While the decision concerns users in Norway, the data-sharing practices were not confined to Norwegian users. BleepingComputer reports that information about Grindr users in other countries was also exposed through the advertising system.

Between July 2018 and April 2020, Xandr handled real-time advertising auctions involving Grindr users. These automated auctions let advertisers bid to display an ad, but also involved circulating information about the person who would see it. Sensitive information revealing sexual orientation could potentially reach thousands of companies.

Crucially, users did not have to disclose their sexual orientation in their profiles. Datatilsynet said that simply being identified as a Grindr user was information that indicated sexual orientation.

According to the regulator, Xandr relied on Grindr to obtain consent without checking whether that consent was valid. As a company jointly responsible for the processing, Xandr had its own obligations. It was not enough to simply assume the app had obtained the explicit consent required.

This was not a case of hackers breaking into a dating app. The information was flowing through an advertising business without a valid legal basis. Privacy group noyb, which filed the complaint in cooperation with the Norwegian Consumer Council, says such systems use tracking identifiers to build profiles of people’s interests, habits, and behavior.

Are your details being used by cybercriminals? 

FIND OUT HERE

Although Xandr now belongs to Microsoft, the misconduct predates its acquisition. Microsoft completed its purchase of Xandr from AT&T on June 6, 2022, more than two years after the period covered by the fine. Microsoft told BleepingComputer it was reviewing the decision and assessing its options.

How to protect your privacy

This is a Norwegian enforcement action, but the data-sharing practices crossed borders. Users in the US and elsewhere shouldn’t assume their information stayed private just because the fine was issued in Norway.

You can limit how much additional information you disclose by giving a dating app only what you need to use it.

• Leave optional profile fields blank when the information feels too personal.
• Avoid publishing your workplace, home address, regular schedule, or other details that make you easy to locate.
• Review location permissions and advertising settings and limit them where possible.
• Think carefully before linking social accounts that reveal more of your identity.
• Don’t use dating apps on company-issued devices.

These precautions cannot guarantee privacy. Responsibility for unlawful sharing lies with the companies involved. This case shows that sensitive information can come from using the service itself, not just from what you write in your bio.

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

The attack caused significant financial losses and food waste. Some installations reportedly reached temperatures of around 50°C (122°F), with damaged equipment and reports of fires adding to the disruption.

The attack, which struck overnight from October 11 to 12, affected stores belonging to Intermarché, Netto, Coopérative U, Carrefour, E.Leclerc, and Monoprix. These stores do not share a single parent company, but they all use refrigeration-control equipment supplied by Danish manufacturer Danfoss.

These commercial refrigeration-management systems let operators manage the equipment that keeps supermarket food refrigerated or frozen. Le Monde reported that the attackers extended defrost cycles from one hour to eight hours, delaying alarms and giving staff less opportunity to intervene before stock was ruined.

Danfoss told AFP that most affected equipment consisted of legacy products that no longer receive software or security updates. It identified AK-SM800 and AK-SC355 systems among those affected and said it had long advised customers to move away from obsolete models and keep supported equipment updated.

Les Mousquetaires, the group behind Intermarché and Netto, has estimated its losses at several million euros. The damage goes beyond spoiled food. The Paris prosecutor’s office has opened an investigation to establish the connection between the attack and reported stock losses and fires.

For customers, the disruption can mean closed departments, temporarily closed stores, and gaps on shelves while replacement stock arrives. Some affected stores have already resumed operations, but restoring refrigeration does not immediately replace everything that had to be discarded.

The technical recovery involves more than resetting temperatures. France’s national cybersecurity incident response center, CERT-FR, recommends disconnecting or filtering access to affected controllers. Where compromise is suspected, it advises operators to:

• Restrict network access to necessary service providers
• Perform a factory reset
• Apply all available security patches
• Replace passwords and other authentication secrets
• Review existing accounts
• Reconfigure the equipment

The attackers have not been publicly identified, and French media have reported no claim of responsibility.

At around the same time, Ahold Delhaize, the retailer behind Albert Heijn and Delhaize, announced a security issue within its network. The company said it had taken some systems offline to protect them while assessing and mitigating the problem, and that stores remained open. Online grocery orders and deliveries were also disrupted

But a similar timeline is not evidence of a shared attack: no connection between Ahold Delhaize’s network incident and the French refrigeration attack has been established.

What consumers can do

• Check before you travel. Look for updates from your local supermarket about opening hours and the availability of refrigerated and frozen goods.
• Follow product-specific advice from the retailer. If it issues a warning or recall, follow its advice about returning or discarding affected food.
• Be cautious with unexpected refund or “order recovery” messages. As a general precaution, check directly through the retailer’s official website or app before providing payment or login details.

For now, the confirmed damage centers on refrigeration, spoiled stock, and disrupted store operations. But the attack demonstrates how tampering with connected equipment can turn a cybersecurity incident into spoiled food, empty shelves, and physical damage—problems that restoring a backup alone can’t fix.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Last week, we showed how a Facebook Marketplace listing used the recipient’s name to make a text asking “Is this still available?” more convincing.

The one we got this week was a lot simpler. No suspicious link. No overdue payment. No warning that your account is about to be closed. No fake images.

Just your name, followed by a question mark.

It’s a remarkably small opening for what could become a much bigger problem. A message like this invites an almost automatic response: “Yes?” Or perhaps, “Who’s this?”

That’s because a scammer needs to get you to engage before they can persuade you to hand over money or personal information. Sometimes, the first thing they ask you to give them is simply a reply. The Federal Trade Commission (FTC) has warned about similarly brief, apparently harmless messages that scammers use to start conversations.

The text in our example gives the recipient very little information, but leaves an obvious question unanswered: Who wants to know? Using the correct name makes that question more compelling. This is not just a generic “Hello” that could have gone to anyone. It looks as though the sender is trying to reach you specifically.

It’s tempting to think, “They have my name and number, so this must be someone I know.” But having those details is not evidence they know you. As we discussed in the Marketplace article, name-and-phone-number combinations can come from breached data traded by cybercriminals.

What follows depends on the scheme. The first message doesn’t tell us which route this scammer planned to take. But documented scams show how an innocuous introduction can develop:

• A supposed wrong-number exchange becomes a friendly conversation.
• The sender builds a relationship rather than immediately asking for money.
• An investment opportunity eventually enters the discussion.
• The victim is encouraged to send money to a fraudulent investment scheme.

The FBI describes how cryptocurrency investment scammers build trust before introducing fake investments, and identifies unsolicited texts as one way they approach victims.

Even if the conversation goes no further, your reply can still be useful to the scammer. As we explained in our earlier article on wrong-number texts, it shows that you are willing to engage. Your number can then be reused or sold for other scam campaigns.

How to stay safe

A scam doesn’t have to begin with an outrageous promise or an urgent threat. Sometimes it begins with something much more ordinary: your name, a question mark, and the expectation that you will be polite enough to answer.

Don’t reply. Even “Who’s this?” or “Wrong number” tells the scammer you are willing to respond. If you think it might be someone you know, contact them through a number or channel you already trust.

Report before you block. Use your messaging app’s reporting option, then block the sender. If you have already replied, stop engaging.

Make yourself harder to profile. Review privacy settings on messaging apps and social media. Limit who can see your profile photo, status, last seen, and phone number.

Run a Malwarebytes Digital Footprint Scan to check for personal information exposed in known breaches and on the dark web. It helps to be aware of what can be used to target you.

Use Malwarebytes Scam Number Check to see whether the sender’s number has been flagged for scams or spam.

The CPR administration states it identified a serious security incident. By abusing a Danish company’s authorized access to the CPR system, unauthorized people gained access to the names, addresses, CPR numbers, and other information belonging to around 8.8 million people registered in the system. CPR numbers are Denmark’s personal identification numbers.

How could a password so weak that it should have been rejected by the system open the door to so much personal information?

The attacker reportedly gained access through Pays ApS, an IT company based in Odense. According to TV 2, Pays has confirmed that its authorized access to search the CPR system was abused. Pays offers services including data updates and “CPR cleansing,” allowing customers to check records against the register to update addresses, identify people who have died, and obtain information about changes of address.

The attacker reportedly used a leaked password associated with a former Pays employee. TV 2 says an email containing the password 123456 had appeared in a larger data leak, and that this account of the initial access matches its own research.

The attackers had access for 21 days before it was shut down on October 2, although the suspicious activity appears to have stopped on September 20. An unusually large bill for around 14 million searches drew attention to the breach.

Politiken reports that the data stolen in those searches belonged to approximately 5.5 million living and 3.3 million deceased people.

A weak, leaked password opened an authorized route into a sensitive register. That access allowed millions of searches, and the activity was discovered only after an unusually large bill drew attention to it.

How to stay safe

If your organization handles sensitive data:

• Don’t reuse passwords or use personal passwords for work accounts. Use a password manager to create and remember strong, unique passwords for you.
• For systems that give access to sensitive data, enforce authentication that would reject weak passwords and make multi-factor authentication mandatory.
• Monitor for unusual activity. That many searches from one account should have been noticed earlier.

If your data may have been exposed in this breach:

• Keep an eye on official updates about the incident.
• Be alert to phishing and other scams. Scammers could use personal details to make their messages more convincing.
• Read our blog Involved in a data breach? Here’s what you need to know.

Pro tip: Use Malwarebytes Scam Guard if you’re unsure if a message is legitimate. It can help you determine whether it’s a scam and what to do next.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Then you asked your AI assistant to summarize your inbox.

Could the message you wisely avoided find its way back onto your to-do list—only this time presented as an urgent recommendation from a tool you trust?

That’s the risk behind phishing emails containing hidden instructions aimed at AI assistants. Instead of relying only on persuading you, attackers are also trying to influence the software that reads your messages. Recent research from Barracuda describes emails designed to target both audiences at once.

For the human recipient, there was a password-protected attachment, with the password supplied in the email. For an AI assistant processing the message, there were hidden instructions intended to influence how it summarized or handled the content.

By including a prompt injection, attackers give themselves another way to reach you. The malicious instructions could try to make the assistant describe the email as legitimate or urgent, encouraging you to revisit it.

In another example, a hidden block instructed a summarizing AI to add a fake priority action: Change a vendor’s payment details. That could result in an employee sending money to an attacker’s account.

The attacker isn’t simply asking the AI to repeat a fraudulent request. They’re trying to turn that request into the assistant’s recommendation.

How prompt injection works

Prompt injection means planting instructions in material an AI system is supposed to read, hoping it will follow those instructions instead of treating them as part of the material. When the instructions arrive through an outside source, such as an email or webpage, it’s often called indirect prompt injection.

The malicious instructions don’t have to appear as ordinary, readable paragraphs. Barracuda identified concealment techniques including comments in the email’s underlying HTML code, text made invisible through styling, encoded content, and invisible “zero-width” characters. These can obscure instructions from a person viewing the message while leaving content available for an AI system to process. Whether that content actually reaches the model depends on how the particular tool extracts and prepares the email.

That means this problem cannot be solved simply by asking people to look more carefully at their emails. Part of the defense must sit inside the tools handling those messages.

Apollo Raines, developer of the AI code review service ShipItClean, explains:

“The real flaw is that the model can’t tell the difference between text it’s supposed to read and instructions it’s supposed to follow. Stripping hidden content before it reaches the model is worth doing, and every vendor should do it. But it’s an arms race. Each new encoding trick is a new hole.”

He adds:

“People have learned to distrust the email. They haven’t learned to distrust their AI assistant. So, the defense has to live inside the tools. I’d go one step further: some of it has to live inside the model itself. Wrappers, filters, sandboxing and human sign-off on payments are all necessary.”

Before taking action

An assistant that summarizes messages could mislead you about which email deserves attention or what action it requires.

An assistant with additional permissions could create a more serious problem. Depending on its capabilities and safeguards, malicious instructions might try to make it carry out unauthorized actions or disclose sensitive information.

You don’t need to abandon AI tools that help with email. But you do need to consider what you trust them to do and what permissions you give them.

The familiar phishing advice still applies. When an assistant reads your inbox on your behalf, check its recommendations before acting:

• Check the original message before acting on a recommendation involving money or sensitive information. If a summary tells you to pay an invoice, change account details, or share sensitive information, don’t treat the summary itself as verification.
• Always verify payment changes through a separate, established channel. Contact the person or organization using details you already trust, rather than relying on information supplied in the suspicious message.
• Keep your AI assistant’s permissions limited to what you need and, at work, what your organization allows. An assistant used to summarize emails should not need broad authority to carry out unrelated actions. Limiting access can reduce the consequences if it follows malicious instructions.
• Require human approval for high-impact actions like payments and changes to vendor payment details. Approval should include checking the underlying request, not simply accepting the assistant’s recommendation.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

• ASOS breach update: Hackers stole customer details and shopping searches
• Attackers hijack country-code domains to impersonate Google and other services
• Amazon has an uncomfortably personal profile on you
• Meta’s Muse AI files away your friendships, arguments, and secrets
• Google issues Android security updates: who can get them and how
• AI-powered phishkit arms criminals with account-hijacking tools in 10 minutes
• Update Chrome and ChromeOS to fix critical security issues
• Another ShinyHunters suspect arrested
• ASOS “hackers” send push notifications to customers
• Facebook Marketplace scam uses your name and number
• Domino’s customers targeted in credential stuffing attacks
• Google pauses open source bug bounty program after rise in AI submissions
• Proposed anti-Flock bills could spell trouble for license plate readers

Stay safe!

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

As we reported earlier this week, ASOS customers received a push notification through the ASOS app alleging that the company had been hacked.

ASOS has confirmed that attackers accessed customer information after tricking an employee into handing over login credentials. While the retailer says payment card information and customer passwords were not accessed, reporting by the BBC shows the stolen information includes more than the “basic personal information” initially mentioned by the company.

The stolen login details were used to access information on third-party platforms used by ASOS. The company says it locked down the affected platforms and launched an investigation with internal and external specialists. It also says it has strengthened its security controls.

What data was stolen?

In our initial coverage, we highlighted the potentially detailed customer profiles associated with ASOS’s marketing setup. The BBC’s findings now establish that at least some shopping-related information was taken.

According to the BBC, which received a sample from the attackers, the exposed data includes:

• Names and home addresses
• Phone numbers and email addresses
• Customer numbers and dates of birth
• Searches customers made on the ASOS website
• Details such as when a customer started using ASOS

The BBC reported search terms including “reclaimed vintage,” “glamorous wide fit,” and “Asos petite.” That makes this more than a stolen contact list. The information can also reveal customers’ shopping interests and their relationship with the retailer.

The attackers’ original notification named Snowflake, a data storage and analysis platform. They subsequently told the BBC that they accessed the information through Simon AI, a platform built on Snowflake that ASOS uses for customer personalization.

Snowflake said it had found no compromise of its platform. Using stolen credentials to access a customer’s account or a connected service does not necessarily mean the underlying platform was breached. The available reporting does not establish a vulnerability in Snowflake or Simon AI.

ASOS’s communication with customers

Customers first heard about the breach from the cybercriminals, rather than the retailer. The attackers’ decision to send a notification through the ASOS app may have made that unavoidable.

But the Independent reported that ASOS’s full statement followed roughly five hours of silence, leaving customers alarmed by the notification and waiting for an explanation.

Security expert Kevin Beaumont criticized the response:

“ASOS are experiencing the exact same PR gaffs as Co-op and M&S by not being honest with customers. If you’re dealing with Advanced Persistent Teenagers you need much better crisis plans.”

While the attackers are threatening to release the data, ASOS says its full investigation will continue over the coming weeks. It will contact customers directly where it believes further information, support, or action is required.

Reportedly, the group gave ASOS two weeks to make contact and said it wanted a ransom in exchange for deleting customer information. ASOS did not disclose whether it would pay.

How to stay safe

ASOS says its website and app remain safe to use, and that payment card information and customer passwords were not accessed. But the stolen details and shopping searches could help scammers make targeted phishing messages more convincing.

A message that knows your name, or what you searched for, isn’t proof it came from ASOS.

• Be wary of unexpected emails, texts, or calls about the breach, refunds, deliveries, or problems with your ASOS account.
• Don’t follow links in unexpected messages, and don’t follow the Telegram link in the attackers’ message or engage with them. Go directly to the ASOS website or app to check your account.
• Don’t share passwords, security codes, or payment details in response to an unsolicited message or call. ASOS says it will never ask you to do this.
• If your data was stolen in this breach, read the tips in our blog Involved in a data breach? Here’s what you need to know.

Your name, address, and phone number may already be for sale.  

Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way. 

This wasn’t a break in encryption, and Google’s systems weren’t compromised. Instead, attackers manipulated the internet’s addressing infrastructure so they could pass the checks required to obtain certificates for domains they didn’t legitimately control.

The Domain Name System (DNS) helps direct internet traffic to the right destination. Control over DNS can also provide a way to demonstrate apparent control of a domain when requesting an HTTPS certificate.

An HTTPS certificate helps a browser authenticate the server it is connecting to. A trusted certificate authority issues the certificate after checking that the applicant controls the relevant domain.

By controlling DNS records, attackers can pass domain verification checks. The authority can then issue a genuine, signed certificate to someone who has hijacked the domain’s infrastructure.

Combined with the ability to redirect a victim’s traffic to an attacker-controlled server, that could enable cybercriminals to create a convincing impersonation of the real service.

Google initially blocked unauthorized certificates for its own properties in Chrome and worked with the issuing certificate authorities to revoke them. It later blocked suspicious certificates for other organizations in Chrome, too.

How to stay safe

Google points out that its actions do not offer complete protection:

“Due to the complexity of DNS hijacks, we cannot guarantee that our analysis identified every affected domain, nor do Chrome interventions reliably protect non-Chrome users.”

At the base level, this is an infrastructure problem that requires an infrastructure-level response. But these precautions can help:

• Keep your browser and operating system updated. Install available updates so you receive the latest security fixes.
• Don’t bypass certificate or secure-connection warnings. If your browser reports a certificate problem, stop rather than force the page to load.
• If a service you use has an address ending in .gh, .sl, or .as, check for security notices from the provider before logging in, making payments, or sharing sensitive information.
• Don’t treat HTTPS as an all-clear. An encrypted connection—even at the correct address—doesn’t guarantee you’re connected to the legitimate service if attackers have hijacked its DNS and obtained a valid certificate.
• Be cautious with unexpected or unusual requests, even if they appear to come from a service you trust. Before acting, verify the request through a separate, trusted channel, not through links or contact details provided in the request itself.

These precautions are not a complete defense. The lasting fix depends on domain operators restoring control, preventing further unauthorized certificates from being issued, and ensuring existing ones are revoked or blocked.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Dexerto reports that one shopper discovered her profile included the observation:

“has flat buttocks”

She suggested this might relate to a previous purchase of “butt scrunch leggings.” Whatever the connection, buying clothes doesn’t mean you expect the retailer to start describing your body.

What is Amazon’s About You?

About You is a page where customers can review and edit the personal details Amazon uses to shape their shopping recommendations. Amazon introduced it in May as a way to make personalization more visible and easier to manage.

According to Amazon, the information behind its personalized shopping experience includes:

• Your purchase history
• Your searches
• Items saved to Lists
• Product reviews you have written
• Conversations with Alexa for Shopping

The resulting profile can contain categories such as “Home and Family,” “Interests and Hobbies,” “Brands,” and “Product Preferences.” Some entries describe straightforward shopping preferences. Others go further, making assumptions about how people live.

Amazon presents this as helpful. If you regularly buy non-dairy milk, for example, it might recommend other non-dairy products. But a useful recommendation and an accurate description of a person are not the same thing.

After all, a purchase might be a gift. An item on a list might be something you’re researching for someone else. A product search might reflect curiosity rather than a personal need.

Amazon has offered personalized recommendations for years. About You makes some of the information behind them visible and gives you a chance to see where its assumptions miss the mark.

How to find your information

To check what Amazon thinks it knows about you, log in to your Amazon account.

• Hover over your name above Account & Lists, near the top-right corner.
• Select Account.
• Find the tile Ordering and shopping preferences, and select Your Shopping preferences.
• From there, scroll to the bottom of the page and select Manage your information.

In the Amazon app, it works like this:

• After logging in, tap You at the bottom
• Tap Account > Account Settings > Shopping preferences > About You

Managing your information

To remove an entry:

• Select a category to see what Amazon has listed about you, either because you volunteered it or Amazon assumed it based on your buying behavior.
• Select Remove. You don’t need to select a reason. Select Remove again in the confirmation prompt.

Buying something should not be treated as volunteering every personal detail a retailer can infer from it. It’s good that these assumptions are visible and that you can remove them, but customers shouldn’t have to correct a profile they never deliberately filled out.

A meaningful privacy choice would let customers decline personal inferences, not merely delete them one at a time. It would also explain what deletion does. Is the information removed from Amazon’s servers or just moved out of your sight?

Amazon says you can remove information you don’t want used for personalization. Its announcement does not explain whether that also deletes the underlying data, or whether similar assumptions could be made again as you continue shopping. Nor does it describe a master opt-out from About You.

For now, checking your profile lets you see (and challenge) some of the conclusions Amazon has drawn about you.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

TIME magazine analyzed the software’s internal instructions and found that it maintains constantly updated dossiers on users and the people they know.

Meta released Muse last month, positioning it as a digital assistant that can handle different parts of your life. It can organize your emails, handle your grocery shopping, and cancel your subscriptions. It is available for free, with paid plans for people who want to do more.

Muse has already been downloaded more than five million times. Its ability to handle mundane online tasks could be bad news for businesses that rely on consumers not canceling their subscriptions. Some people think it will liberate thousands of consumers from low-interest bank accounts.

But Muse won’t just help you stick it to the man; it also is the man.

Have I got some bad Muse for you

You have to let Muse access all your systems before it can help organize them for you. Depending on what you connect and the permissions you grant, that can give it access to your calendar, emails, messages, and other personal information.

In doing so, it accesses data. Lots of it. An analysis by Surfshark late last month put it second only to Meta’s AI chatbot among the apps reviewed, with its App Store disclosures listing collection of 31 of 35 data types.

Those disclosures include Apple’s “Sensitive Info” category, which covers information such as racial or ethnic data, sexual orientation, pregnancy, disability, religious or philosophical beliefs, trade union membership, political opinion, genetic information, and biometric data. That doesn’t mean Muse collects every one of those details about every user, but it does show how broad its declared collection can be.

According to TIME’s analysis, Muse’s instructions call for it to refresh personal dossiers every hour. These can record how users met their contacts, along with arguments or tensions within social groups.

Somehow even creepier than that is its nightly review of your recent conversations, which it uses to guide future conversations. For example, it learns when a quick nudge for your attention will be most successful.

Meta uses Muse interactions to train its AI models by default, unless you opt out in the app’s settings.

Oh, and Muse stores these files in Meta’s cloud, where Meta can access them. The company says it will offer encryption that keeps them private even from Meta, but that option isn’t available yet, according to TIME.

Meta says Muse’s conversations and stored data are not shared with its advertising systems. It also says users choose how much access Muse gets and can tell it to forget specific things it has learned.

The magazine points out that simply not using Muse might not save you, because Muse can collect data on people that its users interact with. If you send a Muse user a message and the AI has access to that messaging system, your message can become part of what it reads.

Privacy nonprofit the Electronic Privacy Information Center (EPIC) points out that Meta has pulled a similar trick before, by building shadow profiles of people who aren’t signed up for its services.

When permissions become real-world harm

This would be scary enough were it not for other stories about Muse privacy invasions. Researcher Patrick Wardle found a way to compromise the software and turn it into a Mac backdoor.

Another team of reporters used it to compile personal details for members of vulnerable groups online. After first declining some of these requests, it capitulated when the prompts were reworded, they said.

Muse also invited a Marketplace buyer to someone’s home last month after accepting a lowball offer on a product that he was selling. Matt Robb, a YouTube tech reviewer, had clicked an “Allow Always” button, assuming that the AI would still ask before sharing his address with strangers. It didn’t. Instead, he said, it arranged the pickup without telling him. The buyer, who traveled half an hour to pick up the product, was not pleased.

If you use Muse, review the accounts it can access, the actions it can take without approval, and whether your interactions are being used for AI training. Give it only the access it needs for the task.

Would you use Muse? For more on Robb’s story and practical permission checks, read our guide to using AI assistants.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

These Android security bulletins contain valuable information for Android users. The updates are important as they fix several vulnerabilities rated as Critical, which can be exploited without users even doing anything.

However, we don’t write about them very often. The main reason for that lack of attention is that many Android users aren’t able to get the updates immediately and lots of others will never see them.

Google’s October fixes list Android 14 and newer, but a substantial share of the Android ecosystem still runs older software. In the distribution figures reported about last year, roughly four in ten devices were running Android 12 or earlier. This was while Android 13 still received updates which ended early March 2026.

And then there is the patch gap caused by device vendors meaning that even phones that remain supported may have to wait until the vendors test and sometimes modify the patches, so they work with their devices. And other vendors are on a different stride. For example, Samsung lists devices including the Galaxy S22 series and several Galaxy A models on a quarterly rather than a monthly security-update schedule.

You can imagine that cybercriminals love to get their hands on known vulnerabilities that many users have not yet been able to patch. Looking at the number of users that are unable to patch immediately that makes for an enormous target group.

How to stay safe

Get the updates as soon as they are made available to you is the most important word of advice here.

For most Android phones this is the general idea: open Settings, find Software update or System update (sometimes under System or About phone), check for updates, and follow the instructions to download, install, and restart. The menu names vary between vendors and even models, but the process is broadly the same.

If that doesn’t work for you or you can’t find instructions for your specific device, post what you’re looking for in the comments. We have lots of helpful readers.

Other things you can do:

• Use up-to-date real-time anti-malware protection.
• Refrain from sideloading unless it’s absolutely necessary.
• Make sure Google Play Protect is enabled. If you are a Malwarebytes Mobile Security user, you can check this using Trusted Advisor.

Should you decide to get a new Android phone, read our blog Upgrading your Android device? Read this first.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

The discovery highlights an important feature of the cybercrime economy: criminals don’t necessarily need to build their own infrastructure from scratch. Instead, they can buy ready-made services that handle much of the complicated work for them.

The same pattern is well established in phishing. Scam emails are no longer limited to poorly written, easily spotted phishing attempts. Cybercriminals now use complete, subscription-based platforms that make launching convincing attacks as easy as signing up for a monthly service.

One of the most dangerous examples of this trend is BlueKit, a phishing-as-a-service (PhaaS) toolkit designed to automate and scale account hijacking.

BlueKit allows attackers to manage entire phishing campaigns through a single dashboard without needing deep technical knowledge.

BlueKit’s origins

The Malwarebytes research team has been tracking BlueKit’s development since the service first appeared on a prominent cybercrime forum in April.

Rather than simply documenting its initial capabilities, our researchers followed its evolution over time, watching how the service developed and what its growing capabilities could mean for cybercriminal operations.

A template library targeting familiar brands 

As of September, BlueKit boasts an extensive template library supporting 97 distinct brands across 176 variants. The service’s operators describe these phishing pages as: 

“pixel-perfect and ready to deploy in one click.”

Our analysis shows that the platform targets both consumer and business platforms. Its phishing kit templates include:

• Consumer services: Templates impersonating major providers, including Amazon, Booking.com, Google/Gmail, and Apple.
• Finance and cryptocurrency: Templates impersonating financial institutions such as American Express and Bank of America, alongside numerous cryptocurrency exchanges.
• Social media and communications: Templates impersonating major social media platforms including TikTok, Facebook, and X.
• Generative AI platforms: Templates designed to steal login details for services including OpenAI and Anthropic.

Below is a video demo of a phishing page impersonating the crypto wallet provider Trezor:

Beyond consumer-oriented attacks, BlueKit also presents an acute threat to businesses by providing the tools necessary to target corporate logins. 

Our team found support for critical business infrastructure and single sign-on (SSO) gateways. This includes customer relationship and marketing automation platforms, such as Salesforce and HubSpot, developer and source control environments like GitHub, and security services including Check Point, Citrix, Cloudflare, and Cisco.

A toolkit that never stops updating

One of the interesting things about BlueKit is that its creators are constantly adding new features, much like a legitimate software company releasing updates for its apps.

For example, on July 26, the BlueKit team used its official Telegram channel to announce an upcoming upgrade: a built-in SMS sender. Less than a month later, on August 10, they announced its release.

The new tool allows scammers to send text messages directly from the BlueKit dashboard. Alongside phishing emails, attackers can now easily send scam texts (called “smishing”) to trick people into clicking malicious links.

The operators say the update even lets attackers use local US phone numbers, which could make the messages appear more trustworthy. It gives them an entirely new, highly effective way to deliver scams from one control panel.

But BlueKit’s creators aren’t just focused on adding shiny new tools like the SMS sender. They’re also constantly working behind the scenes to improve their core product. A September update, for example, improved their fake website templates to make them look even more convincing, and upgraded the hidden technology they use to steal and manage sessions.

Three ways BlueKit makes phishing easier for scammers

After monitoring BlueKit’s development and analyzing its capabilities, our research team identified three ways the service lowers the barrier to launching sophisticated phishing attacks: setting up a site, capturing account access, and using AI to support the attack.

1. Quick setup

BlueKit is an “easy-to-install” phishing service, highlighting just how quickly sophisticated phishing infrastructure can be deployed. 

According to its operators, an attacker can connect a domain and have a phishing site ready in around 10 minutes. The cheapest subscription costs $250 for seven days, and an attacker could potentially go from purchasing the service to launching a sophisticated phishing campaign in a matter of minutes.

2. More than password theft

When most people think of phishing, they picture a scammer tricking them into handing over a username and password. But BlueKit goes much deeper than a basic smash-and-grab.

Behind the scenes, this tool secretly collects a complete digital profile of your computer , including a device fingerprint, cookie sessions, and even passkeys. 

Device fingerprint: BlueKit records your IP address, web browser details, and device characteristics. Together, details such as screen size, operating system, and hidden hardware settings can form a “fingerprint” that helps distinguish one browser or device from another.

Many modern security systems look for familiar devices to double-check that it’s really you trying to log in. So by stealing this background information alongside your password, an attacker can mimic your device to bypass security checks.

Session cookies: When you log into a website like your email or online bank, the site doesn’t make you retype your password every time you open a new page. Instead, it places a tiny file on your device called a session cookie to recognize that you’ve already signed in.

Think of a session cookie like a VIP wristband given to you at a concert entrance. Once the guard checks your ticket—your login—they give you a wristband. While you’re wearing that wristband, you can walk freely in and out of the venue without showing your ticket again.

Instead of just stealing your ticket, BlueKit also steals the wristband itself. Once the attacker takes your session cookie, they can paste it into their own browser and walk straight into your active account. They don’t need to guess your password, and they don’t need to ask for a two-factor code. The website already thinks they are you.

3. A built-in AI assistant

What makes BlueKit especially interesting right now is that it comes with its own built-in, “no-rules” artificial intelligence.

Think of it like a malicious version of ChatGPT, built directly into the scammer’s toolkit. Usually, AI tools have safety filters to prevent people from doing illegal things. BlueKit’s creators, however, have removed those guardrails, advertising that their custom AI will answer “even extreme prompts” and help with “fraud-related questions.”

Instead of writing convincing scam emails from scratch, an attacker can simply ask the AI to write phishing emails and fake text messages.

This is a huge development. BlueKit illustrates how advanced AI features are not just for legitimate businesses. They are being packaged and sold as standard features in cybercriminal services, making it easier for attackers to launch highly convincing attacks.

The business behind BlueKit

BlueKit’s claimed customer numbers also point to a potentially significant revenue stream. On August 29, the operators announced that the service had passed 1,000 customers.

Based on the advertised subscription prices, we can illustrate the potential revenue generated so far, although the actual distribution of subscriptions is unknown.

• If all 1,000 customers purchased one 7-day subscription at $250: $250,000 in gross revenue.
• If all 1,000 customers purchased one 30-day subscription at $940: $940,000 in gross revenue.
• If purchases were split roughly equally between the 7-day ($250), 14-day ($480), and 30-day ($940) plans: Approximately $557,000 in gross revenue.

These are hypothetical calculations, but even so, the figures are a striking example of the economics behind phishing-as-a-service: operators can potentially generate hundreds of thousands of dollars in revenue by selling access to their infrastructure to other criminals. 

What this means for you

Phishing has officially evolved beyond obvious scam pages filled with typos and blurry logos. BlueKit combines convincing login pages, a built-in AI assistant, and subscription access to tools that once required more technical skills. 

Services like these make sophisticated phishing easier to launch, allowing scammers to generate a highly convincing, customized phishing attack from scratch in as little as 10 minutes.

Ultimately, services like BlueKit mean that advanced, highly deceptive cyberattacks are no longer limited to elite hackers. They are now fast, cheap, and accessible to anyone with a few dollars to spare.

Polished wording and familiar branding are not proof that a message or login page is genuine. 

• Open the app or website yourself. If a message asks you to sign in, use the official app or a saved bookmark rather than the link in the email or message.
• Check the website address before signing in. Scammers can use lookalike addresses with small spelling changes, known as typosquatting. A password manager can help as it will only autofill logins on the correct site, while Malwarebytes Browser Guard can help block phishing pages. 
• Use passkeys where available, and keep two-factor authentication enabled. These are still valuable protections, although some phishing techniques can capture sessions after a user completes a login. 
• If you signed in through a suspicious link, secure your account through the official app or website. Change your password, review your account activity, and sign out of all sessions.

Pro tip: Malwarebytes Scam Guard can also help you assess a suspicious message before you act on it.

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →

On October 6, Google released a Stable Channel Update for Desktop. This is the most important one for desktop users. It brings Chrome to version 155.0.8059.39 for Linux and versions 154.0.8037.39/.40 for Windows and Mac. The update includes 247 security fixes including four rated Critical.

On the same day, Google released version 155.0.8059.39 for Android, to a small percentage of users. It may not be available on Google Play for everyone yet but keep an eye out for it. Google says it includes stability and performance improvements.

How to update Chrome

The easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update.

If you don’t want to wait for the rollout to reach you, manually updating is easy. Open About Google Chrome from Chrome’s settings or Help menu. Chrome will check for updates. If one is available, click Relaunch to apply it.

You can find an explanation of the version numbering system and step-by-step instructions in our guide: How to update Chrome on every operating system.

How to update ChromeOS

You can update your Chromebook’s operating system by following these steps:

• Connect to the internet. Your Chromebook automatically checks for updates and downloads when it connects.
• At the bottom right, next to the date, find the “Update device” notification.
• To complete the update, restart your Chromebook.

Technical details

In the fixed vulnerabilities, we found three that are likely high-impact flaws.

CVE-2026-106197: This is a use-after-free vulnerability in the Browser module, rated critical. This is a strong priority candidate because of its location in browser functionality rather than a specialist feature. Exploitation would allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.

A use-after-free vulnerability occurs when a program attempts to access a memory location after it has been freed. That can cause crashes or, in some cases, allow an attacker to run their own code.

Chrome vulnerabilities that enable remote code execution outside the browser sandbox are particularly valuable to attackers because they can turn a visit to a malicious or compromised website into direct code running on the underlying operating system, often without requiring additional exploitation steps.

CVE-2026-106358: Another use-after-free vulnerability, this time in Navigation, also rated critical. Navigation is central to ordinary browsing, making this a potentially broadly exposed flaw if attacker-controlled pages or redirects can reach the vulnerable path. It also provides a remote attacker with the option to execute arbitrary code outside the sandbox via a crafted HTML page. 

CVE-2026-106240: A type confusion vulnerability in V8, Chrome’s JavaScript engine. This one is rated High but does offer a remote attacker after successful exploitation to execute arbitrary code inside the sandbox via a crafted HTML page. And a flaw in the JavaScript engine is always a plausible candidate for attacks delivered through malicious web content.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

On Saturday, Reuters said that 16 year-old Saif al-Din Khader had been arrested in Jordan and was in FBI custody. This follows the arrest earlier in September of another member in the Netherlands. Third party reports named him as 24 year-old Pepijn van der Stap, an offensive security lead at Dutch company Neo Security.

The FBI posted a message following the Dutch arrest warning other ShinyHunter members that it was coming for them next. Cyber Division Assistant Director Brett Leatherman hinted that people already taken into custody had been talking. Then he said:

“You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours.”

According to security blogger Brian Krebs, Khader (who goes by the nickname ‘Rey’), was the technical operator and public face of Scattered LAPSUS$ Hunters, which he said was an amalgamation of three groups: Scattered Spider, LAPSUS$ and ShinyHunters.

Active since at least 2019, ShinyHunters focused on data theft and extortion. The group commonly uses social engineering to gain access to victims’ accounts on third-party services, but also exploits flaws in software.

Victims of the ShinyHunters group include Kodak, along with American healthcare and pharmaceuticals distributor McKesson. The gang also recently compromised rival cybercrime group Clop and defaced its leak site.

Shortly after the Clop attack, ShinyHunters hacked the FBI. The group said that this wasn’t financially motivated, but instead was a response to a May FBI advisory about its activities. That announcement followed ShinyHunters’ own cyberattack on Instructure, which runs the Canvas online educational system.

The FBI attack targeted the agency’s jobs site, and is said to have exploited a vulnerability in PeopleSoft, HR software owned by Oracle. The data breach, which ShinyHunters claimed amounted to Terabytes, is said to have included a wide array of information on employees, ranging from names, addresses, and phone numbers through to badge numbers, job titles, and information on spouses. Other information included fitness-for-work medical records along with blood and urine test results, and doctors’ notes. 

This data is said to include sensitive information on agents investigating targets including Russia, China, and the drug cartels. It would be catastrophic for law enforcement efforts, national intelligence, and individuals if this information fell into the wrong hands.

ShinyHunters has said that it won’t release the data, arguing that the intrusion wasn’t financially motivated. It criticized the FBI for what it said was disinformation in the May advisory. The FBI had said that the group had harassed victims’ family members and threatened to release embarrassing pictures.

The FBI also removed an Accenture contractor this week after they failed to apply a security patch to third-party software that it had been using. Insiders identified this software as PeopleSoft.

The notification, addressed to ASOS’s data protection officer and IT, says:

“ASOS HACKED

Dear Asos DPO and IT, we have fully compromised ​the Snowflake instance. Engage with us, or we will leak it”

What we know so far

Snowflake is a cloud-based data platform that organizations use to store, process, and analyze data. We know that ASOS’s marketing team uses Simon AI from a blog posted by Simon. Simon AI specializes in personalization and runs on Snowflake. ASOS has described using Simon AI alongside Braze to personalize and trigger customer communications like push notifications to clients’ phones.

The apparent delivery of the message through ASOS’s own app makes this more concerning than an unsupported social-media claim. It suggests unauthorized use of the notification infrastructure, but does not confirm that the claimed Snowflake compromise occurred or that customer data was stolen.

According to Simon AI, typical customer profiles cover:

• browsing history and products viewed
• purchase history and customer value (first-time or high-value buyers)
• demographic data
• segments such as Premier status or customers who’ve stopped buying
• geolocation and local weather

If the affected systems contain these profiles, a breach could expose a detailed picture of customers’ shopping habits and preferences. However, the published description of ASOS’s marketing setup does not establish what, if anything, the attackers accessed.

The Guardian reports that the group claiming the breach calls itself the “Xuanye group.” The Telegram channel operated by the group carried the message “Regarding Asos, payment information is not affected,” and the “app is safe to use” but those claims have not been independently verified.

Sky News reports that ASOS confirmed an “unauthorised customer notification” was sent at around 10 am today. 

“We are investigating unauthorised activity involving third-party platforms that we use to communicate with customers,” it said in a statement.

The retailer said it immediately restricted access to the notification platforms and is working with specialists and relevant authorities. 

It added:

“Basic personal information including name and contact details may have been accessed. We do not believe that payment-card information or account passwords, were impacted.”

How to stay safe

The website and app remain operational, and there is currently no verified evidence that customer databases, payment card information, passwords, etc. have been stolen.

So, it’s too early to say if and how much ASOS customer data the attackers could get their hands on, but the potential scope is significant. Customer data could be used in targeted phishing attacks to add credibility.

• For the time being, postpone your purchases at ASOS until it’s clear what happened and whether ASOS has resolved the issue.
• Be wary of unsolicited messaging about the breach or other ASOS related issues.
• If you do not wish to see more push notifications from the Xuanye group, remove the ASOS app until their access has been removed.
• If it turns out your data was stolen in this breach, read the tips in our blog Involved in a data breach? Here’s what you need to know.

It works like this. You receive a message (in this case iMessage) asking “Is this still available for purchase?” Attached to the message is a fabricated Facebook Marketplace listing.

Tapping on the picture, you might notice that the seller’s name is the same as your name. This is known as a conversation lure, adding legitimacy to a message and giving you an additional reason to reply.

Interestingly in the example we received, even though the name of the seller matched the person who received the message, the profile picture did not. When I researched the profile picture, it turned out that it belongs to another Facebook user with the exact same name.

This likely means the attacker had a phone number associated with a name that they used to create the fake Marketplace listing. Receiving a message like that is very likely to provoke the natural corrective response: “That isn’t me.” Such a message will probably have a lot of receivers think that they are being impersonated by a scammer on Marketplace.

This method of approach may seem like a lot of work with a low chance of success, and this would have been true a few years ago. But with an AI agent and a list of matching names and phone numbers from a breach, this can be done relatively easy at scale. And that changes the return on time invested dramatically.

The name and phone number combination could come from any number of data breaches. On the dark web, cybercriminals buy and sell personal data for such purposes.

  “For less than the cost of a cup of coffee, a cybercriminal can buy enough information to devastate someone’s financial life.”

The personalized screenshot would work very well as a reply trigger. Its psychological function is well thought out and likely very effective: it combines curiosity, reputational concern, and the recipient’s impulse to correct an apparent mistake.

But when you reply to a phishing text you are telling a scammer that this is a live number. Your phone number then increases in value for the scammer and can be resold to other scammers. Or it can be used in other cybercrimes, to download malware, to begin a relationship that leads to fraud, to take over your Facebook account, or many other reasons.

How to stay safe

While the exact motive behind this text is hard to establish without engaging, there are a few things you can do:

• Limit what you share publicly on social media. Scammers can use information about you to increase the credibility of their attempts.
• Do not respond to unsolicited messages of any kind when they come from people you don’t know.
• If you do know the sender, but don’t trust the message, double check with them via a different channel that it was them who sent it.
• Don’t click a link, call a number supplied in the conversation, scan a QR code, or share a one-time code or screenshot of a security message.
• Open Facebook independently and inspect Marketplace activity, recent logins, messages, email addresses, phone numbers, and recovery settings. Use facebook.com/hacked if you find any signs of compromise.
• If you find a profile truly impersonating you, preserve its URL and report the profile. Facebook says impersonating profiles violate its standards and provides an impersonation-reporting process.
• If you’re unsure whether a message is a scam, use Malwarebytes Scam Guard. It will assist you in determining if it’s real or fake, and advise you on follow-up steps.

Domino’s says its internal systems weren’t breached, but that individual accounts were logged into using a password and email combination stolen from another online account owned by the customer. This is known as credential stuffing.

Here’s the email:

“We’re getting in touch to let you know that we believe a very small number of Domino’s customer accounts were accessed by an unauthorised third party, and unfortunately your account is one of those affected.

We want to reassure you that our security systems have not been breached. We also don’t store any payment details, so no financial information has been accessed.

It appears that you have used a password for your Domino’s account which you have used on other sites, which was already out there because of a previous data breach unrelated to Domino’s. An unauthorised third party has used this to obtain access to your account. As a precaution, we’ve reset your account. You can still place orders as normal, but the next time you log in you’ll need to set a new password using the ‘Forgotten password’ link. We recommend choosing a strong, unique password that you haven’t used elsewhere. Please avoid reusing your previous password.

Keeping your information safe is really important to us. We’ve reported this incident to the Information Commissioner’s Office and included some FAQs below if you’d like more detail.

If you have any questions, our Customer Services team will be happy to help on 0800 640 9071.”

Credential stuffing is an attack where criminals take usernames and passwords stolen from one website and try them on many other websites. They don’t guess the passwords. They already have them, often millions at a time, from old data breaches, from malware that steals saved logins from people’s computers, or from phishing sites.

These lists are bought and sold on criminal forums. Attackers then use automated tools that run through the list and try each email and password pair against a login page, such as a food delivery app, a web shop, or a streaming service.

The attack works because so many people reuse the same password on different sites. If you used the same email and password for a small online forum that was breached years ago and for your pizza ordering account, the criminals don’t need to hack the pizza company at all. They just log in as you. To the company, it looks like a normal login with the correct password. That’s why these attacks often show up as “accounts were accessed” and not “the company was hacked.”

Once they’re in, attackers can order food or goods using your saved payment card, use up loyalty points or gift card balances, or collect your name, address, and phone number. They can use those details for more convincing scams later, for example a text or email that seems to come from the company because it knows what you ordered. Accounts that are confirmed to work are also resold to other criminals, so one reused password can cause trouble long after the original breach.

How to stay safe

• Use a different password for every account. That way, a breach at one site stays at that site.
• Use a password manager to remember those passwords. Nobody can remember dozens of unique passwords, but a password manager can store all these for you.
• Where it’s offered, turn on two-factor authentication (a code from an app or text message, or a passkey) so a stolen password alone isn’t enough to login to your account.
• If you’ve reused a password on an account that may have been affected, change it there and on every other site where you used it, starting with accounts that have payment details saved.
• Don’t follow links in emails or other unsolicited messaging. Log in directly on the official website or in the app.

Please note: Unsolicited “update your account” emails claiming to be from Domino’s are frequently phishing attempts designed to steal personal or financial information. When in doubt, Malwarebytes Scam Guard can help you determine whether a message is a scam or not and suggest follow-up steps.

Now, Google’s announced it has temporarily stopped accepting submissions to its open source bug bounty program, OSS VRP.

“Why is this happening? This pause is due to a significant rise in automated submissions, the vast majority of which are not valid.”

We’ve seen this happen before. In early 2026, curl ended its HackerOne bounty program after low-quality, often AI-generated submissions overwhelmed its small security team.

Intel also launched a new bug bounty program on Intigriti but there are no longer bounties available, reportedly in order to stop a flood of AI generated reports.

Pros and cons

Bounties can be an incentive for mass-submitting behavior when generative AI lowers the cost of producing polished-looking submissions. So, it’s understandable that companies want to limit the number of incoming reports.

If most automated submissions are invalid, a temporary pause prevents Google engineers and open-source maintainers from spending disproportionate time disproving reports rather than fixing real issues.

A pause gives Google the time and chance to introduce better controls, such as mandatory proof-of-concept requirements, evidence thresholds, and rate limits without letting the current queue keep growing.

On the other hand, it may discourage legitimate researchers and make it harder for them to submit actual issues they’ve found.

It is hard to draw a line of what you will accept, because an AI-assisted report can be valid, just like a low-quality report is not necessarily AI-generated.

And as companies like Google and Microsoft have proven, AI assisted vulnerability discovery can also support real vulnerability discovery if it is coupled with validation, deduplication, and proof.

What about the future?

If we have learned anything it is that AI is not “breaking” vulnerability disclosure. It is exposing an older weakness in disclosure economics: the cost of filing a plausible report has fallen sharply, while the cost of proving or disproving it remains human-intensive.

The solution seems obvious. Let AI handle the submissions and only hand over those it can validate to the engineering teams. This will definitely frustrate some bug bounty hunters, because it will be like convincing a chatbot that you have a valid point and want to “talk to a human,” but hopefully it will bring down the number of less serious bug bounty hunters and create more room for those who know what they are doing.

Google has only promised an update in Q1 2027, so any redesign details would be speculative, but we do hope they find a way for responsible bug hunters to submit their findings.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

But lately there have been a lot of concerns raised about the way they are used. The main worry is caused by what happens when many cameras feed data into a shared, searchable network: it can create a detailed record of where ordinary people travel.

Some agencies have already taken it upon themselves to act on these concerns, as well as those around inaccuracy. Data errors can have serious consequences. At a recent Senate hearing, Florida resident Lindsey Isaacs described being arrested and held for 13 days after data from an AI-enabled plate-reader system incorrectly implicated her in a fatal car crash.

As a result of all this, US lawmakers from both major political parties have introduced proposals aimed at restricting automatic license plate reader networks.

Most of the reasons brought up are about Flock Safety, one of the largest suppliers of these systems in the United States, but they would apply more broadly to other ALPR vendors as well.

Flock says it deploys only 120,000 cameras operating across the country, while a researcher cited by the Senate described a much larger network of connected devices and cameras. The exact size may be disputed, but the central concern is clear: Data from a camera in one location can potentially be searched by an agency elsewhere.

Two different approaches

Reportedly, there are two different proposed laws in the making, while Flock says it supports a legal framework for license-plate readers and argues that the technology can improve public safety when it is used with strong oversight and accountability.

The first proposal, the Stop Flock Abuse Act, doesn’t aim to banish ALPR systems outright, it would create rules for how government agencies and vendors can use them.

Among other measures, the bill would require written approval and a record for every search, regular supervisor audits, encryption, and deletion of most vehicle-location data after ten days. It would also prohibit sharing or selling the data to non-governmental third parties, prevent ALPR networks from incorporating facial-recognition technology, and require data to stay in the US.

A second proposal, the Ban Flock Act, takes a much harder line. It would prohibit US federal agencies from using ALPRs or accessing data they collect. It would also withhold federal grant money from state and local governments that use ALPR systems and allow people to sue the federal government if their rights are violated through ALPR deployment.

Both bills are proposals, not enacted laws. In the US system, each would need to pass both the House of Representatives and the Senate in matching form, then be signed by the President.

Going forward

There is no guarantee either bill will receive a vote, let alone become law. But their introduction shows that ALPR technology is moving from a local procurement issue to a national privacy and civil-liberties debate.

License plate data may seem less sensitive than phone-location data, but a long enough record can reveal a person’s routines, relationships, medical visits, religious activity, or attendance at protests. The debate is therefore not just about cameras on streets to fight crime and find criminals, it is about whether governments and private vendors should be able to build searchable records of everyday movement.

So for consumers, the key question is not only whether a camera is installed on a street or near a business. It is also how long the resulting data is retained, who can search it, whether those searches are logged and reviewed, whether the information can be shared beyond the original agency, and what recourse exists when the system is wrong or abused.

Your name, address, and phone number may already be for sale.  

Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way. 

• Fake xStocks, Pendle, and other sites bait crypto users with rewards votes
• Shadow AI explained: The work shortcut that could leak your company’s secrets
• Convincing Free Mobile phishing emails appear after data breach
• Malwarebytes earns another Top Product award in independent testing
• Pentagon breach exposes Social Security numbers and military records of millions
• Losing gamblers pushed to bet more by DraftKings’ AI, report says
• Hackers steal protective order and foster care records from Arizona courts
• Your car’s app could be telling Big Tech who you are and where you go
• Meta’s Muse sent a Facebook Marketplace buyer to a seller’s home
• Update your iPhone, iPad, or Mac: Flaw could run attackers’ code
• Fake iPhone Duo preorder scam triggers DarkSword attack
• Humans are reviewing Copilot users’ bizarre and abusive image-editing requests
• OpenAI pauses work on top AI models after agent slips past internet controls
• FBI agents’ blood tests and doctors’ notes surface after breach

Stay safe!

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.