Google takes apart a botnet of 1.3 million TV boxes, and says their Chinese maker built the malware in on purpose

The stories

25 stories on this beat today.

Every story told the same way: what happened, who is involved, why it matters, how it works, the truth and the good news.

1. 01

   Google takes apart a botnet of 1.3 million TV boxes, and says their Chinese maker built the malware in on purpose

   1.3 million

   Android TV boxes Google says were in the botnet

   the malware was put in at the factory [2]

   10 million

   more infected devices Google expects to cut off

   karaoke machines and health devices among them [1]

   3.8 million

   home and mobile internet addresses seen in the scheme

   counted by TrendAI from 3 June to 1 October [5]

   44,000

   infected boxes in the US

   between June and October, TrendAI found [3]

   What happened

   • Google and six partners took apart a botnet of more than 1.3 million Android TV boxes, Google said on Monday. [2]
   • A botnet is a crowd of hijacked machines that one group steers from its own control servers. [2]
   • Google says the boxes' maker, Videostrong, a Chinese firm, built the malware into them on purpose. [2][3]
   • The malware sat in the boxes' firmware, the basic software put on them at the factory. [2]
   • Google tests every certified Android device before sale. [1] Videostrong's code loaded only after a buyer first switched the box on, so it slipped past those tests. [3]
   • Once running, it let its operators install apps, switch off Google Play Protect and take screenshots. [2]
   • Videostrong sold access to the infected boxes to other criminal groups, Google's report says. [1]
   • Some made the boxes click on online ads and load hidden web pages, a cheat called ad fraud. [2]
   • Others rented out each owner's home internet connection to strangers. [1]
   • TrendAI counted infected boxes in more than 170 countries, most of them in Malaysia, Brazil, Iraq, Mexico and Taiwan. [3]
   • About 44,000 of the boxes were in the US between June and October. [3]
   • Between 3 June and 1 October, TrendAI saw 3.8 million different home and mobile internet addresses connect. [5]
   • Google cut ties with Videostrong and banned it from making certified Android devices. [2]
   • Google also took legal action to shut the servers and web addresses that ran the botnet. [1]
   • Google says it has changed how it reviews device makers, but will not say how, to avoid helping attackers. [3]

   XCPE boxes1.3 million

   Other devices cut off10 million

   Who is involved

   Videostrong is based in Shenzhen, China, and builds Android devices such as home TV boxes and projectors. [5][4]

   Google had approved it to make certified Android devices, which come with Google's own apps. [2][3]

   Japan's National Police Agency and the security firms Lumen, HUMAN, Plume, Synthient and TrendAI took part. [2]

   Google named proxy services the boxes downloaded, including AppSalt, also called Honeygain, owned by Oxylabs of Lithuania. [1]

   • Videostrong a Chinese maker of Android TV boxes in Shenzhen; Google says it built the malware in
   • Japan's police National Police Agency
   • Five security firms Lumen, HUMAN, Plume, Synthient, TrendAI
   • Box owners connection rented out
   • Strangers use it
   • AppSalt / Honeygain proxy service
   • Oxylabs its owner, Lithuania
   • Google Threat Intelligence Group Google's team that tracks hackers; it led the takedown
   • Synthient a start-up that tracks proxy firms; it traced the malware to Videostrong
   • Japan's National Police Agency Japan's national police; it worked on the takedown

   How it unfolded

   Synthient is a start-up that tracks firms selling internet connections. [1] It found the malware already inside a MECOOL TV box bought in late 2025. [2]

   BadBox 2.0, an earlier botnet of more than 10 million TV boxes and other devices, was disrupted in March 2025. [5]

   1. Late 2025 Synthient buys a MECOOL box with the malware inside [2]
   2. Then it finds the malware inside
   3. March 2025 BadBox 2.0, an earlier TV-box botnet, is disrupted [5]
   4. This week XCPE taken apart
   5. Late 2024 Videostrong adds a separate loader for the criminal modules [2]
   6. August 2026 the operators switch to small droppers dressed as system apps [2]
   7. Mon 2 Nov Google announces the takedown and bans Videostrong [2]

   Why it matters

   The owners never knew strangers were using their internet connection. [3]

   Many such boxes sell through social media stars who promise hundreds of pirated pay-TV channels for one fee. [1]

   How it works

   Network security calls this a residential proxy: a stranger's web traffic sent out through someone's home connection. [1]

   A website then sees an ordinary home, not the real sender. [1] Krebs on Security, a news site, says such traffic helps break into online accounts. [1]

   Seen it before

   It is like posting a letter from a friend's house, so the postmark shows their town, not yours.

   How spy agencies say how sure they are

   Intelligence analysts give each judgement two labels: one for how likely it is, and one for how good the evidence behind it is.

   The twist

   An analyst can call something highly likely while having only moderate confidence, because the odds and the strength of the evidence are rated separately.

   The picture

   Highly likelythe odds

   ++

   High confidencethe evidence

   Step by step

   1. 1 An analyst has to judge something nobody can see directly, such as who hacked a system
   2. 2 They pick a likelihood word from a fixed scale, from 'remote chance' to 'almost certain'
   3. 3 Each word stands for a set range of odds, so the reader knows how probable it is
   4. 4 Separately, they give a confidence level: how good and how complete the evidence is
   5. 5 A claim with neither label, like a gang's boast, says nothing about either

   The same force, elsewhere today

   Where this chain is also running, in today's other stories.

   • Britain's cyber agency warns of a wave of attacks

     The NCSC calls an AI-powered ransomware attack on British essential services by 2028 'highly likely', a word for the odds of an event.

   • Google's TV-box takedown

     Google says it has 'high confidence' that Videostrong built the malware in on purpose, a word for how strong its evidence is.

   • South Asian spy group spotted with new tool

     Fortinet links the attacks to Bitter 'with high confidence' and lists what that rests on: file names, server patterns and code.

   • Hackers say they wiped Russia's statistics agency

     The hackers' claims carry no rating at all, and Rosstat answers that it found no sign of a leak, so neither side is on a scale.

   Where you've seen this

   Weather forecasts

   a 'chance of rain' is a stated probability, so it can be checked against how often it really rains

   Courts

   'beyond reasonable doubt' and 'on the balance of probabilities' are two fixed levels of certainty for two kinds of case

   Doctors

   a doctor can think one illness most likely and still order tests, because the evidence so far is thin

   The catch

   The words only work when the writer and the reader share the scale; outside an intelligence agency, 'likely' can mean very different odds to different people.

   And the whole of it

   Every reader of today's stories is weighing claims from Google, Britain's cyber agency, criminal gangs and governments without seeing their evidence. Each of those sources is also looking at only part of what happened.

   The truth

   • What is really going on Google says Videostrong, a Chinese maker it had approved, put malware into 1.3 million TV boxes before they were sold. [2][3]
   • Why it works on people A takedown with a big number sounds like the end of the problem, but the malware is still sitting on the boxes in people's homes.
   • The malware is still on the boxes, and it reinstalls itself from a protected part of the box if deleted. [2]
   • BleepingComputer says owners must load clean firmware or unplug the box from the internet to stop it. [2]
   • Charley Snyder, who leads Google's takedown work, would not say when Google first learned of the botnet. [3]
   • Sources disagree on its spread: TrendAI counted more than 170 countries, and The Register reports more than 200. [3][5]
   • Who gains Videostrong — It kept making money from the boxes after they were sold, by selling criminal groups access to them. [1]
   • Who gains Residential proxy services such as AppSalt — Their software was loaded onto the infected boxes, giving them home connections to rent out without the owners knowing. [1][3]
   • Who pays Owners of infected TV boxes — Strangers used their home connections without their knowledge, and the malware returns unless they load clean firmware. [3][2]
   • Nobody knows yet

     How many TV boxes are really infected, and where.

     Google counts 1.3 million, but Synthient's founder calls that highly conservative. TrendAI counted more than 170 countries, while The Register reports more than 200. [1][3][5]

   Good news

   • The takedown should also cut off at least 10 million more infected devices, such as karaoke machines and health devices. [1][2]

1. 02

   Hackers heat freezers in 115 European shops

   What happened

   • Hackers changed fridge and freezer settings overnight into Monday in more than 115 shops in 6 European countries. [6]
   • In some shops the temperature was set to 50C, so frozen food thawed and was thrown away. [6][7]
   • About 40 Delhaize shops in Belgium and Luxembourg were hit, and 15 Carrefour shops in Belgium. [6]
   • Sabcobel, which runs Delhaize's fridge systems, said the units were switched to defrost mode. [7] That is believed to be the method used in France. [7]
   • Christophe Hansen, the EU's farm and food commissioner, called it a deliberate attempt to disrupt Europe's food supplies. [9]

   How it unfolded

   It follows an attack on 12 October that hit the fridges of 700 shops in France. [9][11]

   1. 12 October 700 shops in France
   2. This week more than 115 shops across Europe

   Why it matters

   One Delhaize shop in Hoeilaart, Belgium, said it lost 100,000 euros of food. [7]

   Hansen said food security is not at risk, but the waste and the cost to shops are real. [9]

   How it works

   Engineers call machines run by computers over a network operational technology, and shop fridges are now part of it. [9]

   Shops link fridges to the internet so engineers can fix them remotely. [7] Anyone who reaches those controls can also switch a freezer to defrost. [12]

   Seen it before

   It is like putting your home thermostat on a website, where a stranger can turn the heating right up.

   The truth

   • What is really going on Someone also set the freezers in more than 115 European shops to as high as 50C. [6]
   • Sabcobel says its units need physical changes, not just software updates, to close the weakness found in October. [7]
   • No group has claimed it. [10] A Sophos researcher's two likeliest explanations are a state showing what it can do, or a lone hacker. [10]
   • Who pays Shop managers in Belgium — A Proxy Delhaize manager near Brussels had to throw away all of the store's fresh and frozen food. [8]
   • Nobody knows yet

     Who heated the freezers in Europe's shops.

     No group has claimed it, and a Sophos researcher names two possible kinds of attacker, a state or a lone hacker. [10]

   • Nobody knows yet

     How many shops and countries the freezer attack reached.

     BleepingComputer counted more than 115 shops in 6 countries. The BBC reports 7 countries, adding Finland. [6][7]

   Good news

   • Most customers of Sabcobel, the Belgian firm that runs Delhaize's fridges, had moved their fridges onto secure connections after the French attack in October.
2. 03

   Britain's cyber agency warns of a wave of attacks

   What happened

   • Britain's National Cyber Security Centre, the NCSC, part of the GCHQ spy agency, published its yearly report on Tuesday. [14][13]
   • Its head, Richard Horne, warned of a 'real prospect of an unprecedented rise in the number of cyber incidents'. [13]
   • He says the cause is old flaws that AI can now find and use at a huge scale. [13]
   • The report judges it highly likely that AI-powered malware hits British essential services in a ransomware attack by 2028. [14]
   • The NCSC will spend £70 million on a new centre that uses AI to find flaws across British industry. [13]

   Who is involved

   Essential services here include power stations, airports and hospitals. [14]

   How it unfolded

   1. Now AI finds old flaws
   2. By 2028 AI malware in a ransomware attack: highly likely

   Why it matters

   Horne said leaders who 'got away with tech on the cheap' must invest. [15] Otherwise they will have to explain empty shelves and dark homes. [15]

   He called the recent attacks on supermarket fridges in Europe a warning to invest in defences. [14]

   How it works

   The NCSC calls years of put-off fixes and upgrades technical debt. [13] It says AI is now exposing that debt. [13]

   State hackers often got in through flaws whose fixes existed but were not installed in time, the report says. [13]

   Seen it before

   It is like skipping a car's small repairs to save money, until the brakes fail on a busy road.

   The NCSC calls an AI-powered ransomware attack on British essential services by 2028 'highly likely', a word for the odds of an event.

   The idea, in story 01: How spy agencies say how sure they are →

   The truth

   • The NCSC says experts have not yet seen a matching rise in attacks that use these flaws. [13]
3. 04

   Brazil crypto platform loses $46 million

   What happened

   • Mercado Bitcoin, a crypto platform in Brazil, stopped all deposits and withdrawals on Monday after a cyberattack. [16]
   • Blockchain security firms said more than $46 million left the platform late on Sunday night. [16] Mercado Bitcoin has not confirmed that figure. [16]
   • The company published the addresses the stolen coins went to and said it would reopen in the coming days. [16]

   Who is involved

   It calls itself Latin America's largest digital-asset investment platform, with about 4.5 million customers. [16]

   Why it matters

   It came days after $6.3 billion was stolen from Binance, another crypto platform. [16]

   Several crypto platforms have lost millions to hackers in the last 6 months, some more than $100 million each. [16]

   How it works

   Blockchain tracing means following stolen coins as they move, as Chainalysis is doing here. [16] Publishing where the coins went lets other firms freeze them. [16]

   Seen it before

   It is like giving every shop the serial numbers of stolen banknotes, so any till can refuse them.

   The truth

   • Mercado Bitcoin says customers were not harmed. [16] Blockchain experts published evidence that some customer wallets were emptied. [16]
   • Nobody knows yet

     Whether Mercado Bitcoin's customers lost money.

     The company says customers were not harmed, but blockchain experts published evidence that some customer wallets were emptied. [16]

   Good news

   • Tether's chief executive said Tether froze about $4.5 million of the stolen coins. [16] Other platforms froze another $2 million. [16]
4. 05

   Hackers say they wiped Russia's statistics agency

   What happened

   • Two hacking groups say they wiped servers at Rosstat, Russia's state statistics agency, over the weekend. [17]
   • They say they spent months inside the network and reached about 25,000 computers and other devices. [17]
   • They also say they put Ukraine's figures on Russian army losses on Rosstat's servers for about an hour. [17]
   • Rosstat confirmed an attack but said it found no sign that protected data had leaked. [17]

   Who is involved

   They are the Belarusian Cyber Partisans, who oppose Belarus's government, and Silent Crow, which backs Ukraine. [17]

   • Cyber Partisans Belarusian opposition hackers
   • Silent Crow pro-Ukraine hackers
   • The hackers say data was taken
   • Rosstat no sign of a leak

   How it unfolded

   The same groups hit Aeroflot, Russia's main airline, in July 2025, and more than 100 flights were cancelled. [17]

   Why it matters

   Rosstat holds Russia's population records, including data from the parts of Ukraine Russia occupies. [17]

   How it works

   A wiper attack destroys a target's computers and data on purpose. [17] Here the groups say they destroyed servers and storage systems. [17]

   The groups say they spent 4 months quietly collecting data, then about a month preparing the destruction. [17]

   Seen it before

   It is like a burglar who copies every file in an office before setting fire to the cabinets.

   The hackers' claims carry no rating at all, and Rosstat answers that it found no sign of a leak, so neither side is on a scale.

   The idea, in story 01: How spy agencies say how sure they are →

   The truth

   • The hackers' claims about what they destroyed and stole could not be independently checked. [17]
   • Who gains The Belarusian Cyber Partisans and Silent Crow — They say they put Ukraine's figures on Russian army losses on Rosstat's own servers for about an hour. [17]
   • Nobody knows yet

     What the hackers really destroyed and took at Rosstat.

     Their claims could not be independently checked, and Rosstat says it found no sign that protected data leaked. [17]

5. 06

   Ransomware hits old Synology storage boxes

   What happened

   • Synology, a Taiwanese maker of network storage boxes, told customers to update now as ransomware attacks surge. [18]
   • The attackers use a flaw that Synology fixed in December 2024, on boxes that were never updated. [18]
   • Victims found their files locked and a note selling a 'C3rb3r Decryptor' for thousands of dollars. [18]
   • Shadowserver, a group that watches the internet, counts more than 380,000 Synology boxes reachable online. [18]

   Who is involved

   Ransomware locks a victim's files and demands a payment to unlock them. [14]

   How it unfolded

   1. December 2024 Synology fixes the flaw
   2. Now boxes never updated are attacked

   Why it matters

   Synology last warned of attacks like this in August 2019, so such alerts are rare. [18]

   The truth

   • Shadowserver does not say how many of those boxes are already fixed. [18]
   • Who pays Synology owners who never updated — Their files were locked, and a note offered a decryptor for thousands of dollars. [18]
6. 07

   Thieves drain old BTCPay crypto servers

   What happened

   • Attackers have been draining 'hot wallets' on shops' servers running old versions, the project warned on Monday. [19]
   • They logged in as administrators on servers running version 2.4.1, from July, or older. [19]
   • Bitcoin and Litecoin were sent out in payments nobody had approved. [19]
   • The project asked hosting firms to take hit servers offline and told users to update to 2.4.7. [19]

   Who is involved

   BTCPay Server is free software that lets shops take Bitcoin payments straight into their own wallets. [19]

   How it unfolded

   On 29 October the project disclosed a critical flaw found by Anthropic's code scanner and released 2.4.7. [19]

   Why it matters

   Shops that lost money were asked to tell the project and their local police. [19]

   The truth

   • The project says it has no credible reports of thefts from servers running 2.4.7. [19]
7. 08

   Factory machine flaw used to plant malware

   What happened

   • Attackers are using a top-danger flaw in Node-RED, a tool that automates machines in factories and plants. [20]
   • Siemens rated the flaw 10 out of 10 in August. [20] Affected devices ask for no password before their programs are changed. [20]
   • VulnCheck, a security firm, saw the first attack on 30 October on one of its decoy machines. [20]
   • The attacker tried to make the device download and run a Linux program named bot-linux-amd64. [20]

   Who is involved

   It is built into products such as Siemens' SIMATIC IoT2050, a gateway box for industrial machines. [20]

   How it unfolded

   1. August Siemens rates the flaw
   2. 30 October first attack on a decoy

   Why it matters

   The Register links it to a wider rise in attacks on machines that act in the physical world, like fridges. [20]

   How it works

   VulnCheck calls this opportunistic mass scanning: one machine trying many old and new flaws on anything it finds. [20]

   One address tried this flaw 16 times, plus 7 other flaws, including one 7 years old. [20]

   Seen it before

   It is like someone walking down a street trying every front door, not choosing one house.

   The truth

   • VulnCheck did not download the program, so it cannot say what it does once running. [20]
8. 09

   Gang claims Michigan State student data

   What happened

   • The BYOD ransomware gang says it stole personal data on 1.3 million current and former Michigan State University students. [21]
   • The gang added the university to its leak site on Sunday evening. [21]
   • Michigan State says the claim is tied to an incident in early October. [21] It then made every student and worker reset their password. [21]
   • New passwords had to be at least 15 characters long. [21]

   Who is involved

   BYOD is a new gang that appeared in September, and little is known about it. [21]

   How it unfolded

   Last week BYOD attacked the University of New Mexico and shut down its hospital. [21]

   1. Last week New Mexico university hospital shut
   2. Sunday Michigan State on the leak site

   Why it matters

   If the claim is true, it reaches former students as well as current ones. [21]

   How it works

   The university calls it a possible credential compromise: someone got hold of working logins. [21]

   Resetting every password stops stolen logins from working, so Michigan State reset everyone's at once. [21]

   Seen it before

   It is like changing every lock in a building after one key goes missing, because nobody knows whose it was.

   The truth

   • Michigan State says it has no evidence other university data was taken or changed. [21] It did not answer questions about the gang's post. [21]
9. 10

   Bank lending software offline after break-in fears

   What happened

   • It took its Sageworks lending app offline on 30 October after spotting 'irregular activity'. [22]
   • Most of the app is back, but the parts borrowers use are still off. [22]

   Who is involved

   Abrigo sells software to more than 2,400 US community banks and credit unions. [22]

   Lenders use Sageworks to process loan applications and check borrowers' finances. [22]

   How it unfolded

   Earlier this year someone claiming to be from the ShinyHunters gang said they stole 1.7 million records from Abrigo. [22]

   Why it matters

   Some researchers advised banks using Sageworks to change its access keys, though no break-in is confirmed. [22]

   The truth

   • Abrigo has not said whether a break-in or a technical fault caused the outage. [22]
   • Nobody knows yet

     What took Sageworks offline.

     Abrigo has not said whether it was a break-in or a technical fault. [22]

10. 11

    Fake IT helpers on Teams take over logins

    What happened

    • Attackers posing as a company's own IT help desk contacted staff on Microsoft Teams, Microsoft reported. [23]
    • They talked staff into opening Quick Assist, a Windows remote-help tool, and reading out its code. [23]
    • From that computer they got login certificates for powerful accounts from a badly set-up Windows certificate service. [23]
    • In one of the 2 break-ins Microsoft studied, company data was copied to an outside server. [23]

    Who is involved

    Microsoft did not name the group behind it. [23]

    Why it matters

    No Teams flaw was used, so there is no patch. [23] Microsoft's defence is staff checking any surprise support request through a known channel. [23]

    How it works

    Incident responders call cutting a hacked account off containment. [23] In the first case, one powerful account was left out of the automatic cut-off. [23]

    The attacker kept using that one account to reach a file server and copy data out. [23]

    Seen it before

    It is like changing the locks after a burglary but forgetting the back door, the one the burglar uses.

    The truth

    • Microsoft says such a certificate keeps working even after the account's password is reset. [23]
11. 12

    Stolen AI keys run up $100,000 a day

    What happened

    • Criminals using companies' stolen AI access keys can run up more than $100,000 in charges a day, Google's Mandiant says. [24]
    • Mandiant is Google's team that responds to break-ins. [24] Some victims' bills reached $1 million before they cut the thieves off. [24]
    • The trick is called LLMjacking: using someone else's paid access to AI models. [24]
    • One service, Jet Night, sold unlimited AI use for about $60 a month, far below normal prices. [24]
    • Normal plans cost between $100 and $250 a month, and Google believes Jet Night runs on stolen keys. [24]

    Why it matters

    Google says locking down these keys also protects everyone else from a flood of cheap automated attacks. [24]

    How it works

    Researchers see a split of jobs: some criminals steal the access, others resell it through services Google calls LLM Mixers. [24]

    Seen it before

    It is like someone using a stolen phone to sell cheap calls, while the phone's owner pays the bill.

    The truth

    • Jet Night has admitted outages, which Google says are likely stolen keys being cancelled by victims. [24]
    • Who pays Companies whose AI keys were stolen — They pay for the AI use that thieves run up, and some bills reached $1 million. [24]
12. 13

    Two top-danger flaws in an AI app builder

    What happened

    • IBM rated 2 flaws in Langflow, a free tool for building AI agents, 9.8 out of 10 for danger. [25]
    • They let an attacker with no account get past the login or run their own code on the server. [25]
    • Every version from 1.0.0 to 1.12.8 is affected, and the only fix is version 1.13.0. [25]
    • Metasploit, a public hacking toolkit, already includes a module for one of the flaws. [25]

    How it unfolded

    1. Last week IBM warns of the flaws
    2. 30 October not yet on the US list

    Why it matters

    6 other Langflow flaws are already on that US list of flaws used in attacks, the latest added in August. [25]

    How it works

    Langflow's automatic login signs users in as all-powerful superusers, with no password asked. [25] It was on by default in 1.12.8. [25]

    Seen it before

    It is like a new phone that arrives with no screen lock, until its owner sets one.

    The truth

    • IBM gives no workaround for servers that cannot upgrade yet. [25]

    What comes next

    Neither flaw was on the US list of flaws known to be used in attacks, as of 30 October. [25]

13. 14

    AI workflow firm Trigger.dev exposes customer secrets

    What happened

    • Trigger.dev, a cloud service for running AI agents and workflows, said on Sunday an attacker reached some customers' settings. [26]
    • The attacker took environment variables: settings that often hold passwords and keys to other services. [26]
    • Trigger says the way in is now blocked, and affected customers have been told what to do. [26]

    Who is involved

    Its listed customers include the fashion brand Emporio Armani and the calendar service Cal.com. [26]

    • Emporio Armani fashion brand
    • Cal.com calendar service

    Why it matters

    The Register says stolen keys could let an attacker reach linked services, such as payments through Stripe. [26]

    The truth

    • Trigger has not said which customers were hit, and told The Register to wait for a full report. [26]
14. 15

    Pet-photo apps hid abusive deepfake tools

    What happened

    • WIRED found a network of more than 400 apps and websites that pose as everyday tools, such as pet-portrait makers. [27]
    • Under some conditions they load hidden tools that make sexual deepfake images, AI fakes, from photos people upload. [27]
    • Ads for the apps ran on Facebook and Instagram, and some showed AI child sexual abuse images, WIRED reports. [27]
    • The apps were downloaded more than 350,000 times from Google Play, and many were rated suitable for all ages. [27]
    • Apple removed 19 apps after WIRED asked, and Google had removed most of them already. [27]

    Who is involved

    The network appears to be run by Chinese developers and KeLing Technology, a firm registered in Hong Kong. [27]

    Why it matters

    The apps took payment through Apple Pay and Google Pay, inside the companies' own stores. [27]

    How it works

    Researchers call the trick cloaking: an app shows reviewers one face and some users another. [27]

    Apple says the apps passed review, then their makers swapped the website the apps load content from. [27]

    Seen it before

    It is like a shop that shows an inspector a clean back room, then fills it after the visit.

    The truth

    • Apple says it suspended tens of thousands of apps for this bait-and-switch in the past year. [27]
15. 16

    Polymarket repays $3.9 million after supplier hack

    What happened

    • Polymarket, a site for betting on future events, will pay $3.9 million to users hurt by last week's hack. [28]
    • $2.7 million covers money stolen directly, and $1.2 million covers losses from the hours-long trading pause. [28]
    • The thieves swapped a speed-checking script on Polymarket's site for one that emptied logged-in users' wallets. [28]
    • DebugBear, whose script it was, says its web address records were taken over through its domain registrar. [29]

    How it unfolded

    In June, a different supplier's hack cost Polymarket users about $3 million. [29]

    Why it matters

    726 wallets were hit by the theft, and about 5,500 were hurt by the pause or by forced sales. [29]

    How it works

    Security engineers call this a supply-chain attack: hitting a site through code it loads from a supplier. [29]

    Polymarket's pages loaded DebugBear's script for every visitor. [29] So when attackers changed what that address served, Polymarket's users ran it. [29]

    Seen it before

    It is like a cafe buying cakes from a bakery: spoil the bakery's cakes and the cafe's customers eat them.

    The truth

    • DebugBear has not explained how the attackers got in at the registrar. [29]
    • Nobody knows yet

      How attackers took over DebugBear's web address records.

      DebugBear says it happened through its domain registrar, but has not explained how. [29]

    Good news

    • By Saturday, 95% of the affected wallets had been repaid in full, Polymarket said. [28]
16. 17

    Revolve breach reaches at least 180,000 people

    What happened

    • Revolve, an online fashion shop, is telling at least 180,000 people that their card details were stolen. [30]
    • Hackers got in on 11 September and may have taken names, addresses, card numbers and expiry dates. [30]
    • Only cards that customers had saved to their accounts were exposed. [30]
    • Notices filed in Iowa, Massachusetts, Texas and Vermont add up to 179,259 people. [30]

    Why it matters

    Revolve is not offering free credit or identity-theft monitoring to those affected. [30]

    The truth

    • Revolve has not given a total, or said who hacked it and how. [30]
    • Who pays Revolve customers — They must watch their own card statements, because Revolve is not paying for credit monitoring. [30]
17. 18

    South Asian spy group spotted with new tool

    What happened

    • Fortinet, a security company, says a spy group called Bitter has been attacking organisations in South Asia. [31]
    • Its bait files included an ambassador's letter about the Belt and Road Summit and a gala dinner invitation. [31]
    • In one attack chain the group used only tools already built into Windows, with no malware file at all. [31]
    • The other attacks installed PapRAT, a program that lets the attackers control a computer remotely. [31]

    Why it matters

    Fortinet's data also shows the group active in Southeast Asia and South Korea. [31]

    How it works

    Security teams call this living off the land: using a computer's own tools, so no strange file is left. [31]

    Defences that look for known bad files have nothing to flag when there is no bad file, one expert said. [31]

    Seen it before

    It is like a burglar who uses the house's own ladder, so no strange tools are found afterwards.

    Fortinet links the attacks to Bitter 'with high confidence' and lists what that rests on: file names, server patterns and code.

    The idea, in story 01: How spy agencies say how sure they are →

    The truth

    • Fortinet ties the attacks to Bitter 'with high confidence', citing file names, server patterns and code. [31]
18. 19

    North Korea denies the Binance theft

    What happened

    • North Korea called the US charge that it stole more than $6 billion from Binance 'a grave political provocation'. [32]
    • The FBI blamed a North Korean state-linked group, TraderTraitor, at the weekend. [32]
    • Binance says it replaced most of the stolen coins with its own money. [32] More withdrawals restart from 04:00 GMT on Tuesday. [32]

    Who is involved

    The words came from Kim Yo Jong, sister of leader Kim Jong Un, through state media. [32]

    • FBI blames TraderTraitor
    • North Korea denies it

    How it unfolded

    1. At the weekend FBI blames TraderTraitor
    2. Tuesday 04:00 GMT more withdrawals restart

    Why it matters

    Analysts in Seoul said the quick denial suggests worry that the US will try harder to cut this money off. [32]

    Good news

    • Binance says it has replaced most of the stolen coins with its own money, and more withdrawals restart on Tuesday.
19. 20

    Business groups push to renew a cyber-sharing law

    What happened

    • 35 business groups asked US lawmakers on Sunday to renew a cyber information-sharing law for 10 years. [33]
    • The 2015 law protects companies when they share threat data with the US government and with each other. [33]
    • The US House's version of the yearly defence bill has the 10-year renewal. [33] The US Senate's version does not. [33]

    Who is involved

    Senator Rand Paul wants limits on the US cyber agency, which he says threatened free speech in the past. [33]

    How it unfolded

    1. Last year the law lapses
    2. 11 December it expires again

    Why it matters

    The groups say AI now finds and uses software flaws at machine speed, so defenders must share faster. [33]

    What comes next

    It lapsed last year and has since been renewed for short spells. [33] It now expires on 11 December. [33]

20. 21

    US cyber agency's acting chief nears his limit

    What happened

    • Nick Andersen has run CISA, the US cyber-defence agency, as acting director since February. [34]
    • Acting directors face a 210-day limit, and no permanent nominee has been named. [34]
    • Naming a nominee would pause the clock, said Mark Montgomery of the FDD think tank. [34]

    Who is involved

    • Nick Andersen acting director since February

    How it unfolded

    The last nominee, Sean Plankey, withdrew in April. [34]

    1. February Andersen becomes acting director
    2. April Plankey withdraws

    Why it matters

    CISA guards US government networks and the critical systems ordinary Americans rely on every day. [34]

    The truth

    • The White House did not answer CyberScoop's questions. [34]

    What comes next

    Sources told CyberScoop the Trump administration may change his title to keep him in the job. [34]

21. 22

    Google offers $250,000 for the worst cloud flaws

    What happened

    • Google will pay up to $250,000 to researchers who show full control over someone else's Google Cloud project. [35]
    • The attack must work without stolen logins, earlier access or tricking a person. [35]
    • Chris Betz, Google Cloud's security chief, said finding such flaws takes human creativity combined with AI tools. [35]
    • Researchers must stop the moment they run code inside Borg, Google's own core systems. [35]

    Who is involved

    • Chris Betz Google Cloud security chief

    Why it matters

    Google says first-time researchers using AI tools find more interesting bugs, on average, than beginners did 2 years ago. [35]

    How it works

    Security teams call this a bug bounty: a cash reward for reporting a flaw to its owner. [35]

    Researchers prove access against a test account Google provides, so no real customer's project is touched. [35]

22. 23

    Microsoft fixes a switch its update broke

    What happened

    • Microsoft has fixed a bug that stopped some Windows 11 users turning on Smart App Control. [36]
    • Updates from 28 October onward fix it, Microsoft said. [36]
    • Computers that already had the feature on stayed protected. [36]

    Who is involved

    Smart App Control is a Windows feature that blocks apps it judges harmful. [36]

    How it unfolded

    October's security update had greyed out the switch on some computers. [36]

    1. October update greys out the switch
    2. 28 October fix released

    Why it matters

    Until the fix, people who had turned it off could not turn it back on. [36]

23. 24

    Free US guide for one-person businesses

    What happened

    • NIST, the US National Institute of Standards and Technology, published a free cybersecurity guide for one-person businesses. [37]
    • The guide assumes no prior knowledge, and its first steps include regular backups and keeping software up to date. [37]
    • It also says to change the default passwords that come with devices like Wi-Fi routers. [37]

    Who is involved

    More than 28 million US small businesses have no paid staff except the owner. [37]

    Why it matters

    One-person firms may have no security know-how, so NIST wrote the guide for them, its author said. [37]

    How it works

    Criminals can easily look up a device maker's default password and use it to get in. [37]

    Seen it before

    It is like a padlock sold with the same code for every buyer.

24. 25

    37 security company deals in October

    What happened

    • SecurityWeek counted 37 cybersecurity company takeovers and mergers announced in October. [38]
    • IonQ, a quantum computing company, agreed to buy the security firm Elisity in a deal worth up to $1.3 billion. [38]
    • Anthropic, the AI company, agreed to buy Opaque Systems, a 'confidential AI' firm that grew out of UC Berkeley research. [38]
    • Cohere, a Canadian AI developer, plans to buy AISLE, whose AI finds and helps fix flaws in software. [38]

    Who is involved

    • Anthropic AI company, buyer
    • Opaque Systems confidential AI firm
    • Cohere Canadian AI developer
    • AISLE AI that finds flaws

    Why it matters

    Several deals buy AI that finds software flaws, the skill Britain's cyber agency says attackers are also gaining. [38][13]