Malwarebytes Labs Report: October 5-11 Security Roundup

A technical report from Malwarebytes Labs covering the week of October 5 to October 11, 2026, highlights several significant security incidents and product updates. The briefing emphasizes the rapid evolution of cyber threats, particularly those leveraging artificial intelligence to lower the barrier for entry. Small-business owners should note the specific vulnerabilities affecting major platforms and the new tools available to attackers for impersonating legitimate services.

In plain English

Hackers gained unauthorized access to ASOS systems and exfiltrated customer personal information along with shopping search histories. According to the Malwarebytes Labs summary, these attackers also utilized push notifications to target customers further. In a separate development, researchers identified AI-powered phishkits that enable criminals to construct sophisticated account-hijacking tools in just ten minutes. This speed allows bad actors to impersonate trusted brands and services with minimal technical effort, increasing the risk for users across various platforms.

The background

Google issued security updates for Android devices during this period, specifying which users are eligible for the patches and how to install them. The tech giant also updated Chrome and ChromeOS to address critical security issues, though the report does not detail the specific vulnerabilities fixed. Additionally, attackers are hijacking country-code domains to impersonate Google and other major services, a tactic that relies on confusing users with look-alike web addresses. This domain hijacking trend complicates user verification processes.

What changes now

Meta’s Muse AI product was highlighted for its data collection practices, as it files away user friendships, arguments, and secrets. The report also notes that Amazon maintains detailed personal profiles on consumers, raising privacy concerns. On the policy front, proposed anti-Flock bills could create challenges for license plate readers, potentially impacting public safety technologies. Google also paused its open-source bug bounty program due to a surge in submissions generated by artificial intelligence, indicating a shift in how vulnerabilities are reported and validated.

Background: Phishing

Phishing exploits human trust rather than technical flaws. Protect your organization by enforcing multi-factor authentication, restricting administrative privileges, and verifying external requests through secondary channels. Regular training and strict email filtering reduce the likelihood of successful credential theft or malware deployment.

Read the full guide: Phishing Risks and Protection for Small Business Operations

What to do and how to stay safe: Malwarebytes Labs

• Verify the domain names of all login pages carefully to ensure they match the official service, especially for Google and similar platforms.
• Enable multi-factor authentication on all important accounts to protect against credential stuffing and account hijacking attempts.
• Review recent Android device settings to ensure automatic security updates are enabled and install available patches immediately.
• Monitor bank and credit card statements for unauthorized transactions, especially if you have shopped at ASOS recently.

Step-by-step guide: How Software Updates Work: The Hidden Verification Steps

General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What data was stolen in the ASOS breach?

Attackers stole customer personal details and shopping search histories, according to the Malwarebytes Labs report.

How fast can AI phishkits be deployed?

Criminals can use AI-powered tools to create account-hijacking phishing sites in just ten minutes.

Why did Google pause its bug bounty program?

The program was paused due to a rise in artificial intelligence-generated submissions.