Your TV Box Was Spying on You — Plus a $6.3B Crypto Heist and Two Critical Linux Bugs
Wednesday, November 4, 2026 · 5-minute read
Hackers targeted a refrigeration equipment provider used by France's national blood service, raising temperatures and triggering defrost cycles at three storage facilities. Stored blood products were put at risk. This is a stark reminder that cyberattacks on critical infrastructure can cause real, physical harm — not just data leaks.
↗ BleepingComputerAPT29 — the Russian spy group behind several high-profile breaches — has been quietly compromising websites and poisoning a Ukrainian web analytics tool called Plerdy SEO Tracker. Visitors to those sites on iOS or Android get hit with exploits that can steal browser cookies, Wi-Fi passwords, or even wipe their whole device. The campaign, dubbed "Poisoned Source," was uncovered by French researchers in mid-October 2026.
↗ The Hacker NewsNorth Korean hackers tricked a Binance employee into installing malware through what looked like a routine job interview. That malware gave the attackers a path into Binance's wallet systems, and they made off with roughly $6.34 billion in cryptocurrency — one of the largest crypto thefts ever recorded. It's a reminder that social engineering — not just technical hacking — is often the way in.
↗ BleepingComputerRussian hackers have infected legitimate websites and set up fake copycat sites. When you visit one on your phone, hidden code quietly checks your device type and fires off an exploit built for either iPhone or Android. The end goal is stealing your saved browser passwords, session cookies (which let attackers log into sites as you), and in some cases your Wi-Fi credentials. The attackers also compromised a popular Ukrainian web analytics script called Plerdy, turning it into a delivery mechanism — meaning even trusted, well-maintained sites could have been weaponized without their owners knowing.
The developers of the popular mobile game Goddess of Victory: NIKKE confirmed that attackers tampered with the game's PC launcher scripts in a supply chain attack. Anyone who ran the PC launcher during the compromise window may have had credentials and cryptocurrency wallet data stolen. The malware could also give attackers remote access to the victim's computer.
The APT package manager — the tool you use to install software on Debian and Ubuntu — has a serious flaw. If an attacker can intercept your connection while APT is downloading a package (a man-in-the-middle attack), they can swap a legitimate package for a malicious one. When APT retries the failed download, it installs the fake package with full admin (root) privileges — meaning the attacker's code runs with total control over your system. The flaw is triggered by a retry setting that is on by default in Debian 12 and Ubuntu 22.04 and later.
Status: Patch available. Run sudo apt update && sudo apt upgrade on your Linux machine today.
Ruby on Rails is a popular framework that powers countless websites and web apps. A critical flaw in how Rails handles file uploads — specifically when using an image-processing tool called ImageMagick — lets an attacker upload a specially crafted file and write any file they want to the server. In the worst cases, they can read the app's secret keys and use them to fully take over the server or pivot into connected systems. No CVE number yet, but Rails has released fixed versions 8.1.4.1 and 8.0.5.2.
Status: Patch available in Rails 8.1.4.1 and 8.0.5.2. If you run a Rails app, update immediately.
SonicWall's GMS software — used by businesses to manage their network security appliances — has two serious flaws. The first (CVE-2026-109593, score 9.1) lets anyone on the network read internal files without even logging in. The second (CVE-2026-109594, score 6.8) lets a logged-in attacker read or alter the system's database using a technique called SQL injection. The worst part: SonicWall says it will not release patches because this software has officially reached end of life.
Status: No patch — ever. SonicWall says organizations must upgrade to GMS 10 or later. If you're running GMS 9.5.2 or older, treat it as a live security breach waiting to happen.
Google's Threat Intelligence Group worked with industry partners to take down a massive botnet called XCPE, made up of over 1.3 million Android TV set-top boxes. The boxes came pre-infected with malware hidden by their Chinese manufacturer, Videostrong Technology, which sold access to criminals who used the devices to commit advertising fraud and rent out victims' internet connections. Google took legal action to seize the control servers, banned Videostrong from the Android ecosystem, and says it has plugged the gap that let manufacturers sneak malware past its security checks. The takedown is expected to cut off access to over 10 million additional compromised devices, including healthcare gadgets and karaoke machines running the same XCPE malware.
↗ Krebs on SecurityCheck Point Research has identified a new category of malicious software they're calling prompt adware. A jailbreak bundle for OpenAI Codex called "Haiou" secretly rewrites the AI agent's configuration to insert ads for the attacker's own paid AI service into every response the agent gives. It's essentially adware — but for AI assistants instead of web browsers. While this particular example is more annoying than dangerous, it signals a new frontier of abuse: AI tools that appear to work normally but have been secretly hijacked to serve someone else's interests.
↗ The Hacker NewsImagine buying a cheap Android TV box online, plugging it in, and unwittingly handing strangers access to your home internet connection — forever. That's exactly what happened to more than 1.3 million people around the world, and most of them had no idea. Today, Google and its partners finally pulled the plug on the operation.
The culprit is a Chinese manufacturer called Videostrong Technology. The company built malware directly into its TV boxes at the factory level — before they were ever shipped. The moment a customer powered on a new device for the first time, the malware quietly activated and "enrolled" that device in a network called the XCPE botnet. Videostrong then sold access to that network to criminal groups, who used the hijacked devices to do two main things: commit advertising fraud (faking clicks and video views to steal money from advertisers) and resell victims' home internet addresses through residential proxy services. When someone used your address as a proxy, any crime they committed online pointed back to you.
For regular people, the implications are unsettling. You might have bought one of these boxes — they're often sold cheaply on Amazon or AliExpress under various brand names — and never known it was working against you. Your internet might have been slightly slower than usual. You might have seen your data usage creep up. That's about it. Meanwhile, your home connection was being rented out to criminals, potentially being used for fraud, account takeovers, or worse. The same XCPE malware was also found in Android-based healthcare devices and digital signage systems, which raises even bigger concerns about patient data and public safety.
Google says it has now closed the loophole that allowed manufacturers to load malware after a device passes Google's initial security checks. The company also took legal action to seize Videostrong's control servers. But the broader lesson here is one for every consumer: the price tag on a device is not the only cost. Cheap, unbranded hardware from unknown manufacturers often comes with hidden costs — and sometimes those costs are paid in security. Stick to devices from well-known brands, check that Android TV products carry Google's official certification, and if you already own a cheap set-top box of uncertain origin, consider unplugging it until you can verify it's clean.