AI Hacking Tools, a Botnet in Your TV, and Meta Wants to Hear How You Feel
Monday, July 13, 2026 · 5-minute read
The European Union and the United Kingdom jointly sanctioned dozens of Russian individuals and organizations this weekend, accusing Russia of running a network of state-sponsored hacking groups responsible for attacks across Europe. The sanctioned parties are linked to the GRU, Russia's military intelligence agency. Sanctions freeze assets and ban travel — they're diplomatic pressure, not an arrest warrant, but they put names and faces to attacks that were previously anonymous.
↗ BleepingComputerCybersecurity agencies from the United States and eight allied countries issued a joint warning that Russian state hackers are actively targeting routers with weak or default configurations to break into critical infrastructure networks — things like power grids and water systems. Routers are often the forgotten front door: once an attacker owns your router, they can see everything passing through it. The warning urges organizations to patch and properly configure their network equipment immediately.
↗ BleepingComputerThe FBI, working with Google and other partners, seized hundreds of domains belonging to NetNut, a residential proxy network run by Israeli-listed company Alarum Technologies. Security researchers had connected NetNut to the "Popa" botnet — roughly two million compromised smart TVs and streaming boxes in people's homes. Cybercriminals rented access to those devices to hide their tracks while doing things like account takeovers and ad fraud. If you own a smart TV or streaming stick, this is a reminder to keep its firmware updated.
↗ Krebs on SecurityA new hacking toolkit called Forg365 is for sale on Telegram for $400 a month. It combines two sneaky techniques: device code phishing and adversary-in-the-middle interception. It uses AI to write convincing fake emails, sends them through legitimate services like Amazon SES and Twilio so they don't look suspicious, and then steals your Microsoft 365 login session — even if you have multi-factor authentication turned on. Because it piggybacks on real email infrastructure, standard spam filters often miss it entirely.
Three separate Evilginx-based Microsoft 365 phishing operations were also exposed this week after one attacker accidentally left their server wide open to the public. The largest campaign had been running quietly for over a year, stealing corporate email logins at scale.
Researchers at Huntress caught an attacker who, after breaking into a Windows server using stolen passwords, ran an AI-generated Active Directory enumeration script to map out the entire organization. The script had telltale signs of being written by an AI assistant — over-engineered comments, placeholder text, and a very tidy structure. This matters because it shows that criminals with limited technical skill can now use AI tools to carry out sophisticated reconnaissance that previously required real expertise.
Progress Software sent urgent emails to customers using ShareFile's on-premises file-sharing software, describing a "credible external security threat." The company is telling admins to shut down their servers immediately while a fix is prepared. ShareFile is used by businesses and law firms to share sensitive documents securely — so a vulnerability here could expose confidential files to outsiders.
Status: No patch available yet. Progress has instructed affected customers to take servers offline as a precaution. If your organization uses ShareFile Storage Zone Controllers, act now.
Hackers are actively exploiting a critical authentication bypass vulnerability in the official Gitea Docker image. Gitea is a self-hosted code repository platform — essentially a private GitHub that developers run on their own servers. An attacker who exploits this can walk right in without a password and access all the source code stored there.
Status: Update your Gitea Docker image to the latest version immediately. If you can't update right now, take the instance off the public internet.
Six vulnerabilities were found in U-Boot, a piece of software that runs when millions of embedded devices — routers, set-top boxes, network gear — first power on. Exploiting these flaws could let an attacker inject malicious code at the very start of the boot process, before any security software even loads. That kind of attack is extremely hard to detect or remove, sometimes surviving a full factory reset.
Status: Check with your device manufacturer for firmware updates. Consumer devices may take months to receive patches — prioritize network-exposed embedded devices.
Security researchers revealed a technique called "Ghostcommit" that hides malicious instructions inside a normal-looking PNG image file. When an AI-powered code review tool — like CodeRabbit or Bugbot — processes a pull request containing the image, the hidden instructions tell the AI agent to read the repository's secret configuration files and leak API keys and passwords by encoding them into the code itself. Both tools were fooled because they don't open image files, so they never saw the instructions hidden inside. This is a new category of attack called prompt injection, and it's a serious reminder that AI coding assistants can be tricked just like humans can. If your team uses AI code reviewers, treat their output as a starting point — not a final security verdict.
Australia's Cyber Security Centre issued an alert about attackers actively scanning the internet for websites running outdated content management systems (CMS) and vulnerable plugins. Once found, attackers compromise those sites and use them as launching pads for further attacks or to host phishing pages. This isn't a single hacking group — it's a broad, opportunistic global sweep targeting anyone who hasn't kept their website software up to date. If you run a website on WordPress, Joomla, or any similar platform, check that all plugins and themes are current.
A newly published Meta patent describes an AI system that listens to your voice throughout the day, analyses the tone and patterns of how you sound, and builds a timestamped log of your emotional state — pinning each reading to a time, location, and whatever you were doing on your phone at that moment. It's not a product yet. It may never be. But the fact that Meta filed for it tells us something important about where the company thinks the future of AI could go.
The patent (US 2026/0182881) was filed in December 2025 and published on July 2nd. It describes two main variations: one that listens continuously throughout the day, and one that checks in only at set intervals. The stated purpose in the filing links emotional tracking to fitness coaching — imagine an AI that notices you sound stressed and suggests a breathing exercise. That sounds helpful. But the same system that detects stress can detect anger, sadness, or political sentiment. The data it logs — your voice, your mood, your location, your phone activity, all timestamped — is an extraordinarily detailed personal profile.
For everyday people, the question isn't whether this specific patent becomes a product. The question is what you're agreeing to when you use always-on AI assistants. Voice data is uniquely sensitive. Unlike a typed message you can delete, the way your voice sounds reveals things you may never consciously share — your health, your emotional state, your stress levels. Most current voice assistant privacy policies allow companies to store and analyse voice recordings. Adding emotional inference on top of that is a significant step further.
Watch for this in the next 12–18 months: how regulators in the EU respond (the AI Act has provisions on "real-time biometric surveillance"), whether Apple or Google file similar patents, and whether Meta actually ships any product in this space. For now, the most practical thing you can do is audit which apps on your phone have microphone access and revoke it for any app that doesn't genuinely need to hear you.