Malware Bytes Security

On October 13 and 14, Google issued several Chrome updates.

Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 for Linux. The update includes 37 security fixes, including seven rated Critical.

On the same day, Google released version 155.0.8059.79 for Android. It may not be available on Google Play for everyone yet but keep an eye out for it. Google says it also includes stability and performance improvements.

Updates will roll out over the coming days and weeks.

How to update Chrome

The easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update.

If you don’t want to wait for the rollout to reach you, manually updating is easy. Open About Google Chrome from Chrome’s settings or Help menu. Chrome will check for updates. If one is available, click Relaunch to apply it.

Chrome 155.0.8059.80 is up to date

You can find an explanation of the version numbering system and step-by-step instructions in our guide: How to update Chrome on every operating system.

Technical details

Some of the security fixes deserve a closer look.

Mobile protection, anywhere, anytime..wp-block-kadence-advancedbtn.kb-btns400740_ab89fd-c4{gap:var(--global-kb-gap-xs, 0.5rem );justify-content:center;align-items:center;}.kt-btns400740_ab89fd-c4 .kt-button{font-weight:normal;font-style:normal;}.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0{margin-right:5px;}.wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button{color:#555555;border-color:#555555;}.wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button:focus{color:#ffffff;border-color:#444444;}.wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button::before{display:none;}.wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button:focus{background:#444444;}ul.menu .wp-block-kadence-advancedbtn .kb-btn400740_68fb6a-2d.kb-button{width:initial;}.wp-block-kadence-advancedbtn .kb-btn400740_68fb6a-2d.kb-button{color:var(--color-neutral-10);background:var(--color-brand-blue-60);border-top-left-radius:40px;border-top-right-radius:40px;border-bottom-right-radius:40px;border-bottom-left-radius:40px;box-shadow:1px 1px 2px 0px rgba(0, 0, 0, 0.2);}.wp-block-kadence-advancedbtn .kb-btn400740_68fb6a-2d.kb-button:hover, .wp-block-kadence-advancedbtn .kb-btn400740_68fb6a-2d.kb-button:focus{box-shadow:0px 4px 0px 0px var(--color-brand-blue-90);}Try it now

The first is tracked as CVE-2026-110152, a buffer overflow in ANGLE in Google Chrome on Android. It could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.

ANGLE is Chrome’s graphics-translation layer. A buffer overflow occurs when a program puts more data into an area of memory than it can hold, overwriting data in adjoining memory. An attacker can exploit this to make the vulnerable process run malicious code.

Chrome vulnerabilities that enable remote code execution outside the browser sandbox are particularly valuable to attackers because they can turn a visit to a malicious or compromised website into direct code running on the underlying operating system, often without requiring additional exploitation steps.

Then I spotted two use-after-free vulnerabilities in the PDF component. CVE-2026-110136, rated Critical, could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. CVE-2026-110147, rated High, could allow an attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

A use-after-free vulnerability occurs when a program attempts to access a memory location after it has been freed. That can cause crashes or, in some cases, allow an attacker to run their own code.

Inside the sandbox means the malicious code would run in a restricted, sealed-off environment designed to limit access to the rest of your device. That limits what the attacker can do as it constrains them to the browser, lowering the impact compared with code running outside the sandbox. However, attackers often chain multiple vulnerabilities together to escape the sandbox and achieve a more serious compromise. So, the phrase describes an important security limitation, but it does not mean the vulnerability is harmless.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Maybe it’s a text saying your package couldn’t be delivered, with a link to reschedule. Or an email from your bank asking you to verify your account. Or perhaps it’s an invitation from someone you know to view a document. 

The message looks real enough, but something about the link feels fishy. Do you click it? 

Malwarebytes Scam Link Check is a new free tool that lets you check a suspicious link before you click.  

Simply paste the link into Scam Link Check, and Malwarebytes will scan it for signs of phishing, scams, malware, and other online threats. You’ll know within seconds whether the link appears safe or might be dangerous.  

What is Malwarebytes Scam Link Check? 

When you paste a link, Malwarebytes Scam Link Check analyzes the website using our threat intelligence technology. Along with a safety verdict, you’ll learn more about what we found, including: 

• Information about the website’s domain and reputation 
• Signs that the site may be impersonating a known brand 
• Where the link ultimately leads 
• A preview of the website 
• Recommended next steps 

When should you check a link? 

Scam links can show up pretty much anywhere: text messages, emails, social media posts, messaging apps, QR codes, and even search results. 

It’s a good idea to check a link whenever you’re unsure about where it may lead, especially if the message asks you to log in, make a payment, share personal details, or act quickly. 

For instance, you might want to investigate a link if you receive a message claiming: 

• You missed a package delivery 
• There’s a problem with your bank account 
• You need to reset a password or verify your identity 
• You owe a toll, fine, or other payment 
• You’ve won a prize or are eligible for a refund 

How to check if a link is safe 

Using Malwarebytes Scam Link Check is simple and takes just a few steps: 

1. Copy the suspicious link without opening it. 
2. Paste the link into the tool.  
3. Wait while Malwarebytes scans the site for potential threats. 
4. Review the results.  

If we can’t determine whether a link is safe, it’s best not to click it yet. Instead, reach out to the company using the contact details listed on its official website. 

Check before you click 

Scammers are getting more adept at creating convincing copies of a brand’s site, making it even harder to decipher what’s real and what’s not.  

With Malwarebytes Scam Link Check, you don’t have to figure it out on your own.  

Want to try it out now?  Check a link

The Federal Trade Commission (FTC) has filed a complaint accusing Digital Forensics Corporation of exploiting people already targeted by sextortionists.

We have talked about sextortion and recovery scams in the past, but we never looked specifically at the combination. Apparently, there is a lot of money to be made for those ruthless enough to take money from victims already in a state of panic.

The FTC has accused Digital Forensics Corporation, its owner Dmitry Belkin, and affiliated companies of misleading sextortion victims into paying at least $60 million for assistance that, in numerous instances, they did not provide. A federal court has temporarily halted the defendants’ activities while the case proceeds.

Most of the time, sextortion emails are a bluff sent to a large number of targets to see if one takes the bait. But sextortion can also involve intimate images that someone really possesses. In those cases, a criminal threatens to share the material unless the victim pays, sends more images, or complies with other demands.

In those cases, victims can feel desperate, especially when the demands keep coming, and may look for help to make it stop. According to the FTC, Digital Forensics targeted people searching for that help through advertisements on Google, YouTube, X, and other platforms. The company allegedly claimed it could track down criminals worldwide, identify perpetrators, and provide law enforcement with evidence needed to make arrests.

Digital Forensics allegedly charged between $1,499 and $20,000 for a “Phase 1” package. That was supposed to include communicating with the sextortionist, tracking their location, producing an investigative report, and reporting the crime to law enforcement.

According to the FTC, Digital Forensics Corporation changed the victims’ account settings to block the sextortionist, fabricated chat transcripts, and presented pre-saved coordinates, often in Nigeria or the Philippines, as the sextortionist’s location.

After collecting the first payment, the company allegedly pressured customers to purchase “Phase 2” services, supposedly providing ongoing account monitoring and further assistance. The FTC says the company did not follow through on those promises either.

Another huge red flag was that the company also allegedly discouraged victims from blocking their blackmailers, contrary to law enforcement and expert advice.

The allegations against Digital Forensics Corporation have not yet been decided by the court.

How to stay safe

Be wary of anyone who promises to stop the threats or pressures you to pay immediately. Help should offer clear information and realistic options. It should not turn your fear into another payment deadline.

If someone is threatening to share intimate images, you do not have to handle it alone.

• Preserve the threats and account details. Keep the messages, usernames, and payment demands. Block the offender but do not delete your account or the messages, since they may help real investigators.
• Stop communicating and block the blackmailer. Do not pay them or give them access to your devices or financial accounts. Report the account using the platform’s safety tools.
• Tell someone you trust about the sextortion. A friend, family member, counselor, or other trusted adult can provide support while you decide what to do next.
• Report the crime. Contact local police. In the US, you can also report sextortion to the FBI. If it involves a minor, report it through the National Center for Missing and Exploited Children’s CyberTipline.

If you have already paid a service that you believe misled you, keep its ads, messages, contract, and receipts, and report your experience to the FTC through ReportFraud.ftc.gov.

If you’re unsure whether something is a scam or not, ask Malwarebytes Scam Guard. It can help you assess it and provide advice on next steps.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Photos you take with your phone and some digital cameras can contain hidden information, including where they were taken. You can strip that data out before sharing a photo with someone, which would help to protect your location. But the image itself may still give you away.

A company called Graylark says its Raven AI tool can match an indoor photo to a specific property using visual clues alone. No GPS data or view out of the window required.

We’ve seen this company before. Its tool, GeoSpy, could work out where a photo was taken by analyzing features in the image, such as vegetation, buildings, and other landmarks.

Graylark itself grew out of experiments founder Daniel Heinen and his brothers carried out after reading about using AI to play GeoGuessr, a geography game in which people look at street-level images and try to work out where they were taken.

The company has since taken it further. According to 404 Media, Graylark has renamed the tool as Raven and expanded it to identify indoor locations as well. It uses visual clues in the image, without needing location metadata.

The tool works by matching images against property photos. An image of something as banal as a washer/dryer sitting in a nook can return a list of ranked results. The tool’s Short-Term Rental ID feature can search what Graylark describes as millions of rental listings worldwide, using an interior photo or a frame from a video.

However, the system targets more than just rental properties. Its Find Property feature searches for properties using exterior photos and, now, interior ones in supported cities.

This is more than just reverse image search, which can help you see if the same photo you’re looking at has been used elsewhere. The service can match different views of the same property by identifying features ranging from the shapes of wall tiles to the structure of a room and the color of its surfaces.

Law enforcement is already using the tool, for which founder Daniel Heinen landed $10.7m in seed funding in August. 404 Media said that Miami-Dade Sheriff’s Office and the Los Angeles Police Department bought access to the product.

According to Heinen’s social media posts, Raven can now tell which hotel you stayed in from a single photo. He cited a feature called HotelID that isn’t yet listed on the website. The Raven website also cites other uses. For example, it can tell you a car’s exact make, model, and year from a picture of its interior.

The tool works from identifiers such as email addresses, too. Investigators can find public photos on linked accounts and then use those photos to look for location clues. Graylark says this does not give investigators access to private accounts or messages.

Heinen says the short-term rental feature uses images from millions of rental listings around the world. According to 404 Media, Airbnb said it had no relationship with Graylark, and Zillow said scraping was against its terms of service. Those statements don’t confirm how Graylark obtained its imagery.

Heinen’s ambitions don’t seem to stop here. On September 8, he mentioned that he was experimenting with recent footage from tens of thousands of dashcams.

He has said that this kind of system can help combat human trafficking. A George Mason University study found that in around 80% of federal sex trafficking cases active in 2018 and 2019, victims were exploited at hotels or motels. And perhaps AI can help with unsolved crimes if used properly. Any suggested location still needs to be checked against other evidence.

But technology can also be misused, particularly when it comes to stalking. Heinen said on X that Raven is only available to enterprises, government, and law enforcement agencies. Other websites and consumer apps use the GeoSpy name, but Graylark says third-party products using that name are not operated by or affiliated with the company.

This brings us to what you can do to protect yourself should someone use this kind of tool for nefarious purposes.

How to keep your home more private

Think before publishing interior or exterior pictures of your home online. Even Google Photos can estimate where a photo was taken using landmarks and similarities with your other photos that have known locations, it says.

Check the frame for distinctive features before posting. Look for distinctive tiles, room layouts, views through windows, house numbers, or mail showing your address. Crop these out where practical.

Limit who can see your photos. Review the audience for your social posts and photo albums, including older ones. When traveling, consider waiting until you’ve left before posting recognizable accommodation photos.

Review old property listings. Ask your agent and the relevant property websites whether they can remove interior photos from old listings. Removal cannot recall copies already downloaded or collected. If you’re advertising a rental, use approximate-location settings where available, but remember that the listing photos themselves may still identify the property.

Remove location metadata before sharing. This won’t prevent visual matching, but it removes another way to find where a photo was taken. Don’t assume every service removes it for you.

• Apple users can do this directly on iOS: When sharing from Photos, tap Options and turn off Location.
• Google Photos lets you remove estimated or manually added locations, but not those recorded by your camera. Check location-sharing settings for each album, link, or conversation. Photos downloaded and shared outside Google Photos may still contain the original location data.
• Samsung users can choose to remove location data when sharing from Samsung Gallery, where the option is available.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Your streaming box might not look like much of a computer. But connect enough inexpensive devices together, and they can run an AI model.

Researchers at Anthropic demonstrated this by running a Google Gemma model across 15 off-brand Android TV boxes. They warn that small models could soon spread across vulnerable internet-of-things (IoT) devices, including smart ovens and TV boxes, stating:

“Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes.”

In this scenario, AI isn’t simply helping an attacker write malicious code. It becomes part of the software carrying out the replication.

Anthropic breaks that process into four stages:

1. Find another device.
2. Gain the ability to execute code on it.
3. Set up the software needed to run an AI model.
4. Continue spreading from the new host.

The researchers tested whether AI agents could complete this sequence. They did not demonstrate a small model spreading and running independently on compromised household devices.

The tests used Android emulators with unauthenticated debugging access, making it much easier for the agents to gain access than it would be on properly secured devices. Large file transfers and sustained communication between devices could make real-world replication easier to detect, while limited computing power could slow it. Crucially, the experiments did not demonstrate a model that was both capable enough to complete the replication process and small enough to run on the consumer hardware being targeted.

Anthropic projects that smaller models could reach the necessary capability by the end of 2026 if improvement continues at its historical rate.

Varun Chandrasekaran, an assistant professor at the University of Illinois, told AFP that the findings were consistent with related research but cautioned that Anthropic’s work had not been independently verified. He identified people using AI to improve attacks as the bigger current threat, rather than AI systems going rogue.

Smart-device botnets are already a problem.

Criminals hijacking connected devices is nothing new. Mirai and its descendants have recruited routers, security cameras, and digital video recorders into botnets used to launch distributed denial-of-service (DDoS) attacks, overwhelming services with traffic. BADBOX 2.0 illustrates another form of abuse: compromised consumer devices used for activities including residential proxy services, which route other people’s traffic through victims’ internet connections.

Neither demonstrates autonomous AI replication, but both show that connected devices can become infrastructure for criminals.

What you can do now

The practical response is to reduce the opportunities for any attacker to misuse your connected devices:

• Keep operating systems, software, and firmware up to date to reduce exposure to known vulnerabilities.
• Buy from reputable vendors that provide ongoing firmware and security updates. A bargain device is less attractive if you cannot trust its software or obtain security fixes.
• Avoid unofficial app stores promising free streaming content. The FBI specifically flags these marketplaces in its BADBOX 2.0 guidance.
• Don’t disable protections to make an app work. Requests to turn off Google Play Protect are a warning sign, as are Android devices without Play Protect certification.
• If you notice something suspicious, disconnect the device from your network while you investigate.
• Put smart devices that are unable to run security software on a separate network isolated from your computers and phones, such as a guest network.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

.wp-block-kadence-advancedbtn.kb-btns97520_6de029-2f{gap:var(--global-kb-gap-xs, 0.5rem );justify-content:flex-start;align-items:center;}.kt-btns97520_6de029-2f .kt-button{font-weight:normal;font-style:normal;}.kt-btns97520_6de029-2f .kt-btn-wrap-0{margin-right:5px;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button{color:#555555;border-color:#555555;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{color:#ffffff;border-color:#444444;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button::before{display:none;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{background:#444444;}ul.menu .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{width:initial;}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{color:var(--color-neutral-10);background:var(--color-brand-blue-60);border-top-left-radius:40px;border-top-right-radius:40px;border-bottom-right-radius:40px;border-bottom-left-radius:40px;box-shadow:1px 1px 2px 0px rgba(0, 0, 0, 0.2);}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:hover, .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:focus{box-shadow:0px 4px 0px 0px var(--color-brand-blue-90);}Try it now

Microsoft’s October Patch Tuesday release addresses a record-breaking 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day and two other publicly disclosed flaws.

Just when you thought a previous record would stand for a while, Microsoft comes out again with the largest monthly Patch Tuesday release. Microsoft has said its growing use of AI to find and fix security vulnerabilities means users should expect more fixes in its monthly updates.

How to apply patches and check if you’re protected

These updates fix security problems and help keep your Windows PC protected. Here’s how to make sure you’re up to date:

• Click the Start button, then open Settings.
• Select Windows Update (usually at the bottom of the menu on the left).
• Click Check for updates. Windows will search for the latest security updates. If you’ve enabled Get the latest updates as soon as they’re available under More options, you may be prompted to restart immediately to complete the update.
  
• Otherwise, continue to the next step.
• If updates are available, they’ll start downloading automatically. When they’re ready, click Install or Restart now if prompted. Your computer may need a restart to finish the update.
• After restarting, go back to Windows Update and check again. If it says You’re up to date, you’re all set.

Technical details

As usual, we’ve selected a few vulnerabilities to highlight for readers interested in the technical details.

We’ll start with the actively exploited vulnerability tracked as CVE-2026-96951 (CVSS score 8.8 out of 10), a Windows Shell security feature bypass vulnerability.

The security feature it can bypass is the Mark of the Web (MOTW) defense, which can warn users about potentially unsafe downloaded files.

Successful exploitation requires user interaction. For example, in an email or instant message attack, the attacker could send the targeted user a specially crafted file designed to exploit the vulnerability, but the user would have to click a link or open an attachment.

Another one to keep an eye on is CVE-2026-108398 (CVSS score 8.8 out of 10), where an untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally. The bypassed feature is Windows Defender Application Control (WDAC), which could lead to the ability to run unauthorized applications on target systems. This vulnerability was publicly disclosed before the patch.

Another publicly disclosed vulnerability is CVE-2026-92707 (CVSS score 5.3 out of 10). The flaw can let an unauthenticated remote attacker exhaust memory in affected applications that process specially crafted MessagePack data. MessagePack-CSharp is a software component that helps applications pack and unpack data in a compact format, making it efficient to store or exchange information. Exposure depends on how a service uses the library to pack and unpack the information.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

We found a wave of websites posing as Calendly booking pages for job interviews at Meta. Visitors pick a slot for a 30-minute phone call with a recruiter, fill in their details, and pass what looks like a CAPTCHA.

Then the page asks them to log in to Facebook.

The interview is fake. The pages are designed to steal the visitor’s Facebook login details, including the two-factor authentication (2FA) codes meant to protect the account. Visitors are then asked to sign in to their Google account too, supposedly “for security.”

These pages are not affiliated with Meta, Calendly, or Google. If you’ve already entered a password or approved a sign-in prompt, secure the affected accounts straight away. See “How to stay safe” below.

Why Calendly makes a convincing disguise

Calendly is a widely used scheduling tool, and recruiters use it to book interviews. Clicking a booking link, picking a time, and typing in your name and email is something people do without a second thought. There’s no account to create and nothing to download.

That routine makes it a good disguise. By the time the page asks for something unusual, the visitor has already picked a slot and shared their details. Going along with one more step can feel easier than starting to doubt the whole thing.

For someone who has sent out application after application without hearing back, an invitation to interview at Meta may be exactly the kind of message they hope for. Excitement, and the fear of missing a rare chance, can push people to move quickly instead of checking who actually sent the link.

Job seekers are also used to sharing personal details with strangers. Handing your name, email, and phone number to a recruiter you’ve never met is a normal part of applying, so a form asking for them may not raise any alarms.

A job interview that starts with a calendar

The fake page copies Calendly’s booking screen, titled “Calendly | Meta Careers.” It shows a monthly calendar, a time zone picker, and a 30-minute “Phone call.” The available times are loaded from the attackers’ server, so the calendar looks like a real recruiter’s schedule.

After the visitor picks a time, the page walks them through a series of steps:

1. Your details. A form asks for your name, email address, and phone number, plus anything that “will help prepare for our meeting.”
2. A fake CAPTCHA. A grid of images asks you to “Select all images with…”. It makes the page feel legitimate, and it may also stop automated security scanners from seeing what comes next.
3. A Facebook login. A window within the page copies Facebook’s login page. It even draws its own fake address bar showing a Facebook web address, so it looks like a genuine browser pop-up. The copy comes complete with realistic error messages such as “The login information you entered is incorrect.” The page also asks visitors to sign up for a “Career Profile.”
4. Your Facebook security code. If the account has 2FA, the page asks for the code from your authentication app, text message, WhatsApp, or email.
5. A Google sign-in. The page claims “Facebook requires you to sign in to the Gmail address” on your account. To make the request seem harmless, the page adds that “Facebook will not share any of your data with your Google Account.” Fake Google screens, again under a fake address bar, ask for your password and then whatever Google asks for: a tap on a phone prompt, a code from Google Authenticator, a text message code, or your recovery email address. Everything you type into these screens, including the Google password, is sent to the attackers’ collection server.
6. A fake confirmation. Finally, the page says a calendar invitation has been sent and that you’ll hear back within 90 minutes. By the time you start wondering, the attackers may already be inside your accounts.

How the scam can get past two-factor authentication

Many phishing pages simply collect a password and stop. This one keeps going.

While the visitor is on the page, it keeps checking in with the attackers’ server and waits to be told which screen to show next. That allows the attackers to try the stolen password on the real Facebook site right away. If Facebook asks for a code, the fake page asks the visitor for the same code, and the attackers can use it before it expires. If the code doesn’t work, the page simply says “Incorrect code. Please try again.”

The Google screens support the same approach. If Google sends a sign-in prompt to the visitor’s phone, the fake page can tell them to “tap Yes,” potentially approving the attackers’ login.

The visitor sees the fake page while the attackers attempt to sign in to the real service out of sight.

Codes and phone prompts still make accounts much harder to take over, so keep them turned on. But a code entered into a fake page, or a prompt approved for someone else’s login, can let attackers in. Passkeys and compatible hardware security keys are tied to the genuine website, so a fake page like this cannot relay them in the same way. That protection won’t help if you instead choose a password-and-code fallback and give those details to the attackers.

Signs of a reusable phishing kit

The code carries a version number (0.8.0), detailed error logging, and a “campaign key” sent with every message to the attackers’ server. These features suggest a reusable kit with support for identifying different campaigns.

The collection address uses Amazon API Gateway in AWS’s Singapore region, ap-southeast-1. A comment left in the code is written in Vietnamese. It translates to:

“Change the key here when deploying to production.”

Neither the hosting region nor the language of a code comment establishes who is behind the pages or where they operate.

Facebook accounts, especially those linked to business pages or ad accounts, are valuable to criminals. Taking over the Google account as well could expose email and other data, and let attackers reset passwords for accounts linked to that address.

The domains are another warning sign. All 11 follow the same pattern: join plus a recruiting-sounding word, such as joinhire, joinquest, or jointheteam, on the .cfd, .info, and .works top-level domains. None mention Calendly or Meta. These generic names could also be reused for other companies’ job lures.

How to stay safe

• Check the address, not the design. Direct Calendly booking links use calendly.com, although legitimate forms can also be embedded on other websites. Treat an unfamiliar recruiting domain as a reason to verify the invitation independently.
• Don’t give a booking page your Facebook password. Scheduling a call doesn’t require handing your social media password to a recruiter. If a booking flow suddenly asks you to sign in elsewhere, verify both the request and the actual login domain.
• Look at your browser’s real address bar. These fake login windows draw their own address bars showing Facebook or Google web addresses. For a separate pop-up, check the address displayed by the browser itself. A login window that cannot be dragged outside the webpage may be part of the page rather than a separate browser window.
• Verify the recruiter and role. Go directly to the company’s official careers site. A genuine job listing doesn’t prove the person contacting you represents the company, so verify unexpected invitations through an independent contact.
• Don’t share codes or approve unexpected prompts. Only enter a code on the genuine service for a login you initiated. Never approve a phone prompt just because a recruiter or booking page tells you to.
• Use passkeys or a security key where you can.They resist this kind of phishing. Be wary if a page pushes you to use a password and code instead.
• Already entered a password or approved a prompt? From a trusted device, go directly to the affected service and change your password. Sign out other sessions and check your security methods, recovery email, and phone number. If both accounts were affected, secure your Google account promptly because email access can help attackers reset other passwords. Check Gmail for unfamiliar forwarding rules and filters, and review any Facebook business pages or ad accounts you manage. Change the password anywhere else you reused it.
• Locked out of your account? Use Meta’s account recovery support or Google’s compromised-account guidance. If you only shared contact details, watch for follow-up scams that use them to sound convincing.

How Malwarebytes helps

Malwarebytes Browser Guard can block phishing and scam sites before you interact with them. That matters in campaigns like this one, where the page closely copies a service people use every day.

If you receive an interview link and aren’t sure about it, Malwarebytes Scam Guard can help assess the link before you click.

Indicators of compromise

Phishing domains

• joinconnect[.]cfd
• joinconnect[.]works
• joinhire[.]cfd
• joinhire[.]info
• joinquest[.]cfd
• joinquest[.]info
• joinquest[.]works
• jointhetalent[.]cfd
• jointhetalent[.]info
• jointhetalent[.]works
• jointheteam[.]cfd

Collection endpoint

• rkrt01c0mc[.]execute-api[.]ap-southeast-1[.]amazonaws[.]com

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Police tip hotlines already have their fair share of crank callers. Apparently they now have to contend with crank AI agents as well.

AI agents have already been caught hacking software companies, breaching an Australian government portal, and trying to hack a Canadian government website. Now Anthropic’s Claude has added a made-up murder tip to the list.

Claude’s Haiku 4.5 model filed a false tip in an unsolved Philadelphia homicide via the police department’s online public tip form, Anthropic disclosed. The tip was flagged as spam and didn’t reach investigators.

AI’s latest “what does this button do?” moment happened during an internal test on randomly chosen web pages, the company said.

Claude submitted the tip on July 18 at 11:27 pm through PhillyUnsolvedMurders.com, according to police. Tips submitted there can inform real homicide investigations. A fabricated account could send investigators chasing something that never happened.

Here’s what Claude Haiku wrote:

“I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.”

The agent didn’t provide any description of the person that it didn’t actually see. Neither did it leave any contact details before hitting submit.

Haiku did this as part of Anthropic’s internal testing. It had to invent and perform sample tasks on random web pages with live internet access so the company could see how it behaved.

There was a list of prohibited actions to go along with the test. Anthropic told the agents not to log in, create accounts, enter personal data, make purchases, or submit “anything destructive.” The instructions did not explicitly rule out form submissions.

The spam filter caught this one. Philadelphia police said the report never reached its Real-Time Crime Center for review or distribution to investigators. The department did not explain why it was flagged as spam.

All tips go through human review before going out to investigators. That safeguard limited the impact of the incident, the department said, but did not diminish the seriousness of an AI system presenting made-up information as though it came from someone with knowledge of a crime.

As it put it in a statement:

“Unsolved cases involve real victims, grieving families and investigators working to secure answers.”

Anthropic discovered the false tip on September 28 and notified police on October 7, according to the department. Police called the two-month delay in detecting and reporting the incident “unacceptable.” It is coordinating with the City Law Department, its Office of Innovation and Technology, and the Mayor’s executive team, the department added.

Anthropic described the real-world impact of the incidents in its report as minimal. It has now disabled live internet access across its internal evaluations until it confirms that its safeguards reliably catch this behavior.

The company said the transcript suggested Haiku was just trying to produce example content rather than trying to deliberately mislead the cops. But it also admitted that we can’t completely rely on a model’s account of its own reasoning. That leaves its explanation provisional, however reassuring it might sound.

An allowlist could offer a tighter boundary for tests like these, limiting agents to approved sites and actions. A live police tip form should hardly be a testing ground.

The homicide tip was not the only unwanted submission.

Anthropic noted that federal, state, and local government websites also got visits from Claude, which repeatedly tried to fill out forms. Although Anthropic didn’t go into detail, a State Department official said that it got 20 visa applications from a testing model (19 in August, and one in May). None of them were processed, the official added.

When an AI gives you fake information about who Beyoncé is married to, it might be irritating but it might only affect your team’s fortunes in a trivia night.

The stakes get much higher when we’re dealing with intelligence that can inform law enforcement actions or public policy.

In August, the head of the UK’s Police AI center warned law enforcement there to pause plans for AI use in criminal justice work. This came after the UK’s West Midlands Police apologized to members of Parliament over false evidence involving an invented soccer match. The error arose from the use of Microsoft Copilot.

Anthropic’s latest incident raises a further concern: AI agents can put invented information into real systems themselves. What would happen if someone deliberately sent agents to flood police tip lines?

This time, the false account stayed in spam. The people relying on those tip lines deserve safeguards that hold up when the next submission gets through.

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →

Norway’s privacy regulator Datatilsynet has fined advertising technology company Xandr 92 million Norwegian kroner, approximately $9.6 million, for unlawfully processing and sharing sensitive information about Grindr users.

While the decision concerns users in Norway, the data-sharing practices were not confined to Norwegian users. BleepingComputer reports that information about Grindr users in other countries was also exposed through the advertising system.

Between July 2018 and April 2020, Xandr handled real-time advertising auctions involving Grindr users. These automated auctions let advertisers bid to display an ad, but also involved circulating information about the person who would see it. Sensitive information revealing sexual orientation could potentially reach thousands of companies.

Crucially, users did not have to disclose their sexual orientation in their profiles. Datatilsynet said that simply being identified as a Grindr user was information that indicated sexual orientation.

To boldly browse, away from prying eyes. 

TRY OUR ULTRA-FAST VPN

According to the regulator, Xandr relied on Grindr to obtain consent without checking whether that consent was valid. As a company jointly responsible for the processing, Xandr had its own obligations. It was not enough to simply assume the app had obtained the explicit consent required.

This was not a case of hackers breaking into a dating app. The information was flowing through an advertising business without a valid legal basis. Privacy group noyb, which filed the complaint in cooperation with the Norwegian Consumer Council, says such systems use tracking identifiers to build profiles of people’s interests, habits, and behavior.

Although Xandr now belongs to Microsoft, the misconduct predates its acquisition. Microsoft completed its purchase of Xandr from AT&T on June 6, 2022, more than two years after the period covered by the fine. Microsoft told BleepingComputer it was reviewing the decision and assessing its options.

How to protect your privacy

This is a Norwegian enforcement action, but the data-sharing practices crossed borders. Users in the US and elsewhere shouldn’t assume their information stayed private just because the fine was issued in Norway.

You can limit how much additional information you disclose by giving a dating app only what you need to use it.

• Leave optional profile fields blank when the information feels too personal.
• Avoid publishing your workplace, home address, regular schedule, or other details that make you easy to locate.
• Review location permissions and advertising settings and limit them where possible.
• Think carefully before linking social accounts that reveal more of your identity.
• Don’t use dating apps on company-issued devices.

These precautions cannot guarantee privacy. Responsibility for unlawful sharing lies with the companies involved. This case shows that sensitive information can come from using the service itself, not just from what you write in your bio.

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

A cyberattack has forced hundreds of supermarkets across France to throw away refrigerated and frozen food after attackers interfered with the systems that keep it cold.

The attack caused significant financial losses and food waste. Some installations reportedly reached temperatures of around 50°C (122°F), with damaged equipment and reports of fires adding to the disruption.

The attack, which struck overnight from October 11 to 12, affected stores belonging to Intermarché, Netto, Coopérative U, Carrefour, E.Leclerc, and Monoprix. These stores do not share a single parent company, but they all use refrigeration-control equipment supplied by Danish manufacturer Danfoss.

These commercial refrigeration-management systems let operators manage the equipment that keeps supermarket food refrigerated or frozen. Le Monde reported that the attackers extended defrost cycles from one hour to eight hours, delaying alarms and giving staff less opportunity to intervene before stock was ruined.

Danfoss told AFP that most affected equipment consisted of legacy products that no longer receive software or security updates. It identified AK-SM800 and AK-SC355 systems among those affected and said it had long advised customers to move away from obsolete models and keep supported equipment updated.

Les Mousquetaires, the group behind Intermarché and Netto, has estimated its losses at several million euros. The damage goes beyond spoiled food. The Paris prosecutor’s office has opened an investigation to establish the connection between the attack and reported stock losses and fires.

For customers, the disruption can mean closed departments, temporarily closed stores, and gaps on shelves while replacement stock arrives. Some affected stores have already resumed operations, but restoring refrigeration does not immediately replace everything that had to be discarded.

The technical recovery involves more than resetting temperatures. France’s national cybersecurity incident response center, CERT-FR, recommends disconnecting or filtering access to affected controllers. Where compromise is suspected, it advises operators to:

• Restrict network access to necessary service providers
• Perform a factory reset
• Apply all available security patches
• Replace passwords and other authentication secrets
• Review existing accounts
• Reconfigure the equipment

The attackers have not been publicly identified, and French media have reported no claim of responsibility.

At around the same time, Ahold Delhaize, the retailer behind Albert Heijn and Delhaize, announced a security issue within its network. The company said it had taken some systems offline to protect them while assessing and mitigating the problem, and that stores remained open. Online grocery orders and deliveries were also disrupted

But a similar timeline is not evidence of a shared attack: no connection between Ahold Delhaize’s network incident and the French refrigeration attack has been established.

What consumers can do

• Check before you travel. Look for updates from your local supermarket about opening hours and the availability of refrigerated and frozen goods.
• Follow product-specific advice from the retailer. If it issues a warning or recall, follow its advice about returning or discarding affected food.
• Be cautious with unexpected refund or “order recovery” messages. As a general precaution, check directly through the retailer’s official website or app before providing payment or login details.

For now, the confirmed damage centers on refrigeration, spoiled stock, and disrupted store operations. But the attack demonstrates how tampering with connected equipment can turn a cybersecurity incident into spoiled food, empty shelves, and physical damage—problems that restoring a backup alone can’t fix.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Scammers are finding different ways to use personal details exposed in data breaches to lure people into conversations.

Last week, we showed how a Facebook Marketplace listing used the recipient’s name to make a text asking “Is this still available?” more convincing.

The one we got this week was a lot simpler. No suspicious link. No overdue payment. No warning that your account is about to be closed. No fake images.

Just your name, followed by a question mark.

It’s a remarkably small opening for what could become a much bigger problem. A message like this invites an almost automatic response: “Yes?” Or perhaps, “Who’s this?”

That’s because a scammer needs to get you to engage before they can persuade you to hand over money or personal information. Sometimes, the first thing they ask you to give them is simply a reply. The Federal Trade Commission (FTC) has warned about similarly brief, apparently harmless messages that scammers use to start conversations.

The text in our example gives the recipient very little information, but leaves an obvious question unanswered: Who wants to know? Using the correct name makes that question more compelling. This is not just a generic “Hello” that could have gone to anyone. It looks as though the sender is trying to reach you specifically.

It’s tempting to think, “They have my name and number, so this must be someone I know.” But having those details is not evidence they know you. As we discussed in the Marketplace article, name-and-phone-number combinations can come from breached data traded by cybercriminals.

What follows depends on the scheme. The first message doesn’t tell us which route this scammer planned to take. But documented scams show how an innocuous introduction can develop:

• A supposed wrong-number exchange becomes a friendly conversation.
• The sender builds a relationship rather than immediately asking for money.
• An investment opportunity eventually enters the discussion.
• The victim is encouraged to send money to a fraudulent investment scheme.

The FBI describes how cryptocurrency investment scammers build trust before introducing fake investments, and identifies unsolicited texts as one way they approach victims.

Even if the conversation goes no further, your reply can still be useful to the scammer. As we explained in our earlier article on wrong-number texts, it shows that you are willing to engage. Your number can then be reused or sold for other scam campaigns.

How to stay safe

A scam doesn’t have to begin with an outrageous promise or an urgent threat. Sometimes it begins with something much more ordinary: your name, a question mark, and the expectation that you will be polite enough to answer.

Don’t reply. Even “Who’s this?” or “Wrong number” tells the scammer you are willing to respond. If you think it might be someone you know, contact them through a number or channel you already trust.

Report before you block. Use your messaging app’s reporting option, then block the sender. If you have already replied, stop engaging.

Make yourself harder to profile. Review privacy settings on messaging apps and social media. Limit who can see your profile photo, status, last seen, and phone number.

Run a Malwarebytes Digital Footprint Scan to check for personal information exposed in known breaches and on the dark web. It helps to be aware of what can be used to target you.

Use Malwarebytes Scam Number Check to see whether the sender’s number has been flagged for scams or spam.

What do cybercriminals know about you?

Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online.

SCAN NOW

An attacker reportedly used a leaked password to abuse a company’s legitimate access to Denmark’s population register (CPR). The weak password is remarkable, but the failure to spot millions of unusual searches made the breach worse.

The CPR administration states it identified a serious security incident. By abusing a Danish company’s authorized access to the CPR system, unauthorized people gained access to the names, addresses, CPR numbers, and other information belonging to around 8.8 million people registered in the system. CPR numbers are Denmark’s personal identification numbers.

How could a password so weak that it should have been rejected by the system open the door to so much personal information?

The attacker reportedly gained access through Pays ApS, an IT company based in Odense. According to TV 2, Pays has confirmed that its authorized access to search the CPR system was abused. Pays offers services including data updates and “CPR cleansing,” allowing customers to check records against the register to update addresses, identify people who have died, and obtain information about changes of address.

The attacker reportedly used a leaked password associated with a former Pays employee. TV 2 says an email containing the password 123456 had appeared in a larger data leak, and that this account of the initial access matches its own research.

The attackers had access for 21 days before it was shut down on October 2, although the suspicious activity appears to have stopped on September 20. An unusually large bill for around 14 million searches drew attention to the breach.

Politiken reports that the data stolen in those searches belonged to approximately 5.5 million living and 3.3 million deceased people.

A weak, leaked password opened an authorized route into a sensitive register. That access allowed millions of searches, and the activity was discovered only after an unusually large bill drew attention to it.

How to stay safe

If your organization handles sensitive data:

• Don’t reuse passwords or use personal passwords for work accounts. Use a password manager to create and remember strong, unique passwords for you.
• For systems that give access to sensitive data, enforce authentication that would reject weak passwords and make multi-factor authentication mandatory.
• Monitor for unusual activity. That many searches from one account should have been noticed earlier.

If your data may have been exposed in this breach:

• Keep an eye on official updates about the incident.
• Be alert to phishing and other scams. Scammers could use personal details to make their messages more convincing.
• Read our blog Involved in a data breach? Here’s what you need to know.

Pro tip: Use Malwarebytes Scam Guard if you’re unsure if a message is legitimate. It can help you determine whether it’s a scam and what to do next.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

You ignored the suspicious email. You didn’t open the attachment, click the link, or reply to the sender.

Then you asked your AI assistant to summarize your inbox.

Could the message you wisely avoided find its way back onto your to-do list—only this time presented as an urgent recommendation from a tool you trust?

That’s the risk behind phishing emails containing hidden instructions aimed at AI assistants. Instead of relying only on persuading you, attackers are also trying to influence the software that reads your messages. Recent research from Barracuda describes emails designed to target both audiences at once.

For the human recipient, there was a password-protected attachment, with the password supplied in the email. For an AI assistant processing the message, there were hidden instructions intended to influence how it summarized or handled the content.

By including a prompt injection, attackers give themselves another way to reach you. The malicious instructions could try to make the assistant describe the email as legitimate or urgent, encouraging you to revisit it.

In another example, a hidden block instructed a summarizing AI to add a fake priority action: Change a vendor’s payment details. That could result in an employee sending money to an attacker’s account.

The attacker isn’t simply asking the AI to repeat a fraudulent request. They’re trying to turn that request into the assistant’s recommendation.

How prompt injection works

Prompt injection means planting instructions in material an AI system is supposed to read, hoping it will follow those instructions instead of treating them as part of the material. When the instructions arrive through an outside source, such as an email or webpage, it’s often called indirect prompt injection.

The malicious instructions don’t have to appear as ordinary, readable paragraphs. Barracuda identified concealment techniques including comments in the email’s underlying HTML code, text made invisible through styling, encoded content, and invisible “zero-width” characters. These can obscure instructions from a person viewing the message while leaving content available for an AI system to process. Whether that content actually reaches the model depends on how the particular tool extracts and prepares the email.

That means this problem cannot be solved simply by asking people to look more carefully at their emails. Part of the defense must sit inside the tools handling those messages.

Apollo Raines, developer of the AI code review service ShipItClean, explains:

“The real flaw is that the model can’t tell the difference between text it’s supposed to read and instructions it’s supposed to follow. Stripping hidden content before it reaches the model is worth doing, and every vendor should do it. But it’s an arms race. Each new encoding trick is a new hole.”

He adds:

“People have learned to distrust the email. They haven’t learned to distrust their AI assistant. So, the defense has to live inside the tools. I’d go one step further: some of it has to live inside the model itself. Wrappers, filters, sandboxing and human sign-off on payments are all necessary.”

Before taking action

An assistant that summarizes messages could mislead you about which email deserves attention or what action it requires.

An assistant with additional permissions could create a more serious problem. Depending on its capabilities and safeguards, malicious instructions might try to make it carry out unauthorized actions or disclose sensitive information.

You don’t need to abandon AI tools that help with email. But you do need to consider what you trust them to do and what permissions you give them.

The familiar phishing advice still applies. When an assistant reads your inbox on your behalf, check its recommendations before acting:

• Check the original message before acting on a recommendation involving money or sensitive information. If a summary tells you to pay an invoice, change account details, or share sensitive information, don’t treat the summary itself as verification.
• Always verify payment changes through a separate, established channel. Contact the person or organization using details you already trust, rather than relying on information supplied in the suspicious message.
• Keep your AI assistant’s permissions limited to what you need and, at work, what your organization allows. An assistant used to summarize emails should not need broad authority to carry out unrelated actions. Limiting access can reduce the consequences if it follows malicious instructions.
• Require human approval for high-impact actions like payments and changes to vendor payment details. Approval should include checking the underlying request, not simply accepting the assistant’s recommendation.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Last week on Malwarebytes Labs:

• ASOS breach update: Hackers stole customer details and shopping searches
• Attackers hijack country-code domains to impersonate Google and other services
• Amazon has an uncomfortably personal profile on you
• Meta’s Muse AI files away your friendships, arguments, and secrets
• Google issues Android security updates: who can get them and how
• AI-powered phishkit arms criminals with account-hijacking tools in 10 minutes
• Update Chrome and ChromeOS to fix critical security issues
• Another ShinyHunters suspect arrested
• ASOS “hackers” send push notifications to customers
• Facebook Marketplace scam uses your name and number
• Domino’s customers targeted in credential stuffing attacks
• Google pauses open source bug bounty program after rise in AI submissions
• Proposed anti-Flock bills could spell trouble for license plate readers

Stay safe!

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

The customer data stolen from global fashion retailer ASOS includes more than just names and contact details, raising questions about its early reassurances.

As we reported earlier this week, ASOS customers received a push notification through the ASOS app alleging that the company had been hacked.

ASOS has confirmed that attackers accessed customer information after tricking an employee into handing over login credentials. While the retailer says payment card information and customer passwords were not accessed, reporting by the BBC shows the stolen information includes more than the “basic personal information” initially mentioned by the company.

The stolen login details were used to access information on third-party platforms used by ASOS. The company says it locked down the affected platforms and launched an investigation with internal and external specialists. It also says it has strengthened its security controls.

What data was stolen?

In our initial coverage, we highlighted the potentially detailed customer profiles associated with ASOS’s marketing setup. The BBC’s findings now establish that at least some shopping-related information was taken.

According to the BBC, which received a sample from the attackers, the exposed data includes:

• Names and home addresses
• Phone numbers and email addresses
• Customer numbers and dates of birth
• Searches customers made on the ASOS website
• Details such as when a customer started using ASOS

The BBC reported search terms including “reclaimed vintage,” “glamorous wide fit,” and “Asos petite.” That makes this more than a stolen contact list. The information can also reveal customers’ shopping interests and their relationship with the retailer.

The attackers’ original notification named Snowflake, a data storage and analysis platform. They subsequently told the BBC that they accessed the information through Simon AI, a platform built on Snowflake that ASOS uses for customer personalization.

Snowflake said it had found no compromise of its platform. Using stolen credentials to access a customer’s account or a connected service does not necessarily mean the underlying platform was breached. The available reporting does not establish a vulnerability in Snowflake or Simon AI.

ASOS’s communication with customers

Customers first heard about the breach from the cybercriminals, rather than the retailer. The attackers’ decision to send a notification through the ASOS app may have made that unavoidable.

But the Independent reported that ASOS’s full statement followed roughly five hours of silence, leaving customers alarmed by the notification and waiting for an explanation.

Security expert Kevin Beaumont criticized the response:

“ASOS are experiencing the exact same PR gaffs as Co-op and M&S by not being honest with customers. If you’re dealing with Advanced Persistent Teenagers you need much better crisis plans.”

While the attackers are threatening to release the data, ASOS says its full investigation will continue over the coming weeks. It will contact customers directly where it believes further information, support, or action is required.

Reportedly, the group gave ASOS two weeks to make contact and said it wanted a ransom in exchange for deleting customer information. ASOS did not disclose whether it would pay.

How to stay safe

ASOS says its website and app remain safe to use, and that payment card information and customer passwords were not accessed. But the stolen details and shopping searches could help scammers make targeted phishing messages more convincing.

A message that knows your name, or what you searched for, isn’t proof it came from ASOS.

• Be wary of unexpected emails, texts, or calls about the breach, refunds, deliveries, or problems with your ASOS account.
• Don’t follow links in unexpected messages, and don’t follow the Telegram link in the attackers’ message or engage with them. Go directly to the ASOS website or app to check your account.
• Don’t share passwords, security codes, or payment details in response to an unsolicited message or call. ASOS says it will never ask you to do this.
• If your data was stolen in this breach, read the tips in our blog Involved in a data breach? Here’s what you need to know.

Your name, address, and phone number may already be for sale.  

Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way. 

SCAN NOW

According to Google, attackers compromised infrastructure behind three country-code domain namespaces—.gh (Ghana), .sl (Sierra Leone), and .as (American Samoa)—and used it to obtain unauthorized HTTPS certificates for Google domains and other organizations. These domain endings aren’t limited to sites serving those countries, so the risk can extend to users elsewhere.

This wasn’t a break in encryption, and Google’s systems weren’t compromised. Instead, attackers manipulated the internet’s addressing infrastructure so they could pass the checks required to obtain certificates for domains they didn’t legitimately control.

The Domain Name System (DNS) helps direct internet traffic to the right destination. Control over DNS can also provide a way to demonstrate apparent control of a domain when requesting an HTTPS certificate.

An HTTPS certificate helps a browser authenticate the server it is connecting to. A trusted certificate authority issues the certificate after checking that the applicant controls the relevant domain.

By controlling DNS records, attackers can pass domain verification checks. The authority can then issue a genuine, signed certificate to someone who has hijacked the domain’s infrastructure.

Combined with the ability to redirect a victim’s traffic to an attacker-controlled server, that could enable cybercriminals to create a convincing impersonation of the real service.

Google initially blocked unauthorized certificates for its own properties in Chrome and worked with the issuing certificate authorities to revoke them. It later blocked suspicious certificates for other organizations in Chrome, too.

How to stay safe

Google points out that its actions do not offer complete protection:

“Due to the complexity of DNS hijacks, we cannot guarantee that our analysis identified every affected domain, nor do Chrome interventions reliably protect non-Chrome users.”

At the base level, this is an infrastructure problem that requires an infrastructure-level response. But these precautions can help:

• Keep your browser and operating system updated. Install available updates so you receive the latest security fixes.
• Don’t bypass certificate or secure-connection warnings. If your browser reports a certificate problem, stop rather than force the page to load.
• If a service you use has an address ending in .gh, .sl, or .as, check for security notices from the provider before logging in, making payments, or sharing sensitive information.
• Don’t treat HTTPS as an all-clear. An encrypted connection—even at the correct address—doesn’t guarantee you’re connected to the legitimate service if attackers have hijacked its DNS and obtained a valid certificate.
• Be cautious with unexpected or unusual requests, even if they appear to come from a service you trust. Before acting, verify the request through a separate, trusted channel, not through links or contact details provided in the request itself.

These precautions are not a complete defense. The lasting fix depends on domain operators restoring control, preventing further unauthorized certificates from being issued, and ensuring existing ones are revoked or blocked.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Amazon’s “About You” page reveals what it thinks it knows about you—and you can’t simply switch it off.

Dexerto reports that one shopper discovered her profile included the observation:

“has flat buttocks”

She suggested this might relate to a previous purchase of “butt scrunch leggings.” Whatever the connection, buying clothes doesn’t mean you expect the retailer to start describing your body.

What is Amazon’s About You?

About You is a page where customers can review and edit the personal details Amazon uses to shape their shopping recommendations. Amazon introduced it in May as a way to make personalization more visible and easier to manage.

According to Amazon, the information behind its personalized shopping experience includes:

• Your purchase history
• Your searches
• Items saved to Lists
• Product reviews you have written
• Conversations with Alexa for Shopping

The resulting profile can contain categories such as “Home and Family,” “Interests and Hobbies,” “Brands,” and “Product Preferences.” Some entries describe straightforward shopping preferences. Others go further, making assumptions about how people live.

Amazon’s information categories

Amazon presents this as helpful. If you regularly buy non-dairy milk, for example, it might recommend other non-dairy products. But a useful recommendation and an accurate description of a person are not the same thing.

After all, a purchase might be a gift. An item on a list might be something you’re researching for someone else. A product search might reflect curiosity rather than a personal need.

Amazon has offered personalized recommendations for years. About You makes some of the information behind them visible and gives you a chance to see where its assumptions miss the mark.

How to find your information

To check what Amazon thinks it knows about you, log in to your Amazon account.

• Hover over your name above Account & Lists, near the top-right corner.
• Select Account.
• Find the tile Ordering and shopping preferences, and select Your Shopping preferences.
• From there, scroll to the bottom of the page and select Manage your information.

In the Amazon app, it works like this:

• After logging in, tap You at the bottom
• Tap Account > Account Settings > Shopping preferences > About You

Managing your information

To remove an entry:

• Select a category to see what Amazon has listed about you, either because you volunteered it or Amazon assumed it based on your buying behavior.
• Select Remove. You don’t need to select a reason. Select Remove again in the confirmation prompt.

Removing one entry from Amazon’s About You

Buying something should not be treated as volunteering every personal detail a retailer can infer from it. It’s good that these assumptions are visible and that you can remove them, but customers shouldn’t have to correct a profile they never deliberately filled out.

A meaningful privacy choice would let customers decline personal inferences, not merely delete them one at a time. It would also explain what deletion does. Is the information removed from Amazon’s servers or just moved out of your sight?

Amazon says you can remove information you don’t want used for personalization. Its announcement does not explain whether that also deletes the underlying data, or whether similar assumptions could be made again as you continue shopping. Nor does it describe a master opt-out from About You.

For now, checking your profile lets you see (and challenge) some of the conclusions Amazon has drawn about you.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

If you thought that having companies trawling your social media, browsing history, and TV habits for behavioral clues was bad, sit tight. Meta is just getting started. Its Muse personal AI agent is taking surveillance to the next level.

TIME magazine analyzed the software’s internal instructions and found that it maintains constantly updated dossiers on users and the people they know.

Meta released Muse last month, positioning it as a digital assistant that can handle different parts of your life. It can organize your emails, handle your grocery shopping, and cancel your subscriptions. It is available for free, with paid plans for people who want to do more.

Muse has already been downloaded more than five million times. Its ability to handle mundane online tasks could be bad news for businesses that rely on consumers not canceling their subscriptions. Some people think it will liberate thousands of consumers from low-interest bank accounts.

But Muse won’t just help you stick it to the man; it also is the man.

Have I got some bad Muse for you

You have to let Muse access all your systems before it can help organize them for you. Depending on what you connect and the permissions you grant, that can give it access to your calendar, emails, messages, and other personal information.

In doing so, it accesses data. Lots of it. An analysis by Surfshark late last month put it second only to Meta’s AI chatbot among the apps reviewed, with its App Store disclosures listing collection of 31 of 35 data types.

Those disclosures include Apple’s “Sensitive Info” category, which covers information such as racial or ethnic data, sexual orientation, pregnancy, disability, religious or philosophical beliefs, trade union membership, political opinion, genetic information, and biometric data. That doesn’t mean Muse collects every one of those details about every user, but it does show how broad its declared collection can be.

According to TIME’s analysis, Muse’s instructions call for it to refresh personal dossiers every hour. These can record how users met their contacts, along with arguments or tensions within social groups.

Somehow even creepier than that is its nightly review of your recent conversations, which it uses to guide future conversations. For example, it learns when a quick nudge for your attention will be most successful.

Meta uses Muse interactions to train its AI models by default, unless you opt out in the app’s settings.

Oh, and Muse stores these files in Meta’s cloud, where Meta can access them. The company says it will offer encryption that keeps them private even from Meta, but that option isn’t available yet, according to TIME.

Meta says Muse’s conversations and stored data are not shared with its advertising systems. It also says users choose how much access Muse gets and can tell it to forget specific things it has learned.

The magazine points out that simply not using Muse might not save you, because Muse can collect data on people that its users interact with. If you send a Muse user a message and the AI has access to that messaging system, your message can become part of what it reads.

Privacy nonprofit the Electronic Privacy Information Center (EPIC) points out that Meta has pulled a similar trick before, by building shadow profiles of people who aren’t signed up for its services.

When permissions become real-world harm

This would be scary enough were it not for other stories about Muse privacy invasions. Researcher Patrick Wardle found a way to compromise the software and turn it into a Mac backdoor.

Another team of reporters used it to compile personal details for members of vulnerable groups online. After first declining some of these requests, it capitulated when the prompts were reworded, they said.

Muse also invited a Marketplace buyer to someone’s home last month after accepting a lowball offer on a product that he was selling. Matt Robb, a YouTube tech reviewer, had clicked an “Allow Always” button, assuming that the AI would still ask before sharing his address with strangers. It didn’t. Instead, he said, it arranged the pickup without telling him. The buyer, who traveled half an hour to pick up the product, was not pleased.

If you use Muse, review the accounts it can access, the actions it can take without approval, and whether your interactions are being used for AI training. Give it only the access it needs for the task.

Would you use Muse? For more on Robb’s story and practical permission checks, read our guide to using AI assistants.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Google has published security fixes for Android. The October updates are available for Android operating system versions 14, 15, 16, 16-qpr2, and 17 where “qpr” stands for Quarterly Platform Release. QPRs are interim updates Google pushes out between major yearly cycles.

These Android security bulletins contain valuable information for Android users. The updates are important as they fix several vulnerabilities rated as Critical, which can be exploited without users even doing anything.

However, we don’t write about them very often. The main reason for that lack of attention is that many Android users aren’t able to get the updates immediately and lots of others will never see them.

Google’s October fixes list Android 14 and newer, but a substantial share of the Android ecosystem still runs older software. In the distribution figures reported about last year, roughly four in ten devices were running Android 12 or earlier. This was while Android 13 still received updates which ended early March 2026.

And then there is the patch gap caused by device vendors meaning that even phones that remain supported may have to wait until the vendors test and sometimes modify the patches, so they work with their devices. And other vendors are on a different stride. For example, Samsung lists devices including the Galaxy S22 series and several Galaxy A models on a quarterly rather than a monthly security-update schedule.

You can imagine that cybercriminals love to get their hands on known vulnerabilities that many users have not yet been able to patch. Looking at the number of users that are unable to patch immediately that makes for an enormous target group.

How to stay safe

Get the updates as soon as they are made available to you is the most important word of advice here.

For most Android phones this is the general idea: open Settings, find Software update or System update (sometimes under System or About phone), check for updates, and follow the instructions to download, install, and restart. The menu names vary between vendors and even models, but the process is broadly the same.

If that doesn’t work for you or you can’t find instructions for your specific device, post what you’re looking for in the comments. We have lots of helpful readers.

Other things you can do:

• Use up-to-date real-time anti-malware protection.
• Refrain from sideloading unless it’s absolutely necessary.
• Make sure Google Play Protect is enabled. If you are a Malwarebytes Mobile Security user, you can check this using Trusted Advisor.

Should you decide to get a new Android phone, read our blog Upgrading your Android device? Read this first.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

.wp-block-kadence-advancedbtn.kb-btns97520_6de029-2f{gap:var(--global-kb-gap-xs, 0.5rem );justify-content:flex-start;align-items:center;}.kt-btns97520_6de029-2f .kt-button{font-weight:normal;font-style:normal;}.kt-btns97520_6de029-2f .kt-btn-wrap-0{margin-right:5px;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button{color:#555555;border-color:#555555;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{color:#ffffff;border-color:#444444;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button::before{display:none;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{background:#444444;}ul.menu .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{width:initial;}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{color:var(--color-neutral-10);background:var(--color-brand-blue-60);border-top-left-radius:40px;border-top-right-radius:40px;border-bottom-right-radius:40px;border-bottom-left-radius:40px;box-shadow:1px 1px 2px 0px rgba(0, 0, 0, 0.2);}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:hover, .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:focus{box-shadow:0px 4px 0px 0px var(--color-brand-blue-90);}Try it now

In August, the Malwarebytes research team reported on a new malicious turnkey kit that makes it possible for almost anyone to launch a sophisticated online scam. The kit was not simply a fake website. It bundled the command center, victim tracking, and administrative tools into a ready-to-use package, reducing the technical knowledge needed to operate a scam.

The discovery highlights an important feature of the cybercrime economy: criminals don’t necessarily need to build their own infrastructure from scratch. Instead, they can buy ready-made services that handle much of the complicated work for them.

The same pattern is well established in phishing. Scam emails are no longer limited to poorly written, easily spotted phishing attempts. Cybercriminals now use complete, subscription-based platforms that make launching convincing attacks as easy as signing up for a monthly service.

One of the most dangerous examples of this trend is BlueKit, a phishing-as-a-service (PhaaS) toolkit designed to automate and scale account hijacking.

BlueKit allows attackers to manage entire phishing campaigns through a single dashboard without needing deep technical knowledge.

 BlueKit thread on underground cybercrime forum “petrushka” (Russian for parsley), the operator behind BlueKit BlueKit’s origins

The Malwarebytes research team has been tracking BlueKit’s development since the service first appeared on a prominent cybercrime forum in April.

Rather than simply documenting its initial capabilities, our researchers followed its evolution over time, watching how the service developed and what its growing capabilities could mean for cybercriminal operations.

BlueKit offered by the threat actor “petrushka” A template library targeting familiar brands 

As of September, BlueKit boasts an extensive template library supporting 97 distinct brands across 176 variants. The service’s operators describe these phishing pages as: 

“pixel-perfect and ready to deploy in one click.”

The offer of “BlueKit” (extended)

BlueKit’s website Phishing kits list on BlueKit’s website

Our analysis shows that the platform targets both consumer and business platforms. Its phishing kit templates include:

• Consumer services: Templates impersonating major providers, including Amazon, Booking.com, Google/Gmail, and Apple.
• Finance and cryptocurrency: Templates impersonating financial institutions such as American Express and Bank of America, alongside numerous cryptocurrency exchanges.
• Social media and communications: Templates impersonating major social media platforms including TikTok, Facebook, and X.
• Generative AI platforms: Templates designed to steal login details for services including OpenAI and Anthropic.

Below is a video demo of a phishing page impersonating the crypto wallet provider Trezor:

.kadence-column471581_a23f77-44 > .kt-inside-inner-col{display:flex;}.kadence-column471581_a23f77-44{max-width:801px;margin-left:auto;margin-right:auto;}.wp-block-kadence-column.kb-section-dir-horizontal:not(.kb-section-md-dir-vertical)>.kt-inside-inner-col>.kadence-column471581_a23f77-44{-webkit-flex:0 1 801px;flex:0 1 801px;max-width:unset;margin-left:unset;margin-right:unset;}.kadence-column471581_a23f77-44 > .kt-inside-inner-col,.kadence-column471581_a23f77-44 > .kt-inside-inner-col:before{border-top-left-radius:0px;border-top-right-radius:0px;border-bottom-right-radius:0px;border-bottom-left-radius:0px;}.kadence-column471581_a23f77-44 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column471581_a23f77-44 > .kt-inside-inner-col{flex-direction:column;justify-content:center;align-items:center;}.kadence-column471581_a23f77-44 > .kt-inside-inner-col > .kb-image-is-ratio-size{align-self:stretch;}.kadence-column471581_a23f77-44 > .kt-inside-inner-col > .wp-block-kadence-advancedgallery{align-self:stretch;}.kadence-column471581_a23f77-44 > .kt-inside-inner-col > .aligncenter{width:100%;}.kt-row-column-wrap > .kadence-column471581_a23f77-44{align-self:center;}.kt-inner-column-height-full:not(.kt-has-1-columns) > .wp-block-kadence-column.kadence-column471581_a23f77-44{align-self:auto;}.kt-inner-column-height-full:not(.kt-has-1-columns) > .wp-block-kadence-column.kadence-column471581_a23f77-44 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}.kadence-column471581_a23f77-44 > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column471581_a23f77-44{position:relative;}@media all and (min-width: 1025px){.wp-block-kadence-column.kb-section-dir-horizontal>.kt-inside-inner-col>.kadence-column471581_a23f77-44{-webkit-flex:0 1 801px;flex:0 1 801px;max-width:unset;margin-left:unset;margin-right:unset;}}@media all and (max-width: 1024px){.kt-row-column-wrap > .kadence-column471581_a23f77-44{align-self:center;}}@media all and (max-width: 1024px){.kt-inner-column-height-full:not(.kt-has-1-columns) > .wp-block-kadence-column.kadence-column471581_a23f77-44{align-self:auto;}}@media all and (max-width: 1024px){.kt-inner-column-height-full:not(.kt-has-1-columns) > .wp-block-kadence-column.kadence-column471581_a23f77-44 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 1024px){.kadence-column471581_a23f77-44 > .kt-inside-inner-col{flex-direction:column;justify-content:center;align-items:center;}}@media all and (max-width: 767px){.kt-row-column-wrap > .kadence-column471581_a23f77-44{align-self:center;}.kt-inner-column-height-full:not(.kt-has-1-columns) > .wp-block-kadence-column.kadence-column471581_a23f77-44{align-self:auto;}.kt-inner-column-height-full:not(.kt-has-1-columns) > .wp-block-kadence-column.kadence-column471581_a23f77-44 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}.wp-block-kadence-column.kb-section-sm-dir-vertical:not(.kb-section-sm-dir-horizontal):not(.kb-section-sm-dir-specificity)>.kt-inside-inner-col>.kadence-column471581_a23f77-44{max-width:801px;-webkit-flex:1;flex:1;margin-left:auto;margin-right:auto;}.kadence-column471581_a23f77-44 > .kt-inside-inner-col{flex-direction:column;justify-content:center;align-items:center;}}

Beyond consumer-oriented attacks, BlueKit also presents an acute threat to businesses by providing the tools necessary to target corporate logins. 

Our team found support for critical business infrastructure and single sign-on (SSO) gateways. This includes customer relationship and marketing automation platforms, such as Salesforce and HubSpot, developer and source control environments like GitHub, and security services including Check Point, Citrix, Cloudflare, and Cisco.

Business-oriented phishing templates on BlueKit’s website A toolkit that never stops updating

One of the interesting things about BlueKit is that its creators are constantly adding new features, much like a legitimate software company releasing updates for its apps.

For example, on July 26, the BlueKit team used its official Telegram channel to announce an upcoming upgrade: a built-in SMS sender. Less than a month later, on August 10, they announced its release.

The new tool allows scammers to send text messages directly from the BlueKit dashboard. Alongside phishing emails, attackers can now easily send scam texts (called “smishing”) to trick people into clicking malicious links.

The operators say the update even lets attackers use local US phone numbers, which could make the messages appear more trustworthy. It gives them an entirely new, highly effective way to deliver scams from one control panel.

SMS sender announcement in BlueKit’s Telegram channel SMS sender module on BlueKit’s website

But BlueKit’s creators aren’t just focused on adding shiny new tools like the SMS sender. They’re also constantly working behind the scenes to improve their core product. A September update, for example, improved their fake website templates to make them look even more convincing, and upgraded the hidden technology they use to steal and manage sessions.

BlueKit’s September updates Three ways BlueKit makes phishing easier for scammers

After monitoring BlueKit’s development and analyzing its capabilities, our research team identified three ways the service lowers the barrier to launching sophisticated phishing attacks: setting up a site, capturing account access, and using AI to support the attack.

1. Quick setup

BlueKit is an “easy-to-install” phishing service, highlighting just how quickly sophisticated phishing infrastructure can be deployed. 

According to its operators, an attacker can connect a domain and have a phishing site ready in around 10 minutes. The cheapest subscription costs $250 for seven days, and an attacker could potentially go from purchasing the service to launching a sophisticated phishing campaign in a matter of minutes.

Description of BlueKit’s easy setup procedure 2. More than password theft

When most people think of phishing, they picture a scammer tricking them into handing over a username and password. But BlueKit goes much deeper than a basic smash-and-grab.

Behind the scenes, this tool secretly collects a complete digital profile of your computer , including a device fingerprint, cookie sessions, and even passkeys. 

Device fingerprint: BlueKit records your IP address, web browser details, and device characteristics. Together, details such as screen size, operating system, and hidden hardware settings can form a “fingerprint” that helps distinguish one browser or device from another.

Many modern security systems look for familiar devices to double-check that it’s really you trying to log in. So by stealing this background information alongside your password, an attacker can mimic your device to bypass security checks.

Session cookies: When you log into a website like your email or online bank, the site doesn’t make you retype your password every time you open a new page. Instead, it places a tiny file on your device called a session cookie to recognize that you’ve already signed in.

Think of a session cookie like a VIP wristband given to you at a concert entrance. Once the guard checks your ticket—your login—they give you a wristband. While you’re wearing that wristband, you can walk freely in and out of the venue without showing your ticket again.

Instead of just stealing your ticket, BlueKit also steals the wristband itself. Once the attacker takes your session cookie, they can paste it into their own browser and walk straight into your active account. They don’t need to guess your password, and they don’t need to ask for a two-factor code. The website already thinks they are you.

Description of BlueKit’s data-capturing capabilities Live demos using real credentials, shared by the BlueKit team 3. A built-in AI assistant

What makes BlueKit especially interesting right now is that it comes with its own built-in, “no-rules” artificial intelligence.

Think of it like a malicious version of ChatGPT, built directly into the scammer’s toolkit. Usually, AI tools have safety filters to prevent people from doing illegal things. BlueKit’s creators, however, have removed those guardrails, advertising that their custom AI will answer “even extreme prompts” and help with “fraud-related questions.”

Instead of writing convincing scam emails from scratch, an attacker can simply ask the AI to write phishing emails and fake text messages.

This is a huge development. BlueKit illustrates how advanced AI features are not just for legitimate businesses. They are being packaged and sold as standard features in cybercriminal services, making it easier for attackers to launch highly convincing attacks.

BlueKit’s advertised AI capabilities AI features advertised on BlueKit’s website The business behind BlueKit

BlueKit’s claimed customer numbers also point to a potentially significant revenue stream. On August 29, the operators announced that the service had passed 1,000 customers.

Based on the advertised subscription prices, we can illustrate the potential revenue generated so far, although the actual distribution of subscriptions is unknown.

BlueKit’s announcement claiming more than 1,000 customers

• If all 1,000 customers purchased one 7-day subscription at $250: $250,000 in gross revenue.
• If all 1,000 customers purchased one 30-day subscription at $940: $940,000 in gross revenue.
• If purchases were split roughly equally between the 7-day ($250), 14-day ($480), and 30-day ($940) plans: Approximately $557,000 in gross revenue.

These are hypothetical calculations, but even so, the figures are a striking example of the economics behind phishing-as-a-service: operators can potentially generate hundreds of thousands of dollars in revenue by selling access to their infrastructure to other criminals. 

BlueKit’s advertised subscription prices What this means for you

Phishing has officially evolved beyond obvious scam pages filled with typos and blurry logos. BlueKit combines convincing login pages, a built-in AI assistant, and subscription access to tools that once required more technical skills. 

Services like these make sophisticated phishing easier to launch, allowing scammers to generate a highly convincing, customized phishing attack from scratch in as little as 10 minutes.

Ultimately, services like BlueKit mean that advanced, highly deceptive cyberattacks are no longer limited to elite hackers. They are now fast, cheap, and accessible to anyone with a few dollars to spare.

Polished wording and familiar branding are not proof that a message or login page is genuine. 

• Open the app or website yourself. If a message asks you to sign in, use the official app or a saved bookmark rather than the link in the email or message.
• Check the website address before signing in. Scammers can use lookalike addresses with small spelling changes, known as typosquatting. A password manager can help as it will only autofill logins on the correct site, while Malwarebytes Browser Guard can help block phishing pages. 
• Use passkeys where available, and keep two-factor authentication enabled. These are still valuable protections, although some phishing techniques can capture sessions after a user completes a login. 
• If you signed in through a suspicious link, secure your account through the official app or website. Change your password, review your account activity, and sign out of all sessions.

Pro tip: Malwarebytes Scam Guard can also help you assess a suspicious message before you act on it.

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →