Chick-fil-A loyalty accounts hijacked using stolen passwords
2026-07-22T20:51:58Z•4df2583b835a70ad3fb3d2698eb234c06eadffc4366e8396244f7282685c9944
account-takeoveramatera-stealerchick-fil-achrome-extensionclaudebleedclicklockcrashstealercredential-stuffingdata-breachexploitationiot-vulnerabilitymacos-infostealermicrosoft-patch-tuesdaypaidwork-breachpatch-managementphishingransomware-extortionrenpy-loadershark-robot-vacuumsocial-engineeringthreat-intelwordpresswp2shellzero-day
What happened
Collection of Malwarebytes reports (mid–July 2026) describing multiple active incidents and high-impact security issues: credential-stuffing account takeovers (Chick‑fil‑A), a large Paidwork data breach (≈23M users), rapid exploitation of the critical wp2shell WordPress vulnerability chain, a new macOS ClickLock infostealer/backdoor, Chrome/ClaudeBleed extension risks, a Shark robot‑vacuum flaw exposing cameras/home maps/Wi‑Fi credentials, malicious distribution chains using Ren'Py loader delivering Amatera Stealer, a fake Apple CrashStealer app, social‑engineering scams (FaceTime/“FBI agent”/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- malwarebytes_labs
- Record identifier
- 4df2583b835a70ad3fb3d2698eb234c06eadffc4366e8396244f7282685c9944
- Enrichment time
- 2026-07-22T20:51:58Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.