A week in security (September 7 – September 13)

Here’s what we’ve covered in the last seven days on Malwarebytes Labs:

• Crypto customers targeted by scammers after email marketing provider breach
• Android malware creates a hidden copy of your banking app
• BlueMoon exploit kit turns Chrome and Windows flaws into attacks
• Will AI kill us all within the next decade?
• Update Chrome now to protect against an actively exploited vulnerability
• Copyright scammers get Instagram accounts suspended and demand payment
• More than 100,000 fake stores are out to steal your card details
• Microsoft fixes record 964 flaws, including 2 exploited zero-days
• The push to stop algorithms controlling social media feeds has begun
• Grindr settles HIV status data-sharing lawsuit for $35 million
• MikroTik router flaws allow takeover without a password
• Loyalty points fraud is funding hacker holidays (Lock and Code S07E18)
• LG TV flaws could let attackers listen in, even in standby mode
• Flirty OnlyFans promoters on X may be using AI to appear human

Stay safe!

Key Takeaways

• Malwarebytes weekly security roundup covers major cybersecurity events from September 7 to 13, including the GitLab CVSS 10 disclosure, Revolut data breach, and multiple AI security developments.
• The week's dominant themes were AI weaponization with multiple documented attack campaigns, supply chain attacks targeting fintech platforms, and critical vulnerability disclosures.
• Security teams should use weekly roundups to review coverage of emerging threat patterns and verify detection rules account for the latest attack techniques.