Malwarebytes Blog

This surveillance tech is a real problem--it's making everyone unsafe and should be regulated. The other thing is that people willingly buy phones full of spyware. E.g. quite many Samsung models have the Israeli AppCloud installed (supposedly to recommend applications): https://www.malwarebytes.com/blog/news/2025/11/budget-samsung-phones-s… Even though AppCloud itself may be for recommendations it apparently mines a lot of data and each such background application, it is another potential attack vector, and I suppose that the Isreali government can compel the company to use their software for different purposes (not sure). In contrast to what some news articles state, some Samsung models sold in Europe also have it and nobody seems to really care about it (nor the persistent Meta services, etc.).

You mean like the Roomba robots enabled with cameras that have sent embarrassing images back to the mothership where employees have access to the footage and then share on their socials? No, not could be. They already are. I never did follow the home security system with a drone that would fly around your home with a camera. Not sure if that died a glorious death because it was just dumb or what happened to it. I was just waiting to hear about it leaking all sorts of things too. https://www.malwarebytes.com/blog/podcast/2023/01/a-private-moment-cau…

Google won't even make sure that the ads they show you above the search results are safe https://www.malwarebytes.com/blog/news/2025/01/the-great-google-ads-he…

Malwarebytes | Senior Full-Stack Developer | Full Time | REMOTE/ONSITE UTC-3 to +3 (Estonia or Portugal) https://www.malwarebytes.com/jobs?p=job/ow4pqfw9&hn=true I'm looking for a great engineer for my team. Together we will continue to build performant API integrations and human-friendly UI. Our hiring process involves only a few stages for great candidates. Feel free to apply via the link!

> I am personally unaware of any serious reason to believe that Firefox’s numbers will improve soon. Here's a reason: https://www.malwarebytes.com/blog/news/2023/11/chrome-pushes-forward-w… The solution is to use Firefox. uBlock Origin works best in Firefox: https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-best-on-Fir…

Since Firefox is apparently going to follow google with blocking ad blocks, do you have any thoughts of what browser you might move to next? Firefox said it will adopt Manifest V3 in the interest of cross-browser compatibility. https://www.malwarebytes.com/blog/news/2023/11/chrome-pushes-forward-w…

Okta try not to get hacked for a month challenge [level impossible]. In all seriousness, they seem to love getting pwnded. You would hope that the constant stock drops as a result of events like these would force change, but I guess not. 1. https://www.malwarebytes.com/blog/news/2023/01/okta-breached-again-no-… 3. https://www.theverge.com/2022/4/20/23034360/okta-lapsus-hack-investiga… 3. https://techmonitor.ai/technology/cybersecurity/okta-cyberattack-digit…

“RansomWhere? is a utility with a simple goal; generically thwart OS X ransomware. It does so by identifying a commonality of essentially all ransomware; the creation of encrypted files.” https://objective-see.org/products/ransomwhere.html For a deep dive into this line of thinking, his post: Towards Generic Ransomware Detection (04/20/2016) — https://objective-see.org/blog/blog_0x0F.html Malwarebytes purchased an activity detecting product and claimed to offer this type of protection, though that marketing has become more generic now: https://www.malwarebytes.com/cybersecurity/business/what-is-next-gener… Given AV firms change hands and veer into dark patterns, forum posts like this one shouldn't recommend anything in particular as the ownership and policies can change overnight.

I'm a very techy person and I interact with modals as little as possible, even if that means ignoring a chunk of my screen. I have a probably-unreasonable sense that it's only going to trigger a bunch of JS or something unsafe [1]. [1]: https://archive.is/TZ7oe was the best, but is kinda dead now. https://blog.malwarebytes.com/threat-analysis/2016/01/clickjacking-cam…

I'd like to see the return of classic "donationware" shareware - where the app is fully functional but the about box notes that it is shareware and asks you to pay if you end up using it regularly. Sure scammers could try to pass it off as their own work, bundle it with adware/spyware installers, etc. but what's the point of getting a bogus bundle when you can just download the original for free from the developer's web site? Note: even "legitimate" download sites like download.com used to be notorious for basically doing just that, and possibly ranking higher than the developer site in search results. They also hosted deceptive ads with large, fake, "download" buttons [1]. The current incarnation seems to have improved in that regard, fortunately. [1] https://blog.malwarebytes.com/cybercrime/2012/10/pick-a-download-any-d…

mpv is fantastic. I recently decided to abandon MPlayerX when I found out about their incredibly dishonest malware bundling tactics[1] but was surprised at how few good media players there are for macOS, until I read about mpv. mpv took a little bit of getting used to since it doesn't offer a lot of useful stuff out of the box (automatically queuing files, subtitle downloads, etc) but since you can write quite powerful scripts for it that didn't remain a problem for long. [1] https://blog.malwarebytes.com/puppum/2016/09/pup-friday-mplayerx/

I see a lot of recommendations for Transmission and qBittorrent. Having used both of them, I found them both to be great. My only concern is that the Transmission site was hijacked and the download was replaced with ransomware [1]. For those still using Transmission, what are your thoughts on this? [1] https://blog.malwarebytes.com/threat-analysis/2016/09/transmission-hij…

You're right but there's also truth to what you quoted. I switched to Windows 10 earlier this year and before doing so I had concerns about privacy issues, malware, and the half-baked UI. The following three solutions somewhat addressed the privacy and malware concerns: * https://www.oo-software.com/en/shutup10 * https://www.malwarebytes.com/antimalware/ * https://www.glasswire.com/ I use Wox [1] as an Alfred replacement so most of my interactions with applications is via that. Other than that most of my time is spent in tiled browser windows, editors or IDEs, and terminals so I could really be using any OS. I wouldn't say it's perfect but using OS X and then Arch involved different compromises. [1] https://github.com/Wox-launcher/Wox/

I've started looking at profiles of the non-technical "AI at any cost" people on Reddit and noticed a trend towards AI generated NSFW posts and anime. Unsurprisingly they tend to have zero tolerance towards accepting legitimate criticisms or concerns. After reading about the blackmail a school system in the UK faced because criminals took a public post of 10 year old soccer players and generated sexual child abuse materials with the real girls faces it's in everyones best interests to not post their children's images until or unless we can regulate this behavior. https://www.malwarebytes.com/blog/family-and-parenting/2026/05/deepfak… "By November 2025, IWF reports of AI-generated CSAM had more than doubled year over year, rising from 199 to 426. Girls accounted for 94% of the victims. Reported cases included children ranging from newborns to two-year-olds, according to the organization. The ecosystem around these tools is industrial. In April 2025, a researcher found an exposed AWS S3 bucket belonging to South Korean “nudify” app GenNomis containing 93,485 AI-generated images alongside the prompts that produced them."

I never said it was a sole check, I said it was a check. The reality is that app is not thoroughly tested and, even if it was, this would not catch all malware because, again, it's trivial to write malware that can pass a review period and flip on later. First Google search https://www.malwarebytes.com/blog/news/2025/08/77-malicious-apps-remov… Here's 77 found by researchers and then removed. Relying on researchers to find malware isn't a very good bet. If I were a betting man, I would say there are thousands of apps on the play store that you can classify as malware. We will never know the true number because one of the primary goals of malware is to be as difficult to detect as possible. They're not going to declare they're malware, duh. If you know of some algorithm to detect malware, I'd love to hear it. Evidently even trillion dollar companies cannot come up with one. To this day, the best way to detect malware is source code analysis and thorough behavior testing. Google and Apple do neither. Those are just the facts. Do with that what you will, I don't care.

A more constructive response is to explain why it won't work, rather than telling me to explain why it won't work. My first post in this thread has a link that explains why VPN services aren't trustworthy. But the thing I took more issue with is that Tor is omitted entirely. Tor is at least as safe as a VPN. Trying to attack Tor users by registering exit nodes (a Sybil attack) is way more expensive than convincing users to simply not use Tor. The fact that more effort is spent attacking Firefox (i.e., the Tor Browser) than the network is a data point worth considering when deciding your threat model. https://www.malwarebytes.com/blog/news/2024/10/tor-browser-and-firefox… Meanwhile, if you want to do traffic correlation against a VPN service that you don't already own, just pwn the datacenter that the VPN company is hosted in and watch packets coming in/out of the VPN. If you want to try to reframe the conversation to be about defending Tor, you can have that conversation without me. I'm not here to defend Tor, I'm here to advise against using VPN services especially if you have a threat model where Tor is more appropriate. Recommending ProtonVPN over Tor to motherfucking activists is an act of malfeasance that makes me distrust anything coming from this webpage.

A few that might be dangerous. Pfizer, CMS Healthcare, Playstation (Sony), the LA school district, KFC, Freddie Mac (sideshow bob sound...), Capital One, AT&T, Yamaha, Vanderbilt, the Superior Court of California, Square, Siemens Health, Pacific Life Insurance, Ohio Worker's Compensation, Netgear, Micron, HP, Western Union, Warner Music Group, Siemens, Juniper Networks, Forbes, Comcast, City of Tacoma (very financially transparent, cloudy even), Autodesk, and Auburn University. Also, general informational map of those likely affected based on the Ticketmaster breach at least. https://developer.ticketmaster.com/assets/img/products-and-docs/map.jp… Also: Okta also just got hit, and had 99% of user data stolen. Might be related. https://www.govexec.com/technology/2023/11/okta-breach-includes-theft-… The Snowflake breach supposed affects up to 400 companies with a single credential exfiltration. The world wide web's starting to seem like more work than its worth... Also, lots of coverage. Just not front and center. (Reuters) https://www.reuters.com/technology/cybersecurity/live-nation-probing-t… (Fox Business) https://www.foxbusiness.com/technology/hackers-claim-ticketmaster-data… (Bloomberg)…

Malware on the Google Play store seems fairly common. This article from Malwarebytes reported on a family of malicious apps with over 1M downloads: https://www.malwarebytes.com/blog/news/2022/11/malware-on-the-google-p… This paper analyzed 1238 malicious apps grouped into 134 families: https://people.ece.ubc.ca/mjulia/publications/GooglePlayMalware_2022.p… An attacker who can steal these private keys can get malware uploaded to the Google Play store. Getting malware uploaded to Google Play is way easier. And if Samsung's private key is stolen, I would certainly not be inclined to trust their Galaxy Store. Now is a great time to go through your phone & uninstall apps you don't use or don't trust -- especially bloatware from the compromised OEMs. If I understand other comments in this thread correctly, the stolen keys allow the thief to privilege escalate from "ability to issue an update for a random app you have installed" to "ability to root your device".

I certainly did. The whole thing is terrible: its has a false premise, its purported benefits are lies, and ultimately it will be a far worse system that what we have today. > This has numerous benefits due to the inherent benefits of blockchain technology: > Packages will be immutable (no more left-pad incidents) This is a non-argument. Left-pad-tier pissing contests aren't really a problem anymore since NPM changed their deletion policy in direct response to the left-pad incident. The requirements to unpublish an entire package (not just one specific version) on NPM are now [0]: > no other packages in the npm Public Registry depend on > had less than 300 downloads over the last week > has a single owner/maintainer Can left-pad incidents still occur? Yes, but their blast radius is extremely limited. And I'd argue that this is an acceptable trade-off since the ability to unpublish packages is something worth keeping around for accidental screw-ups [1]. The real problem facing node (and other package-heavy ecosystems) is one not addressed by this in any capacity: malicious actors can easily compromise some tiny, insignificant package that nobody pays attention to but which is used by thousands of others by way of dependency creep, maintained by a dev who doesn't use 2FA (or who uses their cell phone for 2FA), and bam, you've just screwed up thousands of CI systems [2]. Imagine what could happen if malicious actors started using container escape vulnerabilities. If…

"The US always claims to have the best cyber-warfare capability on the planet, so presumably they could do ransomware better and faster than gangs like REvil. The US should use this capability to mount ransomware attacks against US companies as fast as they can." This is totally ridiculous. If anything, the US government needs to hack people less, stop dropping broken DLLs[1] and focus on defense. Security needs to be built up and incentivized, not punitively broken down. Practically all of the organizations hit by these huge attacks were not doing basic measures. Many of them not by CVEs from this year as this post implies. It also isn't even "ransomware" in this case since there's no ransom. It's just the government hacking your computer because the military-industrial complex (MITRE) doesn't like you. No hate towards them or CVE, but that's not a good look or policy. --- [1] https://blog.malwarebytes.com/threat-analysis/2021/01/cleaning-up-afte…

> In our tests, some of the Microsoft hosts detected in the Windows 10 HOSTS file include the following: www.microsoft.com microsoft.com telemetry.microsoft.com wns.notify.windows.com.akadns.net v10-win.vortex.data.microsoft.com.akadns.net us.vortex-win.data.microsoft.com us-v10.events.data.microsoft.com urs.microsoft.com.nsatc.net watson.telemetry.microsoft.com watson.ppe.telemetry.microsoft.com vsgallery.com watson.live.com watson.microsoft.com telemetry.remoteapp.windowsazure.com telemetry.urs.microsoft.com I can see the argument for disallowing remapping Microsoft domains in the hosts file as a security precaution [0], but this seems a bit heavy handed. Oh well, there's always pihole. Edit: On second thought, how long before they just start hard coding IP addresses? [0]: https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/

Likely both. I'm no expert in this domain, but from my perspective, due to the nature of cyber warfare, it's all but impossible to have any kind of concrete evidence or smoking gun. Cyber security firms are deliberately very careful in levelling specific accusations with the lack of concrete evidence. For example, researchers at Malwarebytes [1] say: > "While this supports the thesis of APT10 being a government threat group, we caution defenders against associating any one piece of malware exclusively with one group. Countries maintain multiple threat groups, all of whom are fully capable of collaborating and sharing TTPs." > "Variants of PlugX and Poison Ivy were developed and deployed by Chinese state-sponsored actors. They have since been sold and resold to individual threat actors across multiple nations. At time of writing, it is inappropriate to attribute an attack to Chinese threat actors based on PlugX or Poison Ivy deployment alone." Likewise, the report put out by PwC and BAE [2] label APT10 only as a "China-based actor". They cite things like attacks occurring during Chinese timezones and CCP-interest aligned hacking as evidence. This is all great circumstantial evidence and while compelling, it is far from conclusive. The report does not mention the Chinese Ministry of State Security even once. We can say how likely or unlikely something is, but the likelihood of something in the context of circumstantial evidence should not be taken as a full-on indictment.…

Install MalwareBytes — https://www.malwarebytes.com/

Or their app was configured to let other LE agencies access it without their knowledge in violation of state law (1). Only linked one case but afaik it happened in a number of CA cities. (1) https://www.malwarebytes.com/blog/privacy/2026/02/flock-cameras-shared…

I'm not sure that I agree that the iOS devices have equal protection. The recent Darksword exploit should give everyone pause in asserting that iOS is secure: https://www.malwarebytes.com/blog/mobile/2026/03/a-darksword-hangs-ove… I trust iOS with my banking and financial apps in a way that I would never trust Google, but I am under no illusion that any architecture can be completely secure. On the Linux side, I have found SELinux maddening at times in forcing me to the syslog to enable and permit what I need the machine to do. I have never seen anything this obstreperous in a BSD, but perhaps I have not looked with sufficient depth. In any case, the Trust / SELinux / Enforcing status is a sizable advantage against iOS.

A Vibes backed company too, it seems.[1] [1] https://www.malwarebytes.com/blog/news/2026/02/age-verification-vendor…

Google API keys have been used for ages on the frontend. For example on Google Maps embeds. Those are not possible without exposing a key to the frontend. They weren't secret, until Gemini arrived. https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-th… https://medium.com/@ahhyesic/your-google-maps-api-key-now-has-access-t… https://www.malwarebytes.com/blog/news/2026/02/public-google-api-keys-…

The first assumption has been long disproved since multiple full scale Discord data leaks. If it's a public server, it can be scraped. https://www.malwarebytes.com/blog/news/2024/04/billions-of-scraped-dis…