Every week is a rough week in the infosec world, but two stories this week stood out, both indicative of a worrying trend in cybersecurity: Hackers are willing to target anyone, whether to make money or just to make a statement.
Let’s start with the money. The $6.3 billion Binance hack, the biggest crypto heist in history, has now been linked to North Korea, and it all traced back to a single laptop. The employee using it was duped by a fake job interview, a favorite North Korean tactic used both to trick companies into hiring operatives and to trick individuals into down malware. Binance says it can cover the losses through a mix of stablecoin freezes and its own reserves, but the hackers still walked away with an enormous haul.
The second major story this week was in Europe, but first, let’s step back a bit. Last month, hackers attacked connected temperature controllers that manage supermarket refrigerators in France, setting them to defrost across hundreds of stores and spoiling food. It was worrying, and another sign that anything connected to the internet is vulnerable. Then this week, another 40 supermarkets across several European countries were hit by a similar hack, raising temperatures in coolers and refrigerators as high as 122 degrees Fahrenheit. Two days later, attackers moved on to something far more serious: blood plasma storage facilities, where plasma must stay frozen to be usable in hospitals. Staff caught the attack in progress before any supply was damaged, but going from spoiled groceries to the blood supply is a big escalation.
This week we also covered the news that security researchers are warning people not to let Google’s AI generate their passwords. You would think a computer could generate secure passwords, but as we've tested, AI is terrible at password generation. Instead of using secure best practices, AI does what it always does: It tries to make you happy in the easiest possible way. That means it’ll use easily identifiable patterns to generate your passwords, or worse, recommend the same passwords to you and everyone else who asks. Trust us, just use a password manager. Even the free ones are better than AI at this.
Now then, let’s see what else is going on in the infosec world this week.
This Hacker Let AI Agents Attack 100+ Companies on Autopilot #
Let’s start this one with the stats: 1,200 break-in attempts at more than 100 corporate sites, including the likes of Cummins, John Deere, and SharkNinja, and about $5,000 worth of tokens—many of which were completely successful, and all of them conducted completely autonomously. Reuters reported the story first, noting that the hacker used a combination of Claude and DeepSeek over several weeks, starting in late September, to completely outsource the intrusion attempts to AI agents. With just a few instructions, the Chinese-speaking hacker told all the agents to simultaneously probe and break into the targeted sites, then left them alone to do their own thing.
A security researcher at NorForge, an AI security firm, published his findings about the hack and explained that while the hacker involved in this particular spree was the most prolific, they weren’t alone: Another managed to get credit card data from a victim site (which wasn’t named in the report), and another tried to rob a cryptocurrency exchange. The agent instructions were exceptionally brief, and each agent spent about a day searching targets for vulnerabilities before attacking the ones they found. All told, the hacker behind this case spent about $5,000 in tokens, or, according to the research team, about $50 per successful hack.
A Hidden Backdoor Put 1.3 Million TV Boxes to Work for Criminals #
You may not know this, but beyond the world of streaming boxes and sticks you’re likely familiar with is another, gray market of streaming devices that come preloaded with apps designed to make it easy to download and stream content entirely from pirate sites. We don’t test or recommend them because they’re almost universally prepackaged with malware (at worst) or spyware (at best). This week gave us a good example of why, as tempting as they may be, you should steer clear of them: Google’s Threat Intelligence Group announced it had discovered a massive botnet of these devices, totaling more than 1.3 million certified Android TV boxes from the device maker Videostrong Technology.
Here’s how it works: The boxes ship with the backdoor already installed and include a built-in “OEM” firmware partition that tracks any changes to the device. That way, if the backdoor is somehow removed, the box reinstalls it on the next reboot. The box can also turn off Google Play Protect verification, so it can install additional software without user intervention, which is exactly what Videostrong sold to cybercriminals, who used the backdoor to install their own malware on the boxes. The devices were then used as part of a residential proxy network, which routes other people’s traffic through the victim’s home network. The backdoored boxes could also, according to Malwarebytes, be used for ad fraud, spying on victims’ home networks, and other illegal activity that a criminal would want to offload to any network other than their own.
While Google and other authorities have shut down this particular botnet and proxy network, others remain, and backdoored sketchy hardware remains a risk, as prices for reputable hardware climb and cheaper, low-cost alternatives from unknown brands flood gray markets. In any case, make sure you buy from companies and brands you trust, and stay vigilant about the hardware you allow on your home network.
Ask Our Expert: What Happens If My Password Manager Gets Hacked? #
Do you have a question about online privacy or security? I'm here to help! You can submit your question here, and I may answer it in an upcoming SecurityWatch column and newsletter. If you're not subscribed to the newsletter, head here to sign up, and check back each week for the latest updates from PCMag's security team. Now, on to this week's question(s)!
Tommie L asks: “How secure are password managers really? I'm always nervous the info will get leaked.”
Mike W also asks: “There is a lot of talk about using a password manager to store your passwords. I use multiple computers and cell phones, and I am not sure how safe password managers are and how they sync between devices?”
Hi Tommie and Mike! Thanks so much for your questions. These topics come up frequently here at PCMag, and honestly, they're questions that I’ve been getting across my entire career.
While the companies that make password managers do a great job of telling you how much safer you’ll be with their products, many of them don’t really explain why. My colleague Kim Key just put together this great piece on what you need to know about password manager security and what to do if yours gets hacked. In short, hackers know very well that password vaults are treasure troves of valuable information, including account credentials, credit card details, and other sensitive information. But here’s the catch: Your actual vault, which contains all of your passwords and other data, is always heavily encrypted, and the only keys are either your master password (which you should make strong, secure, and unlike any other password you use) or whatever recovery method you’ve set up in the event you forget or lose your master password. Most password managers operate under zero-knowledge, meaning that even they can’t reset your password or get into your vault if, somehow, you lose the password yourself. That also means hackers can’t, even if they do manage to get a copy of it.
Plus, any good password manager is end-to-end encrypted, meaning your vault is encrypted everywhere it exists, whether it’s on your PC, laptop, smartphone, or in the cloud. Some companies are even boosting their encryption to be “post-quantum,” meaning that if quantum computing becomes a reality and old encryption methods become obsolete and easy to break, your data will still be safe. We have an explainer on that topic here. Even when your data is synced across devices (if your password manager does that), it’s still encrypted, meaning it's useless to anyone who might intercept it without the keys we mentioned.
All of that is to say that password managers from security companies (not necessarily the ones baked into your web browser or phone, which are better than nothing, but still not recommended) pride themselves on strong security for your actual vault.
That doesn’t, however, mean they’re immune to being hacked. LastPass, for example, has been breached a couple of times, but the attackers made off with contact data like names and email addresses, never vaults. And in cases where a password manager loses its encrypted vaults, the data is so heavily encrypted that, unless a hacker can guess your master password, you’re still safe.