Your Streaming Box May Be Spying On You — Plus FortiBleed Hits 73,000 Devices
Tuesday, June 23, 2026 · 5-minute read
A campaign called FortiBleed used custom-built snooping software to quietly harvest login credentials from tens of thousands of Fortinet firewall devices. CISA issued an urgent alert on June 18 telling organizations to harden their Fortinet gear immediately. Security firm SOCRadar confirmed the attackers used a specialized sniffer planted directly on compromised devices to scoop up authentication secrets over time.
↗ BleepingComputerA data breach at a Texas government system exposed the personal information of more than three million people, including driver's license details. Breaches like this are dangerous because stolen ID data gets sold on criminal forums and used for identity theft or fraud. If you're a Texas resident, keep an eye on your credit reports and consider placing a free credit freeze with the major bureaus.
↗ BleepingComputerLastPass announced that hackers got into its Salesforce environment by stealing the company's OAuth tokens during the Klue supply chain attack earlier this month. The breach affects LastPass customer data stored in that Salesforce system. This is a reminder that even security-focused companies can be hit through a vendor they trust — the attack didn't break into LastPass directly, it came through a connected third-party platform.
↗ BleepingComputerAttackers are sending malicious files over WhatsApp that are disguised as invoices, contracts, or other business documents. When you open the file, a hidden VBScript kicks off a chain of events that quietly installs legitimate remote-access software on your computer. That gives the attacker full control of your machine without triggering most antivirus tools, because the remote-access program itself isn't considered malware. Targets have been found in Malaysia, Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, and Vietnam, with Malaysia hit hardest.
Three malicious packages were uploaded to npm, the package repository used by millions of software developers worldwide. They were disguised as tools related to PostCSS, a widely trusted CSS processing library. Any developer who installed them unknowingly got a remote access trojan (RAT) on their Windows machine. The packages were downloaded over a thousand times combined before being flagged. They're still live on npm as of today.
Attackers have been actively exploiting vulnerabilities in Fortinet's FortiGate firewall and VPN appliances to plant custom sniffers and steal login credentials. Over 73,000 devices are believed to have been compromised. CISA added this to its Known Exploited Vulnerabilities catalog and urged all organizations running Fortinet gear to act immediately.
Status: CISA alert issued June 18, 2026 — patches and hardening guidance available from Fortinet. Update and audit your devices now.
A flaw nicknamed PixelSmash was found in FFmpeg, the video-processing library built into apps like Jellyfin, Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio. On Jellyfin servers, an attacker could exploit it to run their own code remotely. On other apps, it can crash the program entirely. If you run any of these apps, an update is strongly recommended.
Status: Fix released — update FFmpeg and any apps that bundle it (Jellyfin, Kodi, OBS Studio, etc.).
A vulnerability chain called AutoJack was found in Microsoft's AutoGen Studio, a tool developers use to build and test AI agents. Simply visiting a malicious webpage could trick an AI agent running in AutoGen Studio into executing arbitrary commands on the host computer. Microsoft has patched the issue.
Status: Patched by Microsoft — update AutoGen Studio to the latest version.
OpenAI has released an upgraded AI model called GPT-5.5-Cyber to vetted security defenders as part of its Daybreak initiative. The model is designed to scan large codebases, identify security flaws, trace how an attacker could exploit them, and suggest tested fixes — all in one workflow. OpenAI is also updating its Codex Security plugin to speed up vulnerability discovery in existing software. The goal is to give defenders AI tools as capable as those that bad actors might already be building. Access is currently limited to trusted security researchers and organizations, not the general public.
GitHub has quietly fixed a long-standing security gap in its Actions CI/CD pipeline. Starting June 18, the official actions/checkout tool now refuses to run code from external pull requests in contexts that previously could grant those requests full repository permissions — a class of attack known as a "pwn request." This protects open-source projects from attackers who submit a fake code contribution just to hijack the automated build pipeline. The fix will be rolled back to older supported versions on July 16, 2026.
If you've ever bought a cheap Android TV box online — the kind that promises to stream hundreds of channels for a one-time payment of $30 — there's a real chance it's been doing something else on your home network without you knowing. Researchers this week tied a massive, four-year-old botnet called Popa to a commercial proxy business, and the implications for regular people are significant.
Here's how it works. These boxes come pre-loaded with streaming apps. Hidden inside those apps — or bundled with the device's firmware — is a piece of software that turns your home internet connection into a relay point. Anyone who pays a fee can route their web traffic through your IP address, making it look like their requests are coming from your house. Security firm Synthient traced active traffic from Popa devices directly to NetNut, a commercial residential proxy service run by Israeli company Alarum Technologies. NetNut denies knowingly operating a botnet and calls the devices "bandwidth sharing" tools — but the researchers say the software ran without meaningful user consent, and on devices that never disclosed what they were doing.
The real-world harm isn't hypothetical. In May 2026, a web scraping attack flooded organizations with requests scattered across more than 1.4 million IP addresses — many of them ordinary home internet connections belonging to people who had no idea their box was involved. That makes it nearly impossible for a website to block, because every request looks like it's coming from a different home in a different city. Your connection can also be used for account takeover attempts, ad fraud, or worse. And because the traffic comes from your address, you could theoretically face questions about activity you didn't know was happening.
The Popa botnet's control infrastructure was partially dismantled in July 2025 when Google, HUMAN Security, and Trend Micro took action against the related Badbox 2.0 operation. But researchers say new control domains were registered almost immediately after. The safest move right now: if you own an off-brand Android streaming box you bought from an unknown seller online, unplug it from your router. Stick with devices from known brands — Apple TV, Roku, or an Amazon Fire Stick — that have clear privacy policies and regular security updates.