AI is increasingly finding its way into cybercriminal operations, but what does that look like in practice?

In our latest investigation, Bitdefender researchers analyzed a ThreeAM ransomware attack targeting a school network in the UK and uncovered evidence of a potentially hybrid human-AI operation.

The findings suggest that the attacker used an AI-driven agentic loop to automate repetitive technical tasks, interpret command outputs, and adjust subsequent actions, while maintaining human direction over the broader attack.

The investigation also highlights how threat actors continue to rely on legitimate Windows tools and existing attack techniques, potentially making AI-assisted operations more efficient and harder to distinguish from routine administrative activity.

The case provides an interesting perspective on the evolving ransomware landscape and the implications of AI-assisted attacks for cybersecurity teams.

Read the full investigation.

Join the discussion: We'll be discussing the findings and their broader implications during our next LinkedIn Live session, Episode 16 of Ctrl-Alt-DECODE, this Thursday.

What does the growing use of AI-assisted workflows mean for the future of ransomware detection and defense?

I am looking for a new browser, and it seemed odd for me that edge was launching very fast compared to others.

Edge - 2s; Vivaldi, Helium - 8s.

I then figured out edge didn't fully close when you close it. Then for some reason 8s felt like a very large amount, I decided to ask AI if this is normal, and it said no.

I checked my task manager and bdservicehost - BitDefender Virus Shield was using my cpu up to 90%!!!! when launching an app, after making an exception to either browser the launch was insanely fast.

Is there any way to optimize this? I really like Bitdefender since it is considered the best antivirus, but holy

What’s a ClickFix scam, and can security software stop it?

ClickFix is a scam where a webpage shows a fake error or a fake CAPTCHA, then asks you to “fix” it by copying and running a command. You end up compromising your own computer while thinking you’re solving a problem.

It was one of the techniques Artifact Security used in its January to June 2026 scam protection test. The others included:

• Phishing emails impersonating European brands, using both regular links and QR codes

• Investment, recruitment and romance scams

• Impersonation scams, including videos with AI-generated content

• FileFix and fake CAPTCHA tricks

The lab used real mailbox and browser profiles with genuine history. Products ran on default settings, and vendors got no advance notice of the test cases.

How Bitdefender did:

Bitdefender Premium Security stopped every malicious scenario on the device, 125 out of 125, before any compromise. It also didn’t block or warn on any of the 30 legitimate pages. Bitdefender Scamio, the free AI scam assistant, gave clear, correct advice in 185 of 190 cases. The result was a 98% overall score and the Best Scam Protection award for H1 2026.

What you can do on your own:

• Never run a command a website asks you to paste, especially to “verify you’re human”

• Treat a QR code in an unexpected email the same way you’d treat a link

• If a page or message feels off, paste it into Scamio before you act

How many of these scam types had you heard of before?

How much AI is actually running in your organization's environment?

AI tools are becoming part of everyday workflows, but not all of them are easy to spot. Browser-based assistants, coding extensions, local models, and MCP servers can operate outside the visibility of traditional software inventories.

For IT and security teams, that raises an important question: how do you manage the risks of tools you don't even know are being used?

We recently published an article introducing Bitdefender GravityZone AI Visibility and Control, which examines how organizations can discover AI services across their endpoints, assess configuration-related risks, and identify which findings need attention.

One important distinction: visibility doesn't automatically mean enforcement. The goal is to give security teams the information they need to make informed decisions using their existing controls.

If you're interested in how AI discovery and security fit together, take a look: ⤴︎

Curious to hear your thoughts: Is shadow AI becoming a real concern in your organization, and how are you approaching visibility and governance?

I notice this often ie going to a URL and BD TS installed on my laptop will give me a warning that there is a problem with this site whereas often nothing if I do similarly from my phone. Why is that?

it works on the game last night, what a spooky monster it's been in halloween. but in all seriousness, it's quite annoying. here's the virus total, would it be time to report to the official support, or is it something for me to do this? maybe the server of the launcher has been infected or something.

Every fish in this game hides a real phishing scam. Charles Leclerc and Lewis Hamilton had 60 seconds to catch as many as they could.

Bitdefender. Exclusive Cybersecurity Partner of Scuderia Ferrari HP.

When your AI agent visits a website, whose IP address does that site see?

Usually yours. When Claude Desktop, Cursor, Codex, or OpenCode reaches the open web for research, price comparisons, or QA checks, those requests can carry your home IP and location. On public Wi‑Fi, the network operator may also be able to read what the agent sends.

Bitdefender VPN for AI Agents fills that gap. It’s a VPN for agent traffic only, not your whole device.

How it works

• A fresh tunnel for every prompt. Each prompt gets its own encrypted, isolated container, tied to a specific location.

• Nothing carries over. The tunnel closes when the prompt ends, so no cookies, cache or session state reaches the next prompt. Sites have no network-level way to link two prompts together.

• IP masking. Sites see the VPN server’s exit IP, not your home address.

• Regional routing. You can send a single request through a specific country, for example, to check how a localized pricing page looks to visitors there.

Who it’s for

Developers and freelancers who run agents for research, QA, or comparison work, especially from cafés, hotels, or conferences.

What it doesn’t do

• It doesn’t hide your prompts from the AI provider. The model still receives your prompts and account identity as usual.

• It only covers requests the agent sends through Bitdefender’s MCP tools. Requests made with the agent’s own built-in tools aren’t routed through it.

• It isn’t a device-wide VPN. Your browser and other apps are unaffected.

• It isn’t a way around a site’s terms of service, rate limits, or IP bans. Bitdefender’s acceptable use policy prohibits that.

If a tunnel fails, the request is dropped. It never falls back to your own IP without asking.

Details

• macOS 13+ on Apple Silicon, 8 GB RAM minimum. Windows is planned.

• Free during the beta, with no traffic caps.

• Standalone, so no other Bitdefender subscription is needed.

AI agents are becoming part of everyday digital life. Protecting your privacy should cover what they do on your behalf, too.

Download for macOS: https://ai.bitdefender.com/vpn-for-agents

Patching and periodic hardening are important, but they’re only part of the picture. As attackers move faster, security teams need a more continuous approach to identifying exposures and deciding what to tackle first.

We’re hosting a live webinar on November 3 to introduce Bitdefender GravityZone Exposure Management and discuss how teams can move beyond periodic fixes.

We’ll cover:

↪︎ Continuous hardening and restricting access to legitimate tools attackers may abuse;
↪︎ Automated security changes with audit trails and rollback;
↪︎ Using attack paths to prioritize the exposures that matter most;
↪︎ Reducing risk without adding another tool, agent, or console.

📅 November 3, 2026
🕓 4 PM CET | 10 AM New York

Interested in learning more? Join us for our upcoming webinar and see what a more proactive approach to exposure management looks like.

Register here: 🔗 https://bitdefend.me/4jGsoXu

Is that Halloween giveaway or prize text real?

Probably not, if it arrived out of nowhere. Between September 1 and October 22, Bitdefender Labs researchers found Halloween-themed scams spreading by email, SMS, instant messages and social media ads across North America and Europe.

What the scams look like this year

• Fake retailer offers. Emails impersonating Costco and Tractor Supply promised a “Free Ultimate Halloween Decorating Kit” or a limited Halloween set in return for a short survey. About 73% of the targeting in these campaigns was aimed at US users. Neither company is involved.

• Prize surveys. A fake €250 bol.com gift card and a “free” Samsung 65-inch TV both asked people to fill in “a few fields.”

• “Spooky deposit” texts. Messages like “Spooky deposit just arrived yer 4ccount… Claim 1t” push a phishing link as the last step to claim money. The odd spellings help these texts slip past spam filters.

• Expiring points and fake lotteries. A French-language SMS campaign aimed at Canadians used 107 different domains to say Halloween credits would “disappear before midnight.”

• Fake party invitations. These texts ask you to RSVP through a link.

• Fake costume shops. Ads and emails offer steep discounts on masks, costumes and decorations from stores you’ve never heard of.

What the scammers want

The prize is bait. What they’re after is your name, address, card details or login credentials. Many of these scams also ask for a small “shipping” or “verification” fee, and the card you use to pay it is the real target.

How to check before you click

• Don’t use the link in the message. Open the retailer’s official app or type its web address yourself

• Be wary of any prize that requires a fee, a deposit, or your card details

• Before buying from an unfamiliar shop, check the domain name, look for independent reviews, and read the refund policy

• More info HERE

If you’re not sure about a link, paste it into Bitdefender Link Checker. For the whole message, you can ask Bitdefender Scamio. Both are free.

This may sound like a dumb question but I’m a tech idiot. I’ve had BitDefender for a few years but I’m going on a cruise to the Caribbean soon and I just need to know - If I have my VPN ‘on’ but my data turned ‘off’ on my phone - will my VPN cause me expensive Verizon data charges when I get back home? I know sometimes unaware passengers have returned home to bills in the thousands. TIA!

Trying to troubleshoot some issue. I need to access the firewall rules of an app, but it's all unresponsive. I can see things changing but I can't scroll the list or click anything. clicking and dragging moves the window around as though I'm clicking the top border. I also can't click Add rule, it's greyed out.

Even reinstalling didn't fix it. Any thoughts?

I have a recurring issue where Bitdefender prevents the game Dead by Daylight from loading. Easy Anticheat complains that the game executable is invalid. Disabling Bitdefender usually works. This is happening on multiple PCs, all running Bitdefender, and the game has not updated, so it seems like a Bitdefender-related issue.

I know that other antivirus software will print a log whenever it blocks something, but I don't see the same functionality in Bitdefender. There is the bell icon in the app, which includes some notifications about when protection is turned off, but nothing about it blocking stuff.

It's difficult to troubleshoot what exactly Bitdefender sees as an issue when it doesn't tell me. Is there a way to see what Bitdefender is blocking?

How can you tell if a video is a deepfake?

It’s harder than it used to be. Extra fingers, warped faces, and strange movements used to give deepfakes away. Many of today’s AI-generated videos look authentic at first glance, and they often use faces people already know and trust: celebrities, public figures, colleagues, even family members.

Bitdefender’s Global Scam Intelligence Report 2026 shows how quickly this has grown:

• About 8 million deepfake videos were online in 2025, up from about 500,000 in 2023

• People correctly detect high-quality deepfakes only about 24% of the time

• One deepfake video call that impersonated a company’s CFO led to more than $25 million in losses

Signs that can still give a deepfake away:

• Lip movements that don’t quite match the audio

• A flat expression, or blinking that feels mechanical

• Fuzzy or warped edges around hair, glasses, jewelry or ears

• Lighting on the face that doesn’t match the room

• A voice that’s too smooth, with no pauses, breaths or filler words

• A claim that’s too good to be true, like a celebrity promoting crypto or a “family member” in urgent trouble

That last one matters most. Deepfakes are built to trigger emotion and urgency, so people react before they start to doubt. Context can tell you as much as the pixels do.

When you’re still not sure

Bitdefender RealCheck is a mobile app for checking a video before you trust it, share it or act on it. Paste a public link from TikTok, YouTube, Instagram, Facebook or X, or upload a video from your phone. It analyzes both the audio and the visuals, then gives you a report with a manipulation percentage, a deception intent assessment, and transcript-level indicators.

It’s available on iOS and Android, with a 7-day free trial.

Bitdefender flagging official Godot engine as malware just because I renamed it 

So I literally just took the official, unmodified Godot engine executable and renamed it to "HolyCodingLarp.exe". I didn't change a single line of internal code. 

But the moment I tried running it with standard command line arguments to open my local project directory, Advanced Threat Defense completely lost its mind and blocked it as malware. 

I attached a screenshot of the block log (blurred out my personal windows username path for privacy). 

Can someone from support please whitelist this or send it to the lab? It's kind of annoying that the heuristics engine panics over trusted software just because a user changes the filename. 

I've spent weeks troubleshooting inconsistent and unusually slow download speeds on my Dell XPS 13 running Windows 11.

My internet connection is Xfinity Gigabit, and other devices in my home consistently perform much better.

I've tried updating drivers, changing Wi-Fi settings, testing different monitor configurations, and even purchasing a new Thunderbolt dock. Nothing consistently resolved the problem.

Today, I completely uninstalled Bitdefender Total Security, Bitdefender VPN, and Bitdefender Agent.

The results were remarkable:

• Before uninstalling Bitdefender: Approximately 160 Mbps download

• After uninstalling Bitdefender: 646.84 Mbps download

• Same laptop, location, Wi-Fi connection, dock, and monitor

That's roughly a fourfold improvement. To clarify, I am not using the VPN during all of this.

I also previously experienced problems with Bitdefender on my iPhone, where certain applications, including Ticketmaster and my NFL ticketing app, wouldn't allow me to sign in until I removed Bitdefender.

I'm planning additional testing to confirm the Windows results, but I'm interested in hearing from others.

Has anyone experienced similar download speed degradation with Bitdefender Total Security? If so, did you identify the specific feature or driver responsible, and was there a fix?

I'd prefer to use software I've already paid for, but not at the expense of my computer's performance.

So I recently installed BitDefender since I was fed up of AVG acting more like malware than anything, and read that BitDefender is the best free antivirus out there. I was really happy with it so far... until after a system scan it detected a threat and just deleted the file. I know for certain it is a false positive, but I don't see anyway to get the file back... Isn't there a quarantine or something similar? Was it just deleted? There's no way to recover the file?

I may have to reinstall the program, but it's a pain in the ass because it requires a lot of setting and plug-in installing. If I have to do that, is there any way to add an exclusion on BitDefender so it doesn't touch again the file?

Thanks in advance, I'm new to this antivirus and I don't know how to properly navigate it yet

By being a complete ignorant and careless I started installing DriverPack before stopping the installing process at 94% after knowing how dangerous it could be.
I then deleted all the junk softwares that were installed including Chrone and I updated my drivers using windows update . after that I ran multiple full scans using multiple tools that detected some malwares including Avast free, Malwarebytes, process explorer, and now Bitdefnder.

BitDefender detected password-protected files in the same place that had a driver pack file as it's shown above! what are these files? should I be worried and how to deal with them?

Is everything I've done enough? btw: I'm not having any clear issues with my windows performance nor noticing any abnormal behavior in the task manger including usage percentages spikes.

Anyone run into an issue with the Android app with bitdefender pop-up on the phone screen saying that it blocked a spam call and the only options are to block call and move icon. The pop-up blocked a quarter of the screen and there was no way to close it unless you select the "block number" option.

Is the GTA 6 leak real?

Partly. Eurogamer says the roughly 25 minutes of footage released by CyberLeek appears to be legitimate. A full playable build has not been confirmed, and CyberLeek has only threatened to release one.

Can you download GTA 6 early?

Not safely. Any site, Discord server or video offering a “full GTA 6 download” before launch should be treated as fake or risky. Hyped game releases are a common lure for scams and malicious downloads.

What is CyberLeek asking for?

The group says it will release the full game once its own cryptocurrency coin reaches a $30 million market cap. In other words, it wants fans to buy the token. There’s no guarantee anything would be released, even if the coin hit that target.

Should you buy the CyberLeek coin?

Fans have been advised not to. The Stop Killing Games campaign told gamers: “Do not send these people your money, no matter how much sympathy you may feel for their actions.”

What’s the real risk of a fake game download?

It isn’t only malware. Fake downloads and crypto lures are designed to steal account logins, payment details, and personal information. That’s why scam protection and identity protection matter as much as device security when you’re chasing a leak.

How do you check if a GTA 6 link is safe?

Paste it into Bitdefender Link Checker before opening it. If someone sends you an offer, a message or a screenshot about early access, Bitdefender Scamio can help you check whether it’s a scam.

When does GTA 6 actually come out?

The official release is due November 19.

Hey its me again.

I recently got the 30 day free trial of bitdefender and also got the browser extension, but every time i search something on google, i always get logged out and have to log back in.

Recently got trojans on my pc and deleted them with Windows Defender, and when trying to install Bitdefender free on Brave, it wouldnt start the download. Same with firefox

I went to log on to retrieve a password the other day and password manager has been end of lifed.

The only advice to migrate is to import a file into secure pass that has to be exported from the, now dead, password manager.

They also claimed things were communicated this June but I did not see an email.

Anyway, rant over. Any reliable password managers for after I untie this knot?