KrebsOnSecurity

A botnet named Popa, part of the Vo1d and BADBOX ecosystems, exploits Android-based streaming devices to facilitate ad fraud, account takeovers, and data scraping, with compromised devices routing malicious traffic through home internet connections. The FBI and security researchers warn that these devices, often sold as cheap alternatives for streaming content, can be used for criminal activities without the owner's knowledge.

A CISA contractor intentionally published AWS GovCloud keys and sensitive agency credentials on a public GitHub account, prompting Congressional lawmakers to demand answers. The breach exposed plaintext credentials to dozens of internal CISA systems and occurred amid significant staff losses at the agency following Trump administration-ordered retirements and resignations.