Find out where and how victims can report online scams to prevent more victims and possibly recover funds.

If you’ve been scammed it’s really important to report it, if you can, in order to help prevent others falling for the same scam, and give authorities a chance to catch the criminal who did it.

The methods in which to report a scam varies according to the country you’re in, the platforms you’re using, and the outcome of the scam, so here are the most common methods you may need. Remember to report to both the authorities and the platforms the scammers are using.

**How to report a scam in the United States**

*   **Report to the FBI’s Internet Crime Complaint Center (IC3):** File a complaint online at ic3.gov as soon as possible. This is the main hub for cybercrime reports and helps with investigations and to gather intelligence about scams and the people behind them. Rapid reporting can also help support the recovery of lost funds.
*   **Contact local law enforcement:** If you lost money, you should also file a report with your local police department.
*   **Notify your bank or credit card company:** Inform them about the fraud in order to freeze accounts or reverse charges where possible.

**How to report a scam in Canada**

*   **Canadian Anti-Fraud Centre (CAFC):** Call 1-888-495-8501 or report online. The CAFC collects fraud reports nationwide and coordinates with law enforcement and the National Cybercrime Coordination Centre (NC3).
*   **Local police:** Report the scam to your local police department, especially if you lost money.
*   **Credit bureaus:** It is advisable to contact Equifax Canada and TransUnion Canada to order a free credit report immediately and ask that a fraud alert be put on your file.
*   **Financial institutions:** Notify your bank or credit card issuer immediately, but also to the financial institution that transferred the money in case that’s a different one.

**How to report a scam in the United Kingdom**

*   **Action Fraud:** Report online at actionfraud.police.uk or call 0300 123 2040 (Monday to Friday, 8 am to 8 pm). Action Fraud is the national reporting center for fraud and cybercrime. It collects reports about fraud on behalf of the police in England, Wales and Northern Ireland. For fraud in Scotland please report it directly to Police Scotland.
*   **Local police:** For urgent matters or ongoing threats, contact your local police. If the police decide not to investigate your case as a crime, you might still be able to get compensation or money back by bringing a civil case yourself. Talk to a solicitor or asset recovery agent to find out more.
*   **Financial institutions:** Alert your bank or credit card company to suspicious transactions.

**Reporting scams on popular platforms**

In all countries it’s also helpful to report on the platforms where the scam took place or was initiated. Use built-in reporting tools on platforms like Facebook and WhatsApp to report scam accounts or messages:

**WhatsApp**

*   Open the chat with the suspicious business or individual.
*   Tap the business name or contact info at the top.
*   Scroll down and select **Report Business** or **Report Contact**.
*   Block the contact to stop further messages. The last five messages in the chat will be sent to WhatsApp.

**Facebook**

*   Click the three dots on the post, profile, or message you want to report.
*   Select **Find support or report post/profile/message**.
*   Follow the prompts to specify whether it’s a scam or fraudulent activity.
*   Facebook reviews these reports and may remove or restrict the scammer’s account so they can’t use that account anymore to defraud others.

**Other platforms (e.g. Instagram, X, eBay)**

*   Look for “Report” or “Help” links on the profile or message.
*   Follow platform-specific instructions to flag fraudulent behavior.
*   Provide as much detail as possible about the scam.

 How and where to report an online scam 

Have you been scammed online? Here are some tips to limit the damage and follow up steps you may find useful

Unfortunately, people getting scammed online is a frequent event. Scammers are getting better at social engineering and are using Artificial Intelligence (AI) to sound more authentic and eliminate any spelling errors.

It really can happen to anyone, so there’s no need to feel embarrassed if you have been scammed. Importantly, acting quickly can limit the damage. So here are some things you can do if you’ve been scammed.

**1\. Stop all communication immediately**

Cut off contact with the scammer. Don’t reply to messages or calls, as this can prevent further manipulation or requests for even more money or information.

**2\. Secure your accounts**

Change the passwords on all your online accounts, especially financial and email accounts. Use strong, unique passwords and enable multi-factor authentication (MFA) wherever possible. Start with the ones the scammer may have gained access to, but don’t stop there and check all your important accounts as well.

**3\. Monitor your financial statements**

Check your bank, credit card, and payment service accounts for unauthorized transactions. Report suspicious activity to your banks and credit card company immediately to freeze or reverse fraudulent charges. Let them know what went down and find out how they can help you.

It’s really important that you don’t click on sponsored search results when searching for help with resolving a scam. This kind of topic is seen by scammers as a perfect opportunity to scam you even more and they are known to outbid the rightful owners of certain brands. If you’re using a search engine, type the domain name yourself or scroll down to the regular search results.

**5\. Place fraud alerts and check credit reports**

Contact credit bureaus to place fraud alerts on your file. This warns lenders to verify your identity before opening new accounts. Regularly review your credit reports for unfamiliar activity. If this is an option where you live, add a security freeze, more commonly called a credit freeze, to all of your credit reports for free.

*   In the US, for a credit freeze contact Experian, Equifax, and TransUnion.
*   In Canada, for credit monitoring and alerts contact Equifax Canada and TransUnion Canada.
*   In the UK, for credit reports and monitoring contact Experian, Equifax, and TransUnion UK.

**6\. Try to recover your lost funds**

Sadly, recovering your lost funds will not always be possible. However, you may have some options:

*   If you paid the scammer by credit card, request a chargeback through your card provider.
*   If you paid via bank transfer or wire, contact your bank immediately since they may be able to initiate a recall in some cases.
*   If you sent the money via payment apps (e.g. PayPal, Venmo, Cash App), contact the provider to inquire about recovery options.

Never fall for people that claim they can recover payments in cryptocurrencies. These are known as recovery scams.

**7\. Gather evidence**

Keep all records related to the scam: emails, texts, receipts, screenshots, and any communication details. This documentation supports investigations and helps law enforcement track scammers.

**8\. Scan your device**

If you clicked any links or downloaded something during the course of the scam, make sure to scan your device with an antimalware solution. The scammer could have planted something for later use.

**9\. Report the scam**

Reporting is crucial. It helps authorities track criminal patterns and may assist in recovering lost funds. Report to the appropriate national agencies, local police, and the platform where the scam occurred. For more details, see our article on how to report online scams.

**10\. Set up ongoing protection**

Firstly, make sure to protect your device with a security solution like Malwarebytes Premium. Then, protect yourself in the browser using our free Browser Guard. Finally, if you want to check if something is a scam, Scam Guard—our new feature in Malwarebytes Mobile Security—allows you to upload a text, email, or DM to find out if it’s legit or a scam.

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

 Been scammed online? Here&#8217;s what to do 

A list of topics we covered in the week of June 1 to June 7 of 2025

June 6, 2025 - How to update Chrome on every Operating System (Windows, Mac, Linux, Chrome OS, Android, iOS)

June 6, 2025 - Cybercriminals are abusing the hospitality industry and its booking platforms to defraud the travelers that visit them

June 5, 2025 - Ransomware has been discovered by security researchers in fake installers posing as Chat GPT, Nova Leads, and InVideo AI.

June 4, 2025 - Google has released an important update for Chrome, patching one actively exploited zero-day and two other security flaws

June 3, 2025 - As scammers develop new ways of exploiting unsuspecting users, Malwarebytes is introducing Scam Guard to combat this new wave of threats.

 A week in security (June 1 &#8211; June 7) 

How to update Chrome on every Operating System (Windows, Mac, Linux, Chrome OS, Android, iOS)

We often write about important updates for the most popular browser, Google Chrome. Since it would be out of scope to post elaborate update instructions for every possible platform and operating system (OS)—like iOS, macOS, Windows, Android, etc.—we decided to turn this topic into a separate post that is easy to find (and link to). Also, keep in mind that not every update will be available for every platform or at the same time. You can find when the latest update for your operating system was released on this Google Chrome releases website.

Keeping your Google Chrome browser up to date is essential for security, performance, and access to the latest features. Whether you’re on Windows, Mac, Linux, Android, or iOS, updating Chrome is straightforward, if you know where to look.

But first a few words about the version numbers, because they can be confusing at times.

The Chrome version number consists of four parts separated by dots, like this:

**MAJOR.MINOR.BUILD.PATCH**

Each part has a specific meaning. In order of relevance they are:

*   **MAJOR**: This number increases with significant releases that may include major new features or changes. It usually raises in increments about 7 – 8 times per year, roughly every 6 weeks, reflecting Chrome’s release cycle.
*   **MINOR**: This number is typically zero and rarely changes. It mainly supports the versioning scheme but doesn’t usually affect how users track updates.
*   **BUILD**: This number increases steadily and represents a specific snapshot of Chrome’s source code at a given time. It advances with each new build candidate and is the key indicator of how recent the core code is.
*   **PATCH**: This number changes in increments for smaller fixes and security patches applied to a particular build. It resets with each new build and helps identify minor updates within the same build.

For example, a version like **137.0.7151.56** means:

*   Major version 137 (the milestone release)
*   Minor version 0 (standard)
*   Build number 7151 (the code snapshot)
*   Patch number 56 (the latest fix on that build)

**Why does the version number matter?**

The **BUILD** and **PATCH** numbers together uniquely identify the exact code you are running. Even if two versions share the same major number, a higher build or patch number means you have a newer, more up-to-date Chrome version.

Sometimes you might see slightly different patch numbers on the same major build, for example, **118.0.5993.117** vs. **118.0.5993.118**. This usually happens because Google released a quick fix or minor patch shortly after the initial release. Both are part of the same major update, but the higher patch number is newer.

**How to check if you have the latest version**

To verify your Chrome version:

1.  Open Chrome.
2.  Click the three-dot menu (⋮) in the top-right corner.
3.  Go to **Help** > **About Google Chrome**.

Chrome will display your current version and automatically check for updates. If a newer version is available, it will download and prompt you to relaunch once it’s ready updating.

Chrome is updating

**Update Chrome on Windows**

Method 1: Use Chrome’s built-in update feature

1.  Open Chrome.
2.  Click the three-dot menu icon (⋮) in the top-right corner.
3.  Hover over **Help**, then click **About Google Chrome**.
4.  Chrome will automatically check for updates and download them if available.
5.  Once downloaded, click **Relaunch** to complete the update.

To enable automatic updates for Google Chrome on Windows, ensure that the “**Automatically update Chrome for all users**” option is enabled in Chrome’s settings. You can find this setting by going to “**About Google Chrome**” within the Chrome settings. Closing and restarting Chrome may be required to apply the update. 

Method 2: using Windows Update (for Chrome Enterprise)

If your organization manages Chrome updates via Windows Update or group policies, updates may be automatic. Contact your IT admin if you don’t see updates.

Method 1: For each device

1.  Open Chrome.
2.  Click the three-dot menu icon (⋮) at the top-right.
3.  Select **Help** > **About Google Chrome**.
4.  Chrome will check for updates and install them automatically.
5.  Click **Relaunch** to finish updating.

You can also set up automatic browser updates for all users of your computer if Google Chrome is installed in your Applications folder. Go to “**About Google Chrome**,” and click **Automatically update Chrome for all users**.

Method 2: For Chrome Enterprise

As a Mac administrator, you can use Google Software Update to manage Chrome browser and Chrome apps updates on your users’ Mac computers.

**Update Chrome on Linux**

Chrome updates on Linux depend on your distribution and how you installed it.

For Debian/Ubuntu-based systems:

1.  Open a terminal.
2.  Run:

sudo apt update

sudo apt --only-upgrade install google-chrome-stable

3.  Restart Chrome to apply updates.

For Fedora/openSUSE:

1.  Open a terminal.
2.  Run:

sudo dnf upgrade google-chrome-stable

3.  Restart Chrome.

If you installed Chrome via a package manager, it should handle updates automatically when you update your system.

**Update Chrome on Android**

Chrome updates on Android are handled through the Google Play Store:

1.  Open the **Google Play Store** app.
2.  Tap your profile icon (top right).
3.  Select **Manage apps & device**.
4.  Under **Updates available**, look for **Chrome**.
5.  Tap **Update** next to Chrome if available.

Alternatively, if you have auto-updates enabled, Chrome updates automatically. To enable auto-updates for Android apps, open the Google Play Store, tap your profile picture, go to “Manage apps and device,” and then tap “Manage.” Select the app you want to update automatically, tap the “More” button, and toggle on “Enable auto-update.”

**Update Chrome on iOS (iPhone and iPad)**

Chrome updates on iOS come through the Apple App Store:

1.  Open the **App Store**.
2.  Tap your profile icon at the top right.
3.  Scroll down to **Available Updates**.
4.  Find **Google Chrome** and tap **Update**.

If auto-updates are enabled on your device, Chrome updates automatically.

Chrome in App Store’s recently updated section

**Updating Chrome on Chrome OS**

Chrome OS updates include Chrome browser updates:

1.  Click the time in the bottom-right corner.
2.  Click the **Settings** gear icon.
3.  In the left menu, select **About Chrome OS**.
4.  Click **Check for updates**.
5.  If an update is available, it will download and install automatically.
6.  Restart your Chromebook to complete the update.

Summary table of update methods

**Platform**

**Update Method**

**Notes**

Windows

Chrome Menu > Help > About Chrome

Manual or automatic update

macOS

Chrome Menu > Help > About Chrome

Manual or automatic update

Linux

Package manager commands

Varies by distro

Android

Google Play Store

Manual or automatic update

iOS

Apple App Store

Manual or automatic update

Chrome OS

Settings > About Chrome OS

System update

If you still have questions about updating the Chrome browser, let us know in the comments and allow us to update this article.

 How to update Chrome on every operating system 

ChatGPT developer Open AI has been ordered to maintain user chats as it battle a lawsuit from The New York Times and other publishers.

OpenAI has protested a court order that forces it to retain its users’ conversations. The creator of the ChatGPT AI model objected to the order, which is part of a copyright infringement case against it by The New York Times and other publishers.

The news organizations argued that ChatGPT was presenting their content in its responses to the point where users were reading this material instead of accessing their paid content directly.

The publishers said that deleted ChatGPT conversations might show users obtaining this proprietary published content via the service.

The issue was up for debate in a January, where Judge Ona T. Wang suggested that users who heard about the legal case might delete those conversations to cover their tracks. She denied the publishers’ request for a preservation order at the time, but also asked why OpenAI couldn’t segregate and make anonymous data from users who had requested deletion. OpenAI failed to address this, Wang said, leading to her order, granted May 13.

**OpenAI served with court order**

Wang’s order last month said:

“OpenAI is NOW DIRECTED to preserve and segregate all output log data that would otherwise be deleted on a going forward basis until further order of the Court (in essence, the output log data that OpenAI has been destroying), whether such data might be deleted at a user’s request or because of ‘numerous privacy laws and regulations’ that might require OpenAI to do so.”

ChatGPT already retains user conversations by default, using them to train its AI model for future conversations. However, it provides an option to turn off that setting, causing all conversations with a user to be forgotten. The service also has an ad hoc temporary chat feature, which deletes a chat as soon as it’s concluded.

In a letter objecting to the order, ChatGPT said that was being forced to compromise users’ privacy.

“OpenAI is forced to jettison its commitment to allow users to control when and how their ChatGPT conversation data is used, and whether it is retained,” it said. “Every day the Preservation Order remains in place is another day OpenAI’s users are forced to forgo the privacy protections OpenAI has painstakingly put in place.”

Read OpenAI’s full response here:

The publishers have no evidence that the deleted conversations contain more of their content, OpenAI added. It warned that users frequently share sensitive details in conversations that they expect to be deleted, including everything from financial information to intimate discussions about wedding vows.

Engineering the retention of data would take months, the AI giant added.

**The background to the case**

Three publishers (The New York Times, the New York Daily News and the Center for Investigative Reporting) had been suing OpenAI separately for copyright infringement. In January this year, the publishers joined their cases into a single lawsuit.

OpenAI argued that it could use the content under fair use rules because its AI model transformed the content, breaking it into tokens that it then blends with other information to serve its users.

**ChatGPT has a memory**

Even when it does delete chats, ChatGPT retains a separate memory of details shared in conversations that it can use to understand you better. These might include details you enter about your friends and family, or about how you like your conversations formatted. The service allows users to turn off references to these memories, or to delete them altogether.

Caution is key when giving information to any online service, especially AI services, where conversations are often fluid and free-flowing. It’s also a good idea to think twice before sharing anything you’d rather others didn’t see.

 OpenAI forced to preserve ChatGPT chats 

Cybercriminals are abusing the hospitality industry and its booking platforms to defraud the travelers that visit them

Robert Woodford, a recruitment marketing specialist, recently shared on LinkedIn how he fell victim to a highly sophisticated scam while booking a hotel in Verona through Booking.com, providing a striking example of how attacks on the hospitality industry affect travelers.

After completing a legitimate booking—and trading some communications with the hotel—Woodford received a separate message that he believed came from the official Booking.com messaging system. This message requested “missing details” and a prepayment.

But to be safe, Woodford logged into Booking.com directly rather than clicking any links. There, he found the same message in the _same thread_ as his earlier communications with the hotel. The payment link also looked official, as it contained “bookingcom” in the URL. Woodford didn’t realize until after making the payment that the merchant’s name was incorrect and the payment was fraudulent.

Woodford’s story falls in line with a blog I wrote a few months ago about how phishers use fake CAPTCHAs to trick hotel staff into downloading malware. It also demonstrates how travelers can be deceived by increasingly sophisticated cybercriminals exploiting real booking data and trusted platforms.

The Swiss National Cyber Security Centre (NCSC) reported similar attacks where hotel staff were tricked into installing malware through fake CAPTCHAs and malicious clipboard commands. These infections compromise hotel booking systems, allowing attackers to manipulate guest communications and payments.

To be clear, these types of online scams are so effective because the hotel itself has been compromised, and travelers log into official, verified websites and services only to receive malicious messages from cybercriminals who are secretly in control. These aren’t fake websites—these are fake representatives for real hotels using the hotels’ own messaging platforms to speak with customers.

Once the criminals infect the booking system, they can access guest data, and payment information, enabling them to impersonate hotels and reach guests directly.

Adding to this picture is a warning from Arcona Hotels & Resorts who discovered “technical irregularities” and disconnected several locations from the central IT services as a precautionary measure to limit potential damage. ResponseOne GmbH, a company specializing in IT forensics, was brought in to conduct a technical analysis and manage the situation.

Arcona Hotels & Resorts is a German-based company specializing in operating and developing hotels, particularly focusing on leisure and holiday hotels, boutique hotels, and 5-star properties. While we have no direct information about what happened there, the timing and nature of their advisory suggest that this incident might be part of a wider campaign targeting the hospitality industry’s digital infrastructure.

**Advice for travelers**

 Cybercriminals are no longer just targeting guests. They are infiltrating hospitality systems themselves, turning trusted platforms into vectors for fraud.

Robert lost a few hundred quid and the trust in his bank, the travel platform he used, and a bit of trust in his own judgement. While Robert was vigilant and still became a victim, there are some tips to keep in mind:

*   Always access booking platforms by typing URLs directly into your browser rather than clicking links in emails or messages.
*   Verify any payment requests by contacting the hotel or booking platform through official channels. You can also call the hotel directly.
*   Be suspicious of urgent payment demands or requests for unusual payment methods.
*   Use credit cards for bookings where possible, or other options that provide fraud protection.
*   Report suspicious messages to the booking platform immediately.
*   Use browser protection against scams, credit card skimmers, and other malicious sites.

Be aware of the fact that the systems you trust might be compromised. Vigilance and proactive security measures are essential for both travelers and hotels to mitigate these risks.

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

 Booking.com reservation abused as cybercriminals steal from travelers 

Major porn sites have blocked access in France in response to age verification demands.

VPNs (Virtual Private Networks) are suddenly popular in France. Not because France has suddenly become super privacy conscious, but because Pornhub, RedTube, and YouPorn, have blocked access in France.

But why? Last year, France enacted a law mandating that pornographic sites implement stricter age-verification technology.

Since March 1, 1994, French law has prohibited exposing minors to pornographic content. To strengthen this, a 2020 law empowered the French Regulatory Authority for Audiovisual and Digital Communication (ARCOM) to issue warnings to non-compliant online services and seek judicial orders to block access if necessary.

In 2024, the French law on securing and regulating the digital environment (SREN) further enhanced ARCOM’s authority, allowing it to administratively block platforms that fail to prevent minors from accessing pornographic content.

On October 9, 2024, ARCOM adopted a technical framework, approved by the French Data Protection Agency (CNIL), outlining minimum requirements for age verification systems.

The requirements consisted of three major pillars:

*   Reliability
*   Third party implementation
*   Mandatory on each access

Services had until January 9, 2025, to comply with a transitional period until April 9, 2025, during which credit card-based verification was temporarily accepted under specific conditions.

In response to these regulations, the major adult websites like Pornhub, YouPorn, and RedTube have now suspended access in France, citing concerns over user privacy and data security associated with the mandated age verification methods.

This is a major decision for Pornhub because France is its second biggest market behind the US. Alex Kekesi, VP of president of brand and community of Aylo Holdings (Pornhub’s owner) said that:

> “French citizens deserve a government and a regulator who are serious about preventing children from accessing adult content. They also deserve laws which protect their privacy and safeguard their sensitive data.”

In the United States, 19 states have passed laws requiring pornographic sites to confirm a user’s age by checking a government-issued ID, scanning their face, or other methods. The laws have led some of the largest adult sites, including Pornhub, to block users from those states, rather than paying millions for ID-checking services.

Naturally, everywhere where people want to View Porn Normally, the use of VPNs has increased because VPNs can be used to circumvent access restrictions imposed by such regulations. While specific figures for France are not publicly available, similar scenarios in other regions provide insight into user behavior:

*   Florida: Following Pornhub’s decision to block access in response to new age verification laws, VPN demand in Florida surged by an astonishing 1,150% within the first few hours.
*   Texas: After the implementation of comparable laws, VPN usage increased by approximately 234.8%.

**Malwarebytes Privacy VPN**

Malwarebytes Privacy VPN can help adults to decide for themselves what they want to see or not. By choosing a location where no age verification block is in place, you will be able to access your coveted websites while also enjoying:

*   **No-log policy**: Your activity is neither tracked nor stored.
*   **WireGuard** **protocol**: Ensures fast and secure connections, good for streaming.
*   **Server coverage**: Plenty of servers near you to cover countries that are not blocked.
*   **Strong encryption:** To keep your web activity safe from prying eyes.

 Pornhub, RedTube, and YouPorn block access in France, VPN use set to soar 

Ransomware has been discovered by security researchers in fake installers posing as Chat GPT, Nova Leads, and InVideo AI.

Artificial intelligence (AI) and small business tools are being abused as smokescreens to hit unsuspecting victims with ransomware.

In the masquerade campaigns discovered by Cisco Talos, cybercriminals hid malware behind software and install packages that mimicked the websites or names of the lead monetization service Nova Leads, the enormously popular Chat GPT, and an AI-empowered video tool called InVideo AI.

As small businesses quickly adopt AI tools—a recent survey from the US Chamber of Commerce and the strategy firm Teneo revealed that 98% of small businesses already use at least one AI-powered product and 40% use generative AI—these cybercriminal lures pose the next, big threat to sole proprietors and boutique shops.

According to the researchers at Cisco Talos, the threat is twofold.

“Unsuspecting businesses in search of AI solutions may be deceived into downloading counterfeit tools in which malware is embedded,” Talos said. “This practice poses a significant risk, as it not only compromises sensitive business data and financial assets but also undermines trust in legitimate AI market solutions.”

In the first potential online attack, Talos found that cybercriminals created a fake website that closely resembled that of the legitimate company Nova Leads. The company helps businesses with lead monetization through acquisition, conversion, and content creation. But rather than simply copying the look and feel of Nova’s website, the cybercriminals also offered a completely fake, AI-powered product called “Nova Leads AI.”

On the malicious website, users were prompted to download Nova Leads AI for ”free access” for 12 months. If users downloaded and installed the fake software, the ransomware CyberLock was instead deployed. Researchers at Talos analyzed how CyberLock moved throughout a network and retrieved the ransom note left behind by the cybercriminals. In it, the ransomware gang claimed, falsely, that their attacks were altruistic.

“We want to assure you that your payment does not go to us,” the ransomware gang said in its note. “It will instead go to support affected women and children in Palestine, Ukraine, Africa, Asia, and other regions where injustices are a daily reality.”

In the note, victims are directed to pay $50,000 in cryptocurrency. The ransomware campaign is particularly dangerous as cybercriminals managed to manipulate SEO practices to rank their malicious website near the top of relevant online searches. This method, called “SEO poisoning,” is deployed by scammers, hackers, and shady websites.

In a second potential attack, Talos found that a software installer labeled “ChatGPT 4.0 full version – Premium.exe” was actually hiding the ransomware Lucky\_Gh0$t. Interestingly, the files contained within the installer also contained legitimate open-source AI tools from Microsoft, likely as an evasion technique to ward off any antivirus tools inspecting the package for malware.

Though the Lucky\_Gh0$t ransom note did not include a specific dollar amount, the cybercriminals displayed a starkly different attitude from CyberLock’s alleged humanitarianism:

> “We are not a politically motivated group and we do not need anything other than your money.”

In the last potential attack, Talos found a new malware that the team dubbed “Numero.” Though it is not officially a form of ransomware, Talos found that, once deployed, it effectively renders systems “completely unusable.”

Talos discovered that the malware’s internal data co-opted the product and organizations names of the service InVideo AI, an AI-powered video generation service that can be used for marketing, content, and more.

While cybercriminals have long disguised their malware under popular brands, the emergence of AI—and its popularity for small businesses—highlight the dangers that small shops face simply for trying to do business online. But there is help at hand.

****How to protect your small business from ransomware****

As is true with all malware infections, the best defense to a ransomware attack is to never allow an attack to occur in the first place. Take on the following steps to secure your business from this existential threat:

*   **Block common forms of entry.** Patch known vulnerabilities in internet-facing software and disable or harden the login credentials for remote work tools like RDP ports and VPNs.
*   **Prevent intrusions and stop malicious encryption.** Stop threats early before they can infiltrate or infect your endpoints. Use always-on cybersecurity software that can prevent exploits and malware used to deliver ransomware.
*   **Create offsite, offline backups.** Keep backups offsite and offline, beyond the reach of attackers. Test them regularly to make sure you can restore essential business functions swiftly.
*   **Don’t get attacked twice.** Once you’ve isolated an outbreak and stopped a first attack, you must remove every trace of the attackers, their malware, their tools, and their methods of entry, to avoid being attacked again.

 Ransomware hiding in fake AI, business tools 

Google has released an important update for Chrome, patching one actively exploited zero-day and two other security flaws

Google has released an update for the Chrome browser to patch an actively exploited flaw.

The update brings the Stable channel to versions 137.0.7151.68/.69 for Windows and Mac and 137.0.7151.68 for Linux.

The easiest way to update Chrome is to allow it to update automatically, but you can end up lagging behind if you never close your browser or if something goes wrong—such as an extension stopping you from updating the browser.

To manually get the update, click the “**more menu**” (three stacked dots) **\>**  **Settings > About Chrome**. If there is an update available, Chrome will notify you and start downloading it. Then all you have to do is relaunch the browser in order for the update to complete, and for you to be safe from the vulnerability.

_The About Chrome menu while updating_

This update is crucial since it addresses an actively exploited vulnerability which could allow an attacker to exploit a specially crafted HTML page (website).

**Technical details**

The vulnerability tracked as CVE-2025-5419 is an out-of-bounds read and write in Google Chrome’s “V8,” which is the engine that Google developed for processing JavaScript. Prior to Google Chrome version 137.0.7151.68, this vulnerability allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

V8 has been a significant source of security problems in the past.

An out-of-bounds read and write vulnerability means that the attacker can manipulate parts of the device’s memory that should be out of their reach. Such a flaw in a program allows it to read or write outside the bounds the program sets, enabling attackers to manipulate other parts of the memory allocated to more critical functions. Attackers can write code to a part of the memory where the system executes it with permissions that the program and user should not have.

Google knows that attackers currently exploit CVE-2025-5419 in the wild, but released no details yet on who exploits the flaw, how they do it in real-world attacks, or who the targets are in those attacks. However, the Google Threat Analysis Group (TAG) team, which discovered the exploit, focuses on spyware and nation-state attackers who abuse zero days for espionage purposes.

This Chrome update also patches a medium-severity, use-after-free flaw (CVE-2025-5068) in the open-source rendering engine Blink and one internally discovered vulnerability.

**We don’t just report on** **browser vulnerabilities**. Malwarebytes’ Browser Guard protects your browser against malicious websites and credit card skimmers, blocks unwanted ads, and warns you about relevant data breaches and scams.

 Google fixes another actively exploited vulnerability in Chrome, so update now! 

As scammers develop new ways of exploiting unsuspecting users, Malwarebytes is introducing Scam Guard to combat this new wave of threats.

Mobile scams are becoming increasingly sophisticated, leaving people vulnerable to cybercriminals.  

We recently reported on the ever-increasing number of scams that are created by AI-supported tools, with attackers crafting highly convincing phishing emails that target both individuals and businesses, resulting in devastating financial losses, reputational damage, and compromised personal data.  

Elaborate sextortion scams manipulate victims by using shame as a tactic to coerce them into taking action, sometimes draining their life savings.  

And the list goes on. Scammers are always finding new ways to trick their victims into giving them their hard-earned money or sensitive information. 

These tactics include urging individuals to change their address information on a non-existent delivery, promoting job opportunities that just seem too good to be true, or having a long-lost family member reach out on WhatsApp to invite you to share their newfound fortune with you.  

As scammers develop new ways of exploiting unsuspecting users, Malwarebytes is introducing Scam Guard to combat this new wave of threats.  

Scam Guard simplifies scam prevention by providing real-time feedback via an easy-to-use AI-powered chat. Just submit a screenshot, paste suspicious content, or share texts and numbers, and we’ll give you immediate personalized guidance and safety tips. 

Scam Guard is unique in that it’s backed by Malwarebytes extensive threat research knowledge base, making it both effective and efficient.  

Whether users come across a suspicious message on social media, a phishing attempt in their email, or a questionable text message, Scam Guard provides immediate, expert advice to keep them secure. 

**Key features of Scam Guard**

*   **AI-powered chat companion**: An intuitive, mobile-first advisor available 24/7 that provides guidance to users on suspicious content or activities. 

*   **Comprehensive scam detection**: Scam Guard is trained to recognize various scams, including romance, phishing, financial fraud, text, robocall, and shipping fraud, helping you stay ahead of cybercriminals at all times.  

*   **Constantly evolving:** Scam Guard learns from users who submit new or unknown scams, which in turn helps protect the broader community.  

*   **24/7 support**: Scam Guard is available around the clock, ensuring that users receive timely advice and assistance, no matter where they are or what time it is. 

*   **Holistic mobile security**: Embedded within the Malwarebytes Mobile Security app, Scam Guard works alongside our all-in-one advanced protection for iOS and Android. 

Reporting suspicious content has never been easier—simply tap to submit right in the app.  

Scam Guard is available for both free and paid users of Malwarebytes Mobile Security (iOS and Android), without having to install an additional app.  

Try it out for yourself: Download Malwarebytes Mobile Security for iOS or Android.

Source

Malwarebytes