Kali365 phishing kit bypasses MFA and steals Microsoft logins
When the Federal Bureau of Investigation (FBI) publishes a dedicated public service announcement about a new phishing kit, it’s worth paying attention to. The agency…
Category: MalwareBytes
Company bragged phone mics could listen to conversations. They couldn’t.
A media company and two of its marketing partners have been fined for selling a service which, they said, listened in to people’s conversations through…
700+ education and tech websites hijacked in huge ClickFix malware campaign
Attackers are abusing a critical Ghost Content Management System (CMS) vulnerability to hijack more than 700 legitimate websites and inject a fake Cloudflare verification step…
Fake software on GitHub and SourceForge distribute Deno RAT
During our threat hunting activities, we found fake installers and plugins impersonating popular software including ChatGPT, Claude, AutoTune, and Kontakt on GitHub and SourceForge distributing…
Scammers pretending to be Microsoft had help from US executives
A pop-up appears on your computer, warning of a virus. You call the “Microsoft technician” in the pop-up message, and they explain that they need…
A week in security (May 18 – May 24)
Last week on Malwarebytes Labs: Stay safe! Browse like no one’s watching. Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next…
Update Chrome now: Critical bugs could let attackers run code
Google has issued updates for the Chrome browser patching a number of high‑severity vulnerabilities. The update includes fixes for two critical vulnerabilities that can be…
Researchers left AI agents alone in a virtual town and watched it all unravel
Tech leaders have spent the past year telling everyone that AI agents are about to run financial systems, file your tax returns, and quietly buy…
Microsoft Defender vulnerabilities are being exploited in the wild
Two Microsoft Defender vulnerabilities are being actively exploited in the wild. On May 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added a notable…
Catch spyware in the act with Windows Webcam Monitoring
You’re working hard late at night, replying to emails and planning the week ahead. Then suddenly, a PDF file requests access to your camera. Why would a PDF…
TikTok, YouTube, and Roblox face scrutiny, but age gates won’t fix child safety
A damaging new report from Ofcom, the UK’s communications regulator, has delivered a stark verdict: TikTok and YouTube’s content feeds are “not safe enough” for children.…
Fake malware-signing service Fox Tempest dismantled by Microsoft
Microsoft says it dismantled a malware-signing-as-a-service (MSaaS) called Fox Tempest, which helped cybercriminals make malware appear legitimate. The service let customers submit malicious files to…