Malwarebytes

Fake Claude search results lure Mac users into ClickFix attack

Tue, 12 May 2026 15:46:55 GMT

Researchers found a ClickFix campaign that uses fake Claude setup guides to trick Mac users into infecting themselves.

1 in 8 employees have sold company logins or know someone who has

Tue, 12 May 2026 09:21:39 GMT

Cifas just published research that should bother anyone who runs a business, or buys from one.

Stolen Canvas data was “returned” after hacker agreement, Instructure says

Tue, 12 May 2026 08:41:07 GMT

Instructure says the stolen Canvas data impacting millions of students and staff was “returned.” That’s not how breaches work.

Yarbo responds to robot flaws that could mow down their owners

Mon, 11 May 2026 13:21:57 GMT

A researcher found a host of vulnerabilities in Yarbo garden robots that could expose Wi-Fi passwords, hijack cameras, and run over their owners on command.

A week in security (May 4 – May 10)

Mon, 11 May 2026 07:04:00 GMT

A list of topics we covered in the week of May 4 to May 10 of 2026

Microsoft says Edge’s plaintext password behavior is “by design”

Fri, 08 May 2026 12:48:53 GMT

A researcher found Edge loads saved passwords into computer memory when it starts, making them easier to steal if a device is already compromised.

ShinyHunters escalates Canvas attacks with school login defacements

Fri, 08 May 2026 12:00:01 GMT

Days after the first attack, ShinyHunters is applying pressure with ransom messages on school login portals.

Massive AI investment scam network spans 15,500 domains

Thu, 07 May 2026 14:37:50 GMT

AI investment scammers abused the Keitaro ad-tracking platform to cloak their campaign, exposing it only to likely targets.

If a fake moustache can fool age checks, is the Online Safety Act working?

Thu, 07 May 2026 10:21:22 GMT

A UK report finds some progress since the Act came into force, but widespread workarounds, ongoing harm, and unresolved privacy concerns suggest the impact is still limited.

Google Chrome’s silent 4GB AI download problem [updated]

Wed, 06 May 2026 16:17:03 GMT

Google Chrome writes a 4GB AI model to users’ devices without asking, and reinstalls it if you delete it.

Attackers adopt JavaScript runtime Bun to spread NWHStealer

Wed, 06 May 2026 12:50:55 GMT

A legitimate developer tool is being repurposed by attackers to package and spread this Windows infostealer in harder-to-detect ways.

Millions of students’ personal data stolen in major education breach

Wed, 06 May 2026 12:45:54 GMT

ShinyHunters claims it stole personal data from 275 million users on Instructure’s Canvas platform across schools and education providers.

Update WhatsApp now: Two new flaws could expose you to malicious files

Tue, 05 May 2026 11:39:11 GMT

WhatsApp patches flaws that could expose users to malicious content and disguised malware.

Cyberattacks are raising your prices (Lock and Code S07E09)

Mon, 04 May 2026 14:59:06 GMT

This week on the Lock and Code podcast, we speak with Eva Velasquez about small business cyberattacks and the "cyber tax" coming for us all.

Thousands of Facebook accounts stolen by phishing emails sent through Google

Mon, 04 May 2026 11:41:04 GMT

In an ongoing operation, hackers are hijacking Facebook accounts using Google AppSheet to send phishing emails that pass security checks.

The 2026 World Cup scam economy is already running before the first whistle

Mon, 04 May 2026 11:10:38 GMT

A four-part scam economy is already forming around the 2026 World Cup, using the tournament’s brand to sell everything from fake visas to worthless tokens.

A week in security (April 27 – May 3)

Mon, 04 May 2026 07:01:00 GMT

A list of topics we covered in the week of April 27 to May 3 of 2026

3 easy-to-miss cybersecurity risks for small businesses

Sun, 03 May 2026 10:33:26 GMT

Small business owners should be sure to fix these three non-technical risks that require little cybersecurity expertise.

Actively exploited cPanel bug exposes millions of websites to takeover

Fri, 01 May 2026 10:48:19 GMT

A vulnerability in the cPanel/WHM admin interface lets attackers access websites without a username and password.

More PayPal emails hijacked to deliver tech support scams

Thu, 30 Apr 2026 19:29:36 GMT

We investigate how scammers are abusing PayPal’s systems to push victims into calling fake support numbers.

ESET - WeLiveSecurity

Eyes wide open: How to mitigate the security and privacy risks of smart glasses

Mon, 11 May 2026 08:55:00 +0000

Smart glasses allow anyone to track and record the world around them. That could put your data and the privacy of those nearby at risk.

Fake call logs, real payments: How CallPhantom tricks Android users

Thu, 07 May 2026 08:51:19 +0000

ESET researchers uncovered fraudulent apps on Google Play that claim to provide the call history “for any number” and had been downloaded more than seven million times before being taken down

Fixing the password problem is as easy as 123456

Thu, 07 May 2026 07:00:00 +0000

How come it’s still possible to ‘secure’ an online account with a six-digit string?

A rigged game: ScarCruft compromises gaming platform in a supply-chain attack

Tue, 05 May 2026 08:55:27 +0000

ESET researchers have investigated an ongoing attack by the ScarCruft APT group that targets the Yanbian region via backdoor-laced Windows and Android games

This month in security with Tony Anscombe – April 2026 edition

Thu, 30 Apr 2026 09:00:00 +0000

Warnings about helpdesk impersonation scams and Iran-linked hackers targeting critical sectors in the US, plus the most damaging scams of 2025 - here's some of what made the headlines this month

The calm before the ransom: What you see is not all there is

Fri, 24 Apr 2026 09:00:00 +0000

A breach claims the systems as well as the confidence that was, in retrospect, a major vulnerability

GopherWhisper: A burrow full of malware

Thu, 23 Apr 2026 08:59:18 +0000

ESET Research has discovered a new China-aligned APT group that we’ve named GopherWhisper, which targets Mongolian governmental institutions

New NGate variant hides in a trojanized NFC payment app

Tue, 21 Apr 2026 08:55:00 +0000

ESET researchers discover another iteration of NGate malware, this time possibly developed with the assistance of AI

What the ransom note won’t say

Mon, 20 Apr 2026 09:00:00 +0000

An attack is what you see, but a business operation is what you’re up against

That data breach alert might be a trap

Fri, 17 Apr 2026 09:00:00 +0000

Ignoring a real breach notification invites risk, but falling for a bogus one could be even worse. Stop reacting on autopilot.

Malwarebytes

ESET - WeLiveSecurity

ESET - Support News