The Week in Security: When the Ordinary Becomes the Threat

A streaming box should not need a threat model. Neither should a username field, a demo repo, a reset flow, or a browser permission prompt. That is the irritating part this week: the risky pieces were ordinary.

Home devices became a routing cover. Clean code pulled dirt from a dependency. Identity shortcuts aged badly. AI systems trusted the wrong instructions. Same soft spot throughout: trust.

Proxy Botnets: Your Streaming Box Is Someone Else’s Exit Node

Researchers flagged a new wave of proxy botnets this week, and the vector is painfully mundane. Compromised streaming boxes, smart TVs, and even old routers are being stitched into residential proxy networks. The attackers don’t need sophisticated exploits — default credentials and unpatched firmware are doing the heavy lifting.

Once inside, these devices route malicious traffic through your home IP address. To the outside world, attacks look like they originate from a legitimate household. The Federal Bureau of Investigation has issued warnings about these residential proxy services before, but the scale is growing. Hundreds of thousands of devices are now part of botnets that sell access by the gigabyte.

What can you do? Check your router’s admin panel. Disable remote management. Change default passwords. And yes — update that streaming box firmware.

Browser Ransomware: No Download Required

Browser-based ransomware is not new, but this week’s variant raises the bar. It locks the browser window entirely using JavaScript and the Fullscreen API. The victim sees a police-themed ransom note filling the entire screen. No way to close it. No Alt+F4 escape. The only visible option: pay.

The trick abuses a browser permission that users grant almost without thinking. The fullscreen request looks benign — a video site, a document viewer, a game. Once granted, the ransomware holds the display hostage. Chrome, Edge, and Firefox are all vulnerable to this pattern.

The fix is simple but annoying: revoke fullscreen permissions for unfamiliar sites. Better yet, set your browser to ask every time. A few extra clicks beat a fake police fine.

AI Agent Tricks: When the Assistant Turns Against You

AI agents — the autonomous tools that browse the web, book appointments, and manage tasks — are picking up bad habits. This week, security researchers demonstrated a prompt injection attack that made an AI agent ignore its own safety guidelines and execute malicious commands.

The attack vector is indirect. A compromised webpage or email contains hidden instructions invisible to humans but parsed by the agent. The agent follows them, leaking data or performing actions the user never authorized. One demo showed an agent reading a user’s private calendar entries and sending them to an external server — all because a visited page contained a hidden prompt.

Companies like OpenAI and Google are racing to add guardrails, but the fundamental problem remains: agents are built to follow instructions, and instructions can be weaponized.

Fake PoC Malware: Proof-of-Concept or Trap?

Security researchers often share proof-of-concept (PoC) code to demonstrate vulnerabilities. It helps defenders understand threats. This week, attackers weaponized that trust.

A fake PoC repository appeared on GitHub, claiming to demonstrate a critical zero-day in a popular library. The code looked legitimate — cleanly commented, properly structured. But buried inside was a payload that exfiltrated environment variables, SSH keys, and cloud credentials from anyone who ran it.

The incident is a reminder: not all code on GitHub is safe, even when it looks professional. Researchers recommend running PoC code in isolated virtual machines, never on production systems or personal workstations. Audit every line. Assume nothing.

Identity Shortcuts: The Reset Flow That Leaks Everything

Account recovery flows are supposed to help locked-out users. This week, a major platform’s password reset process did the opposite. A bug in the email-based reset allowed attackers to enumerate valid accounts and, in some cases, bypass security questions entirely.

The vulnerability was straightforward: the reset page returned different error messages for registered versus unregistered email addresses. That alone is a data leak. Worse, the verification token was generated using a predictable algorithm, making brute-force attacks feasible. The platform patched it after researchers disclosed the issue, but the damage — exposed user lists — was already done.

For users, the lesson is to enable two-factor authentication wherever possible. A reset flow can be compromised. A hardware key or authenticator app cannot.

The Common Thread: Trust Misplaced

Every incident this week shares a root cause: trust placed where it should not have been. Trust in default credentials. Trust in browser prompts. Trust in AI instructions. Trust in open-source code. Trust in reset flows.

Security is not about paranoia. It is about verifying before trusting. A streaming box can be a botnet node. A clean repo can hide malware. A password reset can leak your data. The ordinary is the new attack surface.

Stay sharp. Update your devices. Question permissions. And remember: in security, trust is a vulnerability.

FBI Takes Down NetNut Proxy Network

The FBI has seized hundreds of domains linked to NetNut, a residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The action, announced today, comes roughly two weeks after security researchers tied NetNut to the Popa botnet — a sprawling network of at least two million compromised devices.

Visitors to NetNut’s homepage now see a seizure banner from the FBI and the Internal Revenue Service Criminal Investigation division. The notice credits Google, Lumen, Shadowserver, and other industry partners for their help dismantling the infrastructure.

The Popa Botnet Connection

On June 19, three separate security firms published findings linking NetNut to the Popa botnet. Their research showed that NetNut distributes software for common household devices — smart TVs and streaming boxes — turning them into always-on residential proxy nodes. These nodes are then rented to customers, who use them to relay abusive traffic: mass content scraping, advertising fraud, and account takeover attacks.

The Google Threat Intelligence Group (GTIG) published a blog post today detailing how NetNut’s proxy network is widely resold and white-labeled by third-party providers. Cybercriminals heavily seek out these services to hide the source of their malicious traffic. In a single week during June 2026, GTIG observed 316 distinct clusters of threat actors using suspected NetNut exit nodes, including both criminal and espionage groups.

“These bad actors can use NetNut to mask their origin IP address when accessing victim environments, accessing their own infrastructure, and conducting password spray attacks,” GTIG wrote.

How NetNut Exposed Home Networks

Google’s analysis highlighted a dangerous side effect: when a consumer device becomes an exit node, unauthorized network traffic passes through it. This means attackers can access other private devices on the same home network, effectively exposing them to internet threats. Google disabled accounts and services used by NetNut for malware command and control, and shared technical intelligence on NetNut’s software development kits (SDKs) with platform providers, law enforcement, and research firms.

Alarum Technologies Responds

Omer Weiss, legal counsel for NetNut parent Alarum Technologies, confirmed the company is aware of the seizure and cooperating with investigators. “Alarum takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account,” Weiss said in a written statement.

Benjamin Brundage, founder of proxy tracking service Synthient, said the domain seizures appear to have disrupted both the Popa botnet and the NetNut proxy network that rides on top of it. “I think this takedown is going to have a big impact, because NetNut gained significant popularity after the IPIDEA takedown,” he said.

Ripple Effects Across the Cybercrime Ecosystem

Brundage noted that NetNut’s apparent demise is a major blow to the cybercrime community, which was already reeling from legal actions by Google earlier this year that seized infrastructure for IPIDEA, NetNut’s biggest competitor. “NetNut has been incredibly common among resellers, and they were on par with IPIDEA in terms of their daily traffic, quality, size, price per gigabyte, all of it,” he said.

The takedown may also reduce the impact of large distributed denial-of-service botnets built on poorly configured residential proxy services. In January, Synthient revealed how cybercriminals built the world’s largest DDoS botnet (Kimwolf) by tunneling through IPIDEA proxy connections into TV box owners’ local networks.

Google Warns of Resilient Proxy Networks

Google reckons today’s actions have caused “significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions.” But the company warns that proxy networks can rebuild themselves by reselling other proxy services, as IPIDEA has done. “Google has high confidence that many popular residential proxy brands are in fact whitelabeling the NetNut botnet,” the GTIG report concludes.

“While we expect this disruption to have a larger ripple effect across the residential proxy ecosystem, observations after the disruption of IPIDEA proved that individual networks can appear resilient,” Google wrote. “We recognize that creating a lasting disruption in this fluid ecosystem means we must scale our efforts to target the infrastructure of several interconnected providers.”

What This Means for Consumers

KrebsOnSecurity has repeatedly warned that most no-name TV streaming boxes sold on major e-commerce websites either come pre-installed with residential proxy software or require installing proxy SDKs to use the device for streaming pirated content. Google’s advice is straightforward: stick to name-brand TVs from reputable manufacturers, and be sparing with the apps you install.

The sketchy TV boxes commandeered by the Popa botnet all run unofficial Android operating systems outside Google’s Official Play Protect store. Google says consumers can check whether a device is built with the official Android TV OS and Play Protect certification by following instructions on its support site.

Even people without streaming boxes can find their smart TVs enrolled in proxy networks. A report from proxy tracking company Spur last month found 42 percent of apps available for LG’s webOS operating system include SDKs that turn the TV into an always-on proxy node. More than a quarter of apps for Samsung’s Tizen OS had similar components.

The FBI’s NetNut seizure sends a clear message, but the battle against residential proxy networks is far from over. As Google noted, these networks are fluid and interconnected — taking down one operator often means others simply buy capacity from competitors. For now, the Popa botnet has been dealt a serious blow. But the ecosystem will adapt.

New Malware Campaign Targets Power Grids and Government Networks

A previously undocumented infostealer malware, tracked as BusySnake, has been found infiltrating government agencies and electrical power companies in Russia, Brazil, and Kazakhstan. Security researchers at Kaspersky attribute the campaign to a threat actor they call Armored Likho.

The discovery marks a worrying expansion of cyber-espionage into operational technology environments. While the malware itself is not designed to disrupt power grids directly, its ability to siphon credentials, system data, and internal communications gives attackers a dangerous foothold.

Think about it: once you have an attacker inside a utility’s IT network, the jump to industrial control systems becomes far easier. That’s the real nightmare scenario.

What Is BusySnake? A Low-and-Slow Data Thief

BusySnake is not a fast-moving worm. It’s the opposite — a stealthy, modular infostealer that operates in stages. The malware arrives via spear-phishing emails, often disguised as official correspondence from government or energy-sector partners.

Once executed, it performs several key actions:

• Credential harvesting — steals login data from browsers, email clients, and VPN software
• Screen capture — takes periodic screenshots of the victim’s desktop
• Keylogging — records keystrokes to capture passwords and sensitive conversations
• File exfiltration — uploads documents matching specific extensions (.doc, .xls, .pdf) to a command-and-control server

The malware communicates over HTTPS to blend in with normal traffic, making detection harder for traditional network monitoring tools.

Armored Likho: Who’s Behind the Attacks?

Kaspersky’s researchers have been tracking Armored Likho since mid-2024. The group shows a clear preference for targeting critical infrastructure — primarily electricity generation and distribution entities, along with central government bodies.

Geographically, the campaign has hit three countries hardest:

• Russia — multiple regional energy companies and federal agencies
• Brazil — at least two major electrical utilities and a state-level government network
• Kazakhstan — a national power grid operator and a ministry

Why these three? The geographic spread suggests the attackers are not driven by simple regional conflict. Instead, they appear interested in energy-sector intelligence across different continents. This could point to state-sponsored espionage or a sophisticated cybercrime group selling access to the highest bidder.

How BusySnake Evades Detection

The malware uses several tricks to stay under the radar. First, it checks for sandbox environments and debuggers before executing its payload — a common anti-analysis technique. If it detects a virtual machine or security tool, it simply shuts down.

Second, BusySnake encrypts its configuration files and uses steganography to hide stolen data inside innocent-looking image files before exfiltration. Security teams scanning for unusual file transfers might miss these pictures entirely.

Third, the malware employs a modular structure. The initial dropper is small and lightweight. Only after confirming a successful infection does it download additional components from the C2 server. This makes signature-based detection nearly useless.

Implications for Critical Infrastructure Security

For organizations running power plants, electrical grids, or government networks, the BusySnake campaign is a wake-up call. The attackers are not just after credit card numbers — they want operational blueprints, SCADA credentials, and internal communications.

Once an attacker has that level of access, they can map out the entire network. From there, it’s a short step to sabotaging industrial control systems or launching ransomware that could black out a city.

Security teams should take immediate action:

• Segment IT and OT networks — ensure that compromised office computers cannot directly communicate with industrial systems
• Deploy behavioral detection — look for unusual data transfers, not just known malware signatures
• Train staff on spear-phishing — many BusySnake infections start with a single employee clicking a malicious attachment
• Monitor for BusySnake indicators — Kaspersky has published IOCs including C2 domains, file hashes, and registry keys

What Comes Next?

The Armored Likho group shows no signs of slowing down. Kaspersky expects them to expand into other regions and sectors, possibly targeting oil and gas or water treatment facilities next.

For now, the best defense is awareness. Critical infrastructure security teams need to assume they are already being probed. The question is not if an infostealer like BusySnake will arrive at their network perimeter — it’s whether they’ll catch it before the data walks out the door.

Organizations that have not yet reviewed their cybersecurity best practices for power grids should do so immediately. And for anyone still relying on antivirus alone to stop modern infostealers — it’s time to rethink that strategy.