On GitHub, [AyaanB] details buying a cheap Android TV streaming device, looking for, and finding, baked-in malware.

Multiple warnings have been issued by the FBI and CISA regarding malware on media box Android devices. Many devices have been caught participating in botnets providing residential proxies, ad-click fraud, and DDOS services. [AyaanB] sets out to discover if a $30 set-top streaming box is pre-infected with malware, and extracting it – without ever letting the device talk to the Internet or access other devices on the local network.

Picking a device named in the advisories, [AyaanB] discovered that it was, indeed, preloaded with multiple app stores and applications that wouldn’t typically make sense on a set-top TV box. After identifying the serial port test pads and obtaining a low-voltage serial adapter, they were able to gain access to the bootloader and from there dump the contents of the MMC over TFTP.

With the entire filesystem accessible out-of-body, proving it was infected with malware at the factory becomes simple: the malware is signed as a system application, baked onto the system partition of the MMC, granted SELinux exceptions to mark it as a system binary with shell privileges, and has multiple launch scripts to make sure it is executed even if partially removed. With the malware identified, [AyaanB] continues to dig through to uncover the capabilities.

By installing hooks into the low-level Android process spawning system, the malware installs hooks into every application as it is launched: even if an application isn’t trojaned already, by the time it finishes executing, it’s definitely been subverted. The functions patched and the methods used match the Vo1d botnet, which is used for account takeovers, residential proxies, free “VPN” services, and other unfriendly behavior.

Further digging into the system showed hooks for ad-click fraud, where hidden browser windows are allowed to run unthrottled and display overlays are configured to obscure ads below where the user may click. Other included tools bid in real-time ad auctions, claiming to directly publish ads to the user which may or may not be visible. To cap it all off, a root level backdoor allows botnet operators to access the systems directly and install additional tools.

Be sure to check out [AyaanB]’s writeup for more details on exfiltration methods and other malware found on the devices.

Hijacking Calls to Military Bases with DNS

In the early 2000s, a domain name scheme was developed to directly map telephone numbers to DNS records for SIP and VOIP calling. (Who knew? I didn’t!) But [Lina] did, with an excellent writeup on accidentally positioning themselves to intercept phone calls by registering an expired domain.

The e164-arpa number to name scheme was never widely adopted, and quickly forgotten about. As is the way with all forgotten standards, the infrastructure slowly fell apart. [Lina] noticed that several country records were delegated to name servers hosted in expired domains, and by simply registering them, they were able to begin resolving queries. For a five Euro registration fee, [Lina] gained control over an abandoned DNS resolution protocol for Saint Helena, Diego Garcia, and Ascension Island. After watching the logs for some time and not getting any traffic, and running into the bureaucratic tangle of standards committees and the actual United Nations, the project was shelved.

Six months later, [Lina] examined the logs of the other domains, and found hundreds of thousands of records of attempted calls, and since you read the section header, you already know where the calls were headed. Clearly some phone systems still attempt to use the ill-fated e164-arpa calling scheme even in 2026, and because the DNS records control the destination of the call, it would have been possible to hijack all the calls transparently and mine them for information, and all for five Euros. With military bases involved, and with one of the bases targeted by missiles during recent conflicts, suddenly agencies cared significantly more, and the story has the happy ending of the domains being transferred to the National Cyber Security Center in the UK.

AliExpress Fingerprinting Browsers

AliExpress has been caught using a hidden fingerprinting technique to try to identify users.

The fingerprinting plays a waveform in the background of the page with the volume set to zero, and measures variances in the computed values. Variances in the computed waveform are introduced by the browser type, CPU, audio hardware, and even the driver versions. While most of the headlines have focused on the audio fingerprinting, AliExpress also used other fingerprinting techniques to build profiles of each browser, including WebGL, WebRTC, screen resolution, and other web integrations.

The purpose of the advanced device fingerprinting is unknown: AliExpress could use it for fraud prevention, but could also be using it to identify and track customers when they have disabled traditional tracking cookies. The audio fingerprinting was discovered when a user experienced trouble with Bluetooth headphones being attached to the silent audio stream.

Unfortunately with fingerprinting techniques which leverage standard features in the browser it can be difficult to block them. Sometimes, ad blockers may be able to identify and block some of the fingerprinting resources, as can disabling some features in the browser, but many features like audio and WebGL can’t usually be turned off.

[Tom Ritter], who works for Firefox, mentions that they head this fingerprinting method off at the pass three years ago as part of their anti-fingerprinting campaign. This is clearly not the case for all browsers.

Attacking Signal’s Contact Discovery

Most chat apps allow you to discover users from your contacts list who also use that app – but then you’ve given your contact list to the app, helping them build their marketing and social graphs. Signal of course handles it differently, allowing you to discover users from your contacts list while preventing the Signal corporation from being able to access your list of contacts. Well, mostly.

Signal runs the contact discovery process inside an Intel SGX Enclave. A SGX Enclave is an Intel extension similar to a Trusted Execution Environment (TEE) on Arm, where memory and execution can be partitioned for a restricted process. In theory, code and memory inside an enclave can not be read by other processes, root processes, or even a hypervisor or virtualization system. Signal uses enclaves so that the users encrypted contacts list and the encryption key itself are fully insulated. The Signal client is then able to validate the integrity of the enclave using known measurement values baked into the client releases.

Researchers using the V12 AI agent discovered this wasn’t always the case. Because a SGX Enclave shares resources with the rest of the system, a malicious host could create exploitable race conditions in the algorithm by generating page faults and pausing execution of the enclave. The malicious server running the enclave is still unable to directly read the contents, but it could extract the secret values needed to then create false servers which could fully expose the user contact list.

A second attack would allow a malicious host to manipulate the list of clients connected to the enclave, gaining full code execution inside the enclave with the predictable result of exporting contact data.

Both of the issues were reported to Signal and fixed before the public writeup, and there is no evidence they were ever abused: to attack either flaw, a compromised host would have to be running the Signal enclave code and be part of the Signal infrastructure that clients would connect to.

Boston Scientific Hit by Cyberattack

Boston Scientific reported in a SEC filing that it has been hit with an unspecified cyber attack impacting operations, causing the stock to drop by almost 5% in a day.

The company has been unwilling to release any details of the attack, but expects to be able to resume shipping of medical products in “less than three weeks,” which sounds like a pretty major disruption. Boston Scientific manufactures defibrillators, pacemakers, and surgical equipment. It’s unclear if any patient data has been compromised, though presumably regulations will require disclosure if that’s determined to be the case.

With no additional information about the attack, it’s also unclear if any source code or other data which could aid attacking medical devices was impacted, either.

Carhartt Hit by Ransomware

The Carhartt clothing company has also been hit by ransomware, with 13 million accounts leaked.

The ShinyHunters group claims responsibility; previous victims of the group include casinos, car manufacturers, medical companies, and government agencies. The leak claims to include over 50 gigabytes of customer and employee data, with customer data including email, phone numbers, and physical shipping addresses. The group demanded $3.3 million in ransom for the data, and published it when Carhartt didn’t pay.

Have I Been Pwned linked the data to a compromise of the Databricks instance used by Carhartt, which is a platform for linking business data and AI.

AI Agents Installing Unknown Code

Multiple AI agents (Codex, Hermes, and Claude) have been observed executing arbitrary instructions and code contained in the llms.txt files on websites.

Normally, llms.txt and llms-full.txt are used to instruct AI agents on how to summarize and index the sites content, but researchers in Israel indexed the files of Fortune 500 companies, defense contractors, and tech companies and found that over a hundred of them included directions to install packages which didn’t exist or referenced domain names that were not registered. The researchers were able to create packages with matching names and record agents inside multiple high-profile companies installing and executing them.

While documenting the reach of the exposed packages, researchers found at least one had already been replaced by attackers with live malware which would execute inside whatever context the agent was executing in, potentially exposing authentication tokens or company data. The attacks which have been rampant in the NPM and PyPI package repositories can make even legitimate packages dangerous to install, but agents blindly following instructions from arbitrary websites inflates the danger even higher.

Alleged Members of TeamPCP Arrested

Finally, security reporter extraordinaire Brain Krebs brings news that suspected key operators of the TeamPCP group have been arrested in Australia.

TeamPCP has been behind some of the worst of the supply chain attacks plaguing PyPI, NPM, and VSCode plugin repositories, and have released the source code to some of the worms used in the supply chain attacks to muddy the waters and recruit new members. TeamPCP has also been involved in compromising thousands of GitHub repositories, and is affiliated with multiple other crime and malware groups.

While the identities of the arrested individuals have not been officially released, in typical Brian Krebs fashion, dozens of connections are correlated showing their likely identities and links to TeamPCP and other groups. If nothing else, this should serve as a reminder that the best time to pay attention to operational security was ten years ago.

As TeamPCP doesn’t appear to be a state-sponsored group, or even strongly organized, the arrests of a few members are unlikely to drastically slow down the compromises. Krebs details conversations held with one of the arrested men, in which they discuss struggles with sobriety and plans to leave the malware scene, stating that others have already taken over leadership roles in the group.

Apple has started sending some users push notifications warning that they have been targeted with specific malware. No specific information about the threat Apple detected is available. While multiple iOS attacks were released in spring of 2026, they all target much older versions of iOS and older hardware versions.

Users in 110 countries have received notifications recently, warning them they may have been targeted or already impacted by malware such. Apple typically uses the crash reporting mechanism for system apps to track new attack trends. The majority of users will likely never see an alert from Apple because malware with state-level capabilities like the Pegasus family is extremely expensive to develop. However, commercial availability means that some governments have deployed them against political opponents, protesters, human rights lawyers, and journalists.

If Apple pushes a security alert, it will show up as an email and a standard system notification, but also as a notification inside the Settings application. While email and notifications can be spoofed as part of phishing attempts, to date there is nothing which can generate false alerts inside Settings.

Almost universally in these cases, Apple recommends enabling “Lockdown Mode“, which adds extra protection to devices at the cost of decreased battery life and slower performance. Lockdown mode disables custom fonts on web pages, accelerated JavaScript, restricts message attachments over SMS and iMessage, and disables other common paths used by malware to steal data. Android devices offer a similar feature since Android 15 that is less comprehensive but can still provide additional safeguards for users directly at risk.

Attacking Airplane Networks

With research that will surely result in some breathless reports, researchers presented at Usenix 2026 an attack against the communications bus of a Boeing 737.

The ARINC 429 bus is a communications architecture for planes, similar to the CAN bus used in cars. Once you are connected to that bus, it can be vulnerable in the same ways cars can be vulnerable to data manipulation. In the Usenix paper, researchers discovered that one access port to the airplane communications system is easily reached from the outside of the plane, though “easily” in this context means “by airplane maintenance technicians”. The paper represents over a decade of work by the team in obtaining and building a test lab of avionics equipment to represent an actual airplane, culminating in an embedded device described as “the size of a quarter” that plugs into the communications port and provides remote access over WiFi.

It needs to be emphasized, given other recent news, that this is a piece of hardware being added to the plane which communicates over WiFi, and not a way to attack an unmodified plane via passenger WiFi!

Once part of the ARINC bus, it seems access is basically unfettered: the team describes being able to reprogram the autopilot, feed the pilot displays false data, and being able to modify the temperature and weight data shown, which could lead to miscalculations in take-off speeds with obviously catastrophic results. Fortunately, the researchers have also been working with Boeing since 2020 to address the issues being found, and the practicality of the attack in the wild remains largely theoretical. The research team has recommended removing the external ports in future aircraft, and blocking access to them physically, like with epoxy, in the current designs.

If reading security research papers is your kind of fun, be sure to check out the rest of the papers that were part of Usenix 2026.

Copilot Reveals Secrets

Microsoft Copilot was tricked into executing hostile prompts without user intervention, and the team that accomplished it used Copilot itself to expose the vulnerability.

Copilot has a set of guardrails in place intended to safeguard against disclosing private information. Given the initial question — asking how to submit a prompt without the user confirming — the model said this was impossible. Over the course of many questions, researchers at Varonis were able to get Copilot to disclose the exact errors and restrictions that prevented running unauthorized queries, culminating in it admitting that there was an undocumented URL parameter (“autorun=1”, naturally) that would automatically execute a query.

Why such a parameter would exist in the first place is a little unclear. The Ars Technica article says that when Microsoft removed the parameter as part of the initial fix, it caused several AI browser extensions to fail, hinting that it may have been in place to enable automation on behalf of the user without showing the user the actual prompts being run. Regardless, prompts set to autorun were allowed to execute with no intervention, including prompts to disclose the contents of the users inbox, stored information in the users Copilot session, and any connected apps and services.

Comcast Senses Motion With WiFi

Comcast is enabling “WiFi Motion Detection” on its fleet of home router/access point devices. Conceptually, it’s a fairly simple trick. When a WiFi device changes position, or if something partially blocks the signal, the signal level of the device will change. People and pets are basically various sized bags of radio-blocking water, and as we move around we cause fluctuations in the signal levels of surrounding devices.

The risks lie in the second-order aspects: how much data is collected, how is it stored, and what does it expose about your home? Comcast says the feature is optional, and is opt-in: it won’t be turned on unless a customer enables it. This is refreshing, but once enabled, how is the data protected? Currently, Comcast states that the fidelity of the information may not be able to distinguish between a large pet and a small child, and can not identify individual people, but other public projects have refined a similar process to identify the number of people and characteristics about specific people, all based on the signal level. (Be careful when looking for other projects, though. There are several that appear to be completely AI generated, with both false claims and false data!)

As a company subject to the laws of any countries they operate in, Comcast may also be legally compelled to turn over motion and presence data in criminal or civil cases, or may opt to re-sell the data for other training or advertising purposes. Leveraging equipment you already have to collect more data is cool, but personally I’m not sure I want even more tracking data of when I’m home or where I spend time in my home to be that easily collected by a third party.

Stripe Merchant Keys Leaked

The payment processor Stripe has not been hacked, but it looks like 650 companies using it may have been.

Someone has collected hundreds of Stripe API keys, probably from GitHub, mis-configured servers, and infostealer malware, and made them available on trading forums. Despite guardrails by GitHub, a common mistake is committing configuration files, environment files, or code with API keys into public repositories. Once data goes into git, it’s fairly hard to remove it without resetting the entire repository: the whole point of code management is to be able to go back in time and identify the changes! The prevalence of information stealing malware on developer devices, VSCode plugin repositories, and inside packaging systems is another excellent source of stolen authentication tokens for many services.

A Stripe API token acts as the login credentials for the company using Stripe to process payments: it allows creating charging, listing past customers, extracting stored payment data, and essentially anything else a logged in administrator can do.

Stripe themselves say that they actively scan GitHub and other source management platforms looking for leaked keys and notifying customers, and hopefully impacted companies will be notified and can rotate their API tokens before they are used against actual customers.

More Windows Defender Issues

Last week was another Microsoft Patch Tuesday, which somehow didn’t set a third record for the highest number of security fixes in a month. Nonetheless, it would hardly be a proper Patch Tuesday in 2026 without another bypass of Windows Defender.

Previous exploits released by the researcher known as NightmareEclipse have demonstrated bypasses for BitLocker and Windows Defender and have stirred legal threats from Microsoft. Previous attacks against Windows Defender were fixed in the July set of patches, however now the “ShieldBreak” exploit, identified as CVE-2026-69414, uses Windows Defender itself to escalate to admin privileges.

The current fix? Disable Windows Defender. Which probably isn’t a great plan. Hopefully Microsoft is able to release an official fix rapidly.

Kicking Out Hackers by Cutting the Cable

A new article discusses how, during the Salt Typhoon attacks, T-Mobile operators drove to the datacenter physically cut the cable from a compromised system to prevent the attackers from accessing the rest of the network.

Salt Typhoon is believed to be a group based in China, often credited as part of the Ministry of State Security, which perpetrated widespread hacks of the United States telecom industry in 2024. The attackers utilized the hooks in the infrastructure devices required for US wiretap law, which gave them access to call records, contents of text messages, and voice recording of calls, targeting industry, government, and election officials.

Stopping a hack with a pair of wire cutters is definitely a story worth remembering.

Supply Chain Attacks Hit Rust

Supply chain attacks appear to be spreading to Rust packages now. The Rust Security Response Team was notified that a set of packages were downloading malicious payloads during build and confirmed the behavior.

To facilitate building required components, Rust packages can include a build script that is automatically compiled and executed. This is extremely similar to the build hooks enabling the spread of malware in the NPM and PyPI repositories, and could be used to perform the same authentication token theft and manipulation of packages.

Time will show if the Rust Cargo repository is able to prevent a similar scourge of infected packages now that the alarm is raised.

DEF CON Speakers and Attendees Targeted

Huntress reports some DEF CON speakers and attendees are being targeted with a phishing campaign on X/Twitter.

Starting with a claim to be the vice president of Coindesk, the phishing lure asks to collaborate on a future conference and provides a link to a Google document. The Google doc then tries to trick the user into running a click-fix style attack where the user is asked to copy and paste malware into a command shell, or into downloading a malware binary outright.

The malware payload targets the usual selection of cryptocurrency, authentication tokens, SSH keys, and the like. The Huntress article dives deep into the makeup of the malware, which has custom deployments if the victim is on Windows or macOS and can download several dynamic stages as the infection is triggered.