JEDI-SEC | Security Research & Digital Defense

Day: October 22, 2026

  • The Current Landscape of OAuth Attacks

    The Current Landscape of OAuth Attacks

    Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments.

    Source: Palo Alto Networks Unit 42 · 2026-10-22

  • Facebook’s misleading privacy claims land Meta a $25 billion penalty

    Facebook’s Cambridge Analytica scandal may feel like very old news. But the consequences are still arriving, and the latest comes with a $25 billion price tag.

    Reuters reports that a New Mexico judge has ordered Meta to pay $25 billion in civil penalties after a jury found that Facebook misled consumers about its data practices and its handling of hate speech and misinformation. Meta says it expects to win on appeal.

    This case is about more than information ending up in the wrong hands. It concerns what Facebook told people about who could access their information, how much control users had, and how the company enforced its own rules.

    What Facebook told its users

    In September, jurors found that the company and its leadership made 26 misleading statements on data privacy, hate speech, and other subjects. For example, Mark Zuckerberg’s 2010 statement that:

    “We do not share your personal information with people or services you don’t want.”

    That assurance appeared in a statement the jury found misleading. The judge found that choosing who could see a Facebook post did not necessarily control what outside app developers could access. That access was governed by separate settings that many users did not know existed.

    New Mexico’s attorney general filed the lawsuit in 2021, following revelations that Cambridge Analytica obtained personal information from as many as 87 million Facebook users through a third-party app.

    But New Mexico’s case went beyond Cambridge Analytica.

    The state challenged Facebook’s representations to consumers about its data practices and its efforts to address misinformation and hate speech. The case centered on misleading consumers under New Mexico’s Unfair Practices Act, the state’s consumer protection law.

    The state argued that third parties had broad access to users’ information and that Facebook tolerated harmful content when doing so benefited its business. Meta disputed the allegations, denied selling users’ information, and said the state had taken statements out of context.

    New Mexico’s Department of Justice says the jury found 43,899,725 violations of state law. That does not mean nearly 44 million individual New Mexicans had their data taken. The count reflected the estimated audience for each misleading statement, rather than the number of individual people affected.

    State law allows penalties of up to $5,000 per violation. Judge Francis Mathew found that a penalty exceeding $219 billion was warranted under the law but reduced the amount to $25 billion.

    The judge said earlier penalties had failed to stop Meta from misleading consumers, including a $5 billion FTC penalty in 2019.

    The money is not earmarked for compensation payments to individual Facebook users. According to Attorney General Raúl Torrez, state law directs the penalties to New Mexico’s school system.

    Meta’s chief legal officer, C.J. Mahoney, said the company is confident it will prevail on appeal and characterized the lawsuit as an attempt to impose “a tax on speech.” Meta has also argued that a multibillion-dollar penalty risks violating constitutional protections concerning due process and excessive fines.

    How to stay safe on social media

    The case illustrates why privacy is not just a matter of choosing who can see a post. In a separate 2019 case, the Federal Trade Commission (FTC) alleged that Facebook had shared users’ information with third-party apps used by their friends, even when those users had chosen restrictive privacy settings.

    A few precautions can help you limit what you share, although settings alone cannot guarantee privacy:

    • Share selectively. Leave optional profile details blank, limit who can see your posts, and avoid publishing sensitive details such as your address or live location. Ask permission before posting information or photos involving other people.
    • Check app permissions. Does a social media app really need your contacts, precise location, or entire photo library? Turn off unnecessary access in your device settings.
    • Review tracking and advertising settings. Look for controls covering personalized ads, activity outside the platform, and data sharing. Restrict what you can, but don’t assume opting out of personalized ads stops all collection.
    • Be selective about connected apps. Before connecting a quiz, game, or other service to your account, check what information it requests. Decline access that seems excessive for what the service does.
    • Remember what “private” means. Restricting your audience helps control who sees your posts. It does not stop the platform itself from collecting or using information about your activity.

    Scammers don’t need to hack you. They just need you to click once. 

    Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

    Source: Malwarebytes Labs · 2026-10-22

  • Disgraced Indian cert issuer leaves the cert issuing business

    Disgraced Indian cert issuer leaves the cert issuing business

    After embarrassing reports revealed weak private keys, one of which was just a single digit, Indian certification authority eMudhra has decided to take the L and get out of the global SSL/TLS cert game entirely. eMudhra announced Thursday that it was abandoning that arm of its business. Sure, the intense scrutiny heaped on the company was a factor, but the firm also argued that growing compliance costs and competition from free certificate providers had made the business increasingly difficult to justify. “Global SSL/TLS is a small part of eMudhra’s business contributing to about 1 percent of the global revenue,” the company explained, noting that free SSL/TLS cert issuance from large firms and increased compliance and data sovereignty requirements have made it a minor part of the firm’s operation, and one that doesn’t merit so much bad press. “The level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business,” eMudhra explained. “In view of this, after detailed deliberations our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders.” An argument could be made that, even if SSL/TLS accounts for just 1 percent of its global revenue, a private CA key with a value of 4 still deserves a thorough public shaming. It’s only been two days since eMudhra’s weak private keys were exposed in public reports, following a report to Mozilla on October 17, and it wasn’t exactly hard for security researchers to recover them: The eight affected private-key values ranged from the number 4 (yes – a plain old number 4), to 56 and 66, to the far more complicated 115, 155, 156, 230, and 237. No quantum computer required to crack those keys. Wow – better save the qubits. This wasn’t just an embarrassing collection of numbers, either: The weak keys belonged to eight intermediate certificate authorities, potentially allowing attackers to forge certificates trusted by systems that hadn’t blocked them. eMudhra, however, maintains that the affected CAs had issued no end-entity certificates. eMudhra quickly went on the defensive about its mind-boggling key-management failure, acknowledging the weak keys while pointing to independent audits and a problem during its key-generation ceremony that it said produced the weak keys alongside the intended strong ones. “A flaw in the key generation ceremony caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys,” the company said the day after the key fiasco was reported. “The weak keys were the ones published to the browser root stores.” Despite that, eMudhra said the relevant certificate infrastructure had undergone two years of independent audits and had been in browser trust lists since mid-2025, raising questions about why the weak keys weren’t caught sooner. eMudhra claimed on Thursday that the affected CAs had issued no end-entity certificates, that it had revoked those CAs within 14 hours of discovering the issue, and that neither its infrastructure nor its data had been compromised as a result of its key boo-boo. Still, the incident has given eMudhra another reason to shave off a small part of its business rather than continue facing scrutiny over its certificate operations. It’s still going to issue a root-cause report and fulfill its remaining commitments to browser root programs as it winds down the business. The company said it’ll continue to serve G1 RSA roots until it transitions customers to other certificate issuers, which it will do free of charge. “Revocation and certificate status services will keep running until every issued certificate has expired or been replaced,” the company said. ®

    Source: The Register — Security · 2026-10-22

  • How Generative AI is Scaling Transnational Repression

    Kate Pundyk, Siena Anstis, and Marcus Michaelsen write about the rise of AI-enabled digital transnational repression in their piece for Just Security. The use of AI models to identify, monitor, and target diaspora activists and exiled dissidents around the world demonstrates how the misuse of technology produced by companies like Anthropic can have an adverse impact on human rights.

    Read the article

    Source: Citizen Lab · 2026-10-22

  • PHP2Shell Exploit Tooling Found on Exposed Attacker Server

    PHP2Shell Exploit Tooling Found on Exposed Attacker Server

    SOCRadar Threat Intelligence Unit (STRU) researchers found PHP2Shell exploit tooling on an attacker-controlled server whose working directory was exposed through an open, unauthenticated directory listing. The files show an operator turning the PHP2Shell vulnerabilities into practical attack tooling: a full remote code execution (RCE) chain built and tested in a lab, plus scripts that screen live websites for the conditions that chain depends on. 

    The screening reached public websites across Europe, North America, and Asia, including the United Kingdom, Finland, Poland, France, Canada, the United States, and China.

    Key Takeaways

    • Working exploit chain: An exposed attacker server held a lab-tested PHP2Shell exploit for PHP 8.4.26 running as Apache mod_php, the last vulnerable 8.4 release.
    • Live target screening: Companion scripts checked about 20 public websites for the PHP version, server setup, and session settings the exploit needs.
    • No successful exploitation observed: None of the screened sites met the exploit’s preconditions, and the operator’s results show no shell access.
    • Configuration matters, patching decides: Hardened production settings blocked this chain, but only updating to a fixed PHP release removes the risk. 

    Our main FAQ blog, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), covers the flaws, fixed versions, and remediation. To see whether a specific site still needs that fix, SOCRadar’s free PHP2Shell Checker flags its exposure in seconds, with no signup, agent, or exploitation.

    SOCRadar's free PHP2Shell Checker
    SOCRadar’s free PHP2Shell Checker

    How Did SOCRadar Find the Server?

    The data comes from SOCRadar’s own platform. The server was one of the exposed hosts captured through SOCRadar Threat Hunting, and every file analyzed here was collected passively from its open directory listing.

    What the Exposed Server Held

    A Lab-Built PHP2Shell Exploit Chain

    The central file, aslr_exploit.py, is a Python exploit the operator labels a “one-click” PHP2Shell exploit for PHP 8.4.26 under Apache mod_php. It works entirely over ordinary HTTP requests in three broad steps: it recycles the target’s PHP worker, leaks memory addresses through the session cookie to defeat address space layout randomization (ASLR), and then abuses PHP’s session upload progress handling to run a shell command.

    The script ships with two calibration profiles, one for the official PHP 8.4.26 Apache container image and one for a custom lab build, and it defaults to a local target. That points to an operator who has tested the chain against containers they control.

    aslr_exploit.py
    aslr_exploit.py

    What Conditions Does the Exploit Need?

    The chain depends on a debug-style setup that hardened production servers rarely use:

    • Visible errors: PHP errors displayed to visitors.
    • Weak session settings: Session upload progress on and session strict mode off.
    • Tight resource limits: A very low memory limit and a single Apache worker.
    Settings the exploit depends on, compared with hardened values
    Settings the exploit depends on, compared with hardened values

    Even when those conditions are met, the payload can run only a very short command, so a real attack would need a second-stage script. The mod_php focus matches PHP’s own advisory, which rates mod_php deployments as the highest risk.

    How Did the Operator Screen Live Websites?

    Three companion scripts take the work from the lab to real websites. All of them send traffic through a rotating proxy pool hosted on the same server, switching proxies between targets.

    How the operator moved from a lab exploit to screening live websites
    How the operator moved from a lab exploit to screening live websites

    Fingerprinting PHP Versions and Server Setups

    The first script, php2shell_fp.py, works through a list of about 20 websites. It reads each site’s PHP version from the X-Powered-By and Server headers and guesses whether the site runs mod_php based on how those headers appear together. It then sends a small multipart request with an upload-progress field and a random session ID to see whether the site echoes the session back.

    php2shell_fp.py
    php2shell_fp.py

    Probing for Exploit Preconditions

    The second script, deep_probe.py, examines 11 of those sites more closely. It requests a page designed to trigger a PHP warning to see whether errors are shown, and tries six common phpinfo paths to read settings such as the memory limit and upload progress state. It also tests 11 common parameters for file inclusion and sends an upload with a unique MARKER_ filename to test session injection.

    deep_probe.py
    deep_probe.py

    What Do the Results Show?

    The saved results cover those 11 sites, which include a university, nonprofits, and small businesses across Europe, North America, and Asia. Six ran PHP 8.4 releases older than the fix, four of them on 8.4.26 itself, while the rest reported 8.3, 8.2, or end-of-life 5.6. None displayed errors, exposed a phpinfo page, revealed a file inclusion flaw, or echoed the test session, so none met the exploit’s preconditions.

    PHP versions and exploit preconditions found across the 11 probed websites
    PHP versions and exploit preconditions found across the 11 probed websites

    This finding concerns the operator’s PHP2Shell tooling specifically. Other files on the same server point to unrelated intrusion activity against financial and Web3 targets.

    WordPress Follow-Up Reconnaissance

    A third script, wp_attack.py, turns to five of the WordPress sites. It enumerates users through the REST API and author redirects, checks for about two dozen popular plugins, lists XML-RPC methods and tests pingback, and looks for exposed debug logs.

    wp_attack.py
    wp_attack.py

    Assessment

    • Target CVE: We assess with moderate confidence that the tooling targets CVE-2026-109618, based on its use of the session upload progress path and its focus on PHP 8.4.26.
    • Capability: The operator shows strong exploit development skills, but as of October 22, 2026, we have seen no evidence of shell access on any screened site.
    • Attribution and motivation: The operator remains unattributed. Other files on the same server target cryptocurrency and Web3 platforms, which points to financial motivation. 

    The Operator’s Wider Toolset

    PHP2Shell is one part of a broader operation here. As previously mentioned, other tools recovered from the same server show an operator working well beyond PHP exploitation:

    • Secret harvesting: Pulling API keys and backend URLs out of websites’ client-side JavaScript.
    • Endpoint sweeping: Testing web and API routes, including admin paths, for unauthenticated access.
    • Proxy rotation: A pool of rotating proxies to spread traffic and evade rate limits and blocking.

    Related artifacts on the server additionally point to web-archive reconnaissance and automated CAPTCHA solving. Taken together, the toolset points to a financially motivated actor focused on cryptocurrency and Web3 targets. This activity is separate from the PHP2Shell screening.

    What Should Defenders Do?

    • Update PHP: Move to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Hardened settings stopped this chain, but they will not stop every variant.
    • Block and hunt the server: Block 206.188.197[.]105 at the perimeter and search web and proxy logs for past connections.
    • Look for screening traffic: Flag multipart POST requests with a PHP_SESSION_UPLOAD_PROGRESS field from unfamiliar sources, especially uploads named MARKER_ followed by eight hex characters.
    • Harden until patched: Keep display_errors off, set session.use_strict_mode=1, disable session.upload_progress.enabled, and remove any public phpinfo pages.
    • Stop advertising versions: Set expose_php=Off so the X-Powered-By header no longer reveals the PHP version scanners look for.

    Indicators of Compromise

    Type Value Role
    IPv4 206.188.197[.]105 Attacker staging and operations server
    IPv4:Port 206.188.197[.]105:9999 Exposed operator working directory (HTTP directory listing)
    IPv4:Port 206.188.197[.]105:8899 Rotating proxy pool endpoint
    IPv4:Port 206.188.197[.]105:8888 Out-of-band interaction listener
    Upload filename MARKER_[8 hex characters].txt Session injection screening probe
    Session ID prefix fprint, dp Upload-progress screening probes

    MITRE ATT&CK Mapping

    Tactic Technique ID Observed Behavior
    Resource Development Develop Capabilities: Exploits T1587.004 Built and lab-tested a PHP2Shell RCE chain
    Reconnaissance Gather Victim Host Information: Software T1592.002 Read PHP and server versions from response headers
    Reconnaissance Active Scanning: Vulnerability Scanning T1595.002 Probed sites for upload-progress behavior, exposed errors, phpinfo pages, and file inclusion
    Command and Control Proxy T1090 Routed screening traffic through a rotating proxy pool
    Initial Access Exploit Public-Facing Application T1190 Exploit built for internet-facing mod_php servers; no successful use observed

    Source: SOCRadar · 2026-10-22

  • Spectator Loader Advertised as FUD Resident Loader With Anti-Analysis and Evasion Features

    Malware Service Report
    Loader
    Defense Evasion
    Anti-Analysis
    Unverified

    Spectator Loader Advertised as FUD Resident Loader With Anti-Analysis and Evasion Features

    ServiceSpectator Loader
    AV products referenced16
    Delivery optionsEXE / MSI / sideload
    ContactTox

    Overview

    Spectator Loader Advertised as FUD Resident Loader With Anti-Analysis and Evasion Features

    An actor using the handle “Madrex” is advertising a malware service called Spectator Loader. The Russian-language post describes it as a private resident loader built for long-term persistence, resistance to blocking and evasion of modern security products.

    The advertisement claims the service can be delivered through sideloading or installer formats, uses custom obfuscation, anti-sandbox checks and low-level system-call techniques, and is designed to reduce static and behavioral detection. It also advertises remote-management capabilities such as system-information collection, in-memory payload execution, file transfer, process control, registry operations and filesystem management. These are actor claims from the advertisement and have not been independently validated.

    Post details

    ServiceSpectator Loader
    Actor“Madrex”
    Service typePrivate resident malware loader
    Primary marketing claimsPersistence, FUD, anti-analysis, blocking resistance
    Delivery methods advertisedSideloading, EXE, MSI and custom formats
    Security products referenced16 consumer AV products
    Contact methodTox
    Observed date

    What the post advertises

    • Private resident loader
    • Long-term persistence focus
    • FUD / low-detection positioning
    • Sideloading and installer delivery options
    • Custom metamorphic obfuscation
    • Anti-sandbox and anti-analysis checks
    • Claims resistance to static signatures
    • Claims reduced behavioral detection
    • Low-level syscall-based execution claims
    • Traffic imitation / trusted relay claims
    • System-information collection
    • In-memory payload execution
    • File download capability
    • Execution of multiple file/script formats
    • Registry manipulation
    • Process creation and termination
    • Filesystem management
    • Operator support advertised

    The post also claims its protection stack can detect sandboxes, reverse-engineering tools, hypervisors and virtual machines, and that builds are altered to reduce similarity between samples. These statements are summarized as service claims and are not reproduced as implementation guidance.

    Screenshots


    Screenshot 1Source screenshot

    Spectator Loader Advertised as FUD Resident Loader With Anti-Analysis and Evasion Features



    Screenshot 2Source screenshot

    Spectator Loader Advertised as FUD Resident Loader With Anti-Analysis and Evasion Features



    Screenshot 3Source screenshot

    Spectator Loader Advertised as FUD Resident Loader With Anti-Analysis and Evasion Features

    The supplied captures show the Spectator Loader advertisement, including FUD claims, antivirus and anti-analysis positioning, obfuscation and sandbox-evasion claims, network-resilience claims, remote-management features and a Tox contact identifier.

    IOCs & identifiers

    Identifiers directly visible in the supplied material. These support correlation and do not independently verify the advertised capabilities.

    Type Identifier Source
    Actor handle Madrex Screenshots 1–3
    Service name Spectator Loader Screenshots 1–3
    Tox ID 7EB9EF1A8CCCD4E02F87E0908BE745BE0F355D08B29CC1E74831AE80099A070BE4AD7E2E9B24 Screenshot 3

    No malware hash, Session ID, Telegram handle, attacker-controlled domain or attacker-controlled IP address is visible in the supplied screenshots.

    Mapped techniques

    Claimed identifies behavior explicitly advertised by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the capability has been independently validated.

    • Defense Evasion
      T1027
      Obfuscated Files or Information
      Claimed
      The advertisement explicitly promotes custom obfuscation and build-to-build variation intended to reduce static detection.
    • Defense Evasion
      T1497
      Virtualization/Sandbox Evasion
      Claimed
      The post claims the loader can detect sandboxes, virtual machines, hypervisors and reverse-engineering environments.
    • Command and Control
      T1105
      Ingress Tool Transfer
      Inferred
      The advertised management feature set includes downloading files to the compromised host.

    Potential impact

    If the advertised capabilities are genuine, Spectator Loader could provide operators with a stealth-focused foothold that supports payload delivery, in-memory execution, file transfer, process control, registry modification and filesystem access. Its anti-analysis and evasion claims could also increase the time required for defenders to identify and investigate malicious activity.

    Status Unverified

    Dark Web Informer has not independently verified the loader’s detection-evasion claims, supported delivery methods, anti-sandbox behavior, network resilience or remote-management functionality. The supplied screenshots document the advertisement and visible contact information only.

    Dark Web Informer

    Source: Dark Web Informer · 2026-10-22

  • As AI Risks Grow, Insurers Split on Covering the Damage

    As AI Risks Grow, Insurers Split on Covering the Damage

    Some build specialized agentic AI coverage, while major carriers quietly exclude it — leaving enterprises exposed without their knowledge.

    Source: Dark Reading · 2026-10-22

  • Smugglers Collected Up to $509M on Europe Routes in 2025

    Smugglers Collected Up to $509M on Europe Routes in 2025

    Smugglers netted an estimated $388 million to $509 million from sea crossings to Europe in 2025, according to new research by the UN Office on Drugs and Crime (UNODC). The agency estimated that between 190,000 and 209,000 people were smuggled along four major Mediterranean and Atlantic routes, with criminal networks facilitating between 57 percent and 90 percent of departures. Fees varied widely depending on the journey, ranging from $170 for crossing to Spain’s Canary Islands to more than $7,500 for routes toward Italy and Malta, according to the International Organization for Migration.

    The Central Mediterranean was the busiest route, with up to 100,400 people smuggled, followed by the Eastern Mediterranean with up to 51,300, the Northwest African Atlantic route with 33,000, and the Western Mediterranean with 24,500. These estimates, according to UNODC, reflect all smuggling attempts, including journeys that ended in interception or tragedy. The routes remained deadly: 3,404 people died or went missing in 2025, while another 104,200 were intercepted at sea and returned.

    Source: OCCRP · 2026-10-22

    Documents

  • Scammers are finding new ways to target your phone. Here are 5 ways to protect yourself

    Scammers are finding new ways to target your phone. Here are 5 ways to protect yourself

    The warnings are everywhere these days. Don’t click this. Don’t open that. Don’t scan this. Don’t download that. These messages of caution, however well-intended, are so ubiquitous and constant that it should come as no surprise that some people have started to tune them out.

    How many people? About one in three, according to our recent study.

    Keeping up with every warning can feel exhausting. Meanwhile, scammers are finding new ways to target people and phones give them plenty of opportunities.

    Mobile phones give scammers multiple ways to reach people, from text messages and calls to social media posts. According to a 2022 Federal Communications Commission report cited by the Federal Trade Commission (FTC), texting is a more common communication method than voice or email.

    Criminals appear to be taking advantage of that fact. Consumers reported losing $470 million to text scams in 2024, up 26% from $373 million the year before and more than five times the amount reported in 2020. The FTC cites estimates that text message open rates run as high as 98%, compared to just 20% for email. People’s tendency to open and read their texts helps explain their appeal to scammers.

    Meanwhile, AI is making scams harder to detect, but better at impersonating people and companies to steal money, passwords, and identities.

    Voice phishing, or “vishing,” was a vanishingly small category of crime just a few years ago, but AI has made it considerably more convincing. Vishing doubled in the first half of 2026, according to CrowdStrike’s 2026 Threat Hunting Report. Meanwhile, 16% of adults in the Malwarebytes survey said they had received a voice-cloned phone call impersonating someone they knew in the past year.

    Our data also shows how difficult people find it to recognize scams: 85% of survey respondents said it’s hard to tell a scam from the real thing, up from 66% a year ago. And 84% said convincing video evidence no longer feels like the rock-solid proof it once was.

    Here are five ways to protect yourself

    1. Treat unexpected texts and social media posts with suspicion

     Legitimate institutions generally won’t ask for payment or personal information through unsolicited texts. And if the message is marked “urgent,” all the more reason to pause. Instead, go directly to the company’s official website and inquire there.

    AI-generated images and videos are making it harder to tell what’s real online, so don’t rely on what you see as proof that a request is legitimate. If the content involves someone you know, contact them directly using a number you already trust.

    2. Keep your operating system updated

    This is one of the most effective things you can do to keep your phone safe. Security updates patch vulnerabilities that malware takes advantage of. Malwarebytes’ threat research found Android malware detections rose 151% in the first half of 2025. On both iPhone and Android, automatic updates help decrease risk.

    3. Protect your accounts

    Use a strong, unique password for every account. A password manager can create and store them for you. Where available, use a passkey—a way to sign in using your device, often with your fingerprint, face, or PIN—that resists phishing.

    Turn on two-factor authentication, also called 2FA, for all your apps that allow it. This one step makes it harder for criminals who have your password to gain access to accounts on your phone.

    4. Be skeptical of voice calls, even from your mom

    This can be the hardest one to get your head around, but also one of the most dangerous and fastest-growing. AI-synthesized audio fraud has made it easier for scammers to sound convincingly like a loved one in trouble. Agree on a private code word with family members and friends in case of doubt or emergency. If you’re unsure, hang up and call the person on a number you already have. If the caller claims to be your bank, hang up and call back on a number you look up independently.

    Before opening a link in a text, email, or social media post, check the web address for misspellings or an unfamiliar domain. You can also copy it into the free Malwarebytes Scam Link Check for help assessing it.

    QR codes can hide suspicious links, too. Scammers sometimes place fake sticker overlays on top of legitimate QR codes in public spaces, and QR code phishing is morphing so fast that the FBI issued an alert in January about North Korean hackers using QR codes to target think tanks and government officials. Look for signs of tampering and check the web address your phone displays before opening it. If you’re not sure, don’t open the link. Instead, go directly to the organization’s official website or app.

    Scammers rely on speed and pressure, so the best defense is to slow down. If a message or call feels off, step away and check it through a channel you already trust.

    CNET Editors' Choice Award 2026

    “One of the best cybersecurity suites on the planet.” 

    According to CNET. Read their review →

    Source: Malwarebytes Labs · 2026-10-22

  • EU Regulators to Investigate Booking.com Over Scam Risks

    The EU Commission will assess whether Booking.com has adequately protected customers from phishing attacks

    Source: Infosecurity Magazine · 2026-10-22