Google bans Videostrong after 1.3M Android TV boxes found backdoored

Google dismantles XCPE botnet, revokes Videostrong’s Android TV license

Google and partners took down the XCPE botnet, which it says comprised more than 1.3 million Android TV streaming boxes that manufacturer Videostrong Technology intentionally infected to generate cybercrime revenue. Google attributes the botnet to Videostrong with high confidence, saying the backdoor was embedded in firmware during manufacturing and access sold to criminal affiliates for ad fraud, residential proxying and malware delivery. The takedown of command-and-control servers cut off at least 10 million additional compromised devices. Google terminated its relationship with Videostrong, revoked its license to build certified Android TV devices and banned the company and future affiliates. Japan’s National Police Agency and firms including Lumen, HUMAN Security, Plume, Synthient and TrendAI took part. The malware persists on infected devices and reinstalls from the /oem/ partition if removed.

Google disrupts million-device XCPE Android malware botnet, bans TV box maker →

Topics: GoogleMalware & infostealers

Ivanti patches two more Connect Secure zero-days chained in attacks

Ivanti released updates for two more Connect Secure remote access gateway flaws exploited in zero-day attacks since at least October 1. The flaws are CVE-2026-111357, a high-severity privilege escalation bug, and CVE-2026-118527, which lets authenticated attackers upload files on unpatched devices. Attackers chained both with an authentication bypass, CVE-2026-104935, which Ivanti patched in October. Volexity reported that a threat actor designated UTA0576 used the chain to gain unauthenticated root-level code execution on fully patched devices, deploying no malware but re-exploiting the device for each command and tampering with logs to evade Ivanti’s Integrity Checker Tool. CISA added CVE-2026-104935 to its catalog of actively exploited vulnerabilities and ordered federal agencies to patch by Friday. Shadowserver tracks over 5,000 internet-exposed ICS instances.

Ivanti patches two more Connect Secure zero-days chained in attacks →

Topics: Zero-day vulnerabilitiesPatch Tuesday & security updates

Cyberattack on fridge systems hits dozens of Belgian supermarkets

A cyberattack on refrigeration systems at dozens of Belgian supermarkets forced stores to discard around €100,000 worth of food. About 40 Delhaize supermarkets were affected, along with at least 15 Carrefour stores, five Spar shops and the butchery group De Laet en Van Haver. Belgian media reported fridge temperatures rose as high as 70°C. A Delhaize spokesperson said the company had identified an IT incident affecting refrigeration systems in several dozen stores, and problems were also reported at several stores of the Swedish chain ICA. The attack follows a similar one on 12 October in which hundreds of French supermarkets had their refrigeration systems tampered with. Research by Forescout found 12,976 exposed refrigeration management services on 6,017 internet addresses across 99 countries.

Supermarket hacks across Europe: why are fridges connected to the internet? →

Volta infostealer uses commercial LLMs to rank victims by value

A new Windows infostealer called Volta-Autodoxer uses commercial LLMs to gather information on potential victims and rank them by profitability. Volta harvests browser passwords, cookies, payment cards and cryptocurrency wallet seed phrases, plus Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles and screenshots. It builds a structured evidence bundle with geolocation, home address, employer and inferred birth year, then uses stolen Gmail tokens to search for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm the address. The bundle is sent to OpenRouter with a prompt casting the model as a forensic intelligence analyst, requiring a section ranking the victim’s assets by financial value. Cisco Talos researcher Ryan Fetterman noted the live enrichment pass sets Volta apart from commodity stealers.

Infostealer uses LLMs to compile dossiers on victims →

Topics: Malware & infostealersAI-powered malware

Apple warns users in 99 countries of mercenary spyware targeting

Apple sent threat notifications to users in 99 countries warning they may have been targeted by mercenary spyware attacks. German lawmakers and government officials began receiving the notifications the previous Thursday, prompting Germany’s Federal Office for Information Security to issue an urgent warning over the weekend, advising recipients to assume their device is no longer secure. The government said it was taking the incident very seriously and working flat out to investigate. Government spokesperson Stefan Kornelius declined to say whether Chancellor Friedrich Merz was among those affected. The attacks reportedly exploited a zero-click vulnerability, allowing devices to be compromised without any interaction, with knowledge of targets’ phone numbers all the hackers needed. It is unclear who is behind the attacks.

Apple recently notified users in 99 countries of potential mercenary spyware attacks →

Topics: AppleSpyware