Malwarebytes Ultimate

Malwarebytes is well known for its antivirus capabilities that keep your devices safe. Malwarebytes Ultimate reaches into the security suite realm, adding VPN protection and a full-scale identity theft remediation service. However, the TransUnion-powered identity theft system is the same as what you get with several competitors, and they outshine Malwarebytes with a wealth of security features. Bitdefender Ultimate Security stands out in that group, combining identity protection from TransUnion with an award-winning security suite. Norton 360 With LifeLock also starts with an excellent suite and adds the most feature-rich identity system around. Malwarebytes is no slouch, but Bitdefender and Norton are our Editors’ Choice winners.

How Much Does Malwarebytes Ultimate Cost?

When identity protection is added, the price of a security suite jumps. Malwarebytes Ultimate starts at a list price of $239.99 per year, which gets you security protection for a single device. You can protect three devices for $279.99 or five for $319.99. To install protection on 10 or 20 devices, you pay $399.99 or $499.99. This covers devices running Windows, macOS, Android, or iOS.

At the top two tiers, 10 or 20 devices, you get identity protection for two adults, not one, plus up to 10 children. You also get personal data removal services for two individuals.

These prices are a bit on the high side. You pay $179.99 for a five-pack of ESET Home Security Ultimate licenses, $159.99 for Bitdefender Ultimate Security, and $129.99 for Webroot Premium at the same level. The $319.99 price for Malwarebytes stands out.

The same is true at the 10-device level. A 10-device subscription for Malwarebytes costs $399.99. You pay $249.99 for Webroot, $204.99 for ESET, $189.99 for Norton 360 With LifeLock Select, and just $144 for Aura.

Malwarebytes Ultimate’s pricing maxes out at $499.99 for 20 devices. With Bitdefender, $199.99 gets you 25 devices. Avast One Platinum costs $299.99 for 30 days, and you can protect 50 devices with Aura for $444. But why impose limits? A $199.99 subscription for McAfee+ protects all your devices, as does a $349.99 subscription to Norton 360 With Lifelock Ultimate Plus.

The Malwarebytes bundle does come in two lower tiers, with significantly fewer identity protection features. The Essential tier runs from $99.99 per year for one device to $331.99 for 20, and the Advanced tier runs from $189.99 to $441.99. Ultimate, reviewed here, is the best value.

Getting Started With Malwarebytes Ultimate

When you activate your subscription to Malwarebytes Ultimate, you’ll probably be directed to set up your identity protection right away. You can put this off if you don’t have time. I’ll discuss the full identity onboarding in detail below.

From the online Secure Hub, you can also download Malwarebytes Premium for the device you’re using or send a code to install it on another device. Your subscription allows you to protect as many Windows, macOS, Android, and iOS devices as you need.

Features Shared With Malwarebytes Premium

On Windows, what you get is precisely Malwarebytes Premium Security, except that the VPN component is enabled. The same is true of Malwarebytes Premium Security for Mac. That being the case, I’ll refer you to those two reviews for full details and just summarize here.

The Windows and macOS editions are nearly identical in appearance. Both have a left menu with options for Dashboard, Identity Protection, and Settings. The Windows edition adds a Tools menu item, and the menu items display just as icons, with labels sliding in when you point to them. Both have a Trusted Advisor panel at the top right showing your security score, with the option to dig in for actions to raise that score.

Between the menu and Trusted Advisor, you find a stack of three panels labeled Scanner, Detection History, and Real-Time Protection. Even Malwarebytes Free has these three panels, but Real-Time Protection is disabled in the free edition. Finally, below those three stacked panels is a larger pane that displays the status of the VPN component, including a map showing just where you’re connected.

Independent testing labs don’t offer current scores for Malwarebytes on either platform, but it earned a near-perfect score in my malware blocking test on Windows. Its Browser Guard component did well in testing against malware-hosting URLs, and scored identically on both platforms in my phishing detection test, reaching 96% detection.

The Windows-only Tools page warns that the tools are experimental and suggests creating a System Restore Point before using them. Tools include a collection of configuration controls to manage the built-in Windows Firewall and a very simple manager for programs launched at startup. Those using Windows 11 also get a collection of System Tweaks, things you could do yourself in Control Panel or Settings.

VPN Protection

Antivirus protection is just fine for defending the files and documents on your computer or other device against malicious attack. However, when your data goes traveling across the interwebs, your antivirus is powerless to protect it. That’s where a VPN’s protection takes over. When you connect through a VPN, your communications travel an encrypted connection to the VPN server before emerging into the wild web.

That encrypted connection means that even if you’re using a compromised network, nobody can snoop or modify your traffic, not even the network’s owner. At the other end, your traffic seems to come from the VPN server, so the websites you visit can’t scrape your actual IP address and use it to physically locate you. As a bonus, surfing through a foreign VPN server may let you access content that would be blocked at your actual location.

VPN Server Locations

The more choices a VPN service gives you for server locations, the more chances you have to spoof your location to somewhere beneficial. A wide range of choices also means that wherever you are, you can find a server that’s reasonably close. To select a location with the Malwarebytes VPN, you simply click the currently selected location or the adjacent map.

Malwarebytes offers locations in five dozen cities within 34 countries. Almost half are in Europe, another one third in North America, 10% in Asia, and 5% each in Oceania and South America. There are no server choices in Africa, and dangerous locations such as China, Russia, and Turkey are not represented, though Malwarebytes does maintain servers in Kyiv, Ukraine.

If you’re looking for VPN support worldwide, consider ExpressVPN, which has roughly 3,000 server locations in 105 countries. It’s particularly good in underserved regions such as Africa and South America.

VPN Settings

The most important setting in this VPN, next to choosing your server location, is the big on-and-off switch. If you simply click it to turn on protection when required, you’re doing fine. However, if you dig into the simple settings, you can make your protection even more seamless.

To start, you can configure it to connect automatically when the app launches, or to spring into action when you connect to an unsecured network. That way, you don’t even have to remember to flip the big switch. You’ll want to turn on the kill switch feature, which ensures that your device doesn’t leak unencrypted traffic if the VPN connection drops.

You might not realize it from the name, but the setting titled Connection rules refers to what we call split tunneling. This technique lets you define specific apps or websites that will skip VPN protection, either because they’re just not important enough to merit protection or because you can’t afford even the slightest drag on speed. You can define apps, IP addresses, or ports that will bypass the VPN. On the flip side, you can also identify apps, IP addresses, or ports that aren’t allowed to connect without VPN protection.

There are various techniques, called protocols, for a VPN to encrypt your internet traffic. We at PCMag prefer the WireGuard and OpenVPN protocols. Being open-source projects, they’ve been checked and double-checked by experts worldwide. Malwarebytes defaults to WireGuard, specifically the speedy WireGuardNT version. You can optionally switch to Malwarebytes MBtun, a proprietary WireGuard variant. And you probably should, because the split tunneling feature only works if you choose MBtun. Don’t be confused by the fact that the settings page labels this item Tunnel driver rather than Protocol.

That’s it for settings. You don’t get advanced features like multi-hop, which runs your traffic through two VPN servers. Nor does this VPN include the option to masquerade as non-VPN traffic, so as to get past countries and websites that restrict VPN usage.

Hands On With Malwarebytes VPN

Given that this VPN is fully integrated into the Malwarebytes app, there’s no setup required. Getting started is just a matter of selecting a server location and flipping the switch. The map marker jumps to your selected location and, once the connection has been made, you see the IP address that will be displayed to sites you visit.

I connected through Melbourne, Australia, and confirmed that websites now “saw” me as present there. Geolocation sites placed me in Melbourne, and even PCMag presented me with an Aussie edition. I also used iVPN’s DNS Leak Test to verify that the VPN handles DNS requests securely.

In a full review of a VPN app, we run tests to determine the VPN’s impact on performance. Specifically, we check how much it increases latency and how much it impacts the speed of uploads and downloads. This lets us identify the fastest VPNs. But it requires specific testing hardware that I don’t have.

We also run detailed tests to determine whether streaming services such as Netflix block a VPN’s access. Results of this test can often change, as VPN apps try to get through and services try to block them. Given that Malwarebytes doesn’t try to obfuscate its traffic, I didn’t run the tests that identify the best VPNs for Netflix.

It’s great having VPN protection integrated right into the Malwarebytes app. All you need to do is flip on protection as needed, or configure it to go on automatically. Most users don’t need any more. It doesn’t necessarily have the expert-level features a VPN maven might want, but that’s just fine.

If VPN is your main focus, you should probably consider NordVPN or Surfshark One. Both offer excellent VPN service combined with antivirus, and Surfshark even offers some identity protection.

Protection on Android

As noted earlier, you can use your Malwarebytes licenses to install protection on Windows, macOS, Android, or iOS devices. For a mobile device, you start by snapping a QR code to install the app. To activate the installation with your account, you can log in using your username and password. However, it’s easier to do it by generating an MB Code, which is good for just two minutes. Type in the code, and your new device becomes part of the family.

After a quick installation and a few permissions, I found myself confronted with a daunting screen. The Identity Protection section at the bottom offered to check my digital footprint or engage identity theft protection. A panel above that offered to run a scan. But prominently at the top was my protection score, just 20 points, labeled Poor.

I clicked to run a scan in hopes of improving my score. It finished in seconds and (unsurprisingly) reported no problems. And hooray! Just by running that scan, I brought my score up to 31. Tapping a link titled Boost your score brought me to the full Trusted Advisor window, with lots of suggestions.

Working through the critical actions wasn’t very different from simply giving necessary permissions, as you must do with any Android security product. But I appreciated having it phrased in terms of what’s being accomplished, for example, enabling Real-Time Protection rather than just asking for the permissions directly. Finishing with the critical items got me up to 77 points and brought up a list of minor issues, such as scheduling scans and allowing the app to send alerts.

Some of those issues weren’t as minor as others. For example, the app correctly advised that NFC connections shouldn’t be enabled unless the device is unlocked; I fixed that. It also advised me to give it permission to scan texts for scams and fraud. Taking care of all these tasks brought me to a happy, green 100-point score.

Android Lab Scores

While I test and analyze antivirus efficacy against Windows malware, my coding skills don’t extend to other platforms. Fortunately, three of the four independent testing labs that I follow regularly test Android security products.

Researchers at MRG-Effitas hit Android security products with a variety of malware types found in the wild. They also do a sanity check to make sure the antivirus isn’t wrongly flagging valid apps as malware. Malwarebytes reached a perfect 100% score, as did half the other products tested.

Tests from the AV-Test Institute come in three categories: protection, performance, and usability, with six points available in each category. In this lab’s latest report, every app received six points for performance, and all but one reached the pinnacle for protection. Half the apps lost a point in usability due to false positives. Malwarebytes didn’t appear in this test.

Malwarebytes also doesn’t show up in the latest report from AV-Comparatives. Of the small number of apps tested, Bitdefender was the only one to reach 100% detection. In fact, Bitdefender received perfect scores from all three labs, the only app to currently hold that honor.

Android Tools

Tapping the Tools icon at the bottom of the screen brings up a list of four items: Application Manager, Ransomware remediation, Privacy Checker, and Settings Checker. That last item, as its name suggests, checks your settings and offers advice on any changes that would improve security. Like the similar feature in Panda Dome Essential, ESET, and McAfee, Privacy Checker lists all the apps on your device and the permissions they have. Or rather, it lists all the permissions and the apps that have them. The other way around would make it easier to identify apps with permissions they shouldn’t have.

I don’t see much point in the Application Manager. However, the Ransomware remediation system is unusual and interesting. Where desktop ransomware typically encrypts important files, mobile ransomware more commonly locks the entire device. When lock screen ransomware has control of your phone, you can’t enter data in any normal way, so Malwarebytes provides a couple of bizarre triggers to get help. You can plug and unplug a headphone jack four times in 10 seconds (if your device even has a headphone socket). Or you can press the volume buttons in a sequence reminiscent of the famed Konami code. Hey, if doing this breaks you out of a lock screen malware attack, it’s not bizarre at all!

VPN Protection for Android

As on the other platforms, your first step in using the VPN is to select a server location from the same collection that’s available to the VPN on Windows or macOS. Flip the switch to on, and you’ve got VPN protection.

Once you get past server selection, you’ll find that the settings are seriously limited compared with the desktop. You can set an always-on VPN, with an ancillary option to deny connections when the VPN isn’t on. If you’ve enabled the option to deny non-VPN connections, you can manage split tunneling much as you do in the desktop edition. And that’s it for settings. You don’t choose a protocol or set the VPN to kick in when you’re on an unsecured connection. It’s very, very simple.

Other Android Security Features

Scrolling down the main window, you’ll find a collection of security features. You can invoke the same digital footprint scan for data breaches that’s available on other platforms. It’s even possible to access the identity theft remediation system on a phone, though the big screen of a desktop is better for viewing.

Further down the screen are simple toggles for text protection, real-time protection, and safe browsing. With those three, but rather more interesting is a link to the Scam Guard chat assistant. If you get an iffy email or text, you can paste it into Scam Guard for analysis. You can also ask about any website’s reputation.

I warmed up by asking it about a random website, which it flagged as neither malicious nor definitely safe. Then I snapped a screenshot of a scam email that arrived in my inbox this morning. It not only identified it as dangerous, but it also spelled out all the reasons. Pay attention to Scam Guard, and you could learn to be a pretty good scam guard yourself.

Protection for iOS Devices

Apple has done a bang-up job designing iOS for resistance to malware attacks. As it turns out, it’s also pretty resistant to attempts at defense against malware. Like competing suites, Malwarebytes just can’t do as much for you on an iOS device as on other platforms. That being the case, you’ll want to think carefully before expending one of your valuable licenses on protecting an iPhone.

Installation works the same as on Android—scan a QR code to get the app installed, then activate it using a time-limited MB code. Also, as on Android, you start out with a poor protection score. My test iPad started at 45 points, a bit extra low because it had an operating system update pending. Following instructions, I installed the update and enabled Web Protection and Ad Blocking extensions in Safari. That got me up to a much better 87-point score.

The final issue, a minor one, involved enabling Malwarebytes Ultimate’s Call Protection feature, which warns you of known fraud and scam calls. Since the test iPad isn’t configured as a cellular device, I had to just ignore that one, but doing so still brought me to a perfect 100 points.

Reaching 100 wasn’t hard because there’s not much protection available. Web Protection and Ad Blocking work specifically within Safari to suppress advertisements and keep you away from dangerous pages. Call Protection and Text Message Filtering, enabled by digging into Settings, let Malwarebytes warn you away from calls and texts that aren’t in your best interest. And Scam Guard is the same AI chatbot found in the Android edition.

If you’ve purchased a multi-pack of licenses and have more than you need for your Windows, macOS, and Android devices, sure, go ahead and install protection on your iPhone or iPad. If not, just let it go.

Identity Theft Protection

A ransomware attack can lock away your important documents behind a wall of encryption, but identity theft can lock you out of your very life. If someone commits a crime using your identity, you could even go to jail. And recovery can be a long, slow process. Malwarebytes builds in monitoring systems to catch identity theft early, along with remediation to restore your daily life if needed.

If you’ve read many of my reviews, you may find that the descriptions that follow sound familiar. Malwarebytes and several competitors, including Avast One Platinum, Bitdefender Ultimate, and ESET Home Security Ultimate, all license identity protection from TransUnion. If you’re selecting Malwarebytes Ultimate specifically for its identity protection, you should consider the other three as well.

Chances are good that when you first activated Malwarebytes, it sent you through a process to activate the identity protection system. If that didn’t happen, or if you skipped it, just click the Identity Protection menu item and click Manage protection.

The activation process is simple. You enter a few pieces of personal information, such as your name and address, then authenticate using your SSN and a texted code. Once you accept the terms and conditions, you’re ready to start using the identity protection system.

You manage identity theft protection entirely from an online dashboard. A menu at left offers access to various identity features, and panels at right describe the lost wallet assistance and dedicated resolution specialist support that’s available to you. Down the middle is a column of useful information, stacking recent activity, a panel titled Let’s Get Started, quick access links for services, and a credit score summary.

For now, we’ll check out the panel about getting started. This panel contains five action items, with a percent-complete indicator in the top right corner. You’ve already finished creating your profile, so you’ve made it to 20%. Next, you’ll add additional personal data.

The additional information referenced here specifically means your driver’s license, passport, medical insurance, and your mother’s maiden name. As long as you fill in a driver’s license and mother’s maiden name, Malwarebytes considers this step complete, taking you to 40%.

Next up, you’ll connect your social media accounts, specifically Facebook, X/Twitter, Instagram, and YouTube. The service does warn that you should only connect YouTube and Instagram accounts that you use to broadcast your content. If you just like to watch, don’t bother. With Facebook, partner ZeroFox handles the connection. With X/Twitter, it goes through Sontiq. Presto, you’ve reached 60%. I do find it odd that X/Twitter gets such prominent coverage, given the number of users bailing on the troubled site. And where’s TikTok? BlueSky? Mastodon?

IDX Complete tracks social media in a similar fashion, with similar false positives. So does IDShield. IDShield also offers a separate Reputation Management component for social media, a feature that proved seriously unreliable in testing.

For another quick (but pointless) 20%, open the so-called password manager component and add something, anything. Unlike what we’d normally call a password manager, this is just a storage system. It does include a password generator, but the all-important password capture and replay is entirely absent.

Closing out the initial task list, you’ll next enter data that will be useful in the event your wallet is lost or stolen. You can record one or more items of the following types:

Bank Account
Combination
Credit/Debit Card
Customer Rewards Card
Driver’s License
ID Card
Medical ID Card
Passport
Social Security Card

This isn’t quite the same as listing personal items for dark web tracking. Here, you fill in all the details that you would need, including the issuer’s website and customer service phone number.

That’s it—you made it to 100%! You can now hide the whole Let’s Get Started panel, since you’re thoroughly started by now.

Filling Up the Identity Vault

Working down the menu, the next item is Identity Vault. You’ve already worked with the vault when you entered your additional personal information, but there’s more to it. You probably already have one apiece of the following on the Monitored Info page; if not, fill them in:

Address
Date of Birth
Driver’s License
Mother’s Maiden Name
Social Security Number

Most identity protection systems let you enter just one of these, though McAfee permits two driver’s licenses, and Norton will track as many as five physical addresses.

You can expand on what you’ve entered, adding up to 10 phone numbers and email addresses. Consider filling in details in these categories:

Bank Account
Credit/Debit Card
Email
Medical Insurance ID
Passport
Phone

Malwarebytes stores five passport numbers and 10 of the other types. Once you’ve made your additions, it slides them right into the dark web tracking system, looking for any signs your identity is already compromised.

Dark Web Alerts

If Malwarebytes finds your personal information on the dark web (and it almost certainly will), you’ll receive an email notification. The latest alerts also appear at the top of the dashboard, and they have their own page selected from the menu at left.

It’s tedious, but after giving the system a day or two to find what it can, you should go through all the alerts. My experience is that many of them are from years ago, for accounts that no longer exist, but there might well be some live ones in the mix. Read each description, take any available action, such as changing the password for an exposed account, and then archive the item. Now any new alerts will stand out.

Rating and Raising Your BreachIQ Score

Dark web monitoring alerts you whenever it finds your personal information exposed. BreachIQ is focused on known data breaches that include your personal information. The page breaks down into five tabs: ID Safety Score, My Breach Exposures, Action Plan, Search Breaches, and an FAQ page. The basic breach display includes the date, a risk rating, and two items of exposed data. If there are more items, you can click to view them all.

The ID Safety Score page presents your risk score, from 1 to 100, and reveals factors that went into the rating. To raise a poor score, look no further than the Action Plan page.

Many of the items in your action plan are specific tasks you can accomplish and check off, things like setting up USPS Informed Delivery and filing your taxes early. Others are more general, such as advice to watch out for impersonation emails and beware of social engineering. As you check off the actions, your score will rise.

Checking and Managing Your Credit

One of the first signs that someone is meddling with your identity could be an unexpected drop in your credit score. Malwarebytes captures your score with each of the three bureaus (TransUnion, Experian, and Equifax) monthly and displays those scores when you select Credit from the left-rail menu. It also presents a summary of the information in your three credit reports and keeps a history of reports received.

If your credit scores are lower than you’d like, you may want to take action to raise them. But what should you do? By using the Credit Simulator, you can get a preview of just what effect many specific actions would have on your score, and it’s not always what you’d expect. For example, canceling your oldest credit card can actually lower your overall score.

Do you suspect someone might be trying to open credit accounts in your name? This would be a good time to put a freeze on your credit. On the Freeze My Credit tab, Malwarebytes supplies links to the credit freeze function for each of the three big bureaus, along with detailed information about just what a credit freeze is and how you use it. Really, unless you’re actively seeking to finance a house, car, or other large purchase, you’d be smart to keep your credit frozen and lift the freeze as needed.

Tracking Anomalous Transactions

If an identity thief starts buying things on your credit cards, you want to know about it as soon as possible. Malwarebytes helps here by tracking the financial accounts you connect and warning you about transactions that could be red flags.

You start by choosing your financial provider from a big list, logging in, and giving Malwarebytes permission to track accounts from that provider. Once you’ve selected one or more accounts, you can configure your preferences for transaction alerts. You can set distinct thresholds for purchases, fees, deposits, transfers, and other transactions, and you can optionally set different thresholds for different accounts.

The transactions page also gives you one big list of all transactions from all the accounts you’ve linked. If you suspect something fishy is going on, perusing this list could well help you confirm the details or dispel the worry.

I mentioned earlier that Avast, Bitdefender, and ESET also rely on TransUnion for identity protection services. There are a few differences in coverage. ESET doesn’t include transaction tracking, and Bitdefender reserves it for the higher-priced tier.

Resources for Identity and Credit Protection

The final menu item, other than Support, is Resources. Be sure to review this page, as it includes some useful items divided into tabs for Calculators, Forms, and Junk Mail & Calls.

The calculators help you think about decisions like whether to refinance a mortgage or whether to buy a car versus lease one. You just plug in the figures and get some simple answers for comparison. The forms offer templates for complaints and other types of letters, along with a compendium of consumer protection information. Finally, there’s a page with links to help you opt out of various types of junk mail and telemarketing.

Dedicated Resolution Specialist

Prominent on the main dashboard page is a panel inviting you to contact your dedicated resolution specialist if you are a victim of identity theft. Some alerts have an Open Case button that connects you to a specialist. You can initiate remediation by phone or email.

Backing up recovery with a million-dollar guarantee is standard for services that provide identity theft remediation. Malwarebytes offers that standard guarantee, doubling it if you’ve subscribed at a level that protects two individuals. As is common, there are sub-limits on expenditures for particular costs of recovery. For example, the policy will pay up to $25,000 each for funds lost to ransomware and social engineering, and lost wages coverage is limited to $1,500 per week for no more than eight weeks. Norton is among the few similar services that do not impose sub-limits.

As always, I can’t test this service’s ability to remediate the effects of identity theft. I can report that it’s very easy to open a case.

Personal Data Remover

The identity protection component strongly focuses on data theft and illicit use of your personal information. Data brokers and aggregators threaten your privacy in a different way, gathering and analyzing public information to form a personal profile of you that they can then sell. Like Norton, Malwarebytes supplements its identity protection with a separate personal data removal service that aims to clear your data from those brokers.

To get started with this component, you fill in your full name, your age, and any nicknames or alternate names you may use. You also list your primary city and state, optionally including another city where you’ve lived.

The service immediately gets to work, reporting on brokers holding your data and sending automated opt-out requests to those brokers it can handle. I always have trouble testing these services because previous tests have wiped out my data already. Malwarebytes found exactly two instances of my data, which is more than some competitors have done. It sent an automated opt-out request for one and supplied detailed DIY instructions for me to opt out of the other manually.

According to my Malwarebytes contacts, this scan checks about 175 broker sites, with the precise list changing as new brokers emerge. It also scans on a bi-monthly basis to catch any reappearances of your data. It may not be as powerful as a dedicated solution like Optery or Privacy Bee, but clearing your personal data from the brokers that Malwarebytes covers certainly couldn’t hurt, and doing so is truly easy.