Malware Bytes

.kadence-column480618_38f885-ca > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column480618_38f885-ca > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column480618_38f885-ca > .kt-inside-inner-col{flex-direction:column;}.kadence-column480618_38f885-ca > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column480618_38f885-ca > .kt-inside-inner-col{background-color:#ffe5e5;}.kadence-column480618_38f885-ca > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column480618_38f885-ca{position:relative;}@media all and (max-width: 1024px){.kadence-column480618_38f885-ca > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column480618_38f885-ca > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}In this article

• Capcom’s breach exposed 11.7 million account records.
• Leaked details could fuel convincing phishing messages.
• Passwords on 196 accounts were changed without permission.
• Use CAPCOM ID? Check your account and enable two-factor authentication.

Gamers are being warned to watch their inboxes after someone gained unauthorized access to Capcom’s online membership service.

Capcom, the Japanese video game developer and publisher behind Resident Evil, Monster Hunter, and Street Fighter, disclosed a breach affecting more than 11.7 million CAPCOM ID records worldwide.

The exposed information includes email addresses, account activity details, and IP addresses. A much smaller number of records also contained personal details such as dates of birth.

The company says credit card information was not affected, and it has not confirmed that passwords originally chosen by customers were compromised, but someone changed the passwords on 196 accounts without authorization. Capcom has since reset those passwords.

CAPCOM ID is the company’s unified account system for its websites and services, including online features in certain games. Users can also link it to gaming platform accounts, including PlayStation, Xbox, Steam, Epic Games, and Nintendo accounts.

For players, the exposed information could help scammers make fake Capcom messages more convincing, potentially tricking them into handing over passwords or verification codes.

Capcom discovered the incident on October 19, and says it has addressed the attack method. Games and services remain available, and the company plans to notify affected customers.

The 11.7 million figure refers to affected records, so it may not represent that many individual users. Capcom is still investigating the impact, including how the passwords on 196 accounts were changed without permission and whether any other unauthorized activity occurred on those accounts.

How to stay safe

As with any breach, watch for phishing messages, particularly those using the breach to create urgency. If an email claims your account needs attention, open your browser and go to cid.capcom.com independently to check it. Capcom warns users not to follow URLs or open attachments in suspicious messages.

You can also take these steps:

• Enable CAPCOM ID’s two-factor authentication: This adds an authenticator-app code to the sign-in process, helping protect your account if someone obtains your password. Set it up from your Account page using a smartphone or tablet. Capcom recommends Google Authenticator or Microsoft Authenticator.
• Check your account, especially if you received an unexpected password-change notice: Review your registered information and linked platform accounts from your Account page. If you cannot sign in, use Forgot your password? on the login page. See Capcom’s support page for instructions.
• Use official support channels if you need help: Find the appropriate regional contact in Capcom’s breach notice, rather than trusting contact details in an unexpected message.

Pro tip: Unsure whether a message is a scam? Malwarebytes’ Scam Guard can help you assess it and suggest what to do next.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

A breach exposed personal information in supposedly anonymous crime reports. Now one Crime Stoppers chapter has stopped accepting tips because it cannot guarantee anonymity.

Toronto Crime Stoppers, which works with the community, police, and media to help solve crimes, has paused phone, website, and app submissions while it seeks a safer system.

The breach occurred in March and involved P3 Global Intel, the Texas-based tip-management platform owned by Navigate360. Its software is used by Crime Stoppers programs and other organizations in the US and elsewhere.

An October CBC investigation revealed the Canadian impact: More than 1.5 million tips spanning 25 years were exposed, with over 850,000 containing personal information. That included addresses, phone numbers, email addresses, and some banking details associated with rewards. The exposed details belonged to tipsters, people named in allegations, and others, including police and Crime Stoppers staff.

Following CBC’s reporting, Toronto Crime Stoppers acknowledged that its promise of anonymity had been broken for some users. The organization stopped accepting tips, saying it could no longer guarantee users’ anonymity.

In an October 21 statement, the organization says identifying details are normally removed before tips reach investigators, but some original submissions containing potentially identifying information were stolen from P3.

For affected tipsters, exposure could create a risk of retaliation, intimidation, or extortion. Scammers could also use details of a genuine tip to make an approach more convincing.

Unfortunately, the pause removes a reporting option for people afraid to approach police. Toronto police still accept reports directly, but warn that those channels are not anonymous.

How to stay safe

Toronto Crime Stoppers warned people worried about exposure to watch for impersonators. It says it will never contact them first to request a tip number, password, or other information.

The statement did not describe an individual notification process or offer a way to check whether a particular tip was affected. For anyone wanting to submit a new tip, the organization’s message was clear:

“Until we have a safer way to protect you, please do not send us tips by phone, online, or through the app.”

Anyone in immediate danger should call 911. During the pause, non-emergency reports in Toronto should go directly to Toronto police, with the understanding that those channels are not anonymous.

If you use a different Crime Stoppers program, check its official website for updates and advice about its reporting system.

For more general advice if your information may have been exposed, read our blog “Involved in a data breach? Here’s what you need to know.”

What do cybercriminals know about you?

Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online.

SCAN NOW

Facebook’s Cambridge Analytica scandal may feel like very old news. But the consequences are still arriving, and the latest comes with a $25 billion price tag.

Reuters reports that a New Mexico judge has ordered Meta to pay $25 billion in civil penalties after a jury found that Facebook misled consumers about its data practices and its handling of hate speech and misinformation. Meta says it expects to win on appeal.

This case is about more than information ending up in the wrong hands. It concerns what Facebook told people about who could access their information, how much control users had, and how the company enforced its own rules.

What Facebook told its users

In September, jurors found that the company and its leadership made 26 misleading statements on data privacy, hate speech, and other subjects. For example, Mark Zuckerberg’s 2010 statement that:

“We do not share your personal information with people or services you don’t want.”

That assurance appeared in a statement the jury found misleading. The judge found that choosing who could see a Facebook post did not necessarily control what outside app developers could access. That access was governed by separate settings that many users did not know existed.

New Mexico’s attorney general filed the lawsuit in 2021, following revelations that Cambridge Analytica obtained personal information from as many as 87 million Facebook users through a third-party app.

But New Mexico’s case went beyond Cambridge Analytica.

The state challenged Facebook’s representations to consumers about its data practices and its efforts to address misinformation and hate speech. The case centered on misleading consumers under New Mexico’s Unfair Practices Act, the state’s consumer protection law.

The state argued that third parties had broad access to users’ information and that Facebook tolerated harmful content when doing so benefited its business. Meta disputed the allegations, denied selling users’ information, and said the state had taken statements out of context.

New Mexico’s Department of Justice says the jury found 43,899,725 violations of state law. That does not mean nearly 44 million individual New Mexicans had their data taken. The count reflected the estimated audience for each misleading statement, rather than the number of individual people affected.

State law allows penalties of up to $5,000 per violation. Judge Francis Mathew found that a penalty exceeding $219 billion was warranted under the law but reduced the amount to $25 billion.

The judge said earlier penalties had failed to stop Meta from misleading consumers, including a $5 billion FTC penalty in 2019.

The money is not earmarked for compensation payments to individual Facebook users. According to Attorney General Raúl Torrez, state law directs the penalties to New Mexico’s school system.

Meta’s chief legal officer, C.J. Mahoney, said the company is confident it will prevail on appeal and characterized the lawsuit as an attempt to impose “a tax on speech.” Meta has also argued that a multibillion-dollar penalty risks violating constitutional protections concerning due process and excessive fines.

How to stay safe on social media

The case illustrates why privacy is not just a matter of choosing who can see a post. In a separate 2019 case, the Federal Trade Commission (FTC) alleged that Facebook had shared users’ information with third-party apps used by their friends, even when those users had chosen restrictive privacy settings.

A few precautions can help you limit what you share, although settings alone cannot guarantee privacy:

• Share selectively. Leave optional profile details blank, limit who can see your posts, and avoid publishing sensitive details such as your address or live location. Ask permission before posting information or photos involving other people.
• Check app permissions. Does a social media app really need your contacts, precise location, or entire photo library? Turn off unnecessary access in your device settings.
• Review tracking and advertising settings. Look for controls covering personalized ads, activity outside the platform, and data sharing. Restrict what you can, but don’t assume opting out of personalized ads stops all collection.
• Be selective about connected apps. Before connecting a quiz, game, or other service to your account, check what information it requests. Decline access that seems excessive for what the service does.
• Remember what “private” means. Restricting your audience helps control who sees your posts. It does not stop the platform itself from collecting or using information about your activity.

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

The warnings are everywhere these days. Don’t click this. Don’t open that. Don’t scan this. Don’t download that. These messages of caution, however well-intended, are so ubiquitous and constant that it should come as no surprise that some people have started to tune them out.

How many people? About one in three, according to our recent study.

Keeping up with every warning can feel exhausting. Meanwhile, scammers are finding new ways to target people and phones give them plenty of opportunities.

Mobile phones give scammers multiple ways to reach people, from text messages and calls to social media posts. According to a 2022 Federal Communications Commission report cited by the Federal Trade Commission (FTC), texting is a more common communication method than voice or email.

Criminals appear to be taking advantage of that fact. Consumers reported losing $470 million to text scams in 2024, up 26% from $373 million the year before and more than five times the amount reported in 2020. The FTC cites estimates that text message open rates run as high as 98%, compared to just 20% for email. People’s tendency to open and read their texts helps explain their appeal to scammers.

Meanwhile, AI is making scams harder to detect, but better at impersonating people and companies to steal money, passwords, and identities.

Voice phishing, or “vishing,” was a vanishingly small category of crime just a few years ago, but AI has made it considerably more convincing. Vishing doubled in the first half of 2026, according to CrowdStrike’s 2026 Threat Hunting Report. Meanwhile, 16% of adults in the Malwarebytes survey said they had received a voice-cloned phone call impersonating someone they knew in the past year.

Our data also shows how difficult people find it to recognize scams: 85% of survey respondents said it’s hard to tell a scam from the real thing, up from 66% a year ago. And 84% said convincing video evidence no longer feels like the rock-solid proof it once was.

Here are five ways to protect yourself1. Treat unexpected texts and social media posts with suspicion

 Legitimate institutions generally won’t ask for payment or personal information through unsolicited texts. And if the message is marked “urgent,” all the more reason to pause. Instead, go directly to the company’s official website and inquire there.

AI-generated images and videos are making it harder to tell what’s real online, so don’t rely on what you see as proof that a request is legitimate. If the content involves someone you know, contact them directly using a number you already trust.

2. Keep your operating system updated

This is one of the most effective things you can do to keep your phone safe. Security updates patch vulnerabilities that malware takes advantage of. Malwarebytes’ threat research found Android malware detections rose 151% in the first half of 2025. On both iPhone and Android, automatic updates help decrease risk.

3. Protect your accounts

Use a strong, unique password for every account. A password manager can create and store them for you. Where available, use a passkey—a way to sign in using your device, often with your fingerprint, face, or PIN—that resists phishing.

Turn on two-factor authentication, also called 2FA, for all your apps that allow it. This one step makes it harder for criminals who have your password to gain access to accounts on your phone.

4. Be skeptical of voice calls, even from your mom

This can be the hardest one to get your head around, but also one of the most dangerous and fastest-growing. AI-synthesized audio fraud has made it easier for scammers to sound convincingly like a loved one in trouble. Agree on a private code word with family members and friends in case of doubt or emergency. If you’re unsure, hang up and call the person on a number you already have. If the caller claims to be your bank, hang up and call back on a number you look up independently.

5. Check links before you tap, including links in QR codes

Before opening a link in a text, email, or social media post, check the web address for misspellings or an unfamiliar domain. You can also copy it into the free Malwarebytes Scam Link Check for help assessing it.

QR codes can hide suspicious links, too. Scammers sometimes place fake sticker overlays on top of legitimate QR codes in public spaces, and QR code phishing is morphing so fast that the FBI issued an alert in January about North Korean hackers using QR codes to target think tanks and government officials. Look for signs of tampering and check the web address your phone displays before opening it. If you’re not sure, don’t open the link. Instead, go directly to the organization’s official website or app.

Scammers rely on speed and pressure, so the best defense is to slow down. If a message or call feels off, step away and check it through a channel you already trust.

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →

A Cash App account opened in her name has left Amanda Smith facing criminal charges and potentially up to six years in prison.

404 Media reports that Smith says someone used her Social Security number (SSN) and date of birth to create an account that received money from a Facebook Marketplace scam.

Allegedly, a buyer sent $1,000 for items that weren’t really for sale. A scammer had taken over someone else’s Facebook account and directed the buyer to pay a Cash App account in Smith’s name.

Investigators obtained account information from Block, Cash App’s parent company. That information included Smith’s Social Security number and date of birth. Police subsequently arrested her in Pennsylvania over the alleged crime in Arkansas, a state she says she had never visited.

She spent three nights in jail. But 404 Media’s review of account records found that several account details, including the address and network used, did not match her own.

Smith also described a frustrating obstacle when she tried to investigate:

“Cash App refused to provide me with any information about the account, because I couldn’t prove that I was the owner.”

The account was associated with her closely enough to contribute to her arrest, yet she said she could not get information directly from the company. She later received account records through the criminal case.

It’s a disturbing reminder that the consequences of identity theft can go well beyond an unfamiliar charge on your bank statement. You could also find yourself accused of a crime committed using your details.

Breaches happen every day. Don’t be the last to know.

SEE PLANS

Smith suspects that information exposed in a data breach may have been used to impersonate her. When investigating, 404 Media found the phone number used for the account linked to an Amanda Smith in older breach data. They also found someone made a Venmo account using the same phone number but under another name entirely.

The source of her Social Security number and date of birth hasn’t been established, and her case is ongoing. Her experience highlights why it matters to know which of your details have been exposed.

How to protect yourself

The practical lesson is to look beyond the headline that a company “lost customer data.” What matters is which information was exposed, because different exposures call for different responses. Our guide for how to handle being involved in a data breach recommends checking the affected company’s official information before deciding what to do next.

The steps depend on the type of data that was stolen or leaked:

• Email addresses and phone numbers: Be alert for phishing messages and scam calls, including messages that refer to the breach.
• Passwords: Change the affected password and anywhere else you reused it. Enable multifactor authentication where available.
• Payment or banking details: Contact the relevant financial institution and review your accounts for unauthorized activity.
• Social Security numbers and other identifying information: Check your credit reports for unfamiliar accounts. In the US, you can freeze your credit for free with each of the three major credit bureaus: Equifax, Experian, and TransUnion. This helps prevent new credit accounts being opened in your name, but does not prevent every type of identity misuse.

If you discover an account opened in your name, contact the company’s fraud department through its official website and report the identity theft (in the US you can do that at IdentityTheft.gov). Keep copies of your reports and correspondence, and ask for written confirmation when the fraudulent account is closed.

A breach-checking service can help you identify known exposures linked to your information. Malwarebytes’ Digital Footprint Scan, for example, checks for exposures associated with your email address.

What do cybercriminals know about you?

Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online.

SCAN NOW

Two Chicago customers say robots delivering their groceries and takeout scanned their faces and hands without consent, stored the data alongside their names and addresses, and used the recordings to train AI.

Their separate lawsuits accuse delivery robot operators Coco Robotics and Serve Robotics of violating Illinois’ biometric privacy law. Both companies dispute the claims.

The plaintiffs filed the cases in the Circuit Court of Cook County, Illinois, alleging that the robots used their cameras along with light detection and ranging (LiDAR) sensors to scan them.

LiDAR uses laser pulses to build a detailed 3D map of a robot’s surroundings. The lawsuits allege that, at close range, these sensors capture facial geometry in enough detail to support facial recognition.

Mitchell Breidinger ordered DoorDash groceries in September 2025. A Coco robot, operated by Coco Robotics, made the delivery. To collect it, he had to stand within about a meter of the robot’s cameras and LiDAR sensor while he entered a PIN code in the DoorDash app, and a Coco remote pilot watched the live video, according to the complaint.

Barry Schain filed a similar complaint against Serve Robotics, which sent one of its robots to deliver his Uber Eats order.

The complaint against Cyan Robotics (the California-based company that does business as Coco Robotics) states that the robots record detailed 360-degree LiDAR data on the urban environments that they navigate. Coco has never said that it blurs, downsamples, or removes human faces or hands from that LiDAR data, the complaint adds.

It also says the company:

“gives no notice before a robot records a person, identifies no specific purpose or retention period for the data, obtains no written release, and has published no retention or destruction schedule.”

Those who are scanned by Coco robots have no account to close with the robotics company and don’t get to choose whether they are served by a robot, the complaint points out.

Cyan uses the data that the robots collect to train its AI, the complaint says, adding that it also has data-sharing partnerships with companies including ChatGPT creator OpenAI.

Schain, who most recently took a delivery from a Serve robot on October 4, makes similar claims in his complaint. The company fulfills food delivery orders for both Grubhub and Uber Eats, it says, noting (unlike the complaint against Cyan) that these robots also collect audio.

Serve Robotics licenses video and LiDAR data to third parties for model training, the complaint says, citing Serve’s own filings with the Securities and Exchange Commission.

Both companies have pushed back, according to reports.

Coco said it has not collected biometric data in Chicago, that the suit “fundamentally misunderstands our technology” and that “the data we share is navigational data used to make sidewalks safer for all users.” It called the case “frivolous.” Coco said that it doesn’t share data from the beginning and end of delivery runs. Serve said that the robot systems are “not designed to identify individuals or create biometric profiles.”

Whether the data the robots capture qualifies as biometric information under BIPA is central to the lawsuits.

Illinois’ biometric law

Illinois’ biometric privacy law gives people the right to sue companies over the unlawful collection and use of their biometric data.

Under that law, biometric identifiers include scans of hand and face geometry. Companies must tell people in writing what biometric information they’re collecting, what they’ll use it for, and how long they’ll keep it. They must also get each person’s written consent and publish a schedule for destroying the data, and they must not sell or otherwise profit from it.

These class action suits were not delivered in a vacuum. Chicago residents had already mounted a petition against the delivery robots, citing collisions, interference with emergency vehicles, and concerns about potential surveillance. More than 4,550 Chicagoans have signed it, the petition says.

Both suits were filed by the same Chicago law firm, Almeida Law Group. Each seeks $1,000 per class member for negligent violations or $5,000 for intentional or reckless ones. Each complaint says its proposed class “includes many thousands of persons.”

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

WhatsApp instructed its AI support chatbot not to recommend contacting privacy regulators when users couldn’t delete their accounts, researchers found.

Privacy software company Redact discovered the hidden text on October 8. Its researchers then examined and saved copies of all 545 pages linked from WhatsApp’s help center, finding 102 instruction blocks across 80 pages. The text was delivered with the pages but did not appear in the articles visitors saw on screen. Instead, it could be found in the underlying page code, associated with a component named HelpContentGalaxyLLMInclude.

Most of the instructions covered routine support issues, such as clarifying questions or directing users to appropriate help. But the researchers found two sets of instructions that stood out.

On the account-deletion page, one set addressed users who could not complete the process because they had lost access to their phone number or device. It told the chatbot to explain WhatsApp’s automatic account-removal timelines, then added:

“Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority.”

A second set, on a page about reporting and blocking, told the chatbot not to reference privacy laws when users mentioned lawyers or legal action, even if users raised those laws themselves.

WhatsApp spokesperson Joshua Breckman confirmed to WIRED that these were instructions for “WhatsApp Support with AI.” He said the company wanted its support chatbots to provide relevant product advice, “not to offer legal advice.”

Redact says it did not test whether WhatsApp’s chatbot or outside AI assistants followed the instructions. WhatsApp attributed the exposure to a bug it said had been fixed. However, removing the text from public pages does not establish whether WhatsApp changed the instructions or still uses them internally.

Why this is important

A support chatbot doesn’t need to act as your lawyer. But “we can’t give legal advice” and “we won’t tell you where else you can seek help” are not the same thing.

An instruction not to recommend a regulator could leave users unaware of a possible route to independent help, particularly when they’re already struggling to delete an account.

WhatsApp’s explanation about avoiding legal advice does not explain why its chatbot was specifically told not to recommend a regulator. Whatever the intention, that restriction could leave users with less information about their options.

How to delete your WhatsApp account

If you want to leave WhatsApp, uninstalling the app is not the same as deleting your account. WhatsApp provides a separate account-deletion option inside the app. You must be logged in on your primary phone to complete this procedure. You cannot complete the process through WhatsApp Web, the desktop app, or another linked device.

Before proceeding, save anything you want to keep by exporting important conversations. Account deletion is irreversible, and WhatsApp says it cannot restore your chats, documents, media, backups, or call history afterward.

If you still have access to your account

The steps are similar on Android and iPhone:

1. Open WhatsApp on your primary phone.
2. Open Settings. On Android, tap the three-dot menu first. On iPhone, tap Settings or your profile picture.
3. Select Account, then Delete my account.
4. Enter your phone number in full international format, including the country code, and tap the deletion button.
5. On Android, select a reason when prompted, then confirm the deletion. Follow any remaining on-screen prompts.

Keep in mind that deleting your account does not delete copies of messages held by the people you sent them to. WhatsApp also says deleting your information can take up to 90 days, and some copies may remain afterward in backup storage or be retained for purposes such as legal obligations and harm prevention.

If your phone is lost or stolen

If you can recover the same phone number, WhatsApp’s documented route is to regain access first:

1. Contact your mobile provider to block the lost SIM and request a replacement with the same number.
2. Activate the replacement SIM in another phone.
3. Install WhatsApp and register with that number again.
4. Once you have access, follow the account-deletion steps above.

Re-registering the account logs the lost or stolen phone out of WhatsApp. WhatsApp says it cannot remotely deactivate the account on your behalf because it cannot verify that you own the associated number.

If you can no longer access your account or recover your number

This is where WhatsApp’s self-service instructions fall short. Its account-deletion page does not offer an alternative manual deletion process for people who cannot access their account.

Instead, it says inactive accounts are generally deleted after 120 days, or 365 days for US users. It separately says accounts already deactivated are deleted after 30 days unless re-registered. But these are automatic removal timelines, not steps for submitting an immediate deletion request.

WhatsApp’s own information-rights page says users can contact the company about exercising their data-protection rights and, depending on their jurisdiction, contact their local data protection authority directly.

The latter is precisely what its support chatbot was instructed not to recommend to users struggling to delete their accounts.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched.

The vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2 out of 10.

Why this matters

PHP is a programming language that works behind the scenes to power a large part of the web. It underpins WordPress, Drupal, Joomla, Magento, and many other applications, including software whose users may not realize PHP is involved.

Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor.

The PHP team says all PHP installations serving web requests are at risk. In some configurations, an attacker can trigger an exploit before the website’s own code even runs.

Cloudflare’s chief technology officer, Dane Knecht, has reported “early attacks emerging,” while warning that firewall mitigations are only a stopgap.

Emergency patches are now available

The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.

You may still encounter offline websites while administrators install the updates and check their systems.

CERT-EU recommends identifying PHP-based applications and patching as soon as possible. Where an immediate fix is not feasible, it advises considering isolation of internet-facing applications from public networks.

The risk may outlast today’s emergency

The longer-term concern is forgotten infrastructure: abandoned websites, unsupported applications, and connected devices with PHP-based management interfaces. Vulnerable installations may remain exposed if nobody maintains them or a vendor no longer supplies updates.

PHP 8.1 and older no longer receive routine security updates from the PHP project. Administrators using those versions should check whether their vendor supplies a fix or arrange an upgrade to a supported version.

Website owners should establish who updates their underlying PHP installation. Updating WordPress or its plugins is not the same as updating PHP. Hosting providers or server administrators may need to apply the fix.

For visitors, temporary downtime alone doesn’t mean a website has been breached. It may reflect a protective decision while its administrators install updates.

However, consumers need to be extra careful as a “trusted website” may no longer be trustworthy, and not just because of PHP2Shell, but also because of eight compromised TLS certificates.

Shahak Shalev, Global Head of Scam and AI Research at Malwarebytes, said:

“This is a goldmine for hackers. They can hijack real websites to take advantage of the site’s reputation to do things like phish people, serve malicious software from the trusted channel. The opportunities are endless.”

What to do

If you’re a website visitor:

• Some websites may temporarily go offline while they are patched.
• Watch for unexpected content, downloads, or redirects, and repeated login requests, even on familiar sites.
• If something looks wrong, leave the page.
• You don’t need to install PHP updates on your own device.

If you’re a website owner:

• Ask your hosting or IT provider to confirm PHP fixes are installed, not just scheduled, across all your websites and applications.
• If they can’t patch immediately, ask whether affected services should temporarily be taken offline.
• If you manage your own servers, follow PHP’s update instructions.
• Using unsupported PHP? Check for a vendor fix or upgrade to a supported version.

What Malwarebytes is doing

• Helping keep you safe from hacked websites: Malwarebytes web protection and Browser Guard block known harmful sites, scam pages, and dangerous downloads. Our researchers are watching for websites compromised through these flaws so we can quickly add them to our block lists.
• Updating our own websites: We use a managed hosting provider and are working with them to install the PHP fixes. We are closely monitoring our websites until the updates are in place.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

.kadence-column476672_104e78-a1 > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column476672_104e78-a1 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column476672_104e78-a1 > .kt-inside-inner-col{flex-direction:column;}.kadence-column476672_104e78-a1 > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column476672_104e78-a1 > .kt-inside-inner-col{background-color:var(--color-red-10);}.kadence-column476672_104e78-a1 > .kt-inside-inner-col:before{opacity:0.3;background-color:var(--color-red-10);}.kadence-column476672_104e78-a1{position:relative;}@media all and (max-width: 1024px){.kadence-column476672_104e78-a1 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column476672_104e78-a1 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}In this article

• Fake Amazon Music deals use real YouTube stats as bait.
• Fake verification steals Google sign-in details, risking account takeovers.
• Make sure to verify offers independently and check the browser address before signing in.
• Already entered your details? Change your password and check account activity and channel permissions.

On August 27, YouTube announced that Amazon had joined its Shopping Affiliate Program. Eligible creators can now tag Amazon products in their videos and earn a commission on sales.

Weeks later, we found a wave of sites offering YouTube creators what looks like another Amazon opportunity: an invite-only advertising deal with Amazon Music. The site shows creators their own channel stats, then asks them to “verify” their channel with Google before it reveals a personalized offer.

That verification step is a phishing attempt designed to steal Google sign-in details, putting the creator’s account and YouTube channel at risk.

If you receive one of these offers, don’t enter your Google password or verification codes. If you already have, secure your Google account immediately using the steps below.

What the real Amazon and YouTube partnership looks like

The real partnership lets eligible creators in the YouTube Partner Program and YouTube Shopping affiliate program tag Amazon products in their videos, Shorts, and livestreams, and earn a commission when viewers buy. YouTube’s setup guidance also describes linking Amazon and YouTube accounts, with a notification in YouTube Studio once tagging is enabled.

The real program does include a step where you connect and verify your channel. But it happens inside an Amazon account you already have, on Amazon’s own site, and YouTube confirms it in YouTube Studio. It doesn’t involve invite-only Amazon Music ad campaigns, payout calculators, or a third-party “creator portal.”

An invite-only deal that doesn’t exist

The site, hosted at amazonyt[.]com, calls itself the “Amazon Artists Music — Creator Portal.” The name resembles Amazon’s real Amazon Music for Artists service, helping it feel familiar at first glance.

It promises “advertising collaborations with Amazon and Amazon Music,” describes the program as invitation-only, and tells visitors to use “the link from your Amazon Music Artists outreach email.”

There’s even an earnings calculator. You pick one of four packages (a Shorts package, an integration in a planned video, a dedicated video, or a “full campaign package”), set your average views, add “boosters” like extra Shorts or a livestream mention, and choose how exclusive the deal should be. The page then shows an “estimated payout” and compares it with the “endless back-and-forth and delayed payments” of ordinary brand outreach.

The calculator does real math on the numbers you enter. But a working calculator doesn’t make the payout real. The estimates give creators a reason to keep going before the site asks for their sign-in details.

The site is available in nine languages: English, Spanish, Indonesian, Portuguese, Russian, Urdu, Arabic, Hindi, and Thai, suggesting the operators are targeting creators across multiple countries.

Your own channel, used as bait

Next, the site asks for your YouTube channel link.

Once you paste it, a dashboard displays your real channel data: subscriber count, total views, recent and top-performing uploads, playlists, topics, and thumbnails. Seeing your own data on an Amazon-branded page makes the offer feel tailored to you.

To pull this data, the site queries YouTube’s own public API directly from your browser. The code includes 20 Google API keys and automatically switches to the next one if a key hits its usage limit or is rejected.

This data is public, so looking it up isn’t theft in itself. What it buys the criminals is credibility. A site that knows your subscriber count and your latest upload can look as though someone has already assessed your channel for a deal.

The offer itself stays locked until you “verify” your channel.

The fake “Continue with Google” button

To unlock it, you have to “complete the required step: Verify Your Channel.” The page says you need to sign in with Google to confirm you own the channel and “unlock your Amazon Music collaboration brief,” and shows a familiar white button with the colored Google logo: Continue with Google.

The site does contain genuine Google sign-in code, the same kind legitimate sites use. But it’s inactive: the setting that would connect it to Google is empty, so it never runs.

Instead, clicking the button opens a full-screen frame on top of the page. The frame loads content from a second domain, youtubechannelverification[.]com. Its background is almost completely transparent, so whatever the second site draws appears to sit over the Amazon page. Meanwhile, your browser’s address bar still shows amazonyt[.]com.

This is similar to what we described in our recent look at a fake Claude Max giveaway: when the sign-in window lives inside the page, the criminals control nearly everything you see.

The second-stage code shows what it’s after. In the version we analyzed, it sent the email address and password entered into the form to its own server, and it supported steps for multi-factor authentication (MFA) challenges. In other words, it’s built to collect not just your password but also verification codes that could help the criminals get past an additional layer of account protection.

A fake offer to keep you reassured

What happens next depends on how the second stage responds.

The fake window has no close button of its own. It closes only when the second-stage site tells it to. When that happens, the page displays, “Verification failed. Please try again.”

However, the second-stage configuration we analyzed also pointed to a “success” address back on amazonyt[.]com. Visiting that page marks your channel as verified and returns you to the dashboard, where the offer is now unlocked: a fit score, campaign tier, budget band, estimated reach, and a pitch that quotes your recent average views back to you.

You can even negotiate. A counter-offer editor lets you choose deliverables, toggle social media usage rights, and leave a note for “Amazon Music.” When you click Request this collaboration or submit your counter-offer, a “Request received” screen says the Amazon Music partnership team will review your channel and reach out with next steps.

For the creator who reaches this screen, everything appears to have worked. They verified their channel, saw a convincing offer, and sent a request. That reassuring ending may give the criminals more time before the victim suspects anything.

Why this campaign stands out

Fake sponsorship offers have targeted creators for years. This one combines several features that make the trap more convincing:

• The password collection happens on a second domain. The amazonyt[.]com page itself doesn’t contain the sign-in form. That form is loaded from youtubechannelverification[.]com only after you click. A split like this can make the first page look cleaner to anyone checking it, and it lets the operators change the second stage without touching the lure.
• The success page is designed to evade suspicion. Victims who hand over their details aren’t left at an error page. They’re returned to an unlocked offer and a “Request received” confirmation, giving them a reason to wait for a reply.
• Personalization is automatic. Every visitor gets a dashboard and offer built from their own channel’s real numbers.
• It may be part of a reusable kit. The code contains leftover error messages that have nothing to do with this site, like “Please enter the product ID” and “This channel is not in the list, please connect the invited channel.” The link to the second stage also carries a ref value, which the second-stage code we analyzed stored as a workerCode. That could mean more than one person sends traffic to it, though we can’t confirm how the kit is shared.

Why criminals want YouTube channels

YouTube creators have been a target for years. In 2021, Google’s Threat Analysis Group described a campaign that lured creators with fake collaboration offers, used malware to take over their channels, and then sold them on or used them to broadcast cryptocurrency scams.

A hijacked channel comes with an audience that already trusts it. That gives criminals a ready-made platform for reaching potential victims.

How to spot a fake sponsorship offer

• Treat “verify your channel” requests with caution. Legitimate services may use Google’s official sign-in to confirm channel ownership. The important distinction is where you sign in: Your Google password and verification codes belong on Google’s genuine sign-in page.
• Check the browser’s real address bar. If you’re asked for your Google password, the actual browser tab or separate browser window should show accounts.google.com. An address bar drawn inside the webpage can be faked.
• Check the domain, not the logo. The domains amazonyt[.]com and youtubechannelverification[.]com are part of this phishing campaign. Familiar branding and accurate channel stats don’t make them official.
• Know what the real program offers. The Amazon and YouTube Shopping partnership lets eligible creators earn commissions on tagged products. A supposed Amazon Music sponsorship needs to be verified separately.
• Verify the offer independently. Contact the company through its official website, using contact details you find yourself rather than those supplied in the message.

If you already entered your details

Change your Google password through Google’s official site. Review your devices and sign out of unfamiliar sessions in your Google Account security settings, and remove any third-party apps you don’t recognize. Also check that your recovery email address and phone number haven’t changed.

If you entered an MFA code or approved a sign-in prompt, treat your account as potentially compromised.

In YouTube Studio, check Settings > Permissions for anyone you didn’t add. If your channel is connected to a Brand Account, check that account’s permissions too. If you’ve lost access, follow YouTube’s guidance for recovering a hacked channel, starting with the Google account associated with it.

How Malwarebytes spots scams like this

Once a phishing page loads, the criminals control almost everything you see, which is why it’s best to stop it before it opens. 

Malwarebytes Browser Guard blocks phishing and scam domains before the page can load. If you’re unsure about a sponsorship offer, you can ask Malwarebytes Scam Guard to check it before you reply or click anything.

Indicators of compromise

• amazonyt[.]com
• youtubechannelverification[.]com

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

A recently disclosed flaw in Signal’s calling software could allow another participant to keep hearing you after you hang up.

The vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 out of 10), affects RingRTC versions earlier than 2.72.0. RingRTC is the open-source library behind Signal’s voice and video calling functionality, providing calling components for its mobile and desktop applications.

The flaw concerns how Signal’s calling library shuts down a call. It does not affect how it encrypts conversations. According to the published vulnerability description, another participant could overwhelm a call’s internal event queue and interfere with the steps that should disconnect it when you end the call.

The main concern is unwanted listening after someone believes a conversation has ended. If a malicious call participant successfully triggered the flaw, they could potentially continue hearing audio that the other person no longer intended to share. That might include an offhand remark, a conversation with someone nearby, or other private background sound.

The vulnerability description also mentions that video might remain active, but does not confirm that behavior or explain what affected users would see on screen. It also doesn’t specify how long any continued transmission might last.

There are no known reports of exploitation in the wild. The vulnerability concerns only how a call is shut down. It does not involve stolen passwords, compromised accounts, or exposed message histories that would call for a password reset.

What to do

The developers updated the code to make shutdown more resilient when a call’s internal queue is full or another termination step fails.

Install any available Signal updates on your devices. The fix is available in the underlying RingRTC library, but the affected and first-fixed Signal app versions have not yet been confirmed publicly in the sources reviewed.

Personally, I found an update in the Google Play Store which brought my Android app to version 8.32.2. I did not find one in the Apple App Store, although this might be because I have automatic updates enabled. The current version on my iPad is listed as 8.32 (1910). While I think that means it’s all patched, this is hard to confirm from Signal’s website.

I’ve emailed Signal for clarification and will update this article when I hear back.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

.wp-block-kadence-advancedbtn.kb-btns97520_6de029-2f{gap:var(--global-kb-gap-xs, 0.5rem );justify-content:flex-start;align-items:center;}.kt-btns97520_6de029-2f .kt-button{font-weight:normal;font-style:normal;}.kt-btns97520_6de029-2f .kt-btn-wrap-0{margin-right:5px;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button{color:#555555;border-color:#555555;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{color:#ffffff;border-color:#444444;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button::before{display:none;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{background:#444444;}ul.menu .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{width:initial;}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{color:var(--color-neutral-10);background:var(--color-brand-blue-60);border-top-left-radius:40px;border-top-right-radius:40px;border-bottom-right-radius:40px;border-bottom-left-radius:40px;padding:var(--kb-btn-padding);margin:var(--kb-btn-margin);box-shadow:1px 1px 2px 0px rgba(0, 0, 0, 0.2);}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:hover, .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:focus{box-shadow:0px 4px 0px 0px var(--color-brand-blue-90);}Try it now

As Android Central reports, users have received unexpected emails telling them their phone number has been verified for secondary Google accounts.

Like me and many others, you may have one Google account for everyday use, another for work, and a third for things you would rather keep separate. But if you’re using an Android phone, those accounts may have something in common that you didn’t intend or even know about: your phone number.

Google’s own documentation confirms that phone number verification is on by default and adds your number to all Google accounts signed in on the device. This applies to both existing accounts and any you add later.

Google says phone number verification helps support features such as signing in, account recovery, Rich Communications Services (RCS) messaging, and finding or securing a lost device.

But it also means that a number you intended to use with your main account can become associated with a secondary account simply because both are signed in on the same Android device.

If you deliberately left your phone number off a secondary account, this links it to your real identity without you knowingly making that connection. Your number doesn’t automatically become public, but Google gains another way to connect accounts you wanted to keep separate.

This reminded me of an article I wrote about unexpected Google account connections: “Google Play sign-ins can be abused to track another person’s movements.” Signing in to Google Play on one phone allowed me to see its movements in Google Maps Timeline.

“After some digging I learned that my Google account was added to my wife’s phone’s accounts when I logged in on the Play Store, but was not removed when I logged out after noticing the tracking issue.”

While that particular issue should be solved by Google’s move toward device-based Timeline storage, unwanted phone number associations need to be removed manually.

How to remove your number from separate accounts

Phone manufacturers arrange their settings differently, so there may be some differences in menu names and locations. We tried to make sure everyone can follow these instructions, but there might be makes and models where you get stuck. Feel free to ask in the comments and maybe others with the same phone can help you.

Step 1: Turn off automatic phone number verification

This needs to be done on the Android phone itself:

• Open the phone’s Settings app.
• Tap Google. On some phones, this may be called Google services or Google services and preferences.
• Open All services.
• Under Privacy & security, tap Phone number verification.
• Turn off Verify phone numbers automatically, or the equivalent verification switch shown on your phone.

Turning this off does not remove numbers already added to your accounts.

Step 2: Check which accounts already have your number

This step can be done in a browser, so should be the same for everyone.

• Open a browser and type myaccount.google.com into the address bar.
• Check the account picture or initial in the top-right corner. Make sure you are looking at the account you want to inspect.
• Select Personal info.
• Find Contact info, then select Phone. Depending on the layout, you may see Phone directly.
• Select any number listed to review its details and how it is used.

To remove the number from that account, select the delete icon and follow the on-screen instructions. Repeat for each account you want to check.

Step 3: Check for other uses of the number

There’s a wrinkle. Google says changing a number in your Google Account only affects some services. Other services, such as 2-Step Verification, may use the number separately and may not all appear on the Phone page.

On each account you are cleaning up:

• Check the number’s Usage section on the Phone page to see which services are listed.
• Visit Security or Security & sign-in and review your recovery phone and 2-Step Verification settings.
• If you use another Google service that has its own phone number settings, check those settings too.

If your goal is to remove the number entirely from a particular account, don’t assume deleting it from Personal info has removed every separate use. Check those security settings as well, but make sure to keep a working alternative sign-in and recovery method before removing the number.

Android Central reports that some users say automatic verification switches itself back on after they disable it. Those are user reports, not confirmation that this happens on every phone. But if you’re concerned, check the setting again later.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

.wp-block-kadence-advancedbtn.kb-btns97520_6de029-2f{gap:var(--global-kb-gap-xs, 0.5rem );justify-content:flex-start;align-items:center;}.kt-btns97520_6de029-2f .kt-button{font-weight:normal;font-style:normal;}.kt-btns97520_6de029-2f .kt-btn-wrap-0{margin-right:5px;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button{color:#555555;border-color:#555555;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{color:#ffffff;border-color:#444444;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button::before{display:none;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{background:#444444;}ul.menu .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{width:initial;}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{color:var(--color-neutral-10);background:var(--color-brand-blue-60);border-top-left-radius:40px;border-top-right-radius:40px;border-bottom-right-radius:40px;border-bottom-left-radius:40px;box-shadow:1px 1px 2px 0px rgba(0, 0, 0, 0.2);}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:hover, .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:focus{box-shadow:0px 4px 0px 0px var(--color-brand-blue-90);}Try it now

Meta says it has resolved an issue after some Ray-Ban Meta owners reported that their glasses recorded conversations without the “Hey Meta” wake phrase.

Users reported finding recordings and transcripts of conversations they did not knowingly save. Recording without anyone realizing raises privacy concerns for both the wearer and the people around them.

The complaints surfaced on Reddit, where one owner described unexpected recordings occurring with three pairs of glasses. The owner said the behavior started after a firmware update and occurred even with Respond without Hey Meta disabled. They also reported that the glasses’ internal notification light sometimes activated during normal conversation. Other commenters described similar unexplained activations.

As Android Authority reports, Meta says the problem has been fixed:

“This issue has been resolved. People can manage, review and delete voice logs of their interactions with Meta AI via settings at any time.”

What’s missing is a public explanation of what caused it, how many people were affected, and what happened to the audio captured.

This isn’t the first time we’ve reported on privacy concerns involving smart glasses. In June, we covered unreleased facial-recognition code found in Meta’s companion app. The code was not active, but the reporting raised concerns about how wearable cameras could eventually move from capturing people to identifying them without their knowledge.

What owners can do

According to the Reddit owner, Meta Support recommended disabling microphone and camera permissions, turning off Wear Detection, deleting voice history, and disabling automatic updates. Those steps would limit much of the gadget’s core functionality without explaining what went wrong.

Until Meta provides a fuller explanation, here are a few precautions that make sense if you wish to keep using your smart glasses:

• Review your voice history. Look for interactions you do not recognize and delete unwanted recordings or transcripts. Meta says users can manage these logs through Settings.
• Check your voice-activation settings. The owner reporting the issue said Respond without Hey Meta was already disabled, so do not treat that setting alone as a guarantee against unintended activation.
• Keep the glasses and companion app updated. Although the user associated the behavior with an update, that is not a good reason to permanently abandon updates that may contain security and privacy fixes.
• Always ask before recording other people. Their privacy matters even when your glasses are working exactly as intended.

Meta still owes users an explanation of what went wrong and what it has done to ensure it won’t happen again.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

A 49-year-old bricklayer sold his belongings before traveling 2,000 km by bus from his home in Brazil to meet “Jéssica,” an online influencer he had fallen for. Yet despite having a social media account with more than 300,000 followers, she never existed.

Edimar Rocha Martins lives in Imperatriz, a city in northeastern Brazil. He says he struck up an online conversation with Jéssica Fazendeira, who supposedly lived near the southeastern city of Belo Horizonte.

The AI persona promising love

The online persona’s name, “Fazendeira,” loosely translates as “female farmer.” She described herself as living on a farm.

Martins said that he had been talking with the persona online since 2020. He decided to visit her after she offered to pay for his trip and have him live on the farm with her, he said. The account’s operator disputes this, saying the character was created in 2025 and denying any private messages with him.

A video posted on one of her online accounts (captured here by Brazilian news service Imirante) asked for a man to come and live with her and offered to fund the trip.

The AI-generated farmer says, translated:

I’m not joking, my intentions are serious. I want to meet someone who wants to build something real and beautiful with me. If you’re a simple man who likes peace and quiet and a calm life, then maybe we’d get along really well.

After selling his possessions to fund the bus trip, Martins arrived in Belo Horizonte and began asking about the woman. Unable to find her, he approached a local radio station, where staff explained that she was an AI-generated character.

Without enough money to return, he received food, support, and a bus ticket to Augustinópolis, in Tocantins, from the city’s migrant assistance service. He later returned to Imperatriz, where he stayed with relatives.

The account’s operator hits back

The account’s administrator posted a message through the AI character’s TikTok account denying any kind of scam. Translated, it said:

This profile is pretty much abandoned, but I’ve come here to state the obvious. I’m made of artificial intelligence, and I’ve never talked to anyone on this profile. The aim was to get engagement for sales. I never spoke directly to anyone, much less brought anyone to Belo Horizonte.

The operator told reporters that the character was created to attract viewers and promote products through affiliate sales. They said they did not know whether other people had reused the character’s content on other accounts.

Another video shows messages people have reportedly sent the account, with the character explaining that it keeps telling viewers it’s an AI. It complains:

And then it’s still my fault, right? These people are lost.

In another video, where it is being interviewed by an AI-generated male character, the persona explains that it deactivated and then reactivated its account. It said:

I was the first AI to get canceled for absolutely nothing.

These are scripted responses published through a fictional character, rather than an AI independently defending itself.

Police said they could not establish at that stage whether a crime had occurred.

One outlet reported that Martins has been struggling with loneliness following his mother’s death.

Videos published to the reactivated TikTok account are labeled as AI generated. It also links to an Instagram account with videos of the character, where videos carry similar labels. Those current labels don’t establish what Martins saw before his trip.

Social media already encourages parasocial relationships, where viewers feel a personal connection with someone who doesn’t know them. AI-generated personas add another complication: The person viewers feel connected to may be entirely fictional.

In our Face value report, 88% of adults surveyed said it’s becoming harder to tell what online content is genuinely human or real.

The AI plot thickens

June saw reports of a 72-year-old man who traveled 4,000 km from his home in Boa Vista to … Belo Horizonte. He visited after seeing a farm woman on a social network who was offering a job opportunity and perhaps something more. Unable to return home, he sought help from social workers.

In August, 71-year-old Alberto da Costa traveled from Manaus to the same city after watching videos featuring the same woman, according to Itatiaia. He paid almost R$3,000 for a flight, then sought help from the outlet when he couldn’t afford to return home.

The videos simulated personal conversations, giving viewers the impression that the woman was speaking directly to them. The account reportedly had nearly a million followers.

The reporting doesn’t establish whether this woman was AI-generated or whether the account was connected to Jéssica’s. Nor does it establish that the men sent money to the account operators. But the costs can still be real: selling possessions, paying for travel, and finding yourself stranded far from home.

Protect yourself and others

The same advice applies here as to romance scams, but with some extras. Don’t send money or travel to see someone you’ve never met without independently checking who they are.

Don’t rely on video calls alone. Scammers now use deepfake video calls to dupe victims live. And check whether you’re exchanging private messages or watching public videos that anyone can see.

Look for information beyond the account itself. Search their name and profile pictures, and research where they say they work. Be cautious if their story doesn’t add up or they avoid questions about their identity.

When you feel close to someone, questioning that connection can be difficult. Before sending money or booking travel, talk to a friend or family member and get their perspective. And if you’re worried about someone who may be in a similar situation, check in without judgment and offer to look through the account together.

Images courtesy of Jam Press

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

The Google Threat Intelligence Group (GTIG) reports that attackers compromised AOMEI Technology’s update and notification infrastructure in a campaign investigated between April and July.

AOMEI Backupper is backup software that the company says is used by more than 100 million people worldwide. It lets users back up files, copy entire drives, and recover data if something goes wrong with their PC.

The attackers briefly altered AOMEI’s update and notification infrastructure to make customers’ software download and run malware.

The same system also serves AnyViewer customers, but the report does not separately identify confirmed AnyViewer infections.

For brief periods, the attackers changed the software’s download instructions to point to a malicious ZIP archive. They also changed the expected version number and MD5 checksum so the client would accept it. Because the same remote configuration file provided the download address and expected checksum, the attackers could change both the download and the information the software used to accept it.

The researchers confirmed three tampering windows lasting ten, six, and five minutes, but more may have occurred. While these short windows provided fewer opportunities to infect machines, they also made the attack harder to spot.

The attack used an initial downloader to install a persistent remote-access backdoor. The researchers did not identify the delivered malware as ransomware or an infostealer, but the backdoor lets attackers run commands and install additional malware. That means an infected PC could remain open to further attacks.

How to check if you were affected

If you used AOMEI Backupper during the affected period, update your security software and run a scan. You can download Malwarebytes Free to check for and remove malware.

Malwarebytes’ AI detection engine identifies the initial malware downloader, upgrade-now.exe, as Malware.AI.4006642887 so ThreatDown and Malwarebytes customers were protected by the real-time detection component.

Malwarebytes detects the malware dropper upgrade-now.exe

If you’re comfortable checking Windows settings and files, these are additional warning signs:

• Open Windows Task Scheduler and check the Task Scheduler Library for a task named RadminComponentRuntime.
• Look in your AOMEI Backupper installation folder, particularly its version-specific html and Tmphtml folders, for an unsigned upgrade-now.exe or an unexpected upgrade-now.zip. Note that the malware downloader deletes itself after staging the next payload and creating persistence, so its absence does not mean the PC is clean.
• If you’re seeing outgoing traffic to promotion.storage-data.com, aomei.storage-data.com, storage-data.com, 8.210.84.56, 47.239.60.117, or 8.218.65.184, whether blocked or allowed.

Malwarebytes blocks 8.218.65.184

If you encounter one of these signs, get help rather than trying to clean everything manually. Disconnect the PC from the internet if you suspect it is actively compromised, and contact a trusted computer technician, Malwarebytes Support, or your organization’s IT/security team.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

This week on the Lock and Code podcast…

At just 17 years old, Jordan DeMay was murdered by strangers online.

That’s how Jordan’s father, John DeMay, described what happened to his son four years ago. At home in Michigan, Jordan was readying for a weekend trip when he received a friend request on Instagram. The invite was sent by a user named “dani.robertts” whose profile showed an attractive young woman. After accepting the request, Jordan and the account chatted about nothing in particular—teenage matters, getting to know one another—before “dani” became flirtatious, eventually sending Jordan what she claimed was a nude photograph of herself.

Jordan responded in kind with an explicit photograph of himself.

But here, a trap was revealed.

“Dani Robertts” was not a young, friendly, interested woman. Dani Robertts was several men, sending messages from thousands of miles away in Lagos, Nigeria, who had followed a script to pressure young men into handing over their money. This was not the first time these men had run this scam. But with a great deal of investigative work, it hopefully has become the last.

What happened to Jordan can happen to anyone—and it has happened to far too many young men and women today. It is a type of attack commonly referred to as “sextortion.”

Today, on the Lock and Code podcast with host David Ruiz, we speak with John DeMay about his son Jordan, his family’s relationship with social media, and what parents should know.

Tune in today to listen to the full conversation.

Show notes and credits:

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
http://creativecommons.org/licenses/by/4.0/
Outro Music: “Good God” by Wowa (unminus.com)

Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.

Personal information belonging to millions of current and former California public school students has been stolen from a system operated by Educational Testing Service (ETS).

ETS is a nonprofit organization that helps run the state’s standardized tests under contract with the California Department of Education (CDE). It has begun notifying students and families after an unauthorized party accessed and copied student information from an ETS-operated secure file transfer protocol (SFTP) site. CDE is distributing the ETS breach notice to help affected individuals receive information about the incident and available resources.

An investigation determined that an unauthorized party used compromised login details to ​access the site and copy files containing California student information at various ​times between May 22 and September 18.

The CDE says the breach includes all students enrolled during the previous three school years, although the affected population is not limited to that group. The information involved varies by individual but may include:

• Student names
• Statewide Student Identifiers (SSIDs)
• Dates of birth
• Home addresses
• Demographic information
• Disability and program participation information
• Statewide assessment information, including test scores

According to the CDE, over 5.7 million students were enrolled in California ​public schools during the 2025–2026 school year alone.

Not every affected student had every category of information exposed. However, this is clearly more than a list of names and email addresses: The stolen files can reveal highly personal information about a student’s education and disabilities.

CDE says Social Security numbers, financial account information, passwords, and parent or guardian information were not involved. ETS says it has found no evidence so far that the stolen information has been made public.

How to stay safe

ETS, at CDE’s direction, is notifying affected students and families. If your information or your child’s information was involved, follow the instructions in the notification and:

• Verify any communication about the incident through official channels.
• Consider enrolling in the two years of free identity-protection services. Parents or legal guardians can enroll affected minors, while affected adults can enroll themselves. Check the instructions for the appropriate age group.
• Watch for messages that use details about your child or their school to sound convincing. Don’t share passwords, security codes, or payment details in response to an unsolicited message or call. 
• For more advice, read our blog “Involved in a data breach? Here’s what you need to know.”

Pro tip: Students, faculty, and staff at participating US universities can get free security software through the Malwarebytes Student Protection Program. Visit malwarebytes.com/student to check your eligibility and sign up. 

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

Last week on Malwarebytes Labs:

• Eiliko robot companion exposes private chats and can be hijacked
• “Spray and pray” job applications could make it harder for you to spot a scam
• OpenAI sued over children safety and data use
• Update Chrome: Google fixes 37 security flaws, including seven critical bugs
• Is this link safe? Find out with Malwarebytes Scam Link Check
• Sextortion “help” firm took $60 million from victims, FTC alleges
• Raven AI lets cops find your home from a photo taken inside
• AI worms could spread across your smart devices, Anthropic warns
• Update Windows: Record Patch Tuesday fixes flaw already under attack
• Fake Calendly “Meta Careers” pages steal Facebook and Google logins
• Police receive fake murder tip from Anthropic’s Claude AI
• Grindr users’ sensitive data shared through ad auctions without valid consent
• Hackers heat up supermarket fridges, spoiling food across France
• Scammers know your name, and they’re counting on you to reply
• How “123456” became the key to almost 9 million personal records
• Phishing emails are baiting your AI assistant

Stay safe!

Unsure where a link goes? We’ll check it. Check now

The Verge reports that Eiliko, a small AI robot companion made by Energize Lab, has serious security flaws that expose private conversations and let an attacker remotely change what the toy says.

According to The Verge, researcher Sammy Azdoufal could access 13 million conversations and what appeared to be the entire active worldwide fleet of 68,000 robots. The publication reports that the US is the largest market, with more than 31,000 profiles belonging to children there.

Azdoufal found multiple security flaws in Energize Lab’s service:

• The service analyzes conversations to build profiles containing names, ages, birthdays, relationships, occupations, and assessments of personality and emotional vulnerability. They are stored alongside email addresses, IP addresses, and searchable conversation transcripts, potentially giving scammers detailed information to exploit.
• Some photos, including apparent images of children from a related camera-equipped device, and short audio recordings were accessible at public web addresses. Retaining audio conflicts with the company’s privacy policy, which says recordings are deleted immediately after processing.
• It is possible to remotely manipulate the AI: Azdoufal altered The Verge reporter Sean Hollister’s robot’s memory and behavior, making it invent personal details, insist the Earth is flat, and later deliver sexually explicit, abusive dialogue. The researcher says similar manipulation could affect the entire fleet simultaneously.

The reporter contacted Energize Lab through 10 email addresses and LinkedIn, without receiving substantive answers.

How to stay safe

We have reported on safety problems with AI-powered toys before. Manufacturers are responsible for securing their products, but there are steps you can take to reduce the risks.

You’ll see “AI-powered” on almost everything right now, but there are ways to make safer choices.

• Already own an Eiliko? As a precaution, disconnect it from Wi-Fi while seeking confirmation that the reported flaws have been fixed.
• Always research: Check for third-party safety reviews before buying any AI-enabled product marketed for kids.
• Test and supervise: Interact with the device yourself before giving it to children. Monitor usage for odd or risky responses. A safe response during testing doesn’t guarantee safe responses later.
• Use parental controls: If available, enable all content filters and privacy protections.
• Report problems: If devices show inappropriate content, report it to manufacturers and consumer protection groups.
• Check data practices: Find out what the device collects, who it shares data with, and what it uses the information for.

But above all, remember that “smart” doesn’t mean safe. AI may be everywhere, but designers and buyers alike need to put safety, privacy, and common sense ahead of the technological wow factor. Before buying a connected toy, check how the manufacturer handles security updates, privacy, and reports of problems.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

AI can help you send more job applications. But when you lose track of where you’ve applied, a fake recruiter’s message can start to look like the reply you’ve been waiting for.

Job hunting can feel like shouting into the void. You send applications, rewrite cover letters, and wait for replies that may never arrive. Then a message lands on your phone: someone wants to talk about a job.

But was it one of the jobs you applied for? It is hard to keep track when you’ve sent out a lot of them.

Two reports highlight an uncomfortable overlap. The BBC describes jobseekers using AI to apply for large numbers of roles, a strategy known as “spray and pray.” Meanwhile, research reported by The Independent suggests many young adults are receiving unsolicited job offers and worry that ignoring those offers could mean missing a real opportunity.

Neither report establishes that mass applications cause people to fall for recruitment scams. But together, they point to a useful security question: When you’re expecting replies from practically everywhere, how do you recognize a message from someone you never contacted?

The scams

Job offer scams come in different forms. We’ve talked about fake interview apps that are spyware, Calendly interview invites that steal social media credentials, so-called parcel expert jobs, advance fee scams, task scams, and recruiters stealing Google credentials.

There are many more, unfortunately. These examples illustrate some of the risks of a bogus recruitment approach: financial fraud, malware installation, and account theft.

Scam or legit? Scam Guard knows.

TRY IT NOW

An anonymized message submitted to Scam Guard, which appears to falsely claim to be from legitimate UK marketing firm The Goat Agency, showed signs of a possible task scam:

“Hello! I’m a representative from the HR team at goatagency. We’ve recently reviewed your CV and believe you could be a great fit for a remote online opportunity we’re currently offering. This is a flexible part-time or full-time remote position, with responsibilities focused on assisting merchants by providing product reviews. The work is straightforward, and we will provide full training to help you get started quickly. Work just 60-90 minutes per day Daily earnings range from £500 to £1,000, depending on your availability Work anytime, from anywhere If you’re interested in joining us, please contact us via WhatsApp:”

But scammers don’t even need to offer a dream salary. Almost half of UK 18- to 24-year-olds surveyed in research commissioned by Virgin Media O2 said they had received messages offering jobs they had never applied for. Without the obvious red flag of an “easy cash” promise, a scam message can look even more like a legitimate contact from a recruitment agency.

The approach can also start with a phone call. The Independent reports warnings about automated calls asking recipients to add a number on WhatsApp, sometimes in connection with supposed part-time work.

Other approaches use a familiar employer’s name to make requests look credible. We previously reported on fraudulent job postings that imitate real businesses and seek applicants’ personal information or money, including supposed payments for office equipment.

How to stay safe

One simple rule can spare a lot of harm: Keep the applications and verify anyone who contacts you about a job. You don’t need to abandon AI-assisted applications or assume every recruiter is fake, but a plausible opportunity still needs checking

• Keep a simple application log. Record the employer, role, application date, and original listing so you can check when someone contacts you.
• Verify both the vacancy and the recruiter independently. Find the employer’s website yourself and use its published contact details. The existence of a real vacancy doesn’t prove the person messaging you represents that employer.
• A familiar logo doesn’t prove anything. Scammers imitate legitimate companies and may use real employees’ details to support the impersonation.
• Never pay to unlock earnings. A request to deposit money before you can withdraw supposed commissions is a hallmark of a task scam.
• Pause before sharing sensitive information, installing software, or signing in through a recruitment link. Verify the approach first, especially if it arrives unexpectedly.
• Enable multi-factor authentication on your important accounts to make them harder to take over, even if someone steals your password.
• Use up-to-date anti-malware protection with real-time scanning to help detect and block malicious downloads.

An application log can help you check whether a message relates to a job you applied for. Even when it does, verify who’s on the other end before sharing information or taking the next step.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

OpenAI is facing separate legal challenges over how ChatGPT interacts with children.

The Guardian reports that eight US states accuse the company of misleading parents about the chatbot’s safety and exposing vulnerable users to dangerous conversations. Separately, CNET reports that a mother suing on behalf of her two children alleges that OpenAI collected and used children’s sensitive personal information without valid parental consent.

The cases raise serious questions about what happens when children trust a chatbot with their most private thoughts, and what responsibility the company behind it has for the conversations that follow.

The accusations are serious, but we have to remember they are allegations in lawsuits, not established court findings.

Eight states challenge ChatGPT’s safety

On October 14, attorneys general from Iowa, Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho, and Montana filed separate lawsuits against OpenAI. The coordinated action accuses the company of deceiving parents about ChatGPT’s safety and violating state consumer protection laws.

The states allege that the chatbot has been designed to be “overly agreeable and feign human compassion.” The attorneys point to examples of ChatGPT allegedly endangering vulnerable users, including children, by coaching them to commit suicide or harm others.

OpenAI says it has built age-specific protections into its products and will continue developing safeguards.

A separate lawsuit focuses on children’s private information

The day before the states filed their cases, a Hawaii mother brought a proposed class action on behalf of her 12-year-old daughter and 16-year-old son. Filed in federal court in San Francisco, the lawsuit alleges that OpenAI obtained sensitive information from children who signed up for ChatGPT without valid parental permission.

OpenAI’s terms require users under 18 to have a parent or legal guardian’s permission. But the complaint alleges that children can create accounts without OpenAI verifying that permission. It also describes a child under the service’s minimum age of 13 continuing to use the chatbot after explicitly telling it her age.

The plaintiffs allege that the company used children’s information to train its AI models without valid parental consent. They also claim that OpenAI collected information to construct personal profiles.

OpenAI disputes the claims, calling the lawsuit “misguided” and pointing to its protections for younger users.

Parental controls

OpenAI has introduced ChatGPT for Teens, with additional parental controls and alerts intended to notify linked parents in limited situations involving serious self-harm concerns. But the effectiveness of those safeguards is itself under scrutiny. Common Sense Media rated ChatGPT for Teens an “unacceptable risk” earlier this month, reporting that its testing found failures to alert parents during conversations involving suicide, self-harm, or eating disorders.

OpenAI disputes the findings and says its safety alerts cover limited situations and may not identify every concern. But for now, parental controls remain part of the dispute.

How to help keep your children safe

Parents shouldn’t have to compensate for unsafe product design. Unfortunately, we can’t treat parental controls as a safety guarantee. So here are practical steps families can take to reduce the risks:

• Explain that a chatbot is software, not a friend or therapist. A warm tone doesn’t mean it understands your child or has their best interests at heart. Set a clear boundary: Questions about mental health, self-harm, or personal safety should go to a trusted adult or qualified professional, not a chatbot.
• Talk about what your child uses AI for, without making it an interrogation. Ask them to show you the apps they use and what they like about them. Make clear that they can talk to you about any upsetting or inappropriate conversation without being blamed. If they don’t feel comfortable talking to you, help them identify another trusted adult.
• Encourage children to keep personal information out of their prompts. This includes names, school details, addresses, private photographs, and sensitive health or family information. For ChatGPT, parents with linked teen accounts can also disable model training and saved memory. While these settings reduce certain uses of their information, they are not a reason to treat a chatbot as a confidential diary.
• Watch for growing emotional reliance on AI. If you find your child increasingly turns to AI for reassurance, friendship, or emotional support, check in and help them reconnect with people they trust.

If your child mentions self-harm or suicide, take it seriously and seek human help promptly. Contact a qualified healthcare professional or crisis service. If there is immediate danger, contact local emergency services. Don’t wait for a chatbot or a parental notification to tell you to act.

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.