Cybersecurity · Monday, 7 September 2026

01 Briefing what happened

A cheap box gives you free films. It also rents your home internet to criminals.

Cybersecurity 16 sources

Security firm Plume took apart a SuperBox streaming player and found Android's safety checks switched off, a debug port open to the internet and no password on the command that grants full control. It ran a test box inside one proxy service for three weeks and logged 1,352 attempts to break into it.

2 million

home devices inside Popanet, one proxy service

Google's own figure for the network it disrupted [1]

1,352

attempts to break into a single test box in three weeks

logged by Plume from inside the proxy network [1]

passwords needed to take full control of a SuperBox

the command that grants system rights is set to accept anyone [1]

The lead story — what happened

A TV box called SuperBox promises unlimited films and shows for a single payment. The security firm Plume found it also rents the buyer's home internet connection out to strangers. [1]
The box ships with Android's safety checks switched off. Apps run with full system rights, and its debug port is left open to the internet. [1]
The command that grants full control asks for no password. Anyone who reaches that port can install any app on the box. [1]
A home router cannot block it. The box makes the connection outwards and holds it open, so nothing ever arrives looking like an incoming call. [1]
Plume joined one proxy service, Popanet, with a test box and let it run for three weeks. It logged 1,352 separate attempts to reach the box's debug port. [1]
The intruders tried to install three more malware families, called CECbot, Maskify and a version of Mirai. Each signs the box up to another proxy network or to a group that floods websites with traffic. [1]
Google puts Popanet alone at about 2 million devices. Plume examined only SuperBox and says dozens of similar brands behave the same way. [1]
Owners often know. Several told Ars Technica's security editor that free films were worth it, and he wrote that anyone using one should disconnect it and throw it away. [1]
A separate study of a rival brand, H96, found the boxes pretending to be mobile phones clicking adverts on invented websites. [2]

Who is involved

SuperBox

a brand of Android TV box sold with pirated streaming apps; it ships with Android's safety checks turned off [1]
Plume

a security firm that studies home networks; it ran the test box and published the analysis [1]
Popanet

a service that sells access to home internet connections; Google says it ran through about 2 million devices [1]
Bitsight

a security firm; its researcher Pedro Fale bought an expired web address and watched an advert-fraud network running on H96 boxes [2]

How it unfolded

For years researchers warn that cheap streaming boxes rent out the buyer's internet connection [1]
July Bitsight reports H96 boxes faking phone clicks on adverts across invented websites [2]
Three weeks Plume joins Popanet with a test box and logs 1,352 attempts on its open debug port [1]
Next Plume says dozens of other streaming brands behave the same way and have not been examined [1]

Where this points

Watch whether a second brand is tested and found with the same open port, because Plume says it looked at one of dozens.

What is pushing on the whole day

The bar and the word are our reading of how hard each one is pushing today. The arrow is where it is heading. The evidence is in the stories below.

Demand for free films High↑

one payment buys unlimited streaming, and owners told Ars Technica they knew and did not mind [1]

What a home router can see Easing↓

the box dials out and keeps the line open, so nothing ever knocks [1]

Pressure on the proxy services Building↑

Google disrupted Popanet, and Plume still found live break-in attempts running through it [1]

The rest of the day

18 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

02
Fake download pages switch off Windows Update

Microsoft says an active campaign builds near-perfect copies of software makers' download pages and serves its own installer instead. Once the file is run, it adds itself to the exclusion list of Microsoft Defender, the anti-virus built into Windows. It then stops and disables the four Windows services that fetch updates, renames their files and deletes the update cache. Microsoft links the campaign with moderate confidence to a Chinese group it calls Silver Fox, and lists victims in healthcare, manufacturing, gaming, government and education. [3]

Why it matters — A machine that cannot update never receives the next fix, so one bad download quietly removes every future one. Days earlier Kaspersky found the same idea inside a Chinese wallpaper program, using a genuine signed application to load the attackers' code. [3]
03
Company files tell AI assistants to install packages nobody owns

Companies have started publishing a file called llms.txt at the top of their websites. It is a set of instructions for AI assistants: what to read, which programs to install, which sites to trust. An Israeli team scanned 6,214 company websites and found 8,265 of these files. In 120 of them the file named software packages on PyPI or npm, the two big public code libraries, that nobody had ever registered. They registered a few of those names and put a beacon inside. The first call home came in under four minutes. [4]

Why it matters — One real attack has already used this. The login company Clerk named a package it did not own, a stranger registered the name, and the code inside sent back the username, machine name and folder of whoever installed it. Clerk has since fixed its file. [4]
04
One mistyped letter, one bought advert, one fake browser

Someone setting up a computer mouse typed the maker's web address wrong. A paid search result caught the mistake and sent them to a counterfeit site offering a privacy browser. The installer was wrapped in a format signed through Microsoft's own system, and once running it turned commands from a distant attacker into fake mouse movements and keystrokes on the machine. The security firm Intezer says anti-virus scanners flagged the file between zero and two times, and traces the same operation back to 2016. [4]

Why it matters — Nothing was broken into here. The advert slot, the near-miss web address and the signing service can all be bought, and together they replaced the mouse maker as the source of the software. [4]
05
Thirteen website themes attacked visitors' iPhones

The security firm Socket found 13 booby-trapped themes on Packagist, a public library where website builders take free code. Vietnamese film and comic streaming sites installed them. The themes injected code that did two things to every visitor: pushed gambling and advert traffic on phones generally, and on iPhones ran an attack chain against two Safari flaws Apple patched in 2025. The end of that chain installed spying software and went for the recovery phrases that unlock cryptocurrency wallets. The packages sat across five separate publisher accounts. [5]

Why it matters — The site owner chose a free theme, and the theme then decided what happened to everyone who visited. Anyone still running an unpatched iPhone was attacked simply by loading a page. [5]
06
Citrix login bypass now being probed

Citrix patched a serious flaw in NetScaler in mid-August. NetScaler is the box that sits at the edge of a company network and checks who is allowed in, so a way past its login check is a way into everything behind it. On 3 September the vulnerability intelligence firm Previdian saw requests matching a newly published attack arrive at its sensors from three addresses, in Australia, the United States and Germany. Previdian's founder Ryan Dewhurst says this shows attempts, not a successful break-in. [6]

Why it matters — The gap between a patch and a working public attack is where every unpatched company lives, and here it closed in about two weeks. [6]
07
3.2 million WordPress sites still unpatched

All-in-One WP Migration and Backup is a WordPress add-on with more than five million installations. It copies a website so it can be moved to a new server. The security firm Defiant found a flaw that lets a stranger post two comments carrying hidden instructions. When an administrator runs an ordinary backup, those instructions are written into the site's database and its secret key becomes publicly readable. The attacker can then upload an archive that runs their own program. A fix arrived on 20 August. By 3 September only 35% had installed it. [7]

Why it matters — The attack needs the site owner to do something completely ordinary, which is take a backup. That is what makes a two-week patch gap so wide here. [7]
08
Comcast turns home routers into motion detectors

Comcast, one of the biggest home internet providers in the United States, has added motion detection to its wireless routers. The router watches how the wifi signal between it and a connected television or printer wobbles, and sends a phone alert when something moves nearby. There are separate settings for when the household is home, asleep or away. Comcast's own support page says this information may be passed to third parties, without further notice to the customer, in a police investigation, in a dispute Comcast is part of, or under a court order. [8]

Why it matters — Bruce Schneier, who writes about security, said it sounds like a great surveillance tool. Nobody in the house has to install anything for it to start working. [8]
09
India's government makes Meta pull fraud adverts

India's government told Meta that adverts on Facebook and Instagram were using sexually explicit thumbnails to push people towards fake Android apps that steal banking logins. The apps ran under names such as Night Play and Kyss, and were downloaded as files from websites rather than an official app store. India's advisory says they could read what is on a phone, capture one-time passcodes and bank PINs, and move money out. Reuters found 39 adverts still running afterwards, and Meta removed them once asked. India recorded about $2.4 billion in cyber-fraud losses in 2025. [9]

Why it matters — Weeks earlier the same government made Google shut hundreds of accounts being used to impersonate banks. Both times the adverts were sold first and reviewed after a government complained. [9]
10
The gang behind the hospital theft has 683 victims

Sophos, a security firm, counted 683 victims of the ransomware business calling itself The Gentlemen by the end of July, 169 of them added in that month alone. The group rents its software to other criminals, and both scrambles a victim's files and copies them out first so it has something to publish. Its current target is Nutex Health, which runs 27 emergency and hospital sites across 12 US states. Nutex told the US markets regulator that patient, employee, provider and financial information was taken. [4][10][11]

Why it matters — SecurityWeek puts the same group at more than 580 victims in over 75 countries, so the two counts differ by about a hundred and neither can be checked against anything but the gang's own leak site. Nutex has not said how many patients are in the file. [10][11]
11
Six countries tell companies what to say during an outage

The cyber agencies of the United States, United Kingdom, Australia, Canada and New Zealand published joint guidance on 2 September on how a service provider should talk to customers while its systems are down. It tells companies to agree the thresholds and the audiences in advance. They should say plainly what is known, what is unknown and what is still being investigated, publish an explanation of the cause, and drop marketing language. The agencies say they wrote it after the Cloudflare outage of 18 November 2025. [12]

Why it matters — It describes the exact gap this week keeps showing, where a company confirms a break-in and then leaves the number of people affected unpublished for weeks. Guidance is not a rule, and none of these agencies can make a company follow it. [12]
12
A real management tool used to run attackers' commands

The security firm Huntress found attackers using Faronics Deploy, a legitimate program companies buy to manage their computers, as the way in. Victims are tricked by a phishing message into installing it themselves. The attackers then use it to run their own commands and to add ScreenConnect, a genuine remote-control tool, on top. Huntress counted more than 457 machines that met these lures. Because both programs are real and widely used, the activity looks like ordinary IT work in a company's records. [4]

Why it matters — Nothing needs to be smuggled past a scanner when the victim installs the tool and the tool is genuine. It is the same step as the fake download pages, one rung further inside a company. [4]
13
A ransomware service that asks you to paste the command

Researchers have described CRPx0, a ransomware business that rents its software to other criminals. Victims meet a page pretending to be a Windows or macOS update prompt, or a fake check that you are not a robot, and are told to copy a line of text and run it themselves. The program copies files out before scrambling them, tries to spread across the network, and demands payment in Bitcoin or Monero within 48 hours. It first appeared on 7 June 2026 and is now advertised on an ordinary website, not a hidden one. [4]

Why it matters — The victim performs the break-in, which is why a security product watching for a suspicious download sees nothing worth stopping. [4]
14
A phishing service sold by the week to reach finance bosses

The research group ZeroBEC described BlueKit, a ready-made phishing operation aimed at the chief executives of financial firms. It puts the attacker's own browser between the victim and the real login page, so passcodes and the cookie that keeps you signed in pass straight through. Selected victims are then moved into a fake document viewer that installs ScreenConnect pointed at the attackers' server. Access costs $250 for seven days, $480 for fourteen and $940 for thirty, against rivals charging roughly $289 to $400 a month. [4]

Why it matters — Someone with no technical skill can rent this for a week and aim it at one named person, then stop paying. [4]
15
58 unused web addresses found before they switched on

Whisper Security mapped the servers behind an Iranian hacking group known as Prince of Persia, which uses malware called Foudre and Tonnerre to size up high-value targets. Each of the group's live control servers also runs the address book for its own web addresses, which is unusual. That let researcher Kaveh Azarhoosh find 58 further addresses that the group has registered and pointed at its own servers but has not yet connected to anything. The moment one of them is given an address, a new control server becomes visible before it does anything at all. [4]

Why it matters — Most attacker infrastructure is found after it has been used. This is a list of the next ones, published while they are still empty. [4]
16
Victims watch the forestry fraudsters in court

Jane Bertelli travelled from Reading to Southwark Crown Court in London to look at the three men who took 12,000 pounds left to her by an elderly relative. Ethical Forestry, run from Bournemouth by Matthew Pickard, Stephen Greenaway and Paul Laver, sold investments in tree planting in Costa Rica to about 3,000 people, promising a return and reforestation in the same brochure. The three directors admitted fraud. Their investors' money bought a Maserati, Ferraris and Porsches; Bertelli still drives a thirteen-year-old Toyota. [13]

Why it matters — Most investment fraud is sold this way, with a glossy brochure and a cause the buyer already believes in. Bertelli said seeing the men again brought back all the anger she had felt for years about losing the money. [13]
17
266 million pounds laundered through a Bradford jewellery yard

Two men were sentenced at Leeds Crown Court over an operation that turned bags of cash into gold grain and shipped it to Dubai on fake invoices. Baqa Haider, 51, wrote the invoices and handled the exports, and was jailed for six years. Nathan Rivers, 45, worked at the Fowler Oldfield yard in Bradford and got 27 months suspended. Four other men were convicted in March 2025 and given up to eleven years, though three absconded and were sentenced in their absence. West Yorkshire Police call it the largest cash-laundering investigation in UK legal history. [14]

Why it matters — The scheme ran from 2013 until police reached it, and turned bags of cash into gold that could be sold anywhere. Police say they are still trying to bring the three men who fled back to Britain. [14]
18
Ordered to repay 13,750 pounds, she has paid 163

Charlotte Blackwell, 32, from Bridgend in Wales, faked her own wedding and took 12,682 pounds from her then-fiance's mother and three of her friends between 2022 and 2024. In March 2025 a judge gave her a suspended prison sentence and ordered 13,750 pounds in compensation at 400 pounds a month. Her four victims say they have received 163 pounds in total, and nothing at all in the last four months. The UK justice ministry said it could not give details on enforcement in this case. [15]

Why it matters — A compensation order is the main route by which a fraud victim is supposed to get money back. This one has returned about one percent in eighteen months. [15]
19
Care home manager took 50,000 pounds from residents

Michaela Golding, 58, managed a care home in Filey, North Yorkshire. She offered to help relatives who were struggling with residents' fees and finances, then paid some of that money into her own accounts. She also increased the invoices from the visiting foot-care service and took the difference from residents' personal budgets. One resident lost more than 27,000 pounds. Golding pleaded guilty to fraud by abuse of position and to false accounting, and was sentenced at York Crown Court to 32 months in prison. [16]

Why it matters — The offer of help was the method. The son of one victim said money had been taken from his mother before she died. [16]

02 Lesson why it matters

Nobody gets software from the people who made it

You get it from whatever the search or the advert put in front of you, and those slots can be bought for the price of a lunch.

The twist

Every security check on your machine asks whether the file is what it claims to be, and not one of them asks who chose the place you got it from.

How it works

You want a program, a film or a fix
You go to whatever answered first, not to the maker
That slot can be bought: an advert, a near-miss address, an unclaimed package name
You install it yourself, so it arrives with your own permission
Your machine checks what the file is, never who chose it

The same force, elsewhere today

Where this chain is also running, in today's other stories.

The fake vendor download pages

the same step: a search result rather than the maker's own site decided which installer landed on the machine, and that installer then switched off Windows Update
The files companies wrote for AI assistants

the choosing step was handed to a text file, and 120 of those files named packages that nobody had registered, so the name was free to take
The mistyped mouse-driver address

one wrong letter routed the person into a bought advert, and the advert picked the installer for them
The thirteen booby-trapped website themes

a website builder took a free theme from a public library, and the theme then decided what ran on every visitor's phone

Where you've seen this

Bank helplines

people search for the number and ring the one in the advert at the top of the page

Concert tickets

the first result is a reseller, and the box office is further down

Car parts

the garage picks the supplier, and the driver never sees the choice being made

The catch

It breaks when there is only one source. Nobody can fake the update a phone downloads by itself, because the owner was never asked where it should come from.

And the whole of it

Everyone in these stories was doing something ordinary: looking for a film, a mouse driver, a free theme, a browser. The company that published a list of packages for AI assistants had not read its own list either. Most of us will install something this week without ever seeing who chose where it came from.

03 Truth what's really going on

What is really going on

Nobody broke in. People bought a TV box that rents out their internet connection, clicked a download page that outranked the maker's own site, or let an AI assistant install a package named in a file their own company had published. Plume, Microsoft and an Israeli research team each found the same step going wrong, and in every case the owner pressed install.

Why it works on us — Free is the lever. A box that gives you every film for one payment feels like a bargain you found for yourself, so the seller never has to explain what else the box is doing.

Who gains

Proxy services such as Popanet — They get millions of home internet addresses with good reputations for nothing, because the box owner is paid in films rather than money. [1]
Whoever buys the search advert — A sponsored result puts a counterfeit download page above the maker's own site, and the advert fee is close to the whole cost of the attack. [4]
Anyone who registers an unclaimed package name — Companies published files telling AI assistants to install packages that did not exist, so the name is free to take and the installation happens by itself. [4]
The Gentlemen ransomware group — Running a nine-day countdown against a hospital operator that has already told regulators data was taken makes the threat cheap to issue and hard for the next board to dismiss. [10][11]
Meta — It sold the advertising space for the fraud apps first, and removed the adverts only after India's government issued an advisory and Reuters asked about the 39 that were still running. [9]
Comcast — A feature that ships in a rented router turns customers' movements into data the company holds and may pass on under a court order or in a dispute it is party to. [8]

Who pays

People who bought a free-film TV box — Their home address carries whatever reputation the traffic through it earns, and Plume found strangers installing further malware on the box itself. [1]
Visitors to Vietnamese film and comic sites — Thirteen booby-trapped themes attacked unpatched iPhones and went for the recovery phrases that unlock cryptocurrency wallets. [5]
Patients of Nutex Health — Their records are in a set a ransomware group says it will publish, and the company has not said how many people that is. [10][11]
Jane Bertelli and about 3,000 other Ethical Forestry investors — Their money bought the directors a Maserati, Ferraris and Porsches. She still drives a thirteen-year-old Toyota. [13]
Four people owed 13,750 pounds by a Bridgend fraudster — They have received 163 pounds between them since March 2025, and nothing at all in the last four months. [15]
Owners of about 3.2 million WordPress sites — The backup add-on they run still has a hole that lets a stranger take the whole site, and only 35% had installed the fix by 3 September. [7]

What nobody knows yet

Open questions from across today’s stories — ours included.

01

How many homes are running one of these boxes.

Google puts one proxy service, Popanet, at about 2 million devices. Plume examined a single brand and says dozens of others behave the same way, and nobody has counted them. [1]
02

What the fake download campaign was actually for.

Microsoft says Defender detected it and contained the attacks automatically, so the end goal was never reached and is still unclear. [3]
03

Whether the Citrix login flaw has been used to get inside anyone.

Previdian saw requests matching the published attack from three addresses on 3 September and says that shows attempts, not a confirmed break-in. Citrix has not marked the flaw as exploited. [6]
04

How many of the 120 unclaimed package names in AI instruction files somebody else has already taken.

The researchers registered a handful themselves. Only one live attack, against the login company Clerk, has been confirmed. [4]
05

How many people are in the Nutex Health file.

The company told the markets regulator what kinds of information were taken and said it will write to every patient, but has published no number. [10][11]
06

How large The Gentlemen ransomware group really is.

Sophos counts 683 victims by the end of July; SecurityWeek reports more than 580 in over 75 countries. Both figures rest on the group's own leak site, which is the only public list. [4][10]
07

How many people visited the Vietnamese streaming sites while the booby-trapped themes were live.

Socket named 13 packages across five publisher accounts and put no number on the visitors reached. [5]
08

Whether the three men who absconded from the Bradford laundering case will be brought back.

They were sentenced in their absence in March 2025, and West Yorkshire Police say inquiries to find them and secure extradition are continuing. [14]
09

Why a court order to repay 13,750 pounds has produced 163 pounds in eighteen months.

The UK justice ministry said it could not give details on enforcement in the case, and the victims say they were told only that it was being dealt with. [15]

04 Hope carry this

Google disrupted Popanet, a service that had been renting out the internet connections of about two million homes.

Also true today

From October, Windows machines that can run it will switch on memory integrity by themselves. It is the protection that stops malware altering the core of the operating system, and until now most people had to find the setting on their own.
Researchers at Whisper Security found 58 web addresses an Iranian hacking group had registered and parked, before a single one of them was switched on.
Two men were sentenced at Leeds Crown Court over a 266 million pound laundering operation run out of a Bradford jewellery yard. Four others were convicted last year.