Malwarebytes Labs reviews security events from October 5 to 11, 2026
The weekly security digest highlights an ASOS data breach, AI-powered phishing kits, and Google's pause on its open source bug bounty program.
Key points
- Attackers stole customer details and shopping searches from ASOS.
- Google paused its open source bug bounty program due to AI submissions.
- AI-powered phishkits now allow criminals to build account-hijacking tools in ten minutes.
Malwarebytes Labs published its weekly security summary covering the period from October 5 to October 11, 2026. The report details several significant cybersecurity incidents, including a major data breach at fashion retailer ASOS and new developments in artificial intelligence-driven attack tools.
The most prominent incident involves ASOS, where hackers successfully stole customer details and shopping search histories. According to the Malwarebytes Labs summary, the attackers also sent push notifications to customers as part of their campaign. This breach highlights the ongoing risk to e-commerce platforms and the personal data they hold.
Context and Background
Beyond the ASOS breach, the report notes that attackers are hijacking country-code domains to impersonate Google and other major services. This tactic allows threat actors to create convincing fake login pages. Additionally, an AI-powered phishkit is now enabling criminals to assemble account-hijacking tools in just ten minutes, significantly lowering the barrier to entry for such attacks.
Other findings include Domino’s customers being targeted in credential stuffing attacks. The report also mentions a Facebook Marketplace scam that uses victims' names and phone numbers to deceive other users. These incidents illustrate the diverse methods attackers use to compromise consumer accounts and trust.
Who Is Affected
Google issued Android security updates during this period, detailing which devices are eligible and how users can apply them. The tech giant also paused its open source bug bounty program after observing a rise in submissions generated by AI tools. This pause suggests challenges in verifying the authenticity and quality of automated vulnerability reports.
The summary also touches on privacy concerns, noting that Amazon maintains an uncomfortably personal profile on users. Meta’s Muse AI was reported to file away friendships, arguments, and secrets. Furthermore, proposed anti-Flock bills could create difficulties for license plate reader operations, indicating a broader regulatory landscape affecting surveillance technologies.
What should you do?
Users should monitor their accounts for unauthorized activity, particularly after reported breaches. Keeping software updated is crucial, especially for Android devices receiving the latest security patches. Individuals should also be wary of push notifications and domain impersonation attempts.
What to do and how to stay safe: ASOS
- Check your ASOS account for unauthorized changes or suspicious activity.
- Verify the domain of any login page before entering credentials.
- Update Android devices to the latest security patch available.
- Monitor credit reports for signs of identity theft or credential stuffing.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did hackers steal passwords from ASOS?
The report states that hackers stole customer details and shopping searches, but does not explicitly mention passwords.
Why did Google pause its bug bounty program?
Google paused the program after a rise in submissions generated by AI tools, complicating the verification process.
How fast can criminals build phishing kits now?
According to the report, AI-powered phishkits allow criminals to create account-hijacking tools in ten minutes.
