Malwarebytes uses AI to help people assess suspicious messages

Malwarebytes brings Scam Guard and threat intelligence to everyday scam checks. Understand free access, paid protection and the limits of an AI verdict.

01 / ProductAI-assisted scam checking sits beside malware protection

Malwarebytes provides consumer cybersecurity tools, including device protection and assistance with suspicious online content. Malwarebytes Scam Guard is its AI-powered scam-checking feature: a person can submit a message or image and receive an explanation intended to help them judge the risk. The useful outcome is a better next decision before clicking, paying or sharing information, rather than a claim that every deceptive message can be classified perfectly.

The Malwarebytes app in ChatGPT adds another entry point by bringing Malwarebytes threat intelligence into a ChatGPT conversation. Its announcement describes checks involving URLs, domains and phone numbers, alongside context such as domain registration information. This connects a familiar conversational interface with a security provider’s information, but the user still needs to understand which evidence the answer actually checked.

The company boundary matters here. The current ThreatDown company history says ThreatDown became an independent company in 2026, with its own roadmap, board and investors. Earlier material describes it as Malwarebytes’ business unit. This blueprint therefore covers Malwarebytes’ consumer AI and protection tools; it does not attribute the independent ThreatDown enterprise detection and response platform to the current Malwarebytes offering.

02 / AudienceA practical fit is the moment before a risky personal action

The clearest use case is an ordinary person trying to assess an unexpected delivery notice, account warning, job offer or payment request. The message may look plausible and may not contain a known malicious attachment. An explanation that identifies the suspicious element and suggests a safer verification route can be more useful than a bare red or green indicator.

Family members helping one another with unfamiliar online situations may also find a conversational explanation useful. The important design requirement is that the advice remains understandable to the person who will act. A technically accurate description of a domain is not enough if the user still does not know whether to open the message, contact the organisation independently or leave the request alone.

OpenAI provides context for the ChatGPT environment in which the Malwarebytes app can be used. For organisational email protection, Proofpoint illustrates a different security buying decision involving managed policies and business communication. Personal scam checking can complement those controls, but it should not be mistaken for a company-wide email or incident response service.

03 / WorkflowProposed workflow: assess a message without following its instructions

Build a small evaluation set from harmless examples that you are entitled to use: one clearly legitimate notification, one simulated scam and one ambiguous message. Remove personal information that is unnecessary for the question. Record the known context before using the tool. This is a proposed consumer evaluation, not a completed test of Malwarebytes or a measurement of its scam-detection accuracy.

For the simulated suspicious message, submit the relevant text or a redacted screenshot through Scam Guard. Ask for the evidence behind the assessment and a safe next step. The person evaluating the output should be able to distinguish a suspicious wording pattern from a confirmed reputation finding. Both can be useful, but they support different levels of confidence.

Inspect the exact address or domain described in the answer. Similar-looking names are easy to confuse, and a screenshot may conceal part of a destination. Do not open the suspect link merely to supply more detail for the test. If the evidence is incomplete, the useful result is an explanation of what is missing and how to verify the claimed sender through an independently known route.

Compare a ChatGPT app check separately, if the app is available in the user’s account and region. Verify that the response actually came from the Malwarebytes app and includes the relevant security context. A general conversational answer and an app-backed threat intelligence check are different evidence paths, even when they appear in the same chat interface.

For the legitimate example, look for unnecessary alarm and whether the tool explains why uncertainty remains. For the ambiguous example, check whether the recommendation stays proportionate to the evidence. A legitimate business might use an unfamiliar domain, while a compromised legitimate site could host something harmful. The evaluation should reward clear qualification rather than forcing every item into a confident binary verdict.

Finish by asking a less technical person to explain the next action in their own words. Record whether they would independently contact the organisation, ignore the message or seek help, and whether the explanation changed their behaviour safely. The meaningful measure is decision quality and comprehension. A long, reassuring answer that encourages the wrong next step is worse than a short answer that clearly admits uncertainty.

04 / PricingSeparate the free scam check from paid background protection

The Free and paid Malwarebytes Security features, updated 5 October 2026, lists Scam Guard among free features across Windows, macOS, iOS or iPadOS and Android. That recent feature matrix is the clearest source for the entry-level commercial boundary. Some marketing language presents Scam Guard alongside Premium; readers should not infer from that placement that a paid protection subscription is always required to use the feature.

The same matrix distinguishes paid protection functions and other bundled services from the free scam-checking tool. The pricing page offers annual individual and family packages, making paid protection a separate decision about continuous coverage and device allowance. Compare the features available on each operating system and the actual device allowance before selecting a bundle; do not assume that a similarly named plan has identical functions on every platform.

The ChatGPT route depends on app availability and the user’s ChatGPT access. The launch announcement describes supported ChatGPT plans where apps are available, rather than universal access in every market. No separate universal Malwarebytes app charge or current paid-bundle currency tariff is asserted here. Check the relevant account and regional checkout before treating either route as part of a purchase.

05 / DistinctionsAn explanation can be more useful than an unexplained warning

The Scam Guard on Desktop Security describes Scam Guard combining AI analysis with Malwarebytes protection databases, and allowing text or screenshots in the desktop workflow. The distinction is useful: a message can be suspicious because of its content even when its exact wording is new. Conversely, an apparently ordinary link may have reputation information that the person would not discover by reading the message alone.

The product’s consumer focus also changes the evaluation standard. A security analyst may want raw events and a detailed chronology; a person receiving a text message needs clear reasoning and a sensible action. The best explanation preserves enough evidence to be credible while avoiding a false impression that the tool has inspected a bank account, verified an identity or contacted the organisation on the user’s behalf.

06 / QuestionsA risk assessment is not a guarantee of authenticity

An unknown domain is not automatically malicious, and the absence of a known warning does not establish that a request is legitimate. Scams can exploit compromised accounts, new infrastructure and information that the tool cannot see. Keep the final decision tied to the full situation, particularly where a request asks for money, credentials or remote access to a device.

The desktop instructions describe an optional confirmation step before submitting suspicious material to Malwarebytes threat intelligence. That is distinct from using the assistant to analyse an item. Read the current interface before sharing a screenshot or message that contains other people’s information. Crop or redact irrelevant details when doing so still leaves enough context for a useful assessment.

Availability also needs to be checked on the actual device. The desktop guide specifies Windows 10 or later and supported macOS use, while the cross-platform feature matrix identifies where free Scam Guard is offered. Public-source research does not establish that every interface has identical attachment handling, usage allowances or rollout timing. A family or support team should test the particular platform they will recommend, without assuming that a screenshot from another version is a complete guide.

07 / DecisionUse Malwarebytes to support a better next step

Malwarebytes is worth considering when the problem is interpreting a suspicious message before taking action. Start with the free Scam Guard route and evaluate whether its explanation is understandable and appropriately qualified. Choose paid protection separately on device and feature needs, and use the ChatGPT integration only where its availability and evidence path are clear.