Signal users targeted in backup-stealing phishing attacks

Malwarebytes Labs roundup (May 2026) covering multiple active threats and large breaches: phishing campaigns targeting Signal users to steal backup recovery keys; Carnival hit by a ShinyHunters data breach affecting ~6 million people; a major healthcare vendor breach exposing biometrics, diagnoses, and bank details (~1.8M affected). Multiple active phishing and malware campaigns—fake ChatGPT download sites delivering Windows and macOS malware, Kali365 phishing kit that bypasses MFA to steal Microsoft/Outlook/Teams/OneDrive access, LinkedIn credential theft using abused Adobe Target, and fake/G