Media streaming platform Plex has warned customers about a data breach, advising them to reset their password.

Media streaming platform Plex has warned customers about a data breach, advising them to reset their password.

Plex said an attacker broke into one of its databases, allowing them to access a “limited subset” of customer data. This included email addresses, usernames, hashed passwords, and authentication data.

> “Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party. Out of an abundance of caution, we recommend you take some additional steps to secure your account… Rest assured that we do not store credit card data on our servers, so this information was not compromised in this incident.”

Hashing is a way to protect users’ passwords by transforming them into a scrambled and unreadable format before storing them. Think of it like turning a password into a unique “fingerprint” made of random letters and numbers that doesn’t resemble the original password. This scrambled form is called a hash, and it is created using a special mathematical process called a hash function.

The main point about hashing is that it is a one-way process: once a password is hashed, it cannot be reversed or decrypted back into the original password. When you log in, the system hashes the password you enter and compares that to the stored hash. If they match, you get access. This means companies never store your real, plain text password, which helps keep your credentials safe even if their database is hacked.

The downside is that some systems are vulnerable to pass-the-hash attacks where an attacker can sign in by only knowing the hash. But those are mainly a concern in Windows network environments.

In the case of the Plex breach, pass-the-hash attacks are less of a worry for regular users. Plex uses hashed passwords mainly for user login access to its streaming platform, not for network-level authentication. Plex doesn’t directly enable attackers to authenticate anywhere else without cracking those hashes first.

However, as a precaution, Plex users should still follow the instructions from the company, below.

**What Plex asks users to do**

**If you normally log in using a password**: Reset your Plex account password immediately by visiting https://plex.tv/reset. During the reset process you’ll see a checkbox to “Sign out connected devices after password change,” which the company recommends you enable. This will sign you out of all your devices (including any Plex Media Server you own). After the reset you’ll need to sign back in with your new password.

**If you normally log in using Single Sign-On**: Log out of all active sessions by visiting http://plex.tv/security and clicking the button that says ”Sign out of all devices”. This will sign you out of all your devices (including any Plex Media Server you own) for your security, and you will then need to sign back in as normal.

For further account protection, we also recommend enabling two-factor authentication 2FA on your Plex account if you haven’t already done so.

Look out for any phishing attempts that may try to prey on this incident. Plex has said that no one at Plex will ever reach out to you over email to ask for a password or credit card number for payments.

Malwarebytes has a free tool for you to check how much of your personal data has been exposed online. Submit your email address (it’s best to give the one you most frequently use) to our free Digital Footprint scan and we’ll give you a report and recommendations.

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

 Plex users: Reset your password! 

Researchers found a host of vulnerabilities in the platforms run by RBI to service Burger King, Tim Horton's, and Popeyes.

Two ethical hackers say they have uncovered massive security vulnerabilities in the platforms hosted by Restaurant Brands International (RBI).

RBI is one of the world’s largest quick service restaurant companies. It was formed in 2014 through a $12.5 billion merger of the American fast food chain Burger King and the Canadian coffee and restaurant chain Tim Hortons. Since then, RBI has expanded its brand portfolio to include Popeyes Louisiana Kitchen, acquired in 2017, and Firehouse Subs. It operates a global network of over 32,000 restaurants across more than 120 countries and territories.

The two researchers that scrutinized the security were far from impressed. Their, now removed but archived, blog states:

> “Their security was about as solid as a paper Whopper wrapper in the rain.  
> We stumbled upon vulnerabilities so catastrophic that we could access every single store in their global empire. From a Burger King in Times Square to that lonely Tim Hortons where Bugs Bunny shoulda taken a left turn at Albuquerque. Oh, and did we mention we could listen to your actual drive-thru conversations? Yeah, that happened too.”

The researchers say they found that RBI uses AWS Cognito but forgot to turn off user signups. AWS Cognito is a managed service from Amazon Web Services that helps developers handle user signups, sign-ins, and access control without building these features from scratch.

Disabling user signups is important to make sure that only authorized personnel get accounts, which may be created and managed centrally by IT administrators. This approach reduces the attack surface by blocking open self-registration and unauthorized account creation, which is critical for protecting sensitive internal resources and services. Administrators can then validate and approve accounts before enabling user access to applications managed via Cognito.

After managing their way in through that gateway, the researchers said they realised they could have saved themselves the trouble because they found an even easier signup endpoint that completely bypassed email verification, resulting in an email with the password in plain text.

The researchers say they found three assistant platforms (domains bk.com, popeyes.com, and timhortons.com) were all vulnerable and could enable an attacker to:

*   Access voice recordings of customer orders
*   Add/remove/manage franchise stores
*   View and edit employee accounts
*   Access store analytics and sales data
*   Upload files and send notifications to any store’s systems
*   Use a self-install device ordering system (with the password hard coded into the HTML)

They also say they found that the voice recordings of customer orders, raw audio files of real people ordering food, complete with background conversations, car radios, and sometimes personally identifiable information (PII), were fed into an AI to analyze things like:

*   Customer sentiment
*   Employee friendliness levels
*   Upsell success rates
*   Order processing times
*   How many times employees said “You rule” (because that’s definitely a crucial business metric)

The only good thing about this story is that despite the researchers finding all these vulnerabilities in one day, RBI fixed them the same day. But apparently without acknowledging the researchers or commenting on the vulnerabilities.

If you were involved in this or any other data breach, please read: Involved in a data breach? Here’s what you need to know.

Do not share further personal information. Avoid sharing additional personal details publicly on social media or online directories that could be linked to your exposed information. You can check what information is already out there about you by using our free Digital Footprint Scanner.

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

 Popeyes, Tim Hortons, Burger King platforms have &#8220;catastrophic&#8221; vulnerabilities, say hackers 

A court has ordered Google to pay $425m in a class action lawsuit after it was found to have misled users about their online privacy.

A court has ordered Google to pay $425m in a class action lawsuit after it was found to have misled users about their online privacy.

In July 2020, Google user Anibal Rodriguez filed a lawsuit against the search giant, arguing that it misled users with its “Web & App Activity” setting. The setting was supposed to stop Google collecting data about users’ activities online and in apps.

In reality, Google continued to collect data about how people were using their apps, even after they had switched off data collection in the Web & App Activity setting. Although it said that it was anonymizing that data.

The company collected this information via Firebase, a database that it uses to monitor activities across 1.5 million apps for analytics purposes which operates separately to the Web & App Activity setting. It’s reportedly in 97% of the top thousand Android apps, and 54% of leading iOS apps. Google harvested data from apps including Uber, Venmo, Shazam, the New York Times, Duolingo, and Instagram.

This arrangement created a dual data collection system. It misled 98 million Google users into thinking that their actions were completely private, argued the case, which became a class action suit.

Google’s lawyers protested that users were properly informed about how the company collects information and what it does with it. They pointed out that when confirming their choice, Google displays an “Are You Sure?” prompt that lets them check on what information Google collects, according to Bloomberg Law.

This clearly didn’t resonate with jurors, one of whom said after the verdict that Google needed to be clearer in how it communicated its data handling to its users. They’re generally “skimmers, not readers” he said.

Plaintiffs originally asked for $31bn in damages, but the amount awarded is far less, equating to around $4 per user.

Nevertheless, Google plans to appeal. “This decision misunderstands how our products work,” its spokesperson Jose Castaneda reportedly said. “Our privacy tools give people control over their data, and when they turn off personalization, we honor that choice.”

**A history of questionable tactics**

This isn’t the first time that Google has been found guilty of misleading users. In February 2023, it agreed to pay $392m in a settlement with 40 states for storing users’ locations when it told them it wouldn’t. It coughed up another $40m in a separate arrangement with Washington state later that year and also settled with Arizona for $85m.

In December 2023, the search giant also settled in a class action over alleged misleading language in its incognito mode service, which promised not to collect data about browsing activity but actually did. It deleted records costing it at least $5bn to settle that claim, but didn’t pay damages to users. However, in May this year it settled with Texas to pay $1.38bn to resolve the state’s own claims in the location and incognito mode affairs.

One interesting snippet is that Google has a habit of internally playing down its privacy claims because it knows that explaining exactly what it keeps might alarm users. In a ruling that denied a motion to dismiss the Web & App Activites-related case in January, district judge Richard Seeborg said:

> “Internal Google communications also indicate that Google knew it was being ‘intentionally vague’ about the technical distinction between data collected within a Google account and that which is collected outside of it because the truth ‘could sound alarming to users.'”

Google executives had also privately discussed the need to soften up the privacy language in the company’s services to avoid alarming users of incognito mode. The message here to Joe and Jane Public is even clearer now than it was before; take privacy claims from big tech vendors with the skepticism they deserve, and adopt the ‘mom rule’ when dealing with them: never let them see anything you wouldn’t want them to know.

**We don’t just report on privacy—we offer you the option to use it.**

Privacy risks should never spread beyond a headline. Keep your online privacy yours by using Malwarebytes Privacy VPN.

 Google misled users about their privacy and now owes them $425m, says court 

This week on the Lock and Code podcast, we speak with Emily Galvin-Almanza about predictive policing and whether it actually improves safety.

_This week on the Lock and Code podcast…_

In the late 2010s, a group of sheriffs out of Pasco County, Florida, believed they could predict crime. The Sheriff’s Department there had piloted a program called “Intelligence-Led Policing” and the program would allegedly analyze disparate points of data to identify would-be criminals.

But in reality, the program didn’t so much predict crime, as it did make criminals out of everyday people, including children. 

High schoolers’ grades were fed into the Florida program, along with their attendance records and their history with “office discipline.” And after the “Intelligence-Led Policing” service analyzed the data, it instructed law enforcement officers on who they should pay visit to, who they should check in on, and who they should pester.

As reported by The Tampa Bay Times in 2020:

> “They swarm homes in the middle of the night, waking families and embarrassing people in front of their neighbors. They write tickets for missing mailbox numbers and overgrown grass, saddling residents with court dates and fines. They come again and again, making arrests for any reason they can.
> 
> One former deputy described the directive like this: ‘Make their lives miserable until they move or sue.’”

Predictive policing can sound like science fiction, but it is neither scientific nor is it confined to fiction.

Police and sheriff’s departments across the US have used these systems to plug broad varieties of data into algorithmic models to try and predict not just who may be a criminal, but where crime may take place. Historical crime data, traffic information, and even weather patterns are sometimes offered up to tech platforms to suggest where, when, and how forcefully police units should be deployed.

And when the police go to those areas, they often find and document minor infractions that, when reported, reinforce the algorithmic analysis that an area is crime-ridden, even if those crimes are, as the Tampa Bay Times investigation found, a teenager smoking a cigarette, or stray trash bags outside a home.

Today, on the Lock and Code podcast with host David Ruiz, we speak with Emily Galvin-Almanza, cofounder of Partners for Justice and author of the upcoming book “The Price of Mercy,” about predictive policing, its impact on communities, and the dangerous outcomes that might arise when police offload their decision-making to data.

> “ I am worried about anything that a data broker can sell, they can sell to a police department, who can then feed that into an algorithmic or AI predictive policing system, who can then use that system—based on the purchases of people in ‘Neighborhood A’—to decide whether to hyper-police ‘Neighborhood A.’”

Tune in today to listen to the full conversation.

**Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.**

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium Security for Lock and Code listeners.

 This “insidious” police tech claims to predict crime (Lock and Code S06E18) 

Phishers are abusing Apple and Microsoft infrastructure to send out call-back phishing emails with legitimate sender and return addresses.

Once again, phishers are targeting PayPal users by abusing existing legitimate infrastructure. Only this time they’re not abusing PayPal’s platform, but iCloud Calendar invites.

Our friends over at BleepingComputer unraveled a call-back phishing scam which was sent to one of their readers.

> “Pedro McCarthy invited you to ‘Purchase Invoice’.
> 
> Purchase Invoice
> 
> Hello Customer,  
> Your PayPal account has been billed $599.00  
> We’re confirming receipt of your recent payment. Below are the details:  
> Invoice ID: AFER13VD
> 
> Date: AUG 28, 2025
> 
> Amount: USD 599.00
> 
> If you wish to discuss or make changes to this payment, please contact our support team at +1 +1 (786) 902 8579”

The sender email address shows as noreply@email.apple.com which helps it pass every imaginable email security check since it actually came from an Apple server. This happens because it is an iCloud Calendar invite, with the phishing text written in the “Notes” field.

To the recipient it shows a Microsoft 365 account controlled by the phishers. When creating such an iCloud Calendar event with external people added to the invite, an email is sent from Apple’s servers from the iCloud Calendar owner’s name with the email address noreply@email.apple.com.

The Microsoft 365 account is very likely a mailing list holding the email addresses of the targets in this campaign. This method allows the phishers to use the Microsoft Sender Rewriting Scheme (SRS), a technical method used to make email forwarding work smoothly without breaking anti-spoofing protections.

Because the rewritten sender address now belongs to the forwarding domain (e.g., Microsoft 365) it doesn’t trigger any alarms. Meanwhile, the “From” address you see in your email program remains the same as the original sender, so the email looks legitimate to the recipient—especially when that address belongs to Apple.

A call-back phishing campaign is usually set up to entrap targets that decide to call the number listed in the invitation. They’ll be asked to download something under false pretences, which often turns out to be a remote desktop client or information-stealing malware—which will then be used to drain all your accounts.

**How to stay safe**

Don’t be fooled by the legitimate sender email address. Besides spoofing a sender email address, criminals are finding other ways to abuse big tech infrastructure and make it look as if an email came from a legitimate company.

The email has many of the usual signs of a phishing mail:

*   Urgency is imposed by a large amount being billed
*   Generic greetings: “Hello customer” and not your name.
*   The receiver’s email address is not yours.
*   The spelling error in the phone number (twice the +1)

What you can do:

*   Always search phone numbers and email addresses to look for associations with known scams.
*   Login directly to PayPal.com to see if there are any messages in your account.
*   Enable two-factor authentication (2FA) on your Paypal account to add an extra layer of security to your financial accounts and help prevent scammers getting in.
*   Report suspicious emails and phishing emails to phishing@paypal.com. Then delete them.

**We don’t just report on scams—we help detect them**

Cybersecurity risks should never spread beyond a headline. If something looks dodgy to you, check if it’s a scam using Malwarebytes Scam Guard, a feature of our mobile protection products. Submit a screenshot, paste suspicious content, or share a text or phone number, and we’ll tell you if it’s a scam or legit. Download Malwarebytes Mobile Security for iOS or Android and try it today!

 iCloud Calendar infrastructure abused in PayPal phishing campaign 

A list of topics we covered in the week of September 1 to September 7 of 2025

September 5, 2025 - A hacker cracked into a database of video recordings taken from Nexar-branded cameras, which are built to be placed drivers’ cars,...

September 4, 2025 - Roblox announced plans to roll out age estimation for using the communication features on the platform to help fight sexual predators.

September 4, 2025 - Today we're launching Malwarebytes Tools, a new set of free features designed to give your Windows PC a breath of fresh air.

September 4, 2025 - The Quad7 botnet is adding End-of-Life TP-Link routers to its arsenal and using them to steal Microsoft 365 accounts.

September 4, 2025 - A recent report has revealed that many VPNs might allow others to sniff your data—and they're not being honest about who's behind them.

 A week in security (September 1 &#8211; September 7) 

A hacker cracked into a database of video recordings taken from Nexar-branded cameras, which are built to be placed drivers’ cars,...

A hacker cracked into a database of video recordings taken from Nexar-branded cameras, which are built to be placed drivers’ cars, according to a new report from 404 Media.

Nexar is a dashcam company that promotes its products as “virtual CCTV cameras” and offers automatic cloud uploads of critical incidents, AI-driven insights, and real-time road alerts. It offers customers remote video streaming, live GPS tracking, and easy-to-share video-evidence.

Nexar also sells access to reportedly blurred images captured by the cameras and other related data to other companies. Nexar monetizes users’ data and recordings by repackaging them into various products. One of those is the company’s CityStream map which uses recent and blurred images taken by Nexar dashcams, superimposes them on a publicly available map, and annotates things such as yield or speed limit signs, damaged roads, and other hazards.

This level of access and data management should come with a healthy, corporate security stance. But, according to the hacker who breached the company’s systems, Nexar is an absolute privacy nightmare with embarrassing security. Allegedly, it only took the hacker 2 hours to breach Nexar systems, and they stated:

>  “I would be very surprised if no one (foreign government or just bad actor) wasn’t already tapping their customer data.”

In one clip the hacker provided to 404 Media as proof, a Nexar camera is faced inwards for a car, capturing what appears to be a rideshare driver picking up passengers. Like in many other videos, people’s faces are clearly visible.

Nexar co-founder and CTO Bruno Fernandez-Ruiz told 404 Media in an email that, per Nexar’s privacy policy, users who contribute to the CityStream feature do so with either opt-in—or opt-out—consent, depending on the jurisdiction.

Besides the personal implications, 404Media also mentioned and highlighted some potential national security risks that could be found in the evidence the hacker provided.

The hacker found all the videos on an improperly secured Amazon Web Services (AWS) bucket. An AWS bucket is like a virtual file folder in the cloud where you can store various types of data, such as text files, images, videos, and more. There, the hacker found more than 130 TB worth of data.

The hacker were able to access the AWS bucket because embedded in every Nexar dashcam was a key to this database. And this key came with high privileges—too high. These access privileges not only allowed anyone with the key to upload their own camera’s data, but to also access those of everyone else.

Another find by the hacker was a file showing the companies and organizations that Nexar says have had access to the company’s data. According to the document, these include Apple, Microsoft, Amazon, Google, Pokémon Go creator Niantic, transportation companies Lyft and Waymo, the cities of Los Angeles and Austin, the NYPD, and many AI- and logistics-focused companies.

Nexar fixed this issue after being contacted by 404 Media this week, but the level of trust that should be expected from a company that stores dashcam or CCTV images has taken a serious hit.

**Protecting yourself after a data breach**

There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.

*   **Check the vendor’s advice.** Every breach is different, so check with the vendor to find out what’s happened and follow any specific advice they offer.
*   **Change your password.** You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
*   **Enable two-factor authentication** **(2FA****).** If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
*   **Watch out for fake vendors.** The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims and verify the identity of anyone who contacts you using a different communication channel.
*   **Take your time.** Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
*   **Consider not storing your card details**. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
*   **Set up identity monitoring****.** Identity monitoring alerts you if your personal information is found being traded illegally online and helps you recover after.

**We don’t just report on data privacy—we help you remove your personal information**

Cybersecurity risks should never spread beyond a headline. With Malwarebytes Personal Data Remover, you can scan to find out which sites are exposing your personal information, and then delete that sensitive data from the internet.

 Nexar dashcam video database hacked 

Roblox announced plans to roll out age estimation for using the communication features on the platform to help fight sexual predators.

Roblox is an online platform that allows users to build, play and share online worlds and 3D games. Unfortunately, it’s also a popular platform among predators reaching out to kids and seducing them using game features such as messaging, avatar customization, and role-play.

Over the years, the company has faced several lawsuits and backlash for not doing enough to protect kids on its gaming services. Recently, Louisiana sued the Roblox, alleging the wildly popular site has perpetuated an environment where sexual predators “thrive, unite, hunt, and victimize kids.” And back in February Roblox, along with Discord, was sued in California. The law suit referred to it as a “real life nightmare for children.”

The initial response by Roblox’s CEO, Dave Baszucki, was “if you’re not comfortable, don’t let your kids be on Roblox.” But apparently, the company thought better of it, and so yesterday Roblox announced a plan to expand age estimation to all Roblox users who access its on-platform communication features by the end of this year.

Roblox defines age estimation as follows:

> “We estimate your age by analyzing a selfie of your face and examining your facial features. Your estimated age helps place you in the appropriate age group (under 13, 13+ and 18+) to customize your experience on Roblox. If you are placed in the under 13 age group based on facial age estimation, certain personal data, including your email and phone number, will be removed from Roblox.”

While we understand the move, which aims to strengthen communication safety and prevent inappropriate interactions between adults and minors on the platform, we wonder if this will be enough to stop predators.

But the goal is clear: Limit communication between minors and adults that do no know each other in the real world. So, by using methods like facial age estimation, ID verification, and parental consent, Roblox aims to ensure users only access features and content suitable for their age group, and with that create a safer environment, ensuring that young users aren’t exposed to content or interactions that might be inappropriate for their developmental stage.

With governments demanding actual age verification on websites with adult content, and platforms like social media and Roblox introducing restrictions based on a user’s age, the controversy about different types of age verification and those implications is growing.

While Roblox didn’t release any details about how its age estimation technology works, the age estimation processes we know are based on Artificial Intelligence (AI) tools that scan selfies or short videos and compare them to a database to estimate the user’s age. Needless to say, they are not always right and it opens up the system to deepfakes, and spoofing.

This kind of technology is definitely more effective than asking the user to provide their birthday or check a box that they are over 18, but it’s not foolproof.

And methods like facial scans, ID verification, and so on, will store information on servers which can be breached. We would prefer websites to use “double-anonymity” solutions, but it seems to be hard to convince them. Double anonymity basically separates the information of two providers from each other. The first provider (website asking for age confirmation) would only get the requester’s age and no other information. The second provider (the age verifier) wouldn’t receive information about the service or website the age verification is needed for. That enters the user into the appropriate age group, but keeps sensitive information away from servers that are not secure enough to hold it.

Roblox also acknowledges another danger:

>   
> “Unfortunately, bad actors will try to circumvent our systems to try to direct users off the platform, where safety standards and moderation practices may differ. We continuously work to block those efforts and to enhance our moderation approaches to promote a safe and enjoyable environment for all users.”

In defense to the Louisiana lawsuit, Roblox rolled out an AI system to help detect early signs of possible child endangerment, such as sexually exploitive language. Roblox said the system led it to submit 1,200 reports of potential attempts at child exploitation to the National Center for Missing and Exploited Children in the first half of 2025.

**How to keep your kids safe on Roblox**

Since it’s not likely you’ll be able to guide your children 24/7 in their online journey, here are some tips you can use to keep them safe:

*   **Take control.** Use Roblox’s Parental Controls to limit access to age-appropriate games and content and enable features like daily screen-time limits.
*   **Anonymize.** When setting up your child’s Roblox account, avoid using real names, and use an appropriate date of birth to enable the relevant restrictions.
*   **Friend requests.** Access the settings of your child’s account to limit or disable friend requests and online chat capabilities.
*   **Stay on the platform.** Tell your child to refuse requests to take chats offline or to another platform. Predators will do this to avoid Roblox’s restrictions about sharing images.
*   **Education.** Teach children about online safety, including not sharing personal information and avoiding suspicious links, and make sure they are comfortable sharing their online experiences with you.
*   **Play with them.** What’s more fun than beating your parents in your favorite game? Spending some quality time with them makes it fun to keep an eye on them and the games they enjoy.
*   **Information.** Stay on top of information about Roblox’s updates, features, and changes**.**
*   **Protect the device.** Make sure they are playing on a device that is fully up-to-date and actively protected.

**We don’t just report on threats – we help protect your social media**

Cybersecurity risks should never spread beyond a headline. Protect your social media accounts by using Malwarebytes Identity Theft Protection.

 Roblox introduces age checks to use communication features 

Today we're launching Malwarebytes Tools, a new set of free features designed to give your Windows PC a breath of fresh air.

If you ever have the feeling your computer is dragging its feet, or shows odd behavior, you’re not alone. In some cases, the culprit is indeed malware, but often it’s something more mundane. Over time, baggage accumulates, much like a toddler’s backpack after a day in the forest.  

Too many apps starting up at once, Windows settings not tuned for your needs, or even a firewall that’s too confusing to manage.   

That’s why we’re launching Malwarebytes Tools, a new set of free features designed to give your Windows PC a breath of fresh air.   

Think of Malwarebytes Tools as spring cleaning for your computer: clearing out what slows you down, tidying up behind the scenes, and strengthening defenses—without having to read a manual as lengthy as The Lord of the Rings trilogy.   

And the best part? They’re completely free, available today in preview mode inside the Malwarebytes app.  

As Michael Sherwood, VP of Product at Malwarebytes, explains:  

> “For years, people have come to Malwarebytes when something’s not right with their computer. But issues aren’t always caused by malware. Sometimes it’s slow performance, privacy settings, or other configuration issues. With our new optimization tools, we’re making it easier for users to spot these problems and take proactive steps to keep their devices running smoothly and securely.” 

Here’s what you get with Malwarebytes Tools: 

*   **Startup Applications:** If your PC takes forever to start up, it could be because too many apps are trying to start all at the same time. Our feature gives you a clear view of what’s booting up with Windows, and the power to say “no thanks” to the ones that don’t need to be there.  

*   **System Tweaks\*:** These are like quick-fix buttons for your PC. You can use them to repair common issues, adjust privacy settings, and fine-tune how Windows behaves.  

*   **Firewall Control:** Firewalls are essential for online security, but for many people, managing them can be challenging. That’s why we don’t give you another firewall to figure out, we simplify the one you already have. With our new Firewall Control, you can block unwanted traffic, manage which apps have internet access, and switch filtering modes with just one click. Simple, powerful, and built right into what you already use. 

_\*Windows 11 only_  

Malwarebytes Tools are available now in preview, meaning you get early access, free of charge, and can help shape what the full version becomes.  

Your computer deserves to run light, fast, and secure, without you having to become its full-time mechanic. With Malwarebytes Tools, we’re making that possible.  

Curious to try it out? Open Malwarebytes on Windows, test its user-friendliness, and immediately feel the difference it makes to your digital experience.

 Give your PC a fresh start: New free tools to boost your PC’s speed, security, and peace of mind   

The Quad7 botnet is adding End-of-Life TP-Link routers to its arsenal and using them to steal Microsoft 365 accounts.

TP-Link has issued a warning about a botnet exploiting two vulnerabilities to infect small office/home (SOHO) routers, which are then weaponized to attack Microsoft 365 accounts. 

The vulnerabilities affect the Archer C7 and TL-WR841N/ND routers, though other models may also be at risk. Despite the fact that these routers have reached end-of-life (EOL), TP-Link has nonetheless released firmware updates to address the flaws.

If you have a router issued by your internet service provider (ISP) this also deserves checking. Several ISPs have used the TP-Link Archer C7 and TL-WR841N/ND routers, sometimes rebranding them for distribution to customers, especially in Europe and North America. For example, Dutch ISP Ziggo is known to have rebranded the TP-Link Archer C7 as the “Wifibooster Ziggo C7”, supplying it to customers with Ziggo-specific firmware.

The two vulnerabilities, tracked as CVE-2025-50224 and CVE-2025-9377, are chained to add a router to a botnet. CVE-2025-50224 is a vulnerability that allows an attacker to steal passwords from the router and CVE-2025-9377 is a known Parental Control command injection RCE exploit, allowing the attacker to run their code on the router.

The botnet, called Quad7 (aka 7777) uses the infected routers to perform password-spraying attacks against Microsoft 365 accounts. Password spraying literally means trying common passwords across many accounts or using many common passwords against the same account.

Last year, Microsoft warned about the same botnet but the specific vulnerabilities were unknown at the time. Detection remains difficult for defenders, as the botnet uses thousands of IP addresses from home users and small businesses. TP-Link urges owners of these router models to install the updated firmware or switch to a fully supported router. The company is also investigating reports that other models might be vulnerable. Meanwhile, the US Cybersecurity and Infrastructure Security Agency (CISA) has also issued advisories for these two flaws.

**Recommendations for owners of TP-Link routers**

It is rare that a manufacturer would issue a firmware update for a EOL product, which emphasizes the importance of deploying that update. Being a part of a botnet is not just a danger to others, it can considerably slow down your home device(s).

*   Check if your router is an Archer C7 or TL-WR841N/ND, or another older TP-Link model. If so, update your firmware immediately with the version provided by TP-Link.
*   If firmware updates are no longer provided or your router is out of support, strongly consider upgrading to a supported model.
*   Change your router’s admin password to a strong, unique value, meaning you should avoid reusing passwords from other accounts.
*   Disable remote management features unless absolutely necessary and always check that parental control pages are only accessible by authenticated users.

**Recommendations for Microsoft 365 users**

Since the botnet is used at this moment in time to take over Microsoft 365 accounts, there are a few things you can do to make this a lot harder.

*   Use a strong, unique password for your Microsoft 365 account. Avoid using common or guessable words and passwords.
*   Enable multi-factor authentication (MFA) for added protection. This significantly reduces the risk of unauthorized access, even if your password is exposed.
*   Watch for suspicious sign-in attempts or alerts from Microsoft, and review your login history regularly.
*   If you suspect your account has been targeted, reset your password immediately and run a security checkup on your account.

Staying ahead of threats like botnets means keeping devices patched, using strong authentication practices, and remaining alert for updates on device security. Don’t wait until your router—or your Microsoft 365 account—becomes part of someone else’s attack toolkit.

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

Source

Malwarebytes