efee3d-5c > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column488461_efee3d-5c > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column488461_efee3d-5c > .kt-inside-inner-col{flex-direction:column;}.kadence-column488461_efee3d-5c > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column488461_efee3d-5c > .kt-inside-inner-col{background-color:rgba(255, 229, 229, 0.83);}.kadence-column488461_efee3d-5c > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column488461_efee3d-5c{position:relative;}@media all and (max-width: 1024px){.kadence-column488461_efee3d-5c > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column488461_efee3d-5c > .kt-inside-inner-col{flex-direction:column;justify-content:center;}} In this article

• What’s affected by the Microsoft 365 outage
• What Microsoft has said about the cause and recovery efforts
• Where to check for updates and what to keep in mind about security

A widespread Microsoft outage is disrupting Outlook email and other Microsoft 365 services, including SharePoint, Teams, and Copilot. Reportedly, the problems began on Thursday, November 12, and continued into Friday, affecting people trying to access email, communicate with colleagues, and use workplace applications.

Microsoft initially reported problems accessing Exchange Online mailboxes in the Americas, but disruption subsequently extended beyond that region. CNN reports impacts on businesses, schools, and government services, including in Australia.

There are a lot of questions we’ll try to answer as the day evolves.

What’s affected?

Outlook users have reported being unable to send or receive emails or even load their inboxes. Other affected services include SharePoint, Teams, and Copilot, although availability has varied: some people have been able to use certain applications while others remain inaccessible.

Outage tracker Downdetector received reports from 74 countries within about an hour.

What’s the cause?

Microsoft executive Charles Lamanna said there was no indication that malicious activity or a cyberattack caused the outage. The underlying cause remains under investigation.

Microsoft said some servers became unexpectedly unavailable after failing automated health checks. That left the remaining infrastructure handling extra traffic, contributing to connection problems. The underlying reason for the failures was not immediately clear.

Recovery has not been straightforward. Microsoft restored some servers, but subsequently said they could become unresponsive again when traffic returned. Other attempted changes also failed to deliver the expected improvement.

How long will it take to restore services?

At the time of writing, Microsoft has not provided a timeframe for full restoration. The company reported partial recovery in some regions, after earlier attempts produced mixed results.

For updates, check Microsoft’s service status page and its Microsoft 365 Status account on X. Both are channels Microsoft is using to communicate about the incident.

What about security?

ABC reports that Microsoft Defender XDR and Microsoft Defender for Office 365 are both on Microsoft’s list of services that may be affected.

Being unable to log in doesn’t mean attackers are also locked out, or that every security feature has stopped working. If you rely on these services, check which security features are working as access is restored. Follow your IT team’s guidance and check Microsoft’s updates for details.

Be alert for unexpected messages offering to restore access or asking you to sign in through a link. Go directly to Microsoft’s official status pages instead.

Malwarebytes and ThreatDown products are not affected by this outage.

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →

.kadence-column488028_ad75a4-64 > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column488028_ad75a4-64 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column488028_ad75a4-64 > .kt-inside-inner-col{flex-direction:column;}.kadence-column488028_ad75a4-64 > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column488028_ad75a4-64 > .kt-inside-inner-col{background-color:rgba(255, 229, 229, 0.83);}.kadence-column488028_ad75a4-64 > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column488028_ad75a4-64{position:relative;}@media all and (max-width: 1024px){.kadence-column488028_ad75a4-64 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column488028_ad75a4-64 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}} In this article

• LEGO has taken BrickLink offline after detecting unusual activity
• The company has not confirmed a hack or whether customer data was affected
• Users should watch for suspicious payment requests and avoid reusing passwords

LEGO collectors looking for a missing piece have a bigger problem to contend with: accessing the specialized marketplace BrickLink.

LEGO has taken BrickLink offline after detecting what it calls “unusual activity.” The company says it is investigating before bringing the marketplace back, but has not disclosed whether attackers accessed its systems or whether customer information was affected.

BrickLink allows users to buy and sell LEGO parts, sets, and minifigures, making it a useful resource for collectors and a business platform for independent sellers. LEGO acquired the fan-founded marketplace in 2019. Its disruption leaves more than unfinished builds on hold: sellers also depend on access to orders and their storefronts.

The BrickLink website previously said it would remain unavailable until at least Wednesday, November 11. That date has now been removed, with no replacement given.

We took BrickLink offline after identifying unusual activity on the platform. Our immediate priority was to secure the site, protect our members and ensure the integrity of BrickLink.

Before bringing the site back online, we need to fully understand what has happened. That means containing the issue, investigating how it happened and checking for related issues.

This work is still on-going and we appreciate your patience while we work to get things back online as soon as possible.

Updated: 11th November 2026

According to the BBC, LEGO had not provided details confirming a hack or explaining whether customer data was affected.

Specialist LEGO publications reported that BrickLink went offline around November 5. An article published the following morning described a notice saying the site was unavailable while teams carried out “necessary work.” That report also noted that users could not access storefronts, profiles, order histories, or the Designer Program page.

In November 2023, BrickLink also closed down after it noticed what turned out to be credential stuffing attacks.

The BBC also reported the experience of a BrickLink customer who received repeated payment links for a limited-edition preorder she said she had already paid for. The dispute was subsequently resolved, and LEGO told the BBC it was not aware of wider payment issues. But there is no established connection between that payment problem and the activity that prompted the shutdown.

How to stay safe

Until we know what the issue is, it is hard to provide targeted advice, but users can take a few proportionate precautions:

• Watch for unexpected account or payment messages. A request to “restore access,” confirm payment information, or resolve an urgent account problem deserves scrutiny, because these are common phishing themes.
• Verify requests through an independent route. Use the official website or an established support channel rather than following links in an unexpected email or text.
• Use unique passwords. If your BrickLink password is also used elsewhere, change it on those other services now. Use a password manager to generate and store strong, unique passwords. Change your BrickLink password once the site is available again.

BrickLink’s shutdown is disruptive, but the available evidence does not yet justify calling it a confirmed data breach. For now, the priority for users is to follow official updates, check unexpected payment requests carefully, and watch for scams exploiting the outage.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

A website asks you to click “Allow” to start a quiz or read an interesting story. A little later, your device starts warning you about viruses, missed payments, or legal trouble.

While every message may look like a new security problem, the cause could be a permission you granted earlier.

For scammers, browser push notifications turn a passing visit into something much more valuable: access to your attention after you have left their website.

Two investigations—including our own research into deceptive quiz sites and HUMAN Security’s investigation of an operation called Pushpaganda—show how that permission can become a tool for repeated advertising, scareware, and fraud.

Ordinarily, a deceptive website has a limited opportunity to influence you. Once you leave, its sales pitch disappears.

A simple browser push notification permission changes that relationship. A website you’ve authorized can send browser notifications even when you’re not visiting it. Depending on the platform and browser configuration, those messages can appear even when the browser is not visibly open.

Just what scammers need

That gives scammers several advantages:

• Repeat opportunities to get a click. Instead of relying on one visit, they can send more messages to bring you back to their sites.
• A more convincing place to display a lie. Notifications appear through the browser and operating system, while their wording and imagery can impersonate security alerts, financial messages, or people you know.
• Distance from the original trick. By the time alarming messages start appearing, you may not remember which website received permission, let alone connect the alerts to an innocent-looking quiz.
• More chances to make money. The resulting traffic can feed advertising, affiliate promotions, scams, and unwanted downloads.

Allowing notifications doesn’t install malware. But scammers can use them to trick you into clicking a harmful link or downloading something dangerous. That explains why your device can display frightening warnings while a malware scan finds nothing wrong.

The campaignsThe quiz that came with an unwanted extra

Our investigation, published on March 9, began with customers who thought their devices were infected. Malwarebytes scans came up clean. Screenshots helped our Malware Removal Support team identify the real source of the trouble: web push notifications.

While the quizzes were real, the trick was making people think they had to allow the notifications to take them.

Clicking “Start the quiz” first brought up the browser’s notification permission request. Behind that legitimate browser prompt, the website displayed its own instruction:

“Click ‘Allow’ to continue.”

The page made it seem you had to allow the notifications to take the quiz, when it actually meant agreeing to receive future messages.

From clickbait to a notification loop

On April 14, HUMAN Security’s Satori researchers published a larger example of the same underlying strategy. They called it Pushpaganda.

Instead of quizzes, the operation used sensational articles and images, many showing signs of AI generation. Headlines promised attention-grabbing financial developments or implausible technology bargains. The content appeared in Google Discover feeds, exposing it to Android and Chrome users. Researchers could not establish whether those placements resulted from paid promotion or search optimization.

Once someone visited an associated website, the operation prompted them to enable notifications. The messages that followed had little to do with the article that attracted the visitor. Researchers observed fake arrest warrants, false financial alerts, and notifications mimicking missed calls from “Mom” or other family members.

Scam or legit? Scam Guard knows.

TRY IT NOW

Scam Guard stats

The graph shows weekly counts of reports classified by Scam Guard as matching quiz-site notification abuse (red) and Pushpaganda (blue), based on the information provided by users.

The counts show reports over time linked to these campaigns. They don’t represent unique victims, confirmed infections, or total campaign activity.

For context: HUMAN Security’s Satori researchers observed roughly 240 million advertising bid requests associated with Pushpaganda domains in a single seven-day period at the operation’s peak.

A bid request asks advertisers in real-time to bid for an opportunity to show an ad. In a push notification ad auction, the winning ad is sent as a notification to someone who has allowed them.

Note the dip after the reports came out. It takes time to rebuild the infrastructure, but criminals will do so if they think it’s worth the investment.

How to stay safe

Allow notifications only when you want ongoing messages from a site. A few guidelines that may help you:

• Don’t click on prompts until you’re sure what they will set in motion.
• Treat “Allow notifications to continue” as a red flag, particularly on quizzes, video pages, or unfamiliar websites.
• Use web protection. Malwarebytes Browser Guard is a free tool that can help block malicious websites.

If you’re haunted by unwanted alerts, they might be web push notifications. Here’s how to identify the website sending them and turn them off in several popular browsers.

On supported Android devices, Chrome notifications include an Unsubscribe option. Use that built-in control rather than a link inside a suspicious message. When you receive an unwanted website notification through Chrome on Android:

• Swipe down from the top of the screen to open Android’s notification shade.
• Look for an Unsubscribe action on the notification.
• If it is present, tap it to stop future notifications from that website. Chrome also provides Undo if you unsubscribe accidentally.

If Unsubscribe is not present, open Chrome and go to More > Settings > Site settings > Notifications. Review the allowed websites and block the offending site. You don’t need to follow a link in the suspicious notification to manage its permission.

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →

.kadence-column487659_4668c2-bd > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column487659_4668c2-bd > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column487659_4668c2-bd > .kt-inside-inner-col{flex-direction:column;}.kadence-column487659_4668c2-bd > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column487659_4668c2-bd > .kt-inside-inner-col{background-color:rgba(255, 229, 229, 0.83);}.kadence-column487659_4668c2-bd > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column487659_4668c2-bd{position:relative;}@media all and (max-width: 1024px){.kadence-column487659_4668c2-bd > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column487659_4668c2-bd > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}In this article

• A former FBI supervisor stole from cryptocurrency wallets involved in 35 FBI investigations
• He planned to use the proceeds to finance a new life in Portugal
• He turned himself in after confessing to a former colleague

Law enforcement officers are trusted to handle sensitive evidence properly. A 37-year-old former FBI supervisor used that access to steal millions in cryptocurrency.

Patrick Steven Yaroch pleaded guilty on November 5 to wire fraud and money laundering after stealing approximately $2.47 million from cryptocurrency wallets linked to FBI investigations.

He stole the money from wallets held by people the FBI was investigating, which included adversarial nation-state actors. Starting no later than December 2024, he made around 100 transfers using credentials tied to 35 separate investigations.

The FBI’s search affidavit says that Yaroch accessed FBI systems containing wallet seed phrases and memorized them. A seed phrase is a series of words, commonly 12 or 24, used to restore access to a cryptocurrency wallet. Anyone with the seed phrase can potentially control the funds.

He then used the memorized phrases to transfer funds to a personal wallet on his own device. He subsequently swapped assets into different currencies and made further transactions to try and hide their origins.

According to the Department of Justice (DOJ), his actions compromised multiple investigations.

The affidavit also revealed that Yaroch had asked ChatGPT how to invest a million dollars, along with advice on where to live in Europe. It suggested Portugal, and he began the process of setting up a life there.

Caught by a case of cold feet

According to the affidavit, he approached a former DOJ colleague to confess because his actions were “eating him up inside.” The employee urged him to self-report, which he did.

The FBI placed him on leave and then terminated his employment two days later. They showed up at his home with a warrant and seized assets, including his phone, which had access to a Kraken cryptocurrency account. They also seized a piece of paper containing the seed phrases for his own account.

More law enforcement corruption

Yaroch’s justification for his initial actions was frustration that the FBI wasn’t acting quickly enough against the wallets’ criminal owners. So he decided to “take matters into his own hands,” according to the affidavit.

But according to the DOJ, he also used some of the proceeds to cover personal debts, including credit cards, car payments, and other loans.

This isn’t an isolated incident. In December 2024, former Secret Service agent Anthony Joseph Evans pleaded guilty to stealing cryptocurrency worth $56,000 from a hardware wallet held in the agency’s secure evidence vault.

In 2015, former Secret Service agent Shaun W. Bridges also pleaded guilty to money laundering and obstruction of justice after stealing bitcoin during the investigation of Silk Road, a dark web marketplace used to sell illegal drugs and other contraband. He used another person’s administrator account to reset users’ passwords and move bitcoin into a wallet he controlled. The stolen bitcoin was worth approximately $350,000 at the time; he later sold it for $820,000.

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →

.kadence-column487333_a006eb-8f > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column487333_a006eb-8f > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column487333_a006eb-8f > .kt-inside-inner-col{flex-direction:column;}.kadence-column487333_a006eb-8f > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column487333_a006eb-8f > .kt-inside-inner-col{background-color:rgba(255, 229, 229, 0.83);}.kadence-column487333_a006eb-8f > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column487333_a006eb-8f{position:relative;}@media all and (max-width: 1024px){.kadence-column487333_a006eb-8f > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column487333_a006eb-8f > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}In this article

• Vanderbilt is bringing campus systems back online after a cyberattack
• BYOD claims it stole sensitive data, but Vanderbilt has not confirmed those claims
• Students and staff should follow official guidance and watch for suspicious messages
• Eligible students can get Malwarebytes for free through our Student Protection Program

Vanderbilt University is bringing systems back online after a cybersecurity incident claimed by the BYOD ransomware group.

Vanderbilt University is a private research university in Nashville, Tennessee. Founded in 1873, it now serves more than 13,800 undergraduate, graduate, and professional students across 12 schools and colleges, with programs ranging from engineering and education to law, medicine, and nursing. Its combination of teaching and research means its systems support not only everyday campus activities but also valuable academic research.

According to Bleeping Computer, BYOD claims it encrypted Vanderbilt’s databases and obtained more than one million Social Security numbers, along with names, email addresses, telephone numbers, student and employee records, and research data. It also claims control of a domain controller (a server that manages network access) and possession of backups.

How the attackers gained access remains undisclosed. Vanderbilt’s November 10 evening incident update states that the following systems and applications are available:

• Campus Wi-Fi
• Okta: Continue to use multifactor authentication (MFA)
• Vanderbilt email (Outlook): Vanderbilt email is available on Vanderbilt and personal devices
• CampusPrint
• Brightspace
• Zoom
• YES (Your Enrollment Services): All course registration is proceeding as scheduled

Other Vanderbilt systems and applications remained restricted. The university says fully restoring normal operations could take several weeks.

The university has not confirmed the number of affected people. BYOD claims it obtained more than one million Social Security numbers, but that is not a verified count of affected students or other people. The university says it is still determining what data, if any, was accessed.

How to stay safe

BYOD has threatened to release the data it claims to have stolen.

Students and staff should follow Vanderbilt’s latest IT guidance and be alert to messages asking them to restore access, disclose passwords, or approve unexpected login requests.

We have a guide for people who discover their data was included in a data breach: Involved in a data breach? Here’s what you need to know.

How Malwarebytes can help

Protection for personal devices can help reduce the risk of follow-on malware and scams, but it cannot undo the theft of information from a university’s systems.

Vanderbilt students can get free Premium Security for two years on up to three devices through our Malwarebytes Student Protection Program. This can help protect against malware and scams, including those that could follow any release of stolen data.

Malwarebytes Scam Guard is a free tool that can help you assess whether a message is a scam and suggest what to do next.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Changing your password should be part of recovering a compromised account. The developers of Remus Stealer are advertising a Gmail-reading feature they claim can survive that step and even session revocation.

That is a serious claim. It is not, however, a demonstrated capability in the published investigation. Threat intelligence company Hudson Rock examined Remus’s promotional material and questioned both its developer and a self-described customer. Its conclusion is more cautious than the sales pitch: The material depicts a mailbox-reading interface, but it does not establish that Remus can retrieve new messages after an account has been comprehensively secured. Nor does it establish a Gmail zero-day vulnerability.

What Remus is advertising

According to Hudson Rock, Remus’s version 1.3.9 announcement promotes a feature that lets operators open a compromised Gmail mailbox directly from the service’s dashboard. The supplied screenshots show message lists, individual emails, and a “Mail” option attached to records of compromised devices.

The announcement makes several additional claims:

• Operators can intercept email verification codes without collecting browser cookie files.
• Password changes and session revocation do not stop access.
• Mailbox access can be shared with other operators through links.

Asked how it works, the developer described interaction with browser memory and said the malware executes and exits. The developer also claimed the service avoids Google’s anti-fraud checks, but withheld the technical details needed to assess that assertion.

Remember, those are marketing statements from the seller of a criminal service, not independently verified findings.

What the evidence shows

Hudson Rock spoke with a person who had publicly endorsed the feature and described using it. That source said mailbox access continued after browser closure, a session reset, and a Google password change.

But the correspondence does not document exactly which sessions were reset, the account settings involved, or the timing of the password change and subsequent access. The source’s independence was not established, and the statements were not accompanied by a controlled test.

Hudson Rock explicitly states that its report includes neither reverse engineering of the new feature nor controlled post-recovery validation.

Breaches happen every day. Don’t be the last to know.

SEE PLANS

Can Gmail access survive a password change?

Yes. Under some conditions, continued access after a password change is possible.

Google documents that password changes ordinarily invalidate access tokens and refresh tokens used by applications with Gmail permissions. These tokens allow an application to access an account without asking for the password on every request. Token theft alone therefore does not establish that Remus can maintain access after a password change.

What Gmail users should do

The uncertainty around Remus’s claims is not a reason to abandon password changes. It is a reminder that recovering from an infostealer infection involves more than changing a password.

If you suspect an infection or unauthorized Gmail access:

• Use a separate, trusted device to begin securing the account promptly. Disconnect the suspected infected device from the internet and remove the malware before signing in to accounts on it again.
• Change your Google password, review recent security events and signed-in devices, and remove unfamiliar access. Check applications with access to the account as well as device sessions.
• Inspect Gmail settings for unauthorized forwarding, filters, delegated mailbox access, and changes to remote mail access. Check your recovery email, recovery phone number, and verification methods too.
• Run trusted security software on the affected device. Google notes that resetting the computer and reinstalling its operating system is another option when dealing with harmful software.
• Review other important accounts that rely on the mailbox for sign-in or recovery, especially if you see unfamiliar verification or password-reset messages.

A mailbox can be a stepping stone to other accounts because it receives recovery links and verification messages. But the Remus screenshots do not demonstrate a universal multifactor-authentication bypass, the ability to send mail, or complete control over every account associated with that address.

Remus’s claimed persistence remains unverified. If you suspect an infection, secure your account and clean the affected device. Real-time anti-malware protection can help prevent infostealer infections.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

.kadence-column487343_5a0625-ad > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column487343_5a0625-ad > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column487343_5a0625-ad > .kt-inside-inner-col{flex-direction:column;}.kadence-column487343_5a0625-ad > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column487343_5a0625-ad > .kt-inside-inner-col{background-color:rgba(255, 229, 229, 0.83);}.kadence-column487343_5a0625-ad > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column487343_5a0625-ad{position:relative;}@media all and (max-width: 1024px){.kadence-column487343_5a0625-ad > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column487343_5a0625-ad > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}In this article

• Muse’s maker used about 50,000 hours of users’ brainwave recordings to train AI without explicitly telling them
• Stripping names might not be enough to make brainwave data anonymous; researchers have identified individuals from EEG recordings
• Check privacy policies and ask about opt-out and data deletion

Technology companies have spent years trying to get into your head for profit. Now they’re doing it literally. The maker of Muse, a headband that measures brain activity during sleep and meditation, used users’ brainwave data to train AI without explicitly telling them, an investigation has revealed.

Companies sell these consumer sleep bands to help you better understand what your brain does when you sleep and meditate. However, according to an investigation in Science magazine, they’re picking up a little understanding of their own on the side.

The year-long investigation found that Canadian company Interaxon, which makes the Muse sleep and meditation headband, was using the data that it collected from users’ brains to train AI. The company used about 50,000 hours of electroencephalography (EEG) recordings, which measure the brain’s electrical activity, to train a “brain foundation model.”

AI models trained with large amounts of brainwave data from different people can spot patterns in brain activity. For example, a model might learn to recognize patterns associated with seizures.

Researching such outcomes is laudable, but only if you first tell the people whose EEG data is being used for the training. Interaxon didn’t.

This is your brain on an inadequate privacy policy

When Science questioned Interaxon about the issue, its chief marketing officer Nadia Kumentas acknowledged that users should be explicitly informed about the AI training. The company updated its privacy policy, which now says de-identified data is used to train machine learning models.

Collecting data through devices like this is tempting for companies because brainwave data is otherwise difficult to obtain and therefore incredibly valuable.

No wonder, then, that it isn’t the only neuraltech company facing questions about its data practices. The publication reviewed 57 companies that collect brain data, and found that only six explicitly said they wouldn’t sell users’ brain data. More than two-thirds allow brain data to pass to a new owner if they are acquired. Eleven of them only had a privacy policy for website visitors, and four had no policy at all.

To its credit, Interaxon removed names and email addresses from user EEG data before using it for training. However, those users’ data has already helped shape a model trained without explicitly telling them. Removing its influence after the fact is extremely difficult.

But is such “de-identification” enough? An academic study conducted by the University of South-Eastern Norway this year found that EEG recordings and derived features can contain sensitive patient-specific information. It said that this can create privacy risks when that data is shared across clinical and research environments. It added:

“Conventional anonymization methods are often insufficient for high-dimensional biomedical signals, since removing direct identifiers does not necessarily prevent re-identification, linkage, or inference risks.”

Another study by researchers at Ben-Gurion University, Israel, found that analyzing resting-state EEG recordings could shed light on personality traits and cognitive abilities. Resting-state EEG identified users 88.4% of the time, according to a 2018 study by researchers at Korea University. And a University of Southern California study claimed that EEG data could reveal mental health status, neurological conditions, and even substance use history.

These findings do not establish what can be inferred from Muse recordings specifically. Consumer headbands generally have fewer electrodes than clinical EEG systems.

This isn’t the first review of the consumer neurotech industry to reveal some worrying trends. A 2024 Neurorights Foundation report found that 29 of 30 companies it surveyed appeared to have access to consumers’ neural data and had provided “no meaningful limitations to this access.”

The law is still catching up to all this. The Illinois Biometric Information Privacy Act (BIPA) counts your fingerprint, voiceprint, or face geometry among other things as biometric identifiers, but EEG data doesn’t make the cut. However, Colorado and California do now treat neural data as sensitive.

These concerns extend beyond brainwave data. In a Malwarebytes survey of newsletter readers, 90% worried about AI using their data without consent, while 92% were concerned about corporations using their personal data inappropriately.

What Muse owners can do

Do you use a sleep band or another neurotech device? Consider that your brain data might be used for more than you imagined. And if the company goes bust and/or gets acquired, it might pass to another owner. That’s exactly what happened with genetic testing company 23andMe.

With this in mind, check the manufacturer’s privacy policy, and if you can’t find one, ask it directly. Ask whether your EEG data is used to train AI, whether you can opt out, and whether you can delete recordings already collected.

If those options aren’t available, consider whether you’re comfortable continuing to use the device.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Microsoft’s November Patch Tuesday fixes more than 1,000 Microsoft vulnerabilities, including an Outlook flaw that attackers are already exploiting to steal authentication information.

The release also fixes 48 critical remote code execution (RCE) vulnerabilities that could allow attackers to run code on affected machines, in some cases without user interaction.

While Windows updates address many of this month’s vulnerabilities, readers should check for Office updates as well: the exploited Outlook flaw is patched through the affected Office products.

To do this, follow these instructions:

1. Open an Office application, such as Word.
2. Go to File > Account. In Outlook, this may appear as Office Account.
3. Under Product Information, select Update Options > Update Now.
4. If necessary, select Enable Updates first. If the update controls are missing on a work device, contact your organization’s IT team; updates may be centrally managed.

During the update, you may be prompted to save your work (check your open documents). Afterward, you should see something similar to this:

Office updates installedHow to apply Windows patches and check if you’re protected

These updates fix security problems and help keep your Windows PC protected. Here’s how to make sure you’re up to date:

• Click the Start button, then open Settings.
• Select Windows Update (usually at the bottom of the menu on the left).
• Click Check for updates. Windows will search for the latest security updates. If you’ve enabled Get the latest updates as soon as they’re available under More options, you may be prompted to restart immediately to complete the update.
• You may find the update (Security Update KB5132061) already installed.

Windows Update history

• If updates are available, they’ll start downloading automatically. When they’re ready, click Install or Restart now if prompted. Your computer may need a restart to finish the update.
• After restarting, go back to Windows Update and check again. If it says You’re up to date, you’re all set.

Technical details

As usual, we’ve selected a few vulnerabilities to highlight for readers interested in the technical details.

We’ll start with CVE-2026-124194, an Outlook vulnerability that attackers are already exploiting. It has a CVSS score of 6.5 out of 10 and could expose authentication information that attackers could use to impersonate the user. From Microsoft’s description:

“Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.”

To exploit this vulnerability, an attacker must convince someone to open a specially crafted message file in an affected version of Outlook. This can cause Outlook to connect to an attacker-controlled network location without its usual external-content warning, potentially exposing authentication information (the user’s NTLMv2 hash) that could be used to impersonate them.

As this vulnerability is being exploited in the wild, updating Office as described earlier is a priority.

One other vulnerability I want to highlight is CVE-2026-116928 (CVSS score 9.8 out of 10):

“Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.”

An out-of-bounds write vulnerability allows a program to write outside the memory boundaries it is supposed to use, which can lead to memory corruption or place malicious code in memory and trick the system into running it.

Microsoft describes an attack in which a malicious email attachment is processed automatically for indexing by Exchange Server. In that scenario, the recipient does not need to open the email or attachment. Processing it could be enough to let the attacker run code with the permissions of the affected service. Microsoft has not reported exploitation of this vulnerability.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

We’ve written before about what Meta’s Ray-Ban smart glasses can see and hear, and who might get to use that information. Those worries focus on how the glasses handle information during normal use. A security researcher has now shown how to bypass a safeguard meant to stop unauthorized software running on them.

Vulnerability researcher Paula, known online as pamoutaf, found a way to run her own software on a pair of Ray-Ban Meta glasses. For the technical details I’ll gladly refer you to her own post about it.

The glasses are controlled by the Meta AI app on the owner’s phone. Developers can add their own apps to the glasses through a developer tool, and the phone sends that software to the glasses to install.

The glasses were supposed to check that the software really came from Meta. In older firmware (up to and including version 126), they didn’t check, so the researcher could swap in an app of her own.

Meta introduced a check in firmware version 127 to verify the app’s digital signature to prove that it came from Meta . The researcher found the on/off switch for that signature check came from a settings file passed along by the phone. The glasses only checked the file was correctly formed, not whether it had been tampered with. Changing a single byte in the file turned the signature check off.

Once her app was running, she could send commands to the glasses from the paired phone over a wireless connection.

The glasses have a camera, microphones and a wireless connection, and they sit on your face all day. A wearable that can be made to run unapproved code goes beyond a privacy-policy question. It becomes a security question about who controls the device. As we’ve seen, some cheaper smart glasses already are a security disaster.

In this case the person running the code would be the person that controls the phone. If malicious software running on the glasses could access the camera or stored recordings, it could potentially send footage to an attacker’s server. Pamoutaf’s research doesn’t demonstrate that scenario, but it raises questions about what that software might be able to access.

In her post she promised a follow-up exploring other potential ways to attack the glasses.

How to stay safe

Keep the glasses’ firmware and the Meta AI app updated, and avoid unofficial apps or modifications.

If smart glasses are just another gadget to you, I’d leave them on the shelf. If you rely on them as an accessibility aid, you deserve technology that helps you without putting your privacy or other people’s at risk.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

.wp-block-kadence-advancedbtn.kb-btns97520_6de029-2f{gap:var(--global-kb-gap-xs, 0.5rem );justify-content:flex-start;align-items:center;}.kt-btns97520_6de029-2f .kt-button{font-weight:normal;font-style:normal;}.kt-btns97520_6de029-2f .kt-btn-wrap-0{margin-right:5px;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button{color:#555555;border-color:#555555;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{color:#ffffff;border-color:#444444;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button::before{display:none;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{background:#444444;}ul.menu .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{width:initial;}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{color:var(--color-neutral-10);background:var(--color-brand-blue-60);border-top-left-radius:40px;border-top-right-radius:40px;border-bottom-right-radius:40px;border-bottom-left-radius:40px;padding:var(--kb-btn-padding);margin:var(--kb-btn-margin);box-shadow:1px 1px 2px 0px rgba(0, 0, 0, 0.2);}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:hover, .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:focus{box-shadow:0px 4px 0px 0px var(--color-brand-blue-90);}Try it now

On November 9, Google issued a security update to Chrome’s Stable channel for Windows, Mac, and Linux. The update is rolling out over the coming days and weeks.

Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. It includes nine security fixes, including one for an actively exploited zero-day vulnerability.

A zero-day vulnerability is a security flaw disclosed or exploited before an official fix becomes available.

Hong Kong’s Computer Emergency Response Team Coordination Centre (HKCERT) rates the overall risk as “Extremely High.” Its bulletin says some of the vulnerabilities address in the update could allow denial of service, security restriction bypass, and remote code execution.

How to update Chrome

The easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update.

If you don’t want to wait for the rollout to reach you, you can update manually. Open About Google Chrome from Chrome’s Settings or Help menu. Chrome will check for updates and download any available update. If prompted, click Relaunch to apply it.

Chrome 157.0.8103.51 is up to date

You can find an explanation of the version numbering system and step-by-step instructions in our guide: How to update Chrome on every operating system.

Google also released Chrome 157.0.8103.50 for Android on November 9. Google says it includes the same security fixes as the desktop release unless otherwise noted. Android users should check Google Play for the update.

Technical details

Let’s take a closer look at that zero-day vulnerability.

Google says it was notified about a vulnerability by an unnamed third party on November 6. The vulnerability is tracked as CVE-2026-125350 and rated as a high-severity use-after-free vulnerability in Chrome’s XML component.

XML is a data format Chrome uses to read and process certain kinds of structured web content. XML stands for Extensible Markup Language: it labels information with tags, rather like HTML, but allows authors to define their own tags to describe their data.

A use-after-free vulnerability occurs when a program attempts to access a memory location after it has been freed. That can cause crashes or, in some cases, allow an attacker to run their own code.

Google only says that it is “aware that an exploit for CVE-2026-125350 exists in the wild.” It has not named the attackers, the targets, the delivery method, or what the exploit can do.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

.kadence-column482817_d8e68a-90 > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column482817_d8e68a-90 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column482817_d8e68a-90 > .kt-inside-inner-col{flex-direction:column;}.kadence-column482817_d8e68a-90 > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column482817_d8e68a-90 > .kt-inside-inner-col{background-color:rgba(255, 229, 229, 0.85);}.kadence-column482817_d8e68a-90 > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column482817_d8e68a-90{position:relative;}@media all and (max-width: 1024px){.kadence-column482817_d8e68a-90 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column482817_d8e68a-90 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}} In this article

• Store-added reviews and countdowns that keep resetting make products look popular and deals urgent
• Missing contact details can make it harder to resolve a problem with an order
• AI-generated images and unverified brand partnerships promote products with no licensing information
• Learn how to check an online seller before you buy

Advent calendar buying guides are already appearing across the holiday shopping coverage this year. Social media can also put unfamiliar sellers directly in shoppers’ feeds. We found several stores using the same website template, product images with an AI-generated content watermark, and a TikTok account using one store’s branding to link straight to its product page.

We examined stores selling a Legend of Zelda music calendar, a Michael Jackson music calendar, a Lord of the Rings figure calendar, and Harry Potter character plant pots. Other stores, including one selling a Metallica calendar, use the same layout, low-stock warning, and recycled marketing lines. We found no licensing information on the stores, which is reason enough to avoid them.

Fake reviews and countdowns create a false sense of demand

Each store sells a single product. Its page surrounds polished product images with urgency cues: a sale that ends today, a low-stock warning, a five-minute cart reservation timer, a count of orders placed in the last day, and star ratings with thousands of reviews. Testimonials appear underneath, with “verified buyer” badges and timestamps such as “three hours ago.”

None of it is connected to anything. The ratings, review counts, and testimonials are entered into the site theme manually, rather than generated by a review system. The timestamps don’t change, and countdowns reset and run again—on some stores, every day.

Checkout runs through Shopify. That doesn’t establish whether orders will arrive or match their descriptions, and our investigation found no evidence that these pages were designed to steal card details. The risks we can support are misleading sales claims and the possibility of paying for something that never arrives or is very different from what was advertised. Several stores also offer optional checkout add-ons, including shipping protection, a queue-skip fee, and a mystery gift. On one store, these add-ons total nearly $35.

The Zelda calendar’s description contradicts itself

The clearest finding needs no technical analysis. The listing says each of the 25 discs holds a small chip storing your track data, and that the included player reads it and plays music through a built-in speaker with no app, no subscription and no Wi-Fi. Elsewhere on the same page it says the discs work with Spotify, Apple Music and YouTube, and that you can re-link any disc to a new song using a chip-writing app on your phone.

These claims cannot all be true. A device without a network connection can’t stream music from those services. And the instructions for linking discs to new songs suggest that each chip stores a link to a track, rather than the track itself. That’s how the legitimate version of this product works, according to our research: the chip holds a link, and a phone plays the music. Someone appears to have copied that mechanism and bolted a fictional standalone speaker onto it.

The bundle pricing also doesn’t add up. Two bundles claim savings of $15 and $33, but the prices shown below them work out to about $19 and $43 in savings.

The stores are copies of one another

Despite their different names, the stores we examined are nearly identical. They use the same commercial theme version and share an internal fingerprint indicating that their theme files are copies of one another. They also block right-clicking and access to developer tools.

The most direct link was left behind by accident, in that one store’s theme is still named after the file it was exported from, and that filename includes the web address of another store in the group. Other pages contain leftover text from a previous shop, including a warranty promising to replace costumes that don’t inflate properly and a scrolling banner with the unedited placeholder “use code X for X percent off.”

The stores’ files are timestamped from mid-July to the second week of September, with the newest store only days old when we examined it. Most merchant accounts are registered in Romania, while prices are shown in dollars. None of the calendar stores we examined listed a business address or phone number.

The pattern runs well past unlicensed character merchandise. We found advent calendars for fishing lures, squishy toys, charm bracelets, and wearable jumpers, with the same countdowns, stock warnings, and paid add-ons. Most appear to sell real, inexpensive goods at a steep markup. Their add-on prices differ, so we can’t conclude that the same person runs all of them. The evidence points to a shared sales playbook, not necessarily a shared owner.

What the evidence shows, and what it doesn’t

Product images from two of the calendar stores triggered a provenance checker for a watermark, indicating they were produced with OpenAI tools. The filenames agree: across three stores every product image follows the same automated naming pattern, and one store’s entire photography set is timestamped to a single afternoon.

A TikTok account uses one store’s name and branding and links directly to its product page. Several videos claim the store is collaborating with Walmart. They show retail scenes, including an oversized character figure outside a store and pallets of branded boxes. We found no evidence of such a partnership. The videos also depict scenes that don’t appear to be real. Combined with the shared website template and the filename linking two stores, this suggests that one operator or a closely connected group may be involved. It doesn’t establish who is behind the stores.

How to spot a questionable store before you pay

In our survey earlier this year, 22% of respondents said they had been “misled by AI-generated photos or product reviews.”
Here are some checks that can help you spot warning signs.

• Be wary of endless urgency. If a sale keeps “ending today” or low-stock warnings never change, don’t treat them as proof of a genuine deal.
• Check that the product could exist. Search the product type and read how the real version works. If the listing claims something the technology can’t do, stop there.
• Don’t arrive through a link. These stores sell largely through social video. Search the brand name separately and look for history, press, or customers outside its own website.
• Treat partnership claims as claims. A video saying a brand is stocked by a retailer isn’t evidence that it is. Partnerships are announced by the retailer too, not only by the seller.
• Look for a real business. A postal address, company registration and working phone number are easy for a legitimate seller to provide and were absent from these.
• Reverse-image search the photos. Generated images usually have no history anywhere else online. A complete absence of results is itself informative.
• Read the small print against itself. If a calendar’s warranty talks about inflatable costumes, the page wasn’t written for the product you’re buying.
• Check the spelling, including on the box. We found a misspelled artist name in a product title, a mangled savings line, and a calendar with the word spelled “calindar” on the packaging artwork itself. A real manufacturer proofreads its own box.
• Pay with a method that offers buyer protection. A credit card or payment service with buyer protection gives you a route to a refund. Bank transfers can be harder to reverse.

Tools that help

Malwarebytes Browser Guard blocks scam sites, which can help when a link appears in your feed before you’ve had a chance to look up the seller.

Malwarebytes Scam Guard lets you check a suspicious link, message, or screenshot when something feels off but you can’t say why.

If a purchase leads to follow-up texts or calls about delivery fees, customs charges, or a refund, Malwarebytes Scam Number Check can tell you whether the number has been reported. A follow-up message can turn a bad purchase into something worse.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

The New York attorney general (AG) has reached a settlement over a medical data breach that affected 13.3 million people after basic security failures.

Perry Johnson & Associates (PJ&A) and four related companies have agreed to pay $300,000 and implement extensive security reforms following a breach that exposed personal and medical information belonging to more than 13.3 million people. They face another $9.7 million in penalties if they fail to meet the settlement’s terms.

New York AG Letitia James announced the agreement on November 6, alongside the attorneys general of Connecticut, Michigan, and New Jersey. Approximately 4.2 million of the people affected were New York residents.

The investigation describes a series of failures: remote access without multifactor authentication, nearly identical passwords circulated by email, sensitive files without file-level encryption, and security software that detected malicious activity but did not alert security staff.

The result: the companies only discovered the attack when the attackers contacted them on May 2, 2023, and demanded payment.

How many people were affected?

The stolen database files contained records associated with more than 13.3 million people, including approximately 4.2 million New Yorkers.

Earlier reporting put the number of affected patients at approximately 8.95 million. The settlement documents now give the larger figure of more than 13.3 million. The total could be higher, since the AG found that attackers also accessed files in shared network storage containing personal and health information, but the companies did not review those files to identify additional affected people.

The information included:

• Names, dates of birth, and home addresses.
• Social Security numbers.
• Medical record and hospital account numbers.
• Insurance information.
• Admission diagnoses and dates of treatment.
• Clinical information from medical transcriptions, including test results, medications, treatment facilities, and healthcare providers.

See if your personal data has been exposed.

SCAN NOW

Notifications were also slow. PJ&A began contacting clients about the stolen database files in July 2023, and its clients notified affected individuals between October 31, 2023, and February 8, 2024. The New York AG found that the companies violated state requirements to disclose a breach as quickly as possible and without unreasonable delay.

The settlement

Although the announcement describes a settlement worth up to $10 million, the companies must pay $300,000 in penalties to the states. The remaining $9.7 million is suspended and could become payable. New York will receive $100,000 from the initial payment. These are payments to the states, not an announced compensation payout to patients.

The exposed information could be valuable to criminals. Our research found stolen identity packages selling for as little as 95 cents apiece on the dark web.

The settlement also requires extensive security changes for the relevant active companies, including:

• MFA for individual user accounts, including administrator accounts, and remote network access.
• Stronger password management and access restricted to what employees need for their jobs.
• Encryption of personal and protected health information.
• Monitoring that automatically alerts security personnel to suspicious activity.
• Annual risk assessments and penetration testing.
• Network segmentation and measures to detect and prevent unauthorized data transfers.
• Written incident response procedures and clearer rules for retaining and securely disposing of sensitive information.

Given the carelessness, number of exposed records and people, do you think the companies got off cheap? Let us know in the comments.

How to stay safe

A breach does not automatically mean someone has misused your information, but you can take these precautions while you wait for more details:

• Verify unexpected messages independently. Don’t let a message about the breach rush you into clicking a link, sharing sensitive information, or making a payment. Go to your healthcare provider or insurer’s official website yourself or use contact details you already trust.
• Review medical bills and insurance statements. Look for appointments, tests, prescriptions, or services you did not receive. The Federal Trade Commission (FTC) identifies unfamiliar medical bills and unexpected items on an Explanation of Benefits statement, which explains how your insurer processed a claim, as warning signs of medical identity theft. Report discrepancies to your healthcare provider and your insurer.
• Review your credit reports. Look for unfamiliar accounts or debts and dispute errors. Free reports are available through AnnualCreditReport.com.
• Act if you find signs of identity theft. Visit IdentityTheft.gov for a recovery plan. If someone has received care in your name, ask the providers involved for copies of your medical records and request corrections in writing.

Medical identity theft is not just a financial problem; it can also affect your care. Someone using your identity to obtain treatment or submit insurance claims could introduce incorrect information into your health records. Checking medical statements and reporting anything unfamiliar can help you catch that misuse.

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

Last week on Malwarebytes Labs:

• Big Tech sues over California plan to limit kids’ scrolling
• Attacks on supermarket and blood storage systems prompt US warning
• Phone return scams: where a real delivery and a fake return end up in a bill for you
• NIKKE PC launcher compromise put players’ passwords and personal files at risk
• Scammers use AI-generated images of missing pets to extort owners
• Vizio, Samsung smart TVs seem to ignore tracking opt outs
• The fake $750 Apple Cash reward that pays out nothing
• mSecure tells users to change passwords but won’t say why [updated]
• Chrome 157 fixes 213 security issues, including 7 critical flaws
• A hidden backdoor put 1.3 million TV boxes to work for criminals
• Hackers put porn on public billboards and claim it was “far too easy”
• Revolve card breach: 1.5 million people may be affected
• 5 stars for sale: Inside the underground fake review trade
• Applebee’s customer data exposed by password left in app

Stay safe!

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

.kadence-column485324_750a90-49 > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column485324_750a90-49 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column485324_750a90-49 > .kt-inside-inner-col{flex-direction:column;}.kadence-column485324_750a90-49 > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column485324_750a90-49 > .kt-inside-inner-col{background-color:rgba(255, 229, 229, 0.83);}.kadence-column485324_750a90-49 > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column485324_750a90-49{position:relative;}@media all and (max-width: 1024px){.kadence-column485324_750a90-49 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column485324_750a90-49 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}In this article

• California wants to switch off autoplay and personalized feeds for under-16s.
• Google, Meta, and TikTok are suing to stop the restrictions.
• Age checks could raise privacy concerns for adults, too.

Google, Meta, and TikTok filed separate federal lawsuits on November 4, challenging Assembly Bill 1709, which Governor Gavin Newsom signed in September.

The companies argue that the law, due to take effect in 2027, interferes with free speech, overrides parents’ decisions, and conflicts with federal protections for online platforms.

AB 1709 prohibits covered platforms from providing California users under 16 certain

“psychologically exploitative features intended to maximize engagement that foreseeably lead to compulsive use.”

The law specifically includes personalized “addictive feeds” and autoplay. It also allows the attorney general to define additional features through regulations.

It would not ban children from using the platforms. They can keep their accounts if the platform removes the restricted features. Otherwise, the platform must delete the account and associated personal information.

The law also requires age verification before providing the restricted features. The law doesn’t stop children from searching for videos, following creators, or communicating privately. It makes exceptions for certain search-based results, content that a user explicitly requests, and direct private messages, subject to conditions.

California’s argument is that harm is not limited to what children see. It can also arise from how a service encourages them to keep using it, through personalized recommendations and features such as autoplay.

The idea behind the law is straightforward: Instead of relying entirely on teenagers to recognize when to stop, require platforms to remove some of the mechanisms designed to keep them engaged.

The companies’ objections

The companies’ objections fall into several related categories.

Meta argues that deciding which posts to show, and how to arrange them, is protected editorial judgment under the First Amendment. Its complaint accuses California of attempting to appoint itself the

“editor, curator, and controller of online speech.”

TikTok makes a similar argument about its For You feed. It says selecting and arranging videos creates a curated product protected by free-speech rights, not merely a mechanism that the state can redesign at will.

Google likewise argues that YouTube’s recommendations help users find relevant, appropriate material among its vast collection of videos. It also defends autoplay as useful for watching content intended to be viewed in sequence.

The central disagreement is whether these are harmful product features that California can regulate, or editorial decisions protected by free-speech rights. California describes them as potentially harmful product design; the companies describe them as protected decisions about publishing speech.

The companies also raise parental control. Google says parents are best placed to decide what is appropriate for their families. TikTok points to its existing teen-account safeguards and Family Pairing controls, arguing that the law restricts free expression while taking decisions away from parents. Meta adds that personalized features can help deliver age-appropriate experiences.

The business model

There is also a commercial interest at stake: engagement. How often people return, how long they stay, and how much they interact all matter to the platforms’ businesses.

Meta’s annual report says it generates substantially all its revenue from advertising. It also says that changes to its content displays and product features can affect time spent, user engagement, and financial results. That doesn’t establish why the companies sued, but it helps explain why restrictions on recommendations and autoplay could have financial consequences.

If removing these features leads people to spend less time on a service, it could mean fewer opportunities to show ads. Compliance would also require product and operational changes, such as checking users’ ages and providing a different experience to those under 16.

Youth is the future. Big Tech is very much aware of this. Meta’s annual report identifies youth as an investment priority and describes attracting and retaining users as a competitive objective. Restrictions affecting how young people join and use a platform could affect its longer-term audience strategy, too.

What the future will bring

California is challenging an important part of the attention-based business model. Meta’s annual report warns investors that regulation affecting how it displays content or serves younger users could affect user growth, engagement, and financial results.

And then there’s the matter of age verification. The required age checks could affect adults as well as children: a service must verify users’ ages before providing the restricted features. Depending on how the checks work, this could involve sharing age-related information, raising privacy concerns and creating another opportunity for sensitive data to be exposed in a breach.

If it were up to me, platforms would stop designing for compulsive use, whatever the user’s age. Adults deserve a healthier online experience too. Applying those protections to everyone would also remove the need to check someone’s age before deciding whether they can use these features. Platforms might lose some advertising opportunities, but time spent online should not be the only measure of a successful service.

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

Attackers don’t have to steal information to cause serious harm. Sometimes, changing a temperature setting is enough.

On November 5, the US Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and three other federal agencies issued a warning urging operators to secure industrial refrigeration and cold-chain monitoring systems.

The warning follows cyberattacks on supermarket refrigeration systems across Europe. Separately, France’s national blood service confirmed that the monitoring and control systems at three of its cold-storage sites had been affected. Staff intervened before any blood products or samples were compromised. The incident showed how a connected cooling system can put essential supplies at risk.

On October 13, after the first attacks in France, refrigeration supplier Danfoss advised its Dutch customers to disconnect their systems from the public internet and reconnect only through a secure network.

A Danfoss spokesperson told NOS that most stores followed the advice. When similar attacks reached the Netherlands on November 2, major supermarket chains were reportedly unaffected. At least 17 businesses, mainly butcher shops and small neighborhood stores, had their refrigeration systems compromised.

Danfoss said that the affected systems were still accessible through unsecured connections and used default passwords. The spokesperson said the attacks could have been prevented if the recommended precautions had been taken.

CISA and its partners warned that attackers may exploit authentication bypass flaws, code-injection vulnerabilities, or weak configurations in refrigeration controllers. Successful attacks could let them change temperatures or force equipment into continuous heating or defrost cycles.

The agencies recommend reducing that risk by keeping control panels off the public internet, isolating operational equipment from business networks, changing default passwords, using strong authentication, patching firmware, and replacing unsupported devices. They also recommend setting safe operating limits and alerts for temperature changes outside those limits.

What about home appliances?

You don’t need an industrial refrigeration unit to adopt some of these precautions.

• Check whether you need remote access. If you never use a device while away from home, disable that feature. Check the manufacturer’s instructions first; disabling remote access may also affect alerts or smart-home integrations.
• Check who can access the appliance, including suppliers, and how that access is protected.
• Change default passwords and secure the associated account. Use a strong password and enable two-step verification wherever the appliance or app supports it. Protecting the app account matters as well as protecting the appliance itself.
• Keep firmware and apps updated. Turn on automatic updates where available, and don’t ignore manual update prompts.

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →

A caller offers you a free phone upgrade or an exclusive deal from your mobile provider. A new phone arrives at your home. So far, everything seems to check out.

Then comes another call: There’s been a shipping mistake. You received the wrong phone, and the company needs you to send it back. You send it back, but the phone never reaches your provider, leaving you with a large charge or long-term contract to pay.

Now police are warning about this scheme after residents lost devices and were left facing the associated payments.

How phone return scams works

The scam usually starts with a call from a spoofed number. In the US we’re seeing several examples in anonymized Malwarebytes Scam Guard records of the impersonated company being Canadian mobile provider Rogers.

The Canadian Anti-Fraud Centre warns:

“After collecting personal information required for credit checks, they’ll order a new phone in your name.”

Next, a genuine device arrives through a legitimate delivery service. That delivery makes the next part of the story easier to believe.

The caller gets back in touch and claims something went wrong. Perhaps the company sent the wrong device, or an extra phone arrived by mistake. To put things right, you need to send it back using the label or shipping QR code they provide.

The shipping label is the real trick. Rather than directing the package to the provider’s returns facility, it sends the device to an address chosen by the criminals.

The result: You no longer have the phone, but your provider has not received it back. Victims can be left facing a contract, financing agreement, or monthly payments for the missing device.

How to stay safe

The most important protection against most types of scams is having someone you can trust and deliberate whether something is a scam. Malwarebytes Scam Guard can be that partner if you’re on your own.

You don’t need to decide on the spot about whether a caller sounds convincing. Break the conversation and verify the offer separately. Pause and check if you encounter any of the following:

• An unexpected call offering a free phone, loyalty reward, or unusually attractive upgrade.
• A caller asking for personal, financial, or account information to arrange the offer.
• A follow-up call claiming the wrong device was shipped or that another delivery mistake needs correcting.
• Instructions to use a return label or QR code supplied by that caller.
• A return destination that you have not confirmed directly with your provider.

If you’ve already sent a phone, contact your mobile provider immediately using verified contact details. Explain that you believe you were targeted by a phone return scam, identify the affected orders, and ask for a fraud investigation.

If you shared your account password or PIN, change it through the provider’s official channels. Rogers advises customers who disclosed their credentials to reset them and contact customer service to check for unauthorized transactions.

Keep the evidence: messages, emails, the shipping label, tracking details, order confirmations, bills, and a timeline of the calls. These records can help explain what happened to support a billing complaint and fraud report.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Players of Goddess of Victory: NIKKE are being urged to check their PCs after attackers tampered with files used by the game’s Windows launcher. Opening the launcher could allow malicious software to run, potentially exposing much more than a player’s game account.

The incident occurred as part of a supply-chain attack, where services or software used by the company in question is compromised. In practice, this meant that instead of persuading players to download a fake game or install a suspicious add-on, the attackers compromised resources used by the legitimate launcher. Players could therefore encounter the threat simply by opening software they already trusted.

Game publisher Level Infinite has released fixes and added a malware-checking feature to the official PC client. However, fixing the delivery mechanism does not undo an infection, nor does it recover passwords and other information that may have been stolen.

Breaches happen every day. Don’t be the last to know.

SEE PLANS

Independent researcher MotherSphere identified malicious code in four JavaScript files hosted on Level Infinite’s official content delivery network (CDN).

Players should be aware of a discrepancy in the published timelines. Level Infinite says malicious-program distribution began on October 30. while MotherSphere reports evidence of the remote-control agent running as early as October 23.

According to the researcher’s analysis, the distributed remote-control agent supported commands to:

• Run programs and system commands.
• Browse folders and download files.
• Take screenshots.
• Retrieve saved NIKKE login credentials.
• Collect browser passwords and cookies.
• Search for developer credentials, API tokens, and other secrets.
• Collect cryptocurrency wallet-extension data.

The number of compromised PCs and the full extent of any data theft remain unclear.

How to stay safe

Mobile-only players are not affected, according to Level Infinite, so they do not need to take any additional security measures.

Level Infinite says it replaced three abnormal script files early on November 4, then refreshed the CDN’s cache for the remaining file later that day. MotherSphere subsequently reported that all four files were clean on the four CDN servers checked.

If you opened the Windows launcher during the period identified above, take the following steps.

• Close the launcher and check your PC. MotherSphere’s report includes user-reported Malwarebytes detections for traces associated with the attack.
• Follow the removal instructions published by NIKKE carefully.
• Secure your accounts from a clean device. Do not change passwords on a computer that may still be compromised.
• If a cryptocurrency wallet or its recovery phrase may have been exposed, use a clean device to move funds to a newly created wallet with a new recovery phrase.
• Level Infinite asks players who believe they were affected, including those experiencing problems with external accounts or financial losses, to contact its customer support team, so keep relevant records without handing over personal information.

Please note that the NIKKE wiki’s unofficial cleanup guidance recommends scanning with Malwarebytes. Although the guide describes this as a one-time free option, Malwarebytes Free lets you continue running manual scans and removing detected malware after the Premium trial ends. The trial provides additional features, including real-time protection, so decide what is best for you.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

When your pet goes missing, it can be totally heartbreaking.

So hearing that they’ve been found is no doubt very welcome news. Even better to see a photo of them looking safe and well.

But while the photo may look exactly like your pet, that doesn’t mean the person who sent it has your pet or even ever saw it.

The BBC reports how criminals are sending owners AI-generated images of their missing pets, demanding money for their return, and sometimes threatening to harm the animals when owners refuse to pay.

The BBC interviewed two targets of this scam who were both contacted after posting a missing pet message on social media. The scammers sent them pictures of their beloved pets and demanded a ransom for their safe return.

Messages like these exploit two powerful emotions in quick succession: relief that a beloved pet has been found, followed by fear that something terrible will happen unless the owner acts immediately.

The scam typically follows this pattern:

• A scammer finds a missing pet appeal, which is typically posted to social media or local sites with an accompanying photo and contact details.
• The scammer contacts the owner and claims to have found the animal. An image fabricated with the help of AI makes the claim appear more convincing.
• They ask for money which may be described as a reward or as payment for emergency treatment.
• They add pressure. They might refuse to meet until payment arrives, or threaten to sell or harm the pet.

Our data backs this report up. Over the last month, people anonymously submitted three distinctive types of pet related scam attempts to Malwarebytes Scam Guard:

• “We found your missing cat” message, with photos: Someone claimed to have found a user’s missing cat and had images of it.
• Found pet callback lure: A voicemail claimed to have found a lost cat and supplied a callback number.
• Humane Society impersonation and payment demand: A caller claimed a missing cat needed emergency surgery, and demanded successive Zelle payments.

How to stay safe

Sadly, while it can be very useful to use social media to retrieve lost pets, it also attracts scammers and other abuse.

You don’t have to stop asking for help online, but you can put some safeguards between an unexpected message and any payment.

• Keep some identifying details private. Leave a distinctive feature out of the public description so you can ask a supposed finder about it later.
• Do not pay in advance to secure a reunion. Be particularly wary of someone who insists that you send money before they will let you see the animal. Arrange any legitimate handover in a safe, public location, and verify that it is your pet before paying a reward.
• Verify veterinary claims independently. If someone says your pet is at an animal hospital, find the hospital’s contact details yourself and call it directly. Do not rely on the number or payment link in the message.
• A second pair of eyes can help you assess a demand without the same emotional pressure. Malwarebytes Scam Guard can help you identify whether a message might be a scam and how to proceed.
• If someone is threatening your pet, remember that when they make threats to your pet, it is very likely they don’t have a clue where it is either, so don’t let them extort you.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free →