Your Streaming Box May Be Spying for Criminals — Plus Two Linux Root Exploits
Friday, June 26, 2026 · 5-minute read
Two young men — Thalha Jubair, 20, and Owen Flowers, 18 — admitted in a UK court this week to hacking Transport for London's computer systems as part of the notorious Scattered Spider gang. Jubair is also accused by US prosecutors of being behind 120 separate network breaches that cost victims at least $115 million in ransom. The guilty pleas came on day one of what was expected to be a six-week trial — a dramatic early end that saved the court significant time.
↗ Krebs on SecurityPolish authorities arrested four members of a cybercrime group accused of hijacking people's phone numbers to steal cryptocurrency. The gang broke into telecom systems, took over victims' email accounts, and then used SIM swapping to intercept the one-time login codes that protect crypto wallets. The arrests are part of a broader crackdown on SIM-swap fraud across Europe.
↗ BleepingComputerResearchers found malicious code hiding inside popular software packages that developers use every day — including tools from the LeoPlatform ecosystem and the Verana Blockchain project. The supply chain attack is linked to a malware family called Miasma, and its goal is to steal developer login credentials and then spread further through other trusted tools. Dozens of specific package versions are confirmed infected — check the list from Socket if you use any Leo or hexo packages.
↗ The Hacker NewsAttackers are actively breaking into industrial software systems — specifically PTC Windchill, which companies use to manage product designs and manufacturing data. The bug (CVE-2026-12569, score 9.3) lets anyone on the internet send a specially crafted request that tricks the server into running their code. Once in, attackers are installing web shells — essentially hidden back doors — so they can return whenever they like. PTC released a patch last week, but confirmed on June 25 that attacks are still happening, meaning many servers remain unpatched and exposed.
A new attack targeting Mac users tricks them into running a command they copy from a fake error message — a technique called ClickFix. Once run, it silently mounts a disk image in the background and installs an infostealer — software that quietly harvests your saved passwords, browser data, and personal files. This variant is notable because it avoids the usual pop-up warnings macOS shows when you open new applications.
An attacker anywhere on the internet can send a malicious network request to a Windchill server and make it run their own code — no login required. The root cause is that the software processes untrusted data without checking whether it's safe first (deserialization of untrusted data). Windchill is widely used in manufacturing and engineering firms to manage product designs, making this a serious industrial security risk.
Status: Patch available as of last week — but active exploitation continues. Apply immediately.
This flaw, nicknamed "pedit COW," lets someone who already has a regular user account on a Linux machine quietly gain full root access. The trick is clever: instead of modifying a file on disk (which security tools would catch), the attack poisons the in-memory copy of a trusted system program and runs it. File integrity checks come back clean even while the attacker already has root. A working public exploit appeared within 24 hours of the CVE being assigned.
Status: Patch available from Red Hat and Debian. Requires unprivileged user namespaces to be enabled — sysadmins should check whether this is needed in their environment.
DirtyClone is another Linux privilege escalation bug in the same family as the famous Dirty COW vulnerability. An attacker with a regular local account can corrupt the memory of a privileged program by routing it through a network packet clone, then overwrite its security checks to get root. JFrog Security published a working exploit demonstration on June 25. The patch landed in the main Linux codebase on May 21 — so if your system hasn't updated since then, it's exposed.
Status: Patch is available in mainline Linux kernel. Update your kernel now if you haven't since May 21.
As companies deploy agentic AI — software bots that roam through company systems making decisions on their own — a serious security gap has opened up. These AI agents inherit user permissions and act at machine speed, but the identity management tools built over the past 20 years were designed for humans, not autonomous software. The "Guardian Agents" framework, detailed today, is a conceptual model for how companies can build oversight layers specifically designed to track, audit, and limit what AI agents can do. It matters because an AI agent with too many permissions is a massive attack vector — if it's manipulated or misbehaves, it can cause damage far faster than any human attacker. Security teams should start asking vendors: how does your AI agent model get audited?
Millions of people have bought inexpensive Android TV streaming boxes — the kind sold online for $30–$60 that promise to unlock hundreds of paid streaming services for a one-time fee. It turns out many of those boxes come with a hidden extra feature: they silently enroll your home internet connection in a massive criminal network.
Researchers this week confirmed that a botnet called Popa — linked to a residential proxy service operated by a publicly traded Israeli company called Alarum Technologies — has quietly commandeered over a million of these cheap TV boxes. Here's what that means in plain terms: when your box is plugged in, strangers can route their internet traffic through your home connection. To the outside world, their requests look like they're coming from you. This has been used for advertising fraud, account takeovers, and large-scale data scraping attacks. One investigation found attackers were hammering a single website from over 1.4 million different home IP addresses — and many of those addresses belonged to unsuspecting streaming box owners.
The Popa botnet is a plugin of the larger Vo1d botnet and hides inside pirated or modified streaming apps — things like CRICFy, DooFlix, and Sprozfy — that people install to watch sports or movies for free. The troubling part is that some of these proxy networks don't block their customers from accessing other devices on your home network, meaning your laptop, smart thermostat, or home security camera could also be reachable by whoever's paying for the proxy service.
The takeaway is simple but uncomfortable: if your streaming device was cheap, came from an unknown brand, and promised free access to paid content, it may already be working against you. The FBI has warned about this repeatedly. Stick to devices from established manufacturers — Apple TV, Roku, Amazon Fire, Google Chromecast — and never sideload apps from sources outside official app stores. If you already own one of these boxes, consider replacing it or at minimum isolating it on a separate guest Wi-Fi network so it can't reach your other devices.