-
Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user’s Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of sprawling operation that seeks to defraud online merchants and advertising networks.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s webOS store allow unknown third-parties to route their Internet traffic through a user’s TV.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Canadian authorities on Wednesday arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf, a fast spreading Internet-of-Things botnet that enslaved millions of devices for use in a series of massive distributed denial-of-service (DDoS) attacks over the past six months. KrebsOnSecurity publicly named the suspect in February 2026 after the accused launched a volley of DDoS, doxing and swatting campaigns against this author and a security researcher. He now faces criminal hacking charges in both Canada and the…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A Brazilian tech firm that specializes in protecting networks from distributed denial-of-service (DDoS) attacks has been enabling a botnet responsible for an extended campaign of massive DDoS attacks against other network operators in Brazil, KrebsOnSecurity has learned. The firm’s chief executive says the malicious activity resulted from a security breach and was likely the work of a competitor trying to tarnish his company’s public image.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Hackers linked to Russia’s military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The U.S. Justice Department joined authorities in Canada and Germany in dismantling the online infrastructure behind four highly disruptive botnets that compromised more than three million hacked Internet of Things (IoT) devices, such as routers and web cameras. The feds say the four botnets — named Aisuru, Kimwolf, JackSkid and Mossad — are responsible for a series of recent record-smashing distributed denial-of-service (DDoS) attacks capable of knocking nearly any target offline.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The cybercriminals in control of Kimwolf — a disruptive botnet that has infected more than 2 million devices — recently shared a screenshot indicating they’d compromised the control panel for Badbox 2.0, a vast China-based botnet powered by malicious software that comes pre-installed on many Android TV streaming boxes. Both the FBI and Google say they are hunting for the people behind Badbox 2.0, and thanks to bragging by the Kimwolf botmasters we may now have a much clearer idea…
·
18681627767, 189308024@qq.com, 34557257@qq.com, BadBox 2.0, Beijing Astrolink Wireless Digital Technology Co. Ltd, Beijing Hengchuang Vision Mobile Media Technology Co. Ltd., Beijing Hong Dake Wang Science & Technology Co Ltd., Breadcrumbs, cathead@gmail.com, Chen Daihai, Constella Intelligence, daihaic@gmail.com, Dort, Federal Bureau of Investigation, Guilin Huang, HUMAN Security, Internet of Things (IoT), Moxin Beijing Science and Technology Co. Ltd., osint.industries, Snow, SpyCloud, Web Fraud 2.0, xavierzhu@gmail.com, xavierzhu@qq.com, Zhu Zhiyu, 桂林 黄, 陈代海¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A new Internet-of-Things botnet called Kimwolf has spread to more than 2 million devices, forcing infected systems to participate in massive distributed denial-of-service (DDoS) attacks and to relay other malicious and abusive Internet traffic. Kimwolf’s ability to scan the local networks of compromised systems for other IoT devices to infect makes it a sobering threat to organizations, and new research reveals Kimwolf is surprisingly prevalent in government and corporate networks.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Our first story of 2026 revealed how a destructive new botnet called Kimwolf rapidly grew to infect more than two million devices by mass-compromising a vast number of unofficial Android TV streaming boxes. Today, we’ll dig through digital clues left behind by the hackers, network operators, and cybercrime services that appear to have benefitted from Kimwolf’s spread.
·
3XK Tech GmbH, A Little Sunshine, Aisuru, AT&T, Benjamin Brundage, Breadcrumbs, ByteConnect, Cassidy Hales, DDoS-for-Hire, Dort, Ethereum Name Service, Flashpoint, Forky, Friedrich Kraft, GreyNoise Intelligence, Internet of Things (IoT), Julia Levi, Kimwolf, Linus, Maskify, Ne’er-Do-Well News, Plainproxies, Resi Rack LLC, Shox, Snow, Synthient, XLab¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
On the surface, the Superbox media streaming devices for sale at retailers like BestBuy and Walmart may seem like a steal: They offer unlimited access to more than 2,200 pay-per-view and streaming services like Netflix, ESPN and Hulu, all for a one-time fee of around $400. But security experts warn these TV boxes require intrusive software that forces the user’s network to relay Internet traffic for others, traffic that is often tied to cybercrime activity such as advertising fraud and…
·
A Little Sunshine, Amazon, ARP poisoning, BadBox 2.0 Enterprise, BestBuy, Censys, Electronic Frontier Foundation, Federal Bureau of Investigation, Grass OpCo (BVI) Ltd, Half Space Labs Limited, Internet of Things (IoT), IPidea, Lower Tribeca Corp., Netcat, Newegg, Riley Kilmer, Spur, Super Media Technology Company Ltd., Superbox, SuperCaja, Synthient, Tcpdump, Walmart, Web Fraud 2.0, Wynd Network¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
