Cyber, in brief

A TV box called SuperBox promises unlimited films and shows for a single payment. The security firm Plume found it also rents the buyer's home internet connection out to strangers. [1]

The box ships with Android's safety checks switched off. Apps run with full system rights, and its debug port is left open to the internet. [1]

The command that grants full control asks for no password. Anyone who reaches that port can install any app on the box. [1]

A home router cannot block it. The box makes the connection outwards and holds it open, so nothing ever arrives looking like an incoming call. [1]

Plume joined one proxy service, Popanet, with a test box and let it run for three weeks. It logged 1,352 separate attempts to reach the box's debug port. [1]

The intruders tried to install three more malware families, called CECbot, Maskify and a version of Mirai. Each signs the box up to another proxy network or to a group that floods websites with traffic. [1]

Google puts Popanet alone at about 2 million devices. Plume examined only SuperBox and says dozens of similar brands behave the same way. [1]

Owners often know. Several told Ars Technica's security editor that free films were worth it, and he wrote that anyone using one should disconnect it and throw it away. [1]

A separate study of a rival brand, H96, found the boxes pretending to be mobile phones clicking adverts on invented websites. [2]

Why it matters. Watch whether a second brand is tested and found with the same open port, because Plume says it looked at one of dozens.

Microsoft says an active campaign builds near-perfect copies of software makers' download pages and serves its own installer instead. Once the file is run, it adds itself to the exclusion list of Microsoft Defender, the anti-virus built into Windows. It then stops and disables the four Windows services that fetch updates, renames their files and deletes the update cache. Microsoft links the campaign with moderate confidence to a Chinese group it calls Silver Fox, and lists victims in healthcare, manufacturing, gaming, government and education. [3]

Why it matters. A machine that cannot update never receives the next fix, so one bad download quietly removes every future one. Days earlier Kaspersky found the same idea inside a Chinese wallpaper program, using a genuine signed application to load the attackers' code. [3]

Companies have started publishing a file called llms.txt at the top of their websites. It is a set of instructions for AI assistants: what to read, which programs to install, which sites to trust. An Israeli team scanned 6,214 company websites and found 8,265 of these files. In 120 of them the file named software packages on PyPI or npm, the two big public code libraries, that nobody had ever registered. They registered a few of those names and put a beacon inside. The first call home came in under four minutes. [4]

Why it matters. One real attack has already used this. The login company Clerk named a package it did not own, a stranger registered the name, and the code inside sent back the username, machine name and folder of whoever installed it. Clerk has since fixed its file. [4]

Someone setting up a computer mouse typed the maker's web address wrong. A paid search result caught the mistake and sent them to a counterfeit site offering a privacy browser. The installer was wrapped in a format signed through Microsoft's own system, and once running it turned commands from a distant attacker into fake mouse movements and keystrokes on the machine. The security firm Intezer says anti-virus scanners flagged the file between zero and two times, and traces the same operation back to 2016. [4]

Why it matters. Nothing was broken into here. The advert slot, the near-miss web address and the signing service can all be bought, and together they replaced the mouse maker as the source of the software. [4]

The security firm Socket found 13 booby-trapped themes on Packagist, a public library where website builders take free code. Vietnamese film and comic streaming sites installed them. The themes injected code that did two things to every visitor: pushed gambling and advert traffic on phones generally, and on iPhones ran an attack chain against two Safari flaws Apple patched in 2025. The end of that chain installed spying software and went for the recovery phrases that unlock cryptocurrency wallets. The packages sat across five separate publisher accounts. [5]

Why it matters. The site owner chose a free theme, and the theme then decided what happened to everyone who visited. Anyone still running an unpatched iPhone was attacked simply by loading a page. [5]

Citrix patched a serious flaw in NetScaler in mid-August. NetScaler is the box that sits at the edge of a company network and checks who is allowed in, so a way past its login check is a way into everything behind it. On 3 September the vulnerability intelligence firm Previdian saw requests matching a newly published attack arrive at its sensors from three addresses, in Australia, the United States and Germany. Previdian's founder Ryan Dewhurst says this shows attempts, not a successful break-in. [6]

Why it matters. The gap between a patch and a working public attack is where every unpatched company lives, and here it closed in about two weeks. [6]

All-in-One WP Migration and Backup is a WordPress add-on with more than five million installations. It copies a website so it can be moved to a new server. The security firm Defiant found a flaw that lets a stranger post two comments carrying hidden instructions. When an administrator runs an ordinary backup, those instructions are written into the site's database and its secret key becomes publicly readable. The attacker can then upload an archive that runs their own program. A fix arrived on 20 August. By 3 September only 35% had installed it. [7]

Why it matters. The attack needs the site owner to do something completely ordinary, which is take a backup. That is what makes a two-week patch gap so wide here. [7]

Comcast, one of the biggest home internet providers in the United States, has added motion detection to its wireless routers. The router watches how the wifi signal between it and a connected television or printer wobbles, and sends a phone alert when something moves nearby. There are separate settings for when the household is home, asleep or away. Comcast's own support page says this information may be passed to third parties, without further notice to the customer, in a police investigation, in a dispute Comcast is part of, or under a court order. [8]

Why it matters. Bruce Schneier, who writes about security, said it sounds like a great surveillance tool. Nobody in the house has to install anything for it to start working. [8]

India's government told Meta that adverts on Facebook and Instagram were using sexually explicit thumbnails to push people towards fake Android apps that steal banking logins. The apps ran under names such as Night Play and Kyss, and were downloaded as files from websites rather than an official app store. India's advisory says they could read what is on a phone, capture one-time passcodes and bank PINs, and move money out. Reuters found 39 adverts still running afterwards, and Meta removed them once asked. India recorded about $2.4 billion in cyber-fraud losses in 2025. [9]

Why it matters. Weeks earlier the same government made Google shut hundreds of accounts being used to impersonate banks. Both times the adverts were sold first and reviewed after a government complained. [9]

Sophos, a security firm, counted 683 victims of the ransomware business calling itself The Gentlemen by the end of July, 169 of them added in that month alone. The group rents its software to other criminals, and both scrambles a victim's files and copies them out first so it has something to publish. Its current target is Nutex Health, which runs 27 emergency and hospital sites across 12 US states. Nutex told the US markets regulator that patient, employee, provider and financial information was taken. [4][10][11]

Why it matters. SecurityWeek puts the same group at more than 580 victims in over 75 countries, so the two counts differ by about a hundred and neither can be checked against anything but the gang's own leak site. Nutex has not said how many patients are in the file. [10][11]

The cyber agencies of the United States, United Kingdom, Australia, Canada and New Zealand published joint guidance on 2 September on how a service provider should talk to customers while its systems are down. It tells companies to agree the thresholds and the audiences in advance. They should say plainly what is known, what is unknown and what is still being investigated, publish an explanation of the cause, and drop marketing language. The agencies say they wrote it after the Cloudflare outage of 18 November 2025. [12]

Why it matters. It describes the exact gap this week keeps showing, where a company confirms a break-in and then leaves the number of people affected unpublished for weeks. Guidance is not a rule, and none of these agencies can make a company follow it. [12]

The security firm Huntress found attackers using Faronics Deploy, a legitimate program companies buy to manage their computers, as the way in. Victims are tricked by a phishing message into installing it themselves. The attackers then use it to run their own commands and to add ScreenConnect, a genuine remote-control tool, on top. Huntress counted more than 457 machines that met these lures. Because both programs are real and widely used, the activity looks like ordinary IT work in a company's records. [4]

Why it matters. Nothing needs to be smuggled past a scanner when the victim installs the tool and the tool is genuine. It is the same step as the fake download pages, one rung further inside a company. [4]

Researchers have described CRPx0, a ransomware business that rents its software to other criminals. Victims meet a page pretending to be a Windows or macOS update prompt, or a fake check that you are not a robot, and are told to copy a line of text and run it themselves. The program copies files out before scrambling them, tries to spread across the network, and demands payment in Bitcoin or Monero within 48 hours. It first appeared on 7 June 2026 and is now advertised on an ordinary website, not a hidden one. [4]

Why it matters. The victim performs the break-in, which is why a security product watching for a suspicious download sees nothing worth stopping. [4]

The research group ZeroBEC described BlueKit, a ready-made phishing operation aimed at the chief executives of financial firms. It puts the attacker's own browser between the victim and the real login page, so passcodes and the cookie that keeps you signed in pass straight through. Selected victims are then moved into a fake document viewer that installs ScreenConnect pointed at the attackers' server. Access costs $250 for seven days, $480 for fourteen and $940 for thirty, against rivals charging roughly $289 to $400 a month. [4]

Why it matters. Someone with no technical skill can rent this for a week and aim it at one named person, then stop paying. [4]

Whisper Security mapped the servers behind an Iranian hacking group known as Prince of Persia, which uses malware called Foudre and Tonnerre to size up high-value targets. Each of the group's live control servers also runs the address book for its own web addresses, which is unusual. That let researcher Kaveh Azarhoosh find 58 further addresses that the group has registered and pointed at its own servers but has not yet connected to anything. The moment one of them is given an address, a new control server becomes visible before it does anything at all. [4]

Why it matters. Most attacker infrastructure is found after it has been used. This is a list of the next ones, published while they are still empty. [4]

Jane Bertelli travelled from Reading to Southwark Crown Court in London to look at the three men who took 12,000 pounds left to her by an elderly relative. Ethical Forestry, run from Bournemouth by Matthew Pickard, Stephen Greenaway and Paul Laver, sold investments in tree planting in Costa Rica to about 3,000 people, promising a return and reforestation in the same brochure. The three directors admitted fraud. Their investors' money bought a Maserati, Ferraris and Porsches; Bertelli still drives a thirteen-year-old Toyota. [13]

Why it matters. Most investment fraud is sold this way, with a glossy brochure and a cause the buyer already believes in. Bertelli said seeing the men again brought back all the anger she had felt for years about losing the money. [13]

Two men were sentenced at Leeds Crown Court over an operation that turned bags of cash into gold grain and shipped it to Dubai on fake invoices. Baqa Haider, 51, wrote the invoices and handled the exports, and was jailed for six years. Nathan Rivers, 45, worked at the Fowler Oldfield yard in Bradford and got 27 months suspended. Four other men were convicted in March 2025 and given up to eleven years, though three absconded and were sentenced in their absence. West Yorkshire Police call it the largest cash-laundering investigation in UK legal history. [14]

Why it matters. The scheme ran from 2013 until police reached it, and turned bags of cash into gold that could be sold anywhere. Police say they are still trying to bring the three men who fled back to Britain. [14]

Charlotte Blackwell, 32, from Bridgend in Wales, faked her own wedding and took 12,682 pounds from her then-fiance's mother and three of her friends between 2022 and 2024. In March 2025 a judge gave her a suspended prison sentence and ordered 13,750 pounds in compensation at 400 pounds a month. Her four victims say they have received 163 pounds in total, and nothing at all in the last four months. The UK justice ministry said it could not give details on enforcement in this case. [15]

Why it matters. A compensation order is the main route by which a fraud victim is supposed to get money back. This one has returned about one percent in eighteen months. [15]

Michaela Golding, 58, managed a care home in Filey, North Yorkshire. She offered to help relatives who were struggling with residents' fees and finances, then paid some of that money into her own accounts. She also increased the invoices from the visiting foot-care service and took the difference from residents' personal budgets. One resident lost more than 27,000 pounds. Golding pleaded guilty to fraud by abuse of position and to false accounting, and was sentenced at York Crown Court to 32 months in prison. [16]

Why it matters. The offer of help was the method. The son of one victim said money had been taken from his mother before she died. [16]