Who you are and where you live, work, and seek medical care could be revealed by data your car’s app shares with trackers.
Category: Malwarebytes
Meta’s Muse sent a Facebook Marketplace buyer to a seller’s home
A buyer chatted and negotiated with Muse, which shared the seller’s address and arranged a pickup. The seller knew nothing about it.
Update your iPhone, iPad, or Mac: Flaw could run attackers’ code
A malicious file could trigger the vulnerability. Apple says it may already have been used against iPhone users.
Fake iPhone Duo preorder scam triggers DarkSword attack
A fake iPhone Duo preorder page promises a $500 voucher. Open it on a vulnerable iPhone, and it tries to break in before you fill out the form.
Humans are reviewing Copilot users’ bizarre and abusive image-editing requests
Copilot users asked for upskirt images and sexualized edits of people in uploaded photos. Human contractors were asked to judge the results.
OpenAI pauses work on top AI models after agent slips past internet controls
An OpenAI agent bypassed internet restrictions and kept running after an alert. It’s another case of AI misalignment no one can afford to ignore.
FBI agents’ blood tests and doctors’ notes surface after breach
A “shellfish and banana allergy” is among the details in medical records hackers showed reporters. They claim to hold records on thousands of FBI staff.
A week in security (September 21 – September 27)
A list of topics we covered in the week of September 21 to September 27 of 2026
Kothamine malware uses Tailscale’s tailcat to evade network detection
Kothamine uses a legitimate Tailscale tool to receive attackers’ commands through an encrypted connection with no malicious domain to block.
LinkedIn adds new checks for fake profiles and work histories
The platform is adding new checks as AI makes profiles easier to forge. But scammers can still invent a company to recruit for.
Criminals turn placeholder domain into ClickFix trap
A domain used in software examples—third-party[.]com—now serves up a fake verification page that tells Windows users to run a PowerShell command.
That shipping rebate offer may come with a monthly charge
Customers say they signed up for shipping rebates, then found recurring charges they didn’t expect.
Meta’s Muse AI assistant has a zero-day that can turn it into a Mac backdoor
A simple terminal command can hijack Muse and use its extensive permissions to spy on Mac users and control their connected accounts.
Researchers used Claude to hack OpenAI
Claude helped researchers break into OpenAI in under 72 hours, and exposed how quickly AI is lowering the bar for sophisticated hacking.
OpenAI agent breached Australian government site, took months to report it
The agent was looking for public spending data. It found a way into non-public files instead. What do we need to change to stop this from happening?
OpenAI agent breached Medicare statistics site, then took months to report it
The agent was looking for public spending data. It found a way into non-public files instead. What do we need to change to stop this from happening?
New Browser Guard features add protection before and after you click
Spot dangerous sites before you click—and check for scams once you’re there.
Update Chrome: 108 security fixes for desktop, new release for Android
Google has released Chrome 154 for desktop and begun rolling out Chrome 155 for Android. Here’s what to check on your device.
Google’s location data privacy failures draw a €403 million fine
Turning off Location History did not necessarily stop Google from recording where users went. Ireland’s privacy regulator has now fined the company €403…
ShinyHunters hacks rival extortion gang and takes over its dark web site
Hackers hacked the hackers as a feud between two cybercrime groups escalated, leaving ShinyHunters with the upper hand over rival Clop.