A cheap box gives you free films. It also rents your home internet to criminals.

The stories

19 stories on this beat today.

Every story told the same way: what happened, who is involved, why it matters, how it works, the truth and the good news.

1. 01

   A cheap box gives you free films. It also rents your home internet to criminals.

   2 million

   home devices inside Popanet, one proxy service

   Google's own figure for the network it disrupted [1]

   1,352

   attempts to break into a single test box in three weeks

   logged by Plume from inside the proxy network [1]

   0

   passwords needed to take full control of a SuperBox

   the command that grants system rights is set to accept anyone [1]

   What happened

   • A TV box called SuperBox promises unlimited films and shows for a single payment.
   • The security firm Plume found it also rents the buyer's home internet connection out to strangers. [1]
   • The box ships with Android's safety checks switched off.
   • Apps run with full system rights, and its debug port is left open to the internet. [1]
   • The command that grants full control asks for no password.
   • Anyone who reaches that port can install any app on the box. [1]
   • A home router cannot block it.
   • The box makes the connection outwards and holds it open, so nothing ever arrives looking like an incoming call. [1]
   • Plume joined one proxy service, Popanet, with a test box and let it run for three weeks.
   • It logged 1,352 separate attempts to reach the box's debug port. [1]
   • The intruders tried to install three more malware families, called CECbot, Maskify and a version of Mirai.
   • Each signs the box up to another proxy network or to a group that floods websites with traffic. [1]
   • Google puts Popanet alone at about 2 million devices.
   • Plume examined only SuperBox and says dozens of similar brands behave the same way. [1]
   • Owners often know.
   • Several told Ars Technica's security editor that free films were worth it, and he wrote that anyone using one should disconnect it and throw it away. [1]
   • A separate study of a rival brand, H96, found the boxes pretending to be mobile phones clicking adverts on invented websites. [2]

   Who is involved

   • SuperBox a brand of Android TV box sold with pirated streaming apps; it ships with Android's safety checks turned off [1]
   • Plume a security firm that studies home networks; it ran the test box and published the analysis [1]
   • Popanet a service that sells access to home internet connections; Google says it ran through about 2 million devices [1]
   • Bitsight a security firm; its researcher Pedro Fale bought an expired web address and watched an advert-fraud network running on H96 boxes [2]

   How it unfolded

   1. For years researchers warn that cheap streaming boxes rent out the buyer's internet connection [1]
   2. July Bitsight reports H96 boxes faking phone clicks on adverts across invented websites [2]
   3. Three weeks Plume joins Popanet with a test box and logs 1,352 attempts on its open debug port [1]
   4. Next Plume says dozens of other streaming brands behave the same way and have not been examined [1]

   Why it matters

   Watch whether a second brand is tested and found with the same open port, because Plume says it looked at one of dozens.

   The truth

   • Why it works on people Free is the lever. A box that gives you every film for one payment feels like a bargain you found for yourself, so the seller never has to explain what else the box is doing.
   • Who gains Proxy services such as Popanet — They get millions of home internet addresses with good reputations for nothing, because the box owner is paid in films rather than money. [1]
   • Who pays People who bought a free-film TV box — Their home address carries whatever reputation the traffic through it earns, and Plume found strangers installing further malware on the box itself. [1]
   • Nobody knows yet

     How many homes are running one of these boxes.

     Google puts one proxy service, Popanet, at about 2 million devices. Plume examined a single brand and says dozens of others behave the same way, and nobody has counted them. [1]

   Good news

   • Google disrupted Popanet, a service that had been renting out the internet connections of about two million homes.

1. 02

   Fake download pages switch off Windows Update

   What happened

   • Microsoft says an active campaign builds near-perfect copies of software makers' download pages and serves its own installer instead.
   • Once the file is run, it adds itself to the exclusion list of Microsoft Defender, the anti-virus built into Windows.
   • It then stops and disables the four Windows services that fetch updates, renames their files and deletes the update cache.
   • Microsoft links the campaign with moderate confidence to a Chinese group it calls Silver Fox, and lists victims in healthcare, manufacturing, gaming, government and education. [3]

   Why it matters

   A machine that cannot update never receives the next fix, so one bad download quietly removes every future one.

   Days earlier Kaspersky found the same idea inside a Chinese wallpaper program, using a genuine signed application to load the attackers' code. [3]

   How it works

   Nobody gets software from the people who made it

   You get it from whatever the search or the advert put in front of you, and those slots can be bought for the price of a lunch.

   The twist

   Every security check on your machine asks whether the file is what it claims to be, and not one of them asks who chose the place you got it from.

   Step by step

   1. 1 You want a program, a film or a fix
   2. 2 You go to whatever answered first, not to the maker
   3. 3 That slot can be bought: an advert, a near-miss address, an unclaimed package name
   4. 4 You install it yourself, so it arrives with your own permission
   5. 5 Your machine checks what the file is, never who chose it

   The same force, elsewhere today

   Where this chain is also running, in today's other stories.

   • The fake vendor download pages

     the same step: a search result rather than the maker's own site decided which installer landed on the machine, and that installer then switched off Windows Update

   • The files companies wrote for AI assistants

     the choosing step was handed to a text file, and 120 of those files named packages that nobody had registered, so the name was free to take

   • The mistyped mouse-driver address

     one wrong letter routed the person into a bought advert, and the advert picked the installer for them

   • The thirteen booby-trapped website themes

     a website builder took a free theme from a public library, and the theme then decided what ran on every visitor's phone

   Where you've seen this

   Bank helplines

   people search for the number and ring the one in the advert at the top of the page

   Concert tickets

   the first result is a reseller, and the box office is further down

   Car parts

   the garage picks the supplier, and the driver never sees the choice being made

   The catch

   It breaks when there is only one source. Nobody can fake the update a phone downloads by itself, because the owner was never asked where it should come from.

   And the whole of it

   Everyone in these stories was doing something ordinary: looking for a film, a mouse driver, a free theme, a browser. The company that published a list of packages for AI assistants had not read its own list either. Most of us will install something this week without ever seeing who chose where it came from.

   The truth

   • Nobody knows yet

     What the fake download campaign was actually for.

     Microsoft says Defender detected it and contained the attacks automatically, so the end goal was never reached and is still unclear. [3]

   Good news

   • From October, Windows machines that can run it will switch on memory integrity by themselves. It is the protection that stops malware altering the core of the operating system, and until now most people had to find the setting on their own.

1. 03

   Company files tell AI assistants to install packages nobody owns

   What happened

   • Companies have started publishing a file called llms.txt at the top of their websites.
   • It is a set of instructions for AI assistants: what to read, which programs to install, which sites to trust.
   • An Israeli team scanned 6,214 company websites and found 8,265 of these files.
   • In 120 of them the file named software packages on PyPI or npm, the two big public code libraries, that nobody had ever registered.
   • They registered a few of those names and put a beacon inside.
   • The first call home came in under four minutes. [4]

   Why it matters

   One real attack has already used this.

   The login company Clerk named a package it did not own, a stranger registered the name, and the code inside sent back the username, machine name and folder of whoever installed it.

   Clerk has since fixed its file. [4]

   How it works

   the choosing step was handed to a text file, and 120 of those files named packages that nobody had registered, so the name was free to take

   The idea, in story 02: Nobody gets software from the people who made it →

   The truth

   • What is really going on People bought a TV box that rents out their internet connection, clicked a download page that outranked the maker's own site, or let an AI assistant install a package named in a file their own company had published.
   • Who gains Anyone who registers an unclaimed package name — Companies published files telling AI assistants to install packages that did not exist, so the name is free to take and the installation happens by itself. [4]
   • Nobody knows yet

     How many of the 120 unclaimed package names in AI instruction files somebody else has already taken.

     The researchers registered a handful themselves. Only one live attack, against the login company Clerk, has been confirmed. [4]

2. 04

   One mistyped letter, one bought advert, one fake browser

   What happened

   • Someone setting up a computer mouse typed the maker's web address wrong.
   • A paid search result caught the mistake and sent them to a counterfeit site offering a privacy browser.
   • The installer was wrapped in a format signed through Microsoft's own system, and once running it turned commands from a distant attacker into fake mouse movements and keystrokes on the machine.
   • The security firm Intezer says anti-virus scanners flagged the file between zero and two times, and traces the same operation back to 2016. [4]

   Why it matters

   Nothing was broken into here.

   The advert slot, the near-miss web address and the signing service can all be bought, and together they replaced the mouse maker as the source of the software. [4]

   How it works

   one wrong letter routed the person into a bought advert, and the advert picked the installer for them

   The idea, in story 02: Nobody gets software from the people who made it →

   The truth

   • Who gains Whoever buys the search advert — A sponsored result puts a counterfeit download page above the maker's own site, and the advert fee is close to the whole cost of the attack. [4]
3. 05

   Thirteen website themes attacked visitors' iPhones

   What happened

   • The security firm Socket found 13 booby-trapped themes on Packagist, a public library where website builders take free code.
   • Vietnamese film and comic streaming sites installed them.
   • The themes injected code that did two things to every visitor: pushed gambling and advert traffic on phones generally, and on iPhones ran an attack chain against two Safari flaws Apple patched in 2025.
   • The end of that chain installed spying software and went for the recovery phrases that unlock cryptocurrency wallets.
   • The packages sat across five separate publisher accounts. [5]

   Why it matters

   The site owner chose a free theme, and the theme then decided what happened to everyone who visited.

   Anyone still running an unpatched iPhone was attacked simply by loading a page. [5]

   How it works

   a website builder took a free theme from a public library, and the theme then decided what ran on every visitor's phone

   The idea, in story 02: Nobody gets software from the people who made it →

   The truth

   • Who pays Visitors to Vietnamese film and comic sites — Thirteen booby-trapped themes attacked unpatched iPhones and went for the recovery phrases that unlock cryptocurrency wallets. [5]
   • Nobody knows yet

     How many people visited the Vietnamese streaming sites while the booby-trapped themes were live.

     Socket named 13 packages across five publisher accounts and put no number on the visitors reached. [5]

4. 06

   Citrix login bypass now being probed

   What happened

   • Citrix patched a serious flaw in NetScaler in mid-August.
   • NetScaler is the box that sits at the edge of a company network and checks who is allowed in, so a way past its login check is a way into everything behind it.
   • On 3 September the vulnerability intelligence firm Previdian saw requests matching a newly published attack arrive at its sensors from three addresses, in Australia, the United States and Germany.
   • Previdian's founder Ryan Dewhurst says this shows attempts, not a successful break-in. [6]

   Why it matters

   The gap between a patch and a working public attack is where every unpatched company lives, and here it closed in about two weeks. [6]

   The truth

   • Nobody knows yet

     Whether the Citrix login flaw has been used to get inside anyone.

     Previdian saw requests matching the published attack from three addresses on 3 September and says that shows attempts, not a confirmed break-in. Citrix has not marked the flaw as exploited. [6]

5. 07

   3.2 million WordPress sites still unpatched

   What happened

   • All-in-One WP Migration and Backup is a WordPress add-on with more than five million installations.
   • It copies a website so it can be moved to a new server.
   • The security firm Defiant found a flaw that lets a stranger post two comments carrying hidden instructions.
   • When an administrator runs an ordinary backup, those instructions are written into the site's database and its secret key becomes publicly readable.
   • The attacker can then upload an archive that runs their own program.
   • A fix arrived on 20 August.
   • By 3 September only 35% had installed it. [7]

   Why it matters

   The attack needs the site owner to do something completely ordinary, which is take a backup.

   That is what makes a two-week patch gap so wide here. [7]

   The truth

   • Who pays Owners of about 3.2 million WordPress sites — The backup add-on they run still has a hole that lets a stranger take the whole site, and only 35% had installed the fix by 3 September. [7]
6. 08

   Comcast turns home routers into motion detectors

   What happened

   • Comcast, one of the biggest home internet providers in the United States, has added motion detection to its wireless routers.
   • The router watches how the wifi signal between it and a connected television or printer wobbles, and sends a phone alert when something moves nearby.
   • There are separate settings for when the household is home, asleep or away.
   • Comcast's own support page says this information may be passed to third parties, without further notice to the customer, in a police investigation, in a dispute Comcast is part of, or under a court order. [8]

   Why it matters

   Bruce Schneier, who writes about security, said it sounds like a great surveillance tool.

   Nobody in the house has to install anything for it to start working. [8]

   The truth

   • Who gains Comcast — A feature that ships in a rented router turns customers' movements into data the company holds and may pass on under a court order or in a dispute it is party to. [8]
7. 09

   India's government makes Meta pull fraud adverts

   What happened

   • India's government told Meta that adverts on Facebook and Instagram were using sexually explicit thumbnails to push people towards fake Android apps that steal banking logins.
   • The apps ran under names such as Night Play and Kyss, and were downloaded as files from websites rather than an official app store.
   • India's advisory says they could read what is on a phone, capture one-time passcodes and bank PINs, and move money out.
   • Reuters found 39 adverts still running afterwards, and Meta removed them once asked.
   • India recorded about $2.4 billion in cyber-fraud losses in 2025. [9]

   Why it matters

   Weeks earlier the same government made Google shut hundreds of accounts being used to impersonate banks.

   Both times the adverts were sold first and reviewed after a government complained. [9]

   The truth

   • Who gains Meta — It sold the advertising space for the fraud apps first, and removed the adverts only after India's government issued an advisory and Reuters asked about the 39 that were still running. [9]
8. 10

   The gang behind the hospital theft has 683 victims

   What happened

   • Sophos, a security firm, counted 683 victims of the ransomware business calling itself The Gentlemen by the end of July, 169 of them added in that month alone.
   • The group rents its software to other criminals, and both scrambles a victim's files and copies them out first so it has something to publish.
   • Its current target is Nutex Health, which runs 27 emergency and hospital sites across 12 US states.
   • Nutex told the US markets regulator that patient, employee, provider and financial information was taken. [4][10][11]

   Why it matters

   SecurityWeek puts the same group at more than 580 victims in over 75 countries, so the two counts differ by about a hundred and neither can be checked against anything but the gang's own leak site.

   Nutex has not said how many patients are in the file. [10][11]

   The truth

   • Who gains The Gentlemen ransomware group — Running a nine-day countdown against a hospital operator that has already told regulators data was taken makes the threat cheap to issue and hard for the next board to dismiss. [10][11]
   • Who pays Patients of Nutex Health — Their records are in a set a ransomware group says it will publish, and the company has not said how many people that is. [10][11]
   • Nobody knows yet

     How many people are in the Nutex Health file.

     The company told the markets regulator what kinds of information were taken and said it will write to every patient, but has published no number. [10][11]

   • Nobody knows yet

     How large The Gentlemen ransomware group really is.

     Sophos counts 683 victims by the end of July; SecurityWeek reports more than 580 in over 75 countries. Both figures rest on the group's own leak site, which is the only public list. [4][10]

9. 11

   Six countries tell companies what to say during an outage

   What happened

   • The cyber agencies of the United States, United Kingdom, Australia, Canada and New Zealand published joint guidance on 2 September on how a service provider should talk to customers while its systems are down.
   • It tells companies to agree the thresholds and the audiences in advance.
   • They should say plainly what is known, what is unknown and what is still being investigated, publish an explanation of the cause, and drop marketing language.
   • The agencies say they wrote it after the Cloudflare outage of 18 November 2025. [12]

   Why it matters

   It describes the exact gap this week keeps showing, where a company confirms a break-in and then leaves the number of people affected unpublished for weeks.

   Guidance is not a rule, and none of these agencies can make a company follow it. [12]

10. 12

    A real management tool used to run attackers' commands

    What happened

    • The security firm Huntress found attackers using Faronics Deploy, a legitimate program companies buy to manage their computers, as the way in.
    • Victims are tricked by a phishing message into installing it themselves.
    • The attackers then use it to run their own commands and to add ScreenConnect, a genuine remote-control tool, on top.
    • Huntress counted more than 457 machines that met these lures.
    • Because both programs are real and widely used, the activity looks like ordinary IT work in a company's records. [4]

    Why it matters

    Nothing needs to be smuggled past a scanner when the victim installs the tool and the tool is genuine.

    It is the same step as the fake download pages, one rung further inside a company. [4]

11. 13

    A ransomware service that asks you to paste the command

    What happened

    • Researchers have described CRPx0, a ransomware business that rents its software to other criminals.
    • Victims meet a page pretending to be a Windows or macOS update prompt, or a fake check that you are not a robot, and are told to copy a line of text and run it themselves.
    • The program copies files out before scrambling them, tries to spread across the network, and demands payment in Bitcoin or Monero within 48 hours.
    • It first appeared on 7 June 2026 and is now advertised on an ordinary website, not a hidden one. [4]

    Why it matters

    The victim performs the break-in, which is why a security product watching for a suspicious download sees nothing worth stopping. [4]

12. 14

    A phishing service sold by the week to reach finance bosses

    What happened

    • The research group ZeroBEC described BlueKit, a ready-made phishing operation aimed at the chief executives of financial firms.
    • It puts the attacker's own browser between the victim and the real login page, so passcodes and the cookie that keeps you signed in pass straight through.
    • Selected victims are then moved into a fake document viewer that installs ScreenConnect pointed at the attackers' server.
    • Access costs $250 for seven days, $480 for fourteen and $940 for thirty, against rivals charging roughly $289 to $400 a month. [4]

    Why it matters

    Someone with no technical skill can rent this for a week and aim it at one named person, then stop paying. [4]

13. 15

    58 unused web addresses found before they switched on

    What happened

    • Whisper Security mapped the servers behind an Iranian hacking group known as Prince of Persia, which uses malware called Foudre and Tonnerre to size up high-value targets.
    • Each of the group's live control servers also runs the address book for its own web addresses, which is unusual.
    • That let researcher Kaveh Azarhoosh find 58 further addresses that the group has registered and pointed at its own servers but has not yet connected to anything.
    • The moment one of them is given an address, a new control server becomes visible before it does anything at all. [4]

    Why it matters

    Most attacker infrastructure is found after it has been used.

    This is a list of the next ones, published while they are still empty. [4]

    Good news

    • Researchers at Whisper Security found 58 web addresses an Iranian hacking group had registered and parked, before a single one of them was switched on.
14. 16

    Victims watch the forestry fraudsters in court

    What happened

    • Jane Bertelli travelled from Reading to Southwark Crown Court in London to look at the three men who took 12,000 pounds left to her by an elderly relative.
    • Ethical Forestry, run from Bournemouth by Matthew Pickard, Stephen Greenaway and Paul Laver, sold investments in tree planting in Costa Rica to about 3,000 people, promising a return and reforestation in the same brochure.
    • The three directors admitted fraud.
    • Their investors' money bought a Maserati, Ferraris and Porsches; Bertelli still drives a thirteen-year-old Toyota. [13]

    Why it matters

    Most investment fraud is sold this way, with a glossy brochure and a cause the buyer already believes in.

    Bertelli said seeing the men again brought back all the anger she had felt for years about losing the money. [13]

    The truth

    • Who pays Jane Bertelli and about 3,000 other Ethical Forestry investors — Their money bought the directors a Maserati, Ferraris and Porsches. She still drives a thirteen-year-old Toyota. [13]
15. 17

    266 million pounds laundered through a Bradford jewellery yard

    What happened

    • Two men were sentenced at Leeds Crown Court over an operation that turned bags of cash into gold grain and shipped it to Dubai on fake invoices.
    • Baqa Haider, 51, wrote the invoices and handled the exports, and was jailed for six years.
    • Nathan Rivers, 45, worked at the Fowler Oldfield yard in Bradford and got 27 months suspended.
    • Four other men were convicted in March 2025 and given up to eleven years, though three absconded and were sentenced in their absence.
    • West Yorkshire Police call it the largest cash-laundering investigation in UK legal history. [14]

    Why it matters

    The scheme ran from 2013 until police reached it, and turned bags of cash into gold that could be sold anywhere.

    Police say they are still trying to bring the three men who fled back to Britain. [14]

    The truth

    • Nobody knows yet

      Whether the three men who absconded from the Bradford laundering case will be brought back.

      They were sentenced in their absence in March 2025, and West Yorkshire Police say inquiries to find them and secure extradition are continuing. [14]

    Good news

    • Two men were sentenced at Leeds Crown Court over a 266 million pound laundering operation run out of a Bradford jewellery yard. Four others were convicted last year.
16. 18

    Ordered to repay 13,750 pounds, she has paid 163

    What happened

    • Charlotte Blackwell, 32, from Bridgend in Wales, faked her own wedding and took 12,682 pounds from her then-fiance's mother and three of her friends between 2022 and 2024.
    • In March 2025 a judge gave her a suspended prison sentence and ordered 13,750 pounds in compensation at 400 pounds a month.
    • Her four victims say they have received 163 pounds in total, and nothing at all in the last four months.
    • The UK justice ministry said it could not give details on enforcement in this case. [15]

    Why it matters

    A compensation order is the main route by which a fraud victim is supposed to get money back.

    This one has returned about one percent in eighteen months. [15]

    The truth

    • Who pays Four people owed 13,750 pounds by a Bridgend fraudster — They have received 163 pounds between them since March 2025, and nothing at all in the last four months. [15]
    • Nobody knows yet

      Why a court order to repay 13,750 pounds has produced 163 pounds in eighteen months.

      The UK justice ministry said it could not give details on enforcement in the case, and the victims say they were told only that it was being dealt with. [15]

17. 19

    Care home manager took 50,000 pounds from residents

    What happened

    • Michaela Golding, 58, managed a care home in Filey, North Yorkshire.
    • She offered to help relatives who were struggling with residents' fees and finances, then paid some of that money into her own accounts.
    • She also increased the invoices from the visiting foot-care service and took the difference from residents' personal budgets.
    • One resident lost more than 27,000 pounds.
    • Golding pleaded guilty to fraud by abuse of position and to false accounting, and was sentenced at York Crown Court to 32 months in prison. [16]

    Why it matters

    The offer of help was the method.

    The son of one victim said money had been taken from his mother before she died. [16]