Malwarebytes Labs

Insurance provider AssuranceAmerica confirmed a data breach affecting up to 6.9 million people, with hackers stealing driver’s license numbers, customer names, contact information, and auto insurance policy details. The breach originated from a phishing attack targeting a single employee, though no specific threat group or ransom demand has been publicly linked to the incident.

Microsoft has patched the RoguePlanet zero-day vulnerability (CVE-2026-50656) in Microsoft Defender, an elevation of privilege flaw that could allow attackers to gain system-level access. The fix is included in the updated Malware Protection Engine version 1.1.26060.3008, which automatically updates for most users. Systems with other antivirus software like Malwarebytes are not affected if Defender is disabled.

Meta's AI image generation tool, Muse Image, allows users to create images based on public Instagram profiles by tagging handles in prompts. Users are not notified when their likeness is used, and opting out only prevents future generations, not retroactive removal of existing images. The feature raises privacy and security risks, including potential misuse for impersonation, scams, and deepfake fraud.

New EU regulations require driver-monitoring technology in cars to reduce traffic incidents, including systems like Driver Drowsiness and Attention Warning (DDAW) and Advanced Driver Distraction Warning (ADDW). Similar U.S. requirements are under development, but privacy experts and advocates warn of risks like biometric surveillance, data sharing, and potential false positives from the technology.

Scammers on Reddit and Discord use social engineering to trick users into sharing login or verification codes by falsely claiming they were involved in a report. The scam involves fake emails, urgent countdowns, and threats of account suspension to pressure victims into complying.

Meta introduced optional WhatsApp usernames as a privacy feature, but reusing Instagram or Facebook handles risks linking accounts across Meta's ecosystem, increasing data correlation and social-engineering risks. The Dutch consumer organization Consumentenbond advises choosing a unique WhatsApp-only username to avoid these privacy issues.

Google, the FBI, and partners disrupted the NetNut botnet, which used hijacked consumer devices as residential proxies. The operation reduced the botnet's device pool by millions through account disabling, infrastructure sharing, and app warnings. NetNut tricked users into installing malicious apps under the guise of 'bandwidth sharing' payouts.

The article highlights multiple security threats, including malware spread through verified ads on Mac systems, the ConsentFix malware stealing Microsoft accounts, and vulnerabilities in Apple's Hide My Email feature. It also covers fake Google and Cloudflare verification pages distributing malware, a critical WinRAR flaw, a deceptive Perplexity Chrome extension, and security updates from Apple for iOS, MacOS, and Safari.

A researcher discovered a vulnerability in Apple’s Hide My Email feature that could expose users’ real email addresses, undermining the feature’s privacy purpose. Apple has not fixed the issue over a year after being notified and plans to reduce the feature’s utility by moving addresses to a new domain.

A fake Chrome extension named 'Search for perplexity ai' impersonated Perplexity AI, secretly harvesting user search data through a typosquatted domain and unnecessary permissions. Microsoft's Defender team exposed the extension, which was removed from the Chrome Web Store, but remains active for prior users until manually uninstalled.

BioShocking is an attack technique that manipulates AI-powered browsers into bypassing safety guardrails by immersing them in fictional scenarios, leading to the extraction of sensitive data like credentials. The method exploits how AI agents in 'agent mode' inherit user-authenticated contexts, making them vulnerable to goal-manipulation attacks that trick them into performing harmful actions.

Google released a Chrome update addressing 382 security vulnerabilities, including 15 critical flaws that could enable sandbox escapes. The update, version 150.0.7871.47, includes fixes for a high-severity vulnerability (CVE-2026-13789) allowing remote attackers to perform sandbox escapes via a crafted HTML page.

A British AI security firm, Mindgard, discovered a method to manipulate ChatGPT into generating graphic violent and sexual imagery by altering prompts. The technique bypassed ChatGPT's safety filters, producing disturbing content like images of dead women, despite OpenAI's stated safeguards. Other AI models, such as xAI’s Grok, also face similar vulnerabilities, with reports of explicit imagery generation.

Job scammers are using SMS and messaging platforms to impersonate Amazon recruiters, offering fake high-paying remote roles with promises of $250–$500 daily for minimal work. The scams, often attributed to a 'Sophia' from Amazon’s recruiting department, direct victims to non-Amazon contact details and exploit 'task scam' tactics to extract money or personal data.

Apple has released security updates addressing over two dozen vulnerabilities across iOS, iPadOS, macOS Tahoe, and Safari. The updates focus on WebKit-related flaws that could be exploited to steal data or execute malicious code with minimal user interaction.

The article discusses algorithmic wage discrimination, where companies like Uber and Amazon use data-driven models to set fluctuating pay rates for contract workers. This system creates unpredictable income for gig workers, who may earn less despite performing similar tasks as before, with pay influenced by opaque factors like location, traffic, and driver availability.

Microsoft removed 119 Edge extensions linked to a malware campaign called StegoAd, which infected 2.6 million users by initially providing useful tools before secretly downloading malware. The malware stole credentials and used steganography to hide code in images, with some extensions reusing names of legitimate tools to gain trust.

The article highlights multiple cybersecurity threats, including malware stealing Chrome session cookies, parcel mule scams, and critical browser vulnerabilities. It also covers data breaches, phishing scams targeting website owners, and dark web activities involving stolen identities and malware.

A phishing email with a malicious JavaScript file disguised as a PDF installs a Chrome extension that steals session cookies and uses Chrome Native Messaging to execute PowerShell commands. The malware bypasses multi-factor authentication by hijacking active browser sessions and collects data like open tabs and system files.

The article warns about 'Parcel Expert' job offers, which are part of parcel mule scams where scammers recruit individuals to handle stolen goods. These scams promise high-paying remote work for unskilled tasks like inspecting and forwarding packages, often using well-known retailers as trust signals. Victims unknowingly assist in laundering stolen merchandise by shipping items from their homes to distribution hubs or international destinations.