A week in security (July 20 – July 26)
Last week on Malwarebytes Labs: Stay safe! Scammers know more about you than you think. Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and…
Category: MalwareBytes
Beyond the Play Store: How Android threats really spread
You probably think of your phone’s security the way you think of your front door: as long as you’re downloading apps from the Play Store,…
Google wants to store a selfie video of your face
Google has started rolling out a new way to recover access to your account if you’ve lost your phone or forgotten your password: a “selfie…
OpenAI’s agent escaped its sandbox during a security test
During an internal OpenAI security evaluation, a chain of AI models escaped its sandbox, reached the internet, and then accessed Hugging Face infrastructure to complete…
Call of Duty Mobile scam uses fake free points to steal player accounts
Call of Duty Mobile players should watch out for a phishing campaign disguised as a free Call of Duty Points giveaway. Victims are asked to…
Don’t get fooled by TikTok resin art scams
Resin art has become a popular corner of TikTok, with some videos attracting millions of views. But not every glossy, colorful post is what it…
WhatsApp Web chats exposed by Adobe’s Acrobat extension flaw
HermeticReader is the name given to a recently disclosed vulnerability in the Adobe Acrobat PDF extension for Chrome, tracked as CVE-2026-48294. Researchers discovered the issue…
Millions of cars could be tracked and unlocked by a hidden security flaw
A car alarm vendor’s coding mistake has left millions of vehicles vulnerable to theft and location tracking. Thanks to the way dealers sell car alarms,…
Paidwork breach exposes data of 23 million users: Check if you’re affected
A data breach at Paidwork, a platform that pays people small amounts to complete online microtasks, has exposed personal and financial information of more than…
Chick-fil-A loyalty accounts hijacked using stolen passwords
Fast-food chain Chick-fil-A is warning customers after attackers hijacked loyalty accounts using stolen passwords in a credential stuffing attack. Chick-fil-A says it detected suspicious login…
Don’t trust that “FBI agent” in your DMs
The Federal Bureau of Investigation’s (FBI) Internet Crime Complaint Center (IC3) is warning that scammers are impersonating the bureau on social media and on messaging…
What happens if you visit a WordPress site hacked through wp2shell?
WordPress has patched a serious core vulnerability chain known as wp2shell, and site owners are understandably focused on updating their own sites. But there’s another…