Ring’s new TAKE encryption limits video-key retention while keeping cloud AI features, Ring Verify, and optional end-to-end encryption in play.
The post Ring’s New TAKE Encryption Deletes Video Keys Without Giving Up AI Features appeared first on TechRepublic.
Um artigo recente publicado na The Atlantic trazia o título contundente The End of Reading Is Here (O fim da leitura chegou). Segundo a matéria, uma pesquisa do National Endowment for the Arts (NEA) constatou que menos de 50% dos adultos americanos leram sequer um livro em 2022, e apenas 38% leram um romance ou conto.
Ao mesmo tempo, o mercado editorial nos Estados Unidos continua quebrando recordes de publicação ano após ano. Em 2025, por exemplo, o número de novos títulos ultrapassou quatro milhões, um aumento de um terço em relação a 2024. Uma enorme parcela desse total, 3,5 milhões de títulos, veio da autopublicação, e um dos principais motores desse mercado é o Kindle Direct Publishing (KDP), da Amazon.
Minha teoria para essa discrepância é a seguinte: ninguém mais lê livros, porque todo mundo está ocupado demais escrevendo-os. Brincadeiras à parte, se ainda houver algum leitor por aí, provavelmente já terá adivinhado aonde quero chegar: à toda-poderosa IA. Um tempo atrás, uma jornalista de tecnologia do New York Times se surpreendeu ao encontrar sua própria biografia na Amazon. Uma rápida olhada confirmou que ela havia sido escrita por IA. Ao investigar mais a fundo o universo da publicação de livros por IA, ela se deparou com o trabalho de um consultor de cibersegurança aposentado e extraordinariamente prolífico. O que aconteceu depois, e onde encontrar informações confiáveis na era da IA, é o tema deste post.
Vamos começar do início. No verão de 2026, a jornalista de tecnologia do New York Times Kashmir Hill descobriu por meio de um conhecido que uma biografia sua havia sido publicada na Amazon um ano antes. O título era The Biography of Kashmir Hill: The New York Times Technology Journalist Who Exposed Clearview AI, Challenged Big Tech and Redefined Privacy in the Digital Age. E ela ficou mais do que surpresa, pois ninguém havia entrado em contato com ela ou com qualquer pessoa que conhecesse para fazer uma pesquisa sobre o livro.
“Alice pôs-se de pé num salto, pois lampejou-lhe na mente que nunca antes vira um coelho com um bolso de colete, nem com um relógio para tirar dele… “
O autor era um certo John Crane Miller, e a foto em sua página na Amazon era uma imagem genérica de banco de imagens de um homem branco do tipo que aparece por toda a Internet. Hill não conseguiu encontrar nenhum detalhe pessoal nem informação de contato sobre ele. Ao investigar mais a fundo o perfil dele na Amazon, porém, descobriu outra coisa: em uma única semana no verão de 2025, ele publicou biografias de Hill e de mais nove jornalistas americanos. Até o leitor mais crédulo teria dificuldade para acreditar que um gênio literário conseguiria produzir tamanho volume sem uma ajudinha robótica.
A biografia da jornalista Kashmir Hill gerada por IA, que ela encontrou por acaso na Amazon. Fonte
Ainda assim, a edição de capa dura da biografia de Kashmir Hill custava US$ 26,99, embora tivesse apenas 90 páginas. Depois de lê-la, Hill descobriu toda uma série de “fatos” sobre si mesma que jamais conhecera, incluindo uma descrição detalhada de seu ritual de preparo do café que, como observa a jornalista, na verdade é tarefa do marido. Miller chegou a afirmar no texto que havia lido o diário de infância de Kashmir Hill.
“…e, ardendo de curiosidade, correu pelo campo atrás dele, e felizmente chegou a tempo de vê-lo entrar de chofre numa toca de coelho grande sob a sebe. “
Hill não conseguiu localizar o autor de sua biografia. Deixou um comentário na página do livro na Amazon pedindo que ele entrasse em contato. Ninguém respondeu e, pouco depois, todos os livros do perfil de John Crane Miller desapareceram.
Mas isso lhe deu uma pista sobre vários outros autores de IA na Amazon. Em particular, ela encontrou um certo Bill Johns, cuja página de autor exibia impressionantes 445 livros. Sem esperar que desse em muita coisa, perguntou a Johns se ele aceitaria conceder uma entrevista e ficou bastante surpresa quando ele concordou. Foi provavelmente nesse momento que a investigação de Kashmir Hill se transformou em uma verdadeira viagem pela toca do coelho da IA…
“No momento seguinte, lá se foi Alice atrás dele, sem considerar, nem por um momento, como no mundo sairia de lá novamente. “
Bill Johns se aposentou em 2024, depois de construir carreira como consultor de cibersegurança. Em 2025, decidiu experimentar o ChatGPT e, em algumas semanas, usou a ferramenta para gerar seu primeiro livro. O tema era cibersegurança, mais especificamente a história do hacking, e a obra foi publicada com o nada original título Ghosts in the Machine. Johns vendeu apenas alguns exemplares, mas isso não o impediu de gerar outros 444 livros no ano seguinte.
Página de autor de Bill Johns na Amazon. Em um único ano, ele publicou 445 livros, sobre temas que vão de cibersegurança e… Pontes a esportes, biografias e filosofia. Fonte
Esse número impressionante inclui, por exemplo, uma série de 13 livros sobre cibersegurança que, além da já mencionada história do hacking, contém os seguintes títulos (em tradução livre):
A cibersegurança está longe de ser o único tema, ou sequer o principal, na mente desse prolífico autor. Além dela, a obra de Bill Johns abrange esportes, pontes, bebidas alcoólicas de todos os tipos, como saquê e uísque, biografias de personalidades, aviação militar e filosofia. Em resumo, é difícil pensar em um assunto sobre o qual Johns ainda não tenha escrito um livro.
O “processo criativo” de Johns consiste em planejar os capítulos de um livro com o ChatGPT e depois escrever cada um gradualmente. Segundo o próprio Johns, pedir à IA que gere um capítulo inteiro de uma só vez não funciona muito bem (para surpresa de ninguém…). Então, é melhor produzir o texto aos poucos. Quando necessário, ele pede ao ChatGPT que faça revisões. Depois da publicação, compra na Amazon um exemplar de cada um de seus 445 livros, mas apenas para colocá-lo na estante, já que lê-los provavelmente não faz parte do plano. Na visão de Johns, ele leu os livros enquanto estavam sendo gerados. E isso basta.
A meta desse titã literário é gerar 10 livros por semana, exatamente o máximo que a Amazon permite nesse período. Há apenas três anos, esse limite era duas vezes maior. Dito isso, ao contrário do autor da biografia de Kashmir Hill, os livros de Johns costumam ser consideravelmente mais longos.
O toque final no retrato desse incansável autor de autopublicação é, bem, o próprio retrato que aparece em sua página de autor na Amazon e na contracapa de todos os seus livros. Johns não esconde que a imagem também foi gerada por IA e explica a escolha com sua praticidade e franqueza características: “Era isso ou vestir um terno e tirar selfies.”
Johns deixou a IA cuidar até da sua foto de autor. Vestir-se bem e tirar uma selfie aparentemente dava trabalho demais. Fonte
Qualquer leitor minimamente atento inevitavelmente se pergunta: por que Bill Johns e outros produtores de livros gerados por IA se dão a esse trabalho, e em tamanha escala? Claro, alguém poderia “escrever” um livro só para colocar o link no currículo, acrescentar com orgulho “autor na Amazon” às bios das redes sociais e contar a desconhecidos no bar que é escritor. Talvez, por garantia, produzir mais alguns. Mas por que gerar mais de 400 livros?
A resposta está no modelo econômico que a Amazon criou muito antes de a IA entrar em cena. Ao contrário das editoras tradicionais, a Amazon não imprime uma tiragem antecipadamente. A maioria dos livros publicados pelo Kindle Direct Publishing segue um modelo de impressão sob demanda: o exemplar físico só é impresso quando um cliente faz o pedido na Amazon.
É assim que um autor consegue lançar um livro praticamente sem custo inicial. E, principalmente, sem o risco de acumular em um depósito exemplares não vendidos que já foram pagos e impressos. Em outras palavras, listar centenas de livros na loja on-line custa quase nada tanto para a Amazon quanto para o autor.
Com custos de investimento próximos de zero, até uma demanda modesta pode gerar lucro real. Bill Johns, por exemplo, vende algumas centenas de livros por mês a leitores desavisados. Em uma temporada de festas de fim de ano, de dezembro ao início de janeiro, as vendas chegaram a 821 exemplares, rendendo cerca de US$ 6.000 como complemento à aposentadoria.
Alguns livros de IA rendem ainda mais dinheiro aos autores. É o caso da biografia gerada por IA do ativista político americano Charlie Kirk, que se tornou um best-seller na Amazon após seu assassinato. Os leitores não ficaram satisfeitos e, depois de dezenas de avaliações com expressões como “entorpecente”, “golpe” e “uma vergonha”, a Amazon retirou o livro da plataforma. Ainda assim, é provável que o serviço tenha vendido milhares de exemplares da biografia antes disso, gerando um lucro considerável tanto para a Amazon quanto para o autor.
Em um mundo saturado de IA, distinguir o que é feito por humanos do que é feito por máquinas é cada vez mais relevante. E a Amazon está longe de ser o único marketplace on-line que alimenta ativamente a disseminação de lixo de IA, portanto há todos os motivos para acreditar que a situação só tende a piorar.
Para evitar mais uma leva de alucinações nada inspiradoras produzidas por chatbots, recomendamos recorrer a fontes confiáveis quando o assunto realmente importa. Em matéria de conhecimento especializado sobre cibersegurança, por exemplo, nosso blog é um bom ponto de partida. Ao contrário de certos consultores aposentados superprodutivos, escrevemos tudo por conta própria e assumimos a responsabilidade por cada palavra.
Para saber mais sobre cibersegurança em livros e filmes, confira outras publicações do nosso blog:
Amazon’s less-detailed order emails protect purchase data but may make phishing harder to spot. Learn how to verify order messages safely online.
The post Amazon’s Order Email Privacy Change Creates a Potential Phishing Trade-Off appeared first on TechRepublic.
Amazon recently updated its terms of service to ban class action lawsuits completely. Discover how this mandatory arbitration clause affects your consumer rights.
Related Posts:
The post Amazon Bans Class Action Lawsuits in Terms Update appeared first on Daily CyberSecurity.
If you’ve spent any time browsing lately, you may have run into a full-screen popup warning you that your Apple ID or Amazon account was just used for a mysterious $149.99 purchase. It looks urgent. It looks official. And if you look at two examples side by side, it becomes obvious that it’s neither.
Below are two popups pulled from real pages—one dressed up as Apple Support, one as Amazon.
Below, one popup is skinned as Apple Support, the other as Amazon. Swap the logo and color palette and the structure is identical: a warning icon, a claim that a $149.99 purchase was just made “via Pre-Authorization,” and a phone number to call immediately. That phone number is exactly the same in both.
That reused phone number is the tell. If you only see one popup, running the number through a lookup tool like Malwarebytes Scam Number Check is usually enough to expose it—a real Apple or Amazon line won’t come back flagged, but a scam number typically does, often tied to complaints about several unrelated companies at once.
Every element in these popups is doing specific psychological work:
If you do call, the number connects to a live scammer posing as support staff, whose actual goal is to get remote access to your device, walk you through “verifying” your identity in a way that hands over real account or payment info, or push you toward paying a fake fee—often via gift cards or a wire transfer.
A few checks work regardless of which brand is being impersonated:
The brand on screen—Apple, Amazon, or whoever’s next—is the least important part of this scam. What actually matters is the pattern underneath: an unexpected popup, a suspiciously specific dollar amount, urgent language, and a phone number that wants you to call before you think. Once you recognize that pattern, it doesn’t matter which company’s name is stamped on top of it.
An AWS software bug showed some customers billing estimates in the billions and trillions. Here is what failed, why invoices were unaffected, and what IT teams should know.
The post AWS Billion-Dollar Software Bug Explained appeared first on TechRepublic.
Remote, flexible, high‑paying work is a tempting prospect, and the holy grail for many people looking for a new role. But it’s not just recruiters who are aware of this, job scammers do too and are happy to use it as an easy lure.
That lure tends to be even more tempting when they claim to be recruiting for a household name like Amazon. The fraudsters use SMS, WhatsApp, Telegram, and email-to-text gateways to blast out offers that look personalized but are actually mass‑produced scripts tweaked with different names, job titles, and reference numbers.
In recent months, one script has shown up again and again: A supposed recruiter called Sophia from Amazon’s recruiting department, promising $250–$500 a day for just 60–90 minutes of simple work. It’s a textbook example of a “task scam” or “gamified job scam,” where victims are slowly pushed toward paying “deposits” or handing over sensitive personal data.
Here is the exact wording of one such message, sent from a Hotmail address and asking the victim to text a US number for more information:
“Hello, this is Sophia from Amazon’s Recruiting Department. Staff ID: AMZ-7677
We’ve reviewed your background and believe you’re perfect for our high-paying, low-effort remote opening. This role is incredibly straightforward, focusing on helping sellers optimize product listings to enhance their online presence.
- Ultra-flexible schedule: Only 60–90 minutes a day, 4 days per week
- Compensation: $250–$500 per day (Base pay of $1000 for every 4 days worked)
- Extra Perks: Comprehensive guidance provided + 15–20 days of paid annual leave
We are filling 20 spots immediately. If you are at least 25 years old and want to earn extra income easily, please text 16172930958 for further details.
Ref-46499”
Variations of this “Sophia from Amazon” script have been reported to the Better Business Bureau, posted on social media as scam warnings, and shared in discussion threads after users realized the Amazon job offer was fake. The details change slightly sometimes: We’ve seen “Grace from Amazon” and other minor changes, but the structure and unrealistic promises remain the same.
With the help of Malwarebytes Scam Guard we noticed these red flags:
Even if you spot some of the issues, it’s tempting to think you can “just see what they say.” With scams like these, there are several ways engagement can escalate badly.
If someone who says they’re from Amazon—or another company—suddenly offers you a remarkably easy job via text, treat it as a warning sign, not an opportunity. Always verify directly with the company itself, rely on trusted job platforms, and resist the urge to just see what happens when a stranger promises big money for almost no work.
Once you know the red flags, it is easier to stay safe from task scams.
It’s also important to keep in mind that legitimate employers do not ask employees to pay for the opportunity to work. And as with most scams, if it sound to good to be true, it probably is. If you run into a task scam, please report it to the FTC at ReportFraud.ftc.gov.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.
See what you missed in Daily Tech Insider from June 15–18.
The post AI Crackdowns, Mega Mergers, and Security Chaos Define This Week in Tech appeared first on TechRepublic.
What Happened:
Analyst Comment:
Arup Group is a large multinational architectural design and engineering firm based in London who has been involved in constructing the Wembley Football Stadium in London, the HS1 Channel Tunnel Rail Link network, and the Eden Project in Cornwall, among other significant international construction projects.
Active since September 2025, FulcrumSec is a financially motivated data-theft-extortion group that specialises in rapid exfiltration of cloud-hosted databases by exploiting unrotated API keys and misconfigured cloud permissions.
This attack was noteworthy due to its highly targeted nature. FulcrumSec claimed they had access to Arup Group’s data for seven months and they clearly invested significant time to analyse the documents and spent weeks negotiating over email. Plus, to find initial access they also would have had to spend time checking Arup’s domains and Internet-facing assets to eventually find a single leaked credential to exploit. These types of targeted intrusions often only happen to large companies. This is because for it to be worth the cybercriminal’s time, effort, and risk to their freedom they will want a large ransom payment that only rich companies can typically afford.
FulcrumSec is an adversary worth monitoring due to the effort they put into their intrusions compared to other smash-and-grab ransomware campaigns. In October 2025, in a case documented by VX-Underground, FulcrumSec emailed detailed information about the breach they conducted with the aim of those details getting published and exert additional pressure on the victim.
Interestingly, FulcrumSec said the ransom they demanded was less than 1% of Arup’s annual revenue and was less than how much Arup lost to the deepfake fraudsters. This is a reference to Arup reportedly lost over £20 million pounds in 2024 after one of their Hong Kong employees was duped into sending cash to cybercriminals using an AI-generated video call. The fact Arup became publicly known for falling victim to a large scam potentially contributed to the adversary’s decision to select and focus them for this attack.
Defensive Takeaways:
Relevant Sources:
Relevant CTI Resources:
The primary goal for attackers in a phishing campaign is to bypass email security and trick the potential victim into revealing their data. To achieve this, scammers employ a wide range of tactics, from redirect links to QR codes. Additionally, they heavily rely on legitimate sources for malicious email campaigns. Specifically, we’ve recently observed an uptick in phishing attacks leveraging Amazon SES.
Amazon Simple Email Service (Amazon SES) is a cloud-based email platform designed for highly reliable transactional and marketing message delivery. It integrates seamlessly with other products in Amazon’s cloud ecosystem, AWS.
At first glance, it might seem like just another delivery channel for email phishing, but that isn’t the case. The insidious nature of Amazon SES attacks lies in the fact that attackers aren’t using suspicious or dangerous domains; instead, they are leveraging infrastructure that both users and security systems have grown to trust. These emails utilize SPF, DKIM, and DMARC authentication protocols, passing all standard provider checks, and almost always contain .amazonses.com in the Message-ID headers. Consequently, from a technical standpoint, every email sent via Amazon SES – even a phishing one – looks completely legitimate.
Phishing URLs can be masked with redirects: a user sees a link like amazonaws.com in the email and clicks it with confidence, only to be sent to a phishing site rather than a legitimate one. Amazon SES also allows for custom HTML templates, which attackers use to craft more convincing emails. Because this is legitimate infrastructure, the sender’s IP address won’t end up on reputation-based blocklists. Blocking it would restrict all incoming mail sent through Amazon SES. For major services, that kind of measure is ineffective, as it would significantly disrupt user workflows due to a massive number of false positives.
In most cases, attackers gain access to Amazon SES through leaked IAM (AWS Identity and Access Management) access keys. Developers frequently leave these keys exposed in public GitHub repositories, ENV files, Docker images, configuration backups, or even in publicly accessible S3 buckets. To hunt for these IAM keys, phishers use various tools, such as automated bots based on the open-source utility TruffleHog, which is designed for detecting leaked secrets. After verifying the key’s permissions and email sending limits, attackers are equipped to spread a massive volume of phishing messages.
In early 2026, one of the most common themes in phishing emails sent with Amazon SES was fake notifications from electronic signature services.
Phishing email imitating a Docusign notification
The email’s technical headers confirm that it was sent with Amazon SES. At first glance, it all looks legitimate enough.
Phishing email headers
In these emails, the victim is typically asked to click a link to review and sign a specific document.
Phishing email with a “document”
Upon clicking the link, the user is directed to a sign-in form hosted on amazonaws.com. This can easily mislead the victim, convincing them that what they’re doing is safe.
Phishing sign-in form
The resulting form is, of course, a phishing page, and any data entered into it goes directly to the attackers.
However, Amazon SES is used for more than just standard phishing; it’s also a vehicle for a very sophisticated type of BEC campaigns. In one case we investigated, a fraudulent email appeared to contain a series of messages exchanged between an employee of the target organization and a service provider about an outstanding invoice. The email was sent as if from that employee to the company’s finance department, requesting urgent payment.
BEC email featuring a fake conversation between an employee and a vendor
The PDF attachments didn’t contain any malicious phishing URLs or QR codes, only payment details and supporting documentation.
Forged financial documents
Naturally, the email didn’t originate with the employee, but with an attacker impersonating them. The entire thread quoted within the email was actually fabricated, with the messages formatted to appear as a legitimate forwarded thread to a cursory glance. This type of attack aims to lower the user’s guard and trick them into transferring funds to the scammers’ account.
Phishing via Amazon SES experienced an uptick in January 2026 and has remained relatively steady through Q1. By weaponizing this service, attackers avoid the effort of building dubious domains and mail infrastructure from scratch. Instead, they hijack existing access keys to gain the ability to blast out thousands of phishing emails. These messages pass email authentication, originate from IP addresses that are unlikely to be blocklisted, and contain links to phishing forms that look entirely legitimate.
Since these Amazon SES phishing attacks stem from compromised or leaked AWS credentials, prioritizing the security of these accounts is critical. To mitigate these risks, we recommend following these guidelines:
We recommend that users remain vigilant when handling email. Do not determine whether an email is safe based solely on the From field. If you receive unexpected documents via email, a prudent precaution is to verify the request with the sender through a different communication channel. Always carefully inspect where links in the body of an email actually lead. Additionally, robust email security solutions can provide an essential layer of protection for both corporate and personal correspondence.
On the surface, the Superbox media streaming devices for sale at retailers like BestBuy and Walmart may seem like a steal: They offer unlimited access to more than 2,200 pay-per-view and streaming services like Netflix, ESPN and Hulu, all for a one-time fee of around $400. But security experts warn these TV boxes require intrusive software that forces the user’s network to relay Internet traffic for others, traffic that is often tied to cybercrime activity such as advertising fraud and account takeovers.
Superbox media streaming boxes for sale on Walmart.com.
Superbox bills itself as an affordable way for households to stream all of the television and movie content they could possibly want, without the hassle of monthly subscription fees — for a one-time payment of nearly $400.
“Tired of confusing cable bills and hidden fees?,” Superbox’s website asks in a recent blog post titled, “Cheap Cable TV for Low Income: Watch TV, No Monthly Bills.”
“Real cheap cable TV for low income solutions does exist,” the blog continues. “This guide breaks down the best alternatives to stop overpaying, from free over-the-air options to one-time purchase devices that eliminate monthly bills.”
Superbox claims that watching a stream of movies, TV shows, and sporting events won’t violate U.S. copyright law.
“SuperBox is just like any other Android TV box on the market, we can not control what software customers will use,” the company’s website maintains. “And you won’t encounter a law issue unless uploading, downloading, or broadcasting content to a large group.”
A blog post from the Superbox website.
There is nothing illegal about the sale or use of the Superbox itself, which can be used strictly as a way to stream content at providers where users already have a paid subscription. But that is not why people are shelling out $400 for these machines. The only way to watch those 2,200+ channels for free with a Superbox is to install several apps made for the device that enable them to stream this content.
Superbox’s homepage includes a prominent message stating the company does “not sell access to or preinstall any apps that bypass paywalls or provide access to unauthorized content.” The company explains that they merely provide the hardware, while customers choose which apps to install.
“We only sell the hardware device,” the notice states. “Customers must use official apps and licensed services; unauthorized use may violate copyright law.”
Superbox is technically correct here, except for maybe the part about how customers must use official apps and licensed services: Before the Superbox can stream those thousands of channels, users must configure the device to update itself, and the first step involves ripping out Google’s official Play store and replacing it with something called the “App Store” or “Blue TV Store.”
Superbox does this because the device does not use the official Google-certified Android TV system, and its apps will not load otherwise. Only after the Google Play store has been supplanted by this unofficial App Store do the various movie and video streaming apps that are built specifically for the Superbox appear available for download (again, outside of Google’s app ecosystem).
Experts say while these Android streaming boxes generally do what they advertise — enabling buyers to stream video content that would normally require a paid subscription — the apps that enable the streaming also ensnare the user’s Internet connection in a distributed residential proxy network that uses the devices to relay traffic from others.
Ashley is a senior solutions engineer at Censys, a cyber intelligence company that indexes Internet-connected devices, services and hosts. Ashley requested that only her first name be used in this story.
In a recent video interview, Ashley showed off several Superbox models that Censys was studying in the malware lab — including one purchased off the shelf at BestBuy.
“I’m sure a lot of people are thinking, ‘Hey, how bad could it be if it’s for sale at the big box stores?'” she said. “But the more I looked, things got weirder and weirder.”
Ashley said she found the Superbox devices immediately contacted a server at the Chinese instant messaging service Tencent QQ, as well as a residential proxy service called Grass IO.
Also known as getgrass[.]io, Grass says it is “a decentralized network that allows users to earn rewards by sharing their unused Internet bandwidth with AI labs and other companies.”
“Buyers seek unused internet bandwidth to access a more diverse range of IP addresses, which enables them to see certain websites from a retail perspective,” the Grass website explains. “By utilizing your unused internet bandwidth, they can conduct market research, or perform tasks like web scraping to train AI.” 
Reached via Twitter/X, Grass founder Andrej Radonjic told KrebsOnSecurity he’d never heard of a Superbox, and that Grass has no affiliation with the device maker.
“It looks like these boxes are distributing an unethical proxy network which people are using to try to take advantage of Grass,” Radonjic said. “The point of grass is to be an opt-in network. You download the grass app to monetize your unused bandwidth. There are tons of sketchy SDKs out there that hijack people’s bandwidth to help webscraping companies.”
Radonjic said Grass has implemented “a robust system to identify network abusers,” and that if it discovers anyone trying to misuse or circumvent its terms of service, the company takes steps to stop it and prevent those users from earning points or rewards.
Superbox’s parent company, Super Media Technology Company Ltd., lists its street address as a UPS store in Fountain Valley, Calif. The company did not respond to multiple inquiries.
According to this teardown by behindmlm.com, a blog that covers multi-level marketing (MLM) schemes, Grass’s compensation plan is built around “grass points,” which are earned through the use of the Grass app and through app usage by recruited affiliates. Affiliates can earn 5,000 grass points for clocking 100 hours usage of Grass’s app, but they must progress through ten affiliate tiers or ranks before they can redeem their grass points (presumably for some type of cryptocurrency). The 10th or “Titan” tier requires affiliates to accumulate a whopping 50 million grass points, or recruit at least 221 more affiliates.
Radonjic said Grass’s system has changed in recent months, and confirmed the company has a referral program where users can earn Grass Uptime Points by contributing their own bandwidth and/or by inviting other users to participate.
“Users are not required to participate in the referral program to earn Grass Uptime Points or to receive Grass Tokens,” Radonjic said. “Grass is in the process of phasing out the referral program and has introduced an updated Grass Points model.”
A review of the Terms and Conditions page for getgrass[.]io at the Wayback Machine shows Grass’s parent company has changed names at least five times in the course of its two-year existence. Searching the Wayback Machine on getgrass[.]io shows that in June 2023 Grass was owned by a company called Wynd Network. By March 2024, the owner was listed as Lower Tribeca Corp. in the Bahamas. By August 2024, Grass was controlled by a Half Space Labs Limited, and in November 2024 the company was owned by Grass OpCo (BVI) Ltd. Currently, the Grass website says its parent is just Grass OpCo Ltd (no BVI in the name).
Radonjic acknowledged that Grass has undergone “a handful of corporate clean-ups over the last couple of years,” but described them as administrative changes that had no operational impact. “These reflect normal early-stage restructuring as the project moved from initial development…into the current structure under the Grass Foundation,” he said.
Censys’s Ashley said the phone home to China’s Tencent QQ instant messaging service was the first red flag with the Superbox devices she examined. She also discovered the streaming boxes included powerful network analysis and remote access tools, such as Tcpdump and Netcat.
“This thing DNS hijacked my router, did ARP poisoning to the point where things fall off the network so they can assume that IP, and attempted to bypass controls,” she said. “I have root on all of them now, and they actually have a folder called ‘secondstage.’ These devices also have Netcat and Tcpdump on them, and yet they are supposed to be streaming devices.”
A quick online search shows various Superbox models and many similar Android streaming devices for sale at a wide range of top retail destinations, including Amazon, BestBuy, Newegg, and Walmart. Newegg.com, for example, currently lists more than three dozen Superbox models. In all cases, the products are sold by third-party merchants on these platforms, but in many instances the fulfillment comes from the e-commerce platform itself.
“Newegg is pretty bad now with these devices,” Ashley said. “Ebay is the funniest, because they have Superbox in Spanish — the SuperCaja — which is very popular.”
Superbox devices for sale via Newegg.com.
Ashley said Amazon recently cracked down on Android streaming devices branded as Superbox, but that those listings can still be found under the more generic title “modem and router combo” (which may be slightly closer to the truth about the device’s behavior).
Superbox doesn’t advertise its products in the conventional sense. Rather, it seems to rely on lesser-known influencers on places like Youtube and TikTok to promote the devices. Meanwhile, Ashley said, Superbox pays those influencers 50 percent of the value of each device they sell.
“It’s weird to me because influencer marketing usually caps compensation at 15 percent, and it means they don’t care about the money,” she said. “This is about building their network.”
A TikTok influencer casually mentions and promotes Superbox while chatting with her followers over a glass of wine.
As plentiful as the Superbox is on e-commerce sites, it is just one brand in an ocean of no-name Android-based TV boxes available to consumers. While these devices generally do provide buyers with “free” streaming content, they also tend to include factory-installed malware or require the installation of third-party apps that engage the user’s Internet address in advertising fraud.
In July 2025, Google filed a “John Doe” lawsuit (PDF) against 25 unidentified defendants dubbed the “BadBox 2.0 Enterprise,” which Google described as a botnet of over ten million Android streaming devices that engaged in advertising fraud. Google said the BADBOX 2.0 botnet, in addition to compromising multiple types of devices prior to purchase, can also infect devices by requiring the download of malicious apps from unofficial marketplaces.
Some of the unofficial Android devices flagged by Google as part of the Badbox 2.0 botnet are still widely for sale at major e-commerce vendors. Image: Google.
Several of the Android streaming devices flagged in Google’s lawsuit are still for sale on top U.S. retail sites. For example, searching for the “X88Pro 10” and the “T95” Android streaming boxes finds both continue to be peddled by Amazon sellers.
Google’s lawsuit came on the heels of a June 2025 advisory from the Federal Bureau of Investigation (FBI), which warned that cyber criminals were gaining unauthorized access to home networks by either configuring the products with malicious software prior to the user’s purchase, or infecting the device as it downloads required applications that contain backdoors, usually during the set-up process.
“Once these compromised IoT devices are connected to home networks, the infected devices are susceptible to becoming part of the BADBOX 2.0 botnet and residential proxy services known to be used for malicious activity,” the FBI said.
The FBI said BADBOX 2.0 was discovered after the original BADBOX campaign was disrupted in 2024. The original BADBOX was identified in 2023, and primarily consisted of Android operating system devices that were compromised with backdoor malware prior to purchase.
Riley Kilmer is founder of Spur, a company that tracks residential proxy networks. Kilmer said Badbox 2.0 was used as a distribution platform for IPidea, a China-based entity that is now the world’s largest residential proxy network.
Kilmer and others say IPidea is merely a rebrand of 911S5 Proxy, a China-based proxy provider sanctioned last year by the U.S. Department of the Treasury for operating a botnet that helped criminals steal billions of dollars from financial institutions, credit card issuers, and federal lending programs (the U.S. Department of Justice also arrested the alleged owner of 911S5).
How are most IPidea customers using the proxy service? According to the proxy detection service Synthient, six of the top ten destinations for IPidea proxies involved traffic that has been linked to either ad fraud or credential stuffing (account takeover attempts).
Kilmer said companies like Grass are probably being truthful when they say that some of their customers are companies performing web scraping to train artificial intelligence efforts, because a great deal of content scraping which ultimately benefits AI companies is now leveraging these proxy networks to further obfuscate their aggressive data-slurping activity. By routing this unwelcome traffic through residential IP addresses, Kilmer said, content scraping firms can make it far trickier to filter out.
“Web crawling and scraping has always been a thing, but AI made it like a commodity, data that had to be collected,” Kilmer told KrebsOnSecurity. “Everybody wanted to monetize their own data pots, and how they monetize that is different across the board.”
Products like Superbox are drawing increased interest from consumers as more popular network television shows and sportscasts migrate to subscription streaming services, and as people begin to realize they’re spending as much or more on streaming services than they previously paid for cable or satellite TV.
These streaming devices from no-name technology vendors are another example of the maxim, “If something is free, you are the product,” meaning the company is making money by selling access to and/or information about its users and their data.
Superbox owners might counter, “Free? I paid $400 for that device!” But remember: Just because you paid a lot for something doesn’t mean you are done paying for it, or that somehow you are the only one who might be worse off from the transaction.
It may be that many Superbox customers don’t care if someone uses their Internet connection to tunnel traffic for ad fraud and account takeovers; for them, it beats paying for multiple streaming services each month. My guess, however, is that quite a few people who buy (or are gifted) these products have little understanding of the bargain they’re making when they plug them into an Internet router.
Superbox performs some serious linguistic gymnastics to claim its products don’t violate copyright laws, and that its customers alone are responsible for understanding and observing any local laws on the matter. However, buyer beware: If you’re a resident of the United States, you should know that using these devices for unauthorized streaming violates the Digital Millennium Copyright Act (DMCA), and can incur legal action, fines, and potential warnings and/or suspension of service by your Internet service provider.
According to the FBI, there are several signs to look for that may indicate a streaming device you own is malicious, including:
-The presence of suspicious marketplaces where apps are downloaded.
-Requiring Google Play Protect settings to be disabled.
-Generic TV streaming devices advertised as unlocked or capable of accessing free content.
-IoT devices advertised from unrecognizable brands.
-Android devices that are not Play Protect certified.
-Unexplained or suspicious Internet traffic.
This explainer from the Electronic Frontier Foundation delves a bit deeper into each of the potential symptoms listed above.
Entrar