Brahim

Software Engineer | I uncover the stories behind hackers, tech, business & the internet.

[Brahim @IBthecoder]

Welcome.

Not every interesting story makes the headlines.

Here you’ll find stories about hackers, technology, history, crime, business, and the people behind them.

If you’re curious, you’ll fit right in.

[Brahim @IBthecoder]

A trusted Windows program was turned into a tool for delivering malware.

And the attackers didn't need to modify the original program.

On October 19, 2026, Siemens confirmed that hackers were actively exploiting a vulnerability in Siemens Software Center.

Here's how it happened.

First, the attackers used a technique called ClickFix.

You visit a website and see a fake verification prompt, error message or instruction telling you to copy a command and run it on your computer.

You think you're fixing a problem.

But you're actually helping the attackers execute their attack.

In this campaign, the attackers bundled a genuine, digitally signed copy of Siemens Software Center with malicious files.

The problem was a vulnerability in the older version of the software.

When the program started, it could load a malicious DLL placed beside it without properly checking that file.

A DLL is a file containing code that another program can use.

The attackers abused that behaviour to make a legitimate program execute their malicious code.

This technique is called DLL sideloading.

And here's what makes this interesting.

The original Siemens program was genuine. Siemens said its official software distribution channels had not been breached.

The attackers were abusing the trusted program outside those channels.

What should you learn from this?

Never paste commands from a random website into PowerShell or the Windows Run box just to prove you're human.

Download software from official websites, not unfamiliar download pages or suspicious links.

Don't assume a digitally signed file makes an entire download package safe.

Keep your applications updated. Siemens fixed this vulnerability in Software Center version 4.0.9.8 and later.

If you have already run a suspicious command, take it seriously. Seek help securing the device and change important passwords from a clean device if your information may be exposed.

The bigger lesson?

Cybercriminals don't always need to make a fake program look real.

Sometimes, they use a real program to make their attack look trustworthy.

The software you trust can still be abused. Pay attention to what you're being asked to run.

Sources:
Siemens official security report: https://t.co/1EZ9fjoH8C
The Hacker News: https://t.co/3zZWLcmD3S

[Brahim @IBthecoder]

A fake Microsoft warning can be the beginning of a cyberattack.

And the person pretending to help you fix it may be the one trying to hack you.

On October 19, Dark Reading reported on researchers who investigated a long-running tech support scam operation impersonating Microsoft.

Here’s how it works.

You visit a compromised website or encounter a malicious ad or link.

You’re redirected to a page showing frightening Windows warnings. Your browser may appear frozen, with loud alerts telling you your computer is blocked.

The warning tells you to call a support number to fix the problem.

Someone answers, claims to be Microsoft support, and guides you through the supposed solution.

They ask you to install remote-access software, such as UltraViewer.

That last step is where things get dangerous.

Remote-access software can let another person control your computer. If you give that access to a scammer, they may be able to access files, steal information, or carry out further attacks.

Researchers at Infoblox actually called one of the numbers and recorded a conversation with someone posing as Microsoft support.

When the researcher questioned why they needed to install additional software, the call ended.

But there’s more.

The operation, known as Help TDS, has been active since at least 2017. Researchers linked it to a Russian-language affiliate network called Hotejka.

Since April 2026, the operation has abused thousands of Cloudflare Pages domains. Infoblox detected more than 20,000 such domains over six months, with roughly 300 new pages generated daily.

Why should you care?

Because this isn't just about a fake warning. Criminals are using the warning to convince victims to hand over access to their own devices.

Here’s how to protect yourself:

• Never call a phone number displayed in a sudden browser security warning.

• Never install remote-access software because an unexpected caller tells you to.

• If your browser freezes, try Esc or Alt + F4 on Windows. If necessary, close the browser using Task Manager. Don't follow the warning's instructions.

• If you already granted access, disconnect the device from the internet, contact a trusted security professional, and change important passwords from a different, clean device. Contact your bank if financial information may have been exposed.

Remember: a frightening warning is not proof that your computer has been hacked.

The real danger may be the person convincing you that they are there to save you.

Sources:
Dark Reading: https://t.co/74uNnncpgl

Original research by Infoblox: https://t.co/Cpz4DQQtwe

[Brahim @IBthecoder]

@Bank_Rupt_Bruh I agree ☝️

[Brahim @IBthecoder]

You might be one Google search away from installing malware on your computer.

And the website could look like ChatGPT or Claude.

On October 15, The Hacker News reported on a growing scam where attackers impersonate popular AI tools to trick people into downloading malware.

Here’s how it works.

You search for Claude or ChatGPT.

You find a website that looks official and click Download.

Instead of giving you a normal installer, the website tells you to copy a command and paste it into Windows PowerShell.

You follow the instructions, thinking you're installing an AI tool.

But that command can secretly download malware designed to steal your passwords, browser sessions, and other sensitive information.

The scary part? The website may look convincing, and you might not realise anything is wrong.

According to https://t.co/lv0MD80kxa, researchers linked 1,258 public sandbox analyses to fake AI campaigns between April and October 2026.

So, how do you protect yourself?

Download AI apps only from their official websites.
Never paste commands into PowerShell or Terminal just because a website tells you to.
Don't trust a website simply because it appears at the top of Google search results.
If you've already run a suspicious command, take it seriously. Secure your accounts from a trusted device and get the computer checked.

One thing to remember:

A website doesn't have to look suspicious to be dangerous.

And just because you're using a popular AI brand doesn't mean you're on the real website.

Source: https://t.co/uYhOYYFdGT

[Brahim @IBthecoder]

One compromised login exposed California students' personal records.

Millions of students could be affected.

And the scary part? The attackers didn't need to break through every security system. They used a login credential that had already been compromised.

On October 19, SecurityWeek reported a data breach involving Educational Testing Service (ETS), an organization that handles state-mandated testing for California schools.

Let's talk about what actually happened.

First, what was ETS doing with students' data?

ETS works with California's Department of Education to support statewide testing programs.

To exchange student assessment records with the department, ETS used a system called SFTP.

SFTP stands for Secure File Transfer Protocol. Think of it as a protected digital delivery system that allows organizations to transfer files between computers.

But here's the problem: even a secure file-transfer system can be abused if someone gets access using valid login credentials.

How did the breach happen?

According to the official investigation:

September 25, 2026: ETS detected unauthorized activity on its file-transfer system.

But the intrusion had started much earlier.

Investigators found that someone used a compromised login credential to access the system at different times between May 22 and September 18.

The intruder copied files containing California student information.

That means the activity went on for months before it was detected.

But how did the attacker get the login details?

This is where we need to be careful.

The official disclosure has not explained how the credentials were compromised.

It could be tempting to blame phishing, password theft or another attack method, but there is no confirmed evidence identifying the exact cause.

What we know is that the attacker had access to a legitimate login credential and used it without authorization.

This is one reason stolen credentials are so dangerous: an attacker can appear to be a legitimate user.

What information was exposed?

The copied records may include:

• Students' names, dates of birth and home addresses.

• Their schools, districts and grade levels.

• Student identification numbers.

• Race or ethnicity, primary language and country of origin.

• Disability status and testing accommodations.

• English proficiency information and test registration or results.

Not every student's record contained all these details.

The official notice says Social Security numbers, passwords, financial account details and parents' or guardians' personal information were not involved.

How many people were affected?

The exact number has not been publicly confirmed.

However, the incident affects more than just current students. The official notice says it may include students who attended California public schools in recent school years, as well as former students who left as far back as 2006 without a confirmed transfer recorded by the department.

Millions of records could be involved, but we should not mistake California's total student population for a confirmed number of victims.

What happened after the breach was discovered?

ETS disabled the compromised account and took the affected file-transfer site offline.

It began building a replacement system with stronger security controls.

The company also worked with law enforcement and cybersecurity experts. As of the official update, monitoring had not found evidence that the stolen information had been published publicly.

Affected current and former students are being offered two years of free identity-protection services.

What can we learn from this?

This incident is a reminder that cybersecurity is not just about preventing hackers from breaking into a system.

It's also about protecting accounts, limiting what each account can access, monitoring suspicious activity and detecting abuse quickly.

For organizations:

• Use multi-factor authentication wherever possible.

• Give accounts access only to the information they need.

• Monitor login activity and unusual file downloads.

• Review access permissions regularly.

• Alert security teams when an account behaves differently from normal.

For everyday users, remember that personal information can be used to make scam messages more convincing.

If someone knows your school, name, location or other personal details, that does not automatically mean their message is legitimate.

Verify unexpected requests before sharing more information.

The biggest lesson?

A system can have security protections and still be compromised when an attacker gains access through a legitimate account.

And sometimes, the longer an intrusion goes unnoticed, the more information an attacker has time to copy.

Source: California Department of Education
https://t.co/SaVi0Ev4kZ
Report: SecurityWeek, October 19, 2026.

[Brahim @IBthecoder]

One hacker. A few thousand dollars. More than 100 companies breached.

And AI did most of the work.

Reuters reported today that a hacker used AI agents to attack websites belonging to companies including Deere, SharkNinja and Cummins.

Here’s what makes this different.

The hacker didn't have to sit in front of a computer and manually test every website.

They gave AI agents instructions and let them work for hours, searching for weaknesses and figuring out how to exploit them.

According to cybersecurity researcher Snorre Fagerland, the campaign attempted to break into more than 1,200 websites.

The estimated AI processing cost? Around $5,000.

Some attacks reportedly took about 23 hours to succeed.

Think about what this means.

AI is making it easier for one person to automate work that would otherwise require significant technical skill and time.

And this isn't just a problem for big companies.

If you own a website, run an online store, or build websites for clients, your application could become a target.

So, what should you do?

• Keep your website, frameworks and plugins updated.
• Use multi-factor authentication for admin accounts.
• Don't expose admin panels or sensitive services unnecessarily.
• Monitor your website for unusual activity.
• Regularly test your application's security and fix vulnerabilities.

As developers, we need to stop thinking that building a website is only about making it look good and work properly.

Security is part of the job.

AI can help us build faster. But attackers can use it to find weaknesses faster, too.

The question is no longer just whether your website works. It's whether it can withstand someone actively trying to break it.

Source: https://t.co/R5Y7QSagpU

[Brahim @IBthecoder]

Your phone might be telling strangers more about your life than you realise.

And no, I'm not talking about hackers breaking into your phone.

I'm talking about something that can happen through ordinary apps.

Think about it.

You download a weather app, a game, or an app that helps you find places.

It asks for your location. You tap “Allow” because you want to use it.

But here's what many people don't know:

Some apps can share your location data with other companies, including companies you've never heard of.

And this isn't just a theory.

In 2024, the US Federal Trade Commission took action against companies accused of collecting and selling people's location data. That data could reveal visits to hospitals, places of worship, and other sensitive locations.

Source: https://t.co/ct25le4YOr

Now think about what your location history can reveal.

If someone repeatedly sees a device at the same place every night, they may work out where its owner lives.

If that device regularly appears at an office every weekday, they may work out where the person works.

And if it visits certain places regularly, it can reveal details about that person's habits and private life.

Even when your name isn't attached, location records can sometimes be linked to other information to identify you.

So, what can you do?
1. Open your phone's settings and check which apps have access to your location.
2.Ask yourself: Does this app really need to know where I am?
3.Allow location access only while using an app when that option is available and suitable.
4.Use approximate location instead of precise location when an app doesn't need your exact position.
5.Remove location permission from apps that have no good reason to use it.

On iPhone, check Settings → Privacy & Security → Location Services.

On Android, look for Settings → Location → App location permissions. The exact names may differ depending on your phone.

Remember, location access isn't automatically bad. Maps need it to guide you. But a simple game may not need to know your exact location.

The problem isn't just where your phone can find you.

It's who gets access to that information, how it's used, and what it can reveal about you.

Your phone knows where you go. Do you know which apps you've allowed to follow you?

Check your settings today. And share this with someone who has never thought about it.

[Brahim @IBthecoder]

“Facebook disabled my account for suspicious activity” — but the suspicious activity started with one click.

Someone reached out to me on X, asking if I could help recover their hacked account.

I asked what happened.

Their story was a reminder of how easily people can lose accounts they use every day.

They received an email that looked like a suspicious login alert from Facebook. They clicked the link.

Facebook later disabled the account for suspicious activity.

I asked for a screenshot of the email so I could investigate. They couldn't access the account anymore, and the email had been deleted because they thought it was spam.

I couldn't verify exactly what happened, but the story raises an important question:

Here's what everyone needs to understand, especially if you're not into tech.

1. A familiar logo doesn't prove an email is genuine. Scammers can copy Facebook's branding, colours and email layout to make fake alerts look real.

2. An email can look urgent without being legitimate.
“Your account will be disabled in 24 hours” is the kind of message designed to make you panic and click before thinking.

3.A link can look trustworthy but lead somewhere dangerous. A fake Facebook login page can look almost identical to the real one. Enter your password there, and you may have just handed it to an attacker.

4.Facebook can send legitimate login and security alerts. The trick is knowing how to verify them. Instead of clicking the email link, open the official Facebook app or type https://t.co/U9rMe0ydpS into your browser yourself. Check your account notifications and security settings there.

5.Never share your password or verification code with someone claiming to help you. Even a genuine-looking support message can be a trap.

6.Don't delete suspicious emails immediately if you may need to investigate them. Don't click anything in them. Keep the message long enough to inspect the sender and report it as phishing. If you've already clicked, don't panic act quickly to secure your account.

If you've already entered your password on a suspicious page, change it through the official website or app, secure the email account connected to Facebook, enable two-factor authentication, and review active sessions. If you're locked out, use Facebook's official recovery page: https://t.co/ffXio1gCkT

And please understand this: being a victim doesn't mean you're stupid. These scams are designed to fool people. But learning how they work can stop the next attempt from succeeding.

Now I'm curious: How did you lose access to your first hacked account?

Was it a fake login link, a code you shared, a suspicious app, or something else?

Share your experience. Someone reading it might recognise the same trick before it's too late.

[Brahim @IBthecoder]

Your data doesn't always get exposed because the company you use was hacked.

Sometimes, the weakness is in a company that handles your data on its behalf.

A Japanese entertainment company, Daiichi Kosho, has warned that personal information belonging to approximately 8.6 million customers and 93,000 employees may have been exposed after malware infected a device used by its data-handling contractor.

The information potentially affected includes names, dates of birth, email addresses and phone numbers.

Payment information and passwords were not reported as exposed.

The company also says there is currently no confirmed evidence that the information was leaked externally or misused.

But here's why this matters.

You can trust a company with your information, yet that company may share it with contractors, service providers or other businesses.

Every additional party handling your data creates another potential point of failure.

And if your email address or phone number gets into the wrong hands, criminals can use it to send convincing messages pretending to be your bank, employer or a service you use.

What can you do?

• Be suspicious of unexpected messages using your personal details.
• Never share an OTP because a caller or message asks for it.
• Verify unusual requests through the company's official app or website.

Your data can be at risk even when you did nothing wrong.

Source: https://t.co/66gmIbxMUl

[Brahim @IBthecoder]

A PDF file can be more than a document.

A newly reported security flaw in Ghostscript could allow attackers to run malicious commands on vulnerable servers by getting them to process a specially crafted file.

Ghostscript is software used to interpret and convert document formats, including PostScript and PDF-related files.

The danger is called remote code execution.

In simple terms, it means an attacker may be able to make a computer run commands without having normal access to it.

This is especially concerning for businesses that automatically process documents uploaded by customers.

An innocent-looking file could become the entry point for an attack.

One important distinction: this is not proof that every PDF is dangerous, or that simply opening any PDF will hack your device.

The risk depends on the vulnerable software and how the file is processed.

The lesson?

Keep your software updated, and don't assume a file is harmless just because it looks familiar.

Sometimes, the danger isn't what a document says.

It's what the software does when it reads it.

Source: https://t.co/do21qRaqW2

[Brahim @IBthecoder]

Imagine buying a device to protect your money, only to discover someone may have tampered with it before you bought it.

That's the warning from a recent cryptocurrency security incident.

Ledger, a company that makes physical crypto wallets, asked distributors across several Asian markets to stop selling devices while it investigated tampered wallets.

According to reports, some modified devices contained a hidden component capable of stealing the owner's 24-word recovery phrase and transmitting it to an unauthorized party.

What's a recovery phrase?

It's a set of secret words that can restore access to your crypto wallet. If someone gets those words, they may be able to steal your funds.

Here's the scary part:

The device could look legitimate while the hidden hardware did its work.

What should you learn from this?

• Buy security devices from trusted, authorized sources.
• Never share your recovery phrase with anyone.
• Never enter it into a website or app just because someone tells you to.
• If you suspect your wallet has been tampered with, don't enter your recovery phrase into that device.
We spend so much time worrying about hackers breaking into our devices.

But what happens when the device itself cannot be trusted?

Source: https://t.co/rPOvkykqb9

[Brahim @IBthecoder]

Over 1 billion malicious messages.

That is how many phishing messages were linked to a cybercrime network disrupted by Microsoft and its partners.

And these weren't all obvious scam messages.

The criminals used tools that imitate trusted organizations, including banks, government agencies, delivery companies and familiar online services.

Some platforms even offered thousands of ready-made templates to make the scams look legitimate.

The operation targeted more than 75,000 organizations across 150+ countries.

Why does this matter to you?

Because a message can look official, use a familiar logo and still be designed to steal your password or banking details.

Before you click that link:

• Check the actual website address.
• Never share your OTP or password through a link in a message.
• If a message claims your bank or account has a problem, open the official app or website yourself.
A familiar logo is not proof that a message is genuine.
Scammers are professionalizing fraud. We need to get better at spotting it.

Source: https://t.co/ef3JrEMAGa

[Brahim @IBthecoder]

Someone could be recording you without you even realizing it.

And they don't need to hold a phone.

Smart glasses look like ordinary eyewear, but some have cameras, microphones and internet connectivity.

That means someone could capture your face, conversations or activities without you knowing.

On October 13, Europe's privacy watchdog, the EDPB, raised concerns about these devices.

It wants manufacturers to make recording obvious through visible lights, sounds or other clear warnings.

Why should you care?

Imagine being recorded in a hospital, classroom, workplace or private conversation, only to discover the footage has been shared online.

The bigger problem? You might never know it happened.

What should you do?

• Be mindful of smart glasses in sensitive spaces.
• Ask whether you're being recorded if you're uncomfortable.
• Don't assume footage of you will remain private just because you're in a public place.
Technology is getting better at capturing the world around us.

But people's right to privacy shouldn't disappear with it.

Source: https://t.co/m66pbqc4SL

[Brahim @IBthecoder]

That Chrome extension you installed to make life easier could be seeing more than you think.

In 2020, security researchers reported that browser extensions with around 33 million downloads were secretly collecting sensitive user information.

And we're talking about extensions people installed to use their browsers more conveniently.

Researchers reported that some collected data such as:

• Websites users visited.
• Cookies that can help keep people logged in.
• Information copied to the clipboard.
• Screenshots of activity on the screen.

Why does this matter?
Your browser is where you open your email, access work accounts, shop online and sometimes manage your finances.

Cookies can contain sensitive session information.

If criminals steal usable session cookies, they may be able to access an account without needing to enter the password again.

Your clipboard can also contain things you've copied, including private messages or sensitive information.

Now imagine an extension quietly collecting that information.

You don't always have to download an obvious virus to put your privacy at risk. Sometimes, the risk comes from software you deliberately installed because you trusted it.

So what should you do?

Open your browser's extensions page and remove anything you no longer use.

Review the permissions of extensions you keep. A simple tool shouldn't need access to everything you do online without a good reason.

Install extensions only when necessary, and research the developer before trusting them.

Remember that high download numbers and positive reviews don't guarantee safety.

If an extension is flagged as malicious, remove it immediately. If you suspect your accounts were exposed, review active sessions, sign out of unfamiliar sessions and change affected passwords from a trusted device.

One more thing: an extension can become dangerous after an update, even if it was originally legitimate.

Source: Ars Technica
https://t.co/JtVFKntvaO

[Brahim @IBthecoder]

Someone inside OpenAI allegedly planted a hidden recorder to spy on executive meetings.

And this is a security lesson every business needs to understand.

On Sept. 30, OpenAI discovered a recording device hidden behind a TV in an executive conference room.

It was reportedly connected to a USB port and concealed with toilet paper.

The room was used for confidential discussions about AI research, product plans and business strategy.

Investigators allege that OpenAI engineer Abdulrahman Alfozan planted the device. A second similar device was reportedly found in his bag.

Authorities also allege that a chatbot account associated with his spouse was used to ask questions about building and concealing a recorder.

He was arrested on Oct. 9. OpenAI fired him and referred the case to the FBI.

Important: These are allegations, and he is presumed innocent unless proven guilty.

OpenAI says it found no indication that he stole its AI models, source code or customer data.

But here's the bigger lesson:

Your biggest security risk may already have legitimate access to your workplace.

So what should businesses do?

• Regularly inspect meeting rooms for unfamiliar devices.
• Restrict access to sensitive rooms, calendars and documents.
• Give employees only the permissions their jobs require.
• Monitor unusual access and investigate suspicious activity.
• Set clear rules for using AI tools with company information.
• If you find a suspicious device, don't plug it in or tamper with it. Report it, preserve evidence and contact security.

Don't rely on antivirus or network monitoring alone. A recorder that stores audio locally may leave little network activity to detect.

Cybersecurity isn't just about stopping hackers outside your company.

It's also about protecting the information inside it.
Sources: https://t.co/h04w8MU0Fp

[Brahim @IBthecoder]

The password “123456” has been linked to a data breach affecting 8.8 million people in Denmark.

Let that sink in.

Reports say attackers abused a small IT company's access to Denmark's national population register, exposing names, addresses and personal identification numbers.

The password reportedly belonged to a former employee and had appeared in an earlier data leak.

But here's the bigger problem: weak passwords aren't the only issue. Suspicious activity went undetected for far too long.

A strong password, unique for every account, and multi-factor authentication (MFA) can make a real difference. MFA adds another verification step beyond your password.

Never reuse passwords. Use a password manager, enable MFA, and change any password that may have been exposed.

Your password might look unimportant to you. What it protects could affect millions.

Sources: https://t.co/criYxLmdPG

Official statement: https://t.co/aZBtTTxeaL

[Brahim @IBthecoder]

Norway’s military rented cars for an exercise. Those cars ended up recording soldiers and military gate codes.

Nobody needed to hack the cars.

During a military exercise in September, Norwegian soldiers discovered that rental cars had stored footage showing their movements, who entered and left the vehicles, and even codes used to open military gates.

At least two of the cars were reportedly Chinese-made Deepal models.

The recordings were deleted, but one major question remains: was the data stored anywhere else or transmitted outside the vehicles?

There’s no confirmed evidence that China used the footage for espionage.

But this incident exposes a bigger problem.

Modern cars are computers on wheels. Their cameras, GPS, microphones and other sensors can collect information about where we go, what happens around us, and sometimes who we're with.

Now imagine that happening around a military base, a hospital, or your own home.

The lesson isn't simply to fear cars from a particular country.

It's to understand what your connected devices record, where that data goes, and who can access it.

Convenience should never come at the cost of security.

Source: https://t.co/DpI78QPJjZ

[Brahim @IBthecoder]

Hackers reportedly turned supermarket fridges into ovens.

In France, a cyberattack hit refrigeration systems across hundreds of supermarkets. Some temperatures reportedly reached 50°C, destroying food stocks and causing fires.

But how can hackers do this?

Supermarkets use connected controllers to monitor and manage refrigeration equipment. If attackers compromise those systems, they may be able to change how the equipment operates.

In this case, the damage went beyond computers. Food spoiled, stores faced major losses, and authorities launched an investigation.

Here's what makes this even more concerning: security researchers had already disclosed serious vulnerabilities in Danfoss refrigeration controllers months earlier.

The exact vulnerability used in this attack has not been publicly established.

This is why cybersecurity isn't just about protecting your phone, password or bank account.

When computers control physical equipment, a cyberattack can damage real-world infrastructure, destroy products and disrupt essential services.

Anything connected to a network can become a target. What matters is how well it's secured.

Sources:
https://t.co/7clzY26yGU
https://t.co/9JN6nvBsXx

[Brahim @IBthecoder]

Your smart TV could give a hacker more control than you think.

Researchers have found a chain of security flaws in LG smart TVs that can let an attacker on the same network take complete control of a vulnerable device.

Here's how it works.

The flaws affect webOS, LG's smart TV operating system.

Researchers found hardcoded credentials, a way to bypass the normal pairing process, and a weakness that could let attackers run commands with root privileges.

In simple terms, they could potentially go from bypassing security to gaining the highest level of control over the TV.

The scary part? The attack can work without a PIN prompt or any action from the TV owner.

LG has issued a fix, and the researchers have published technical details of the exploit.

If you own an LG smart TV, check for a firmware update and install the latest version available for your model.

Your TV is a computer connected to your home network. It deserves security updates just like your phone or laptop.

Source: https://t.co/i8MtXnvwCn

LG security updates: https://t.co/huz7I1krrq

[Brahim @IBthecoder]

Your new Android phone could come with malware already installed.

And you might not even know it's there.

Researchers discovered a campaign called Midnight Mimosa affecting low-cost Android phones.

Unlike normal malware that tricks you into installing a suspicious app, this one was found embedded in the phone's firmware.

It can secretly install apps, generate fake advertising clicks and even turn your phone into a proxy that routes other people's internet traffic through your connection.

That last part matters because criminals could use your connection to hide where their activity is coming from.

Researchers found affected devices across more than 150 countries.

The lesson isn't that every cheap Android phone is dangerous.

It's that a phone being new doesn't automatically mean it's secure.

Buy from reputable sellers, research unfamiliar phone brands and models, and install official firmware updates carefully.

Source: https://t.co/OntnqKSw4Y