Purchase order attachment isn’t a PDF. It’s phishing for your password
An attachment named New PO 500PCS.pdf.hTM, posing as a purchase order in PDF form, turned out to be something entirely different: a credential-harvesting web page that…
Category: MalwareBytes
A fake FileZilla site hosts a malicious download
A trojanized copy of the open-source FTP client FileZilla 3.69.5 is circulating online. The archive contains the legitimate FileZilla application, but with a single malicious…
Samsung TVs stop spying on viewers in Texas. Here’s how to disable ACR anywhere
Samsung has settled a lawsuit with the Texas Attorney General over how its smart TVs collect and monetize viewing data using Automated Content Recognition (ACR).…
Chrome flaw let extensions hijack Gemini’s camera, mic, and file access
Chrome’s Gemini “Live in Chrome” panel (Gemini’s embedded, agent-style assistant mode within Chrome) had a high‑severity vulnerability tracked as CVE‑2026‑0628. The flaw let a low‑privilege…
Pentagon ditches Anthropic AI over “security risk” and OpenAI takes over
On Friday the US Pentagon cut ties with Anthropic, the company behind Claude AI. Defense Secretary Pete Hegseth designated the San Francisco-based company a “supply-chain…
High-severity Qualcomm bug hits Android devices in targeted attacks
Google has patched 129 vulnerabilities in Android in its March 2026 Android Security Bulletin, including a Qualcomm display flaw that is known to be actively exploited.…
Attackers abuse OAuth’s built-in redirects to launch phishing and malware attacks
Attackers are abusing normal OAuth error redirects to send users from a legitimate Microsoft or Google login URL to phishing or malware pages, without ever…
Does the UK really want to ban VPNs? And can it be done?
The idea of a “Great British Firewall” makes for a catchy headline, but it would be riddled with holes and cause huge problems. The Guardian…
Beware of fake OpenClaw installers, even if Bing points you to GitHub
Attackers are abusing OpenClaw’s popularity by seeding fake “installers” on GitHub, boosted by Bing AI search results, to deliver infostealers and proxy malware instead of…
One click on this fake Google Meet update can give attackers control of your PC
A phishing page disguised as a Google Meet update notice is silently handing victims’ Windows computers to an attacker-controlled management server. No password is stolen,…
Supreme Court to decide whether geofence warrants are constitutional
Google has weighed in on a court case that will decide the future of a powerful but contentious tool for law enforcement. The company submitted…
Windows File Shredder: When deleting a file isn’t enough
Most of us think deleting a file means it’s gone for good. But “delete” on a Windows device often just means “out of sight,” not…