The FBI, in partnership with Google and other tech companies, struck a massive blow against NetNut, a public-facing residential network proxy service that secretly hosted a botnet controlling approximately 2 million Android TVs and similar smart home devices. The network was being used for password-spraying, credential attacks and other malicious activity. 

Residential proxy botnets make malicious traffic appear like normal internet use, allowing everyday devices to be secretly hijacked by cybercriminals to conduct illegal activities using your home internet. Infected home devices were often preloaded with malicious software used by the botnet, which made traditional home security practices less effective at detecting and stopping the problem. 

According to an FBI statement emailed to CNET, on July 2, the federal agency carried out “a court-authorized seizure of multiple domains as part of a coordinated law enforcement action with the Department of Justice and IRS Criminal Investigation targeting infrastructure associated with the NetNut residential proxy platform, its administrators, and users.”

Authorities worked in tandem with Google, Lumen Technologies and the Shadowserver Foundation to go after NetNut and its services — also known as the Popa botnet by security researchers. Google said in a blog post that the actions “caused significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions.” NetNut’s website now shows an FBI takedown notice. 

Google acknowledged that taking down NetNut is only the first step. Because these proxy networks frequently share and resell access to each other’s botnets, disrupting one provider often leads malicious actors to simply purchase capacity from a competitor. To create a lasting impact, Google said it must “target the infrastructure of several interconnected providers” simultaneously.

How this botnet worked

In 2024, security researchers at XLab found the Vo1d botnet, a massive collection of hacked, mostly off-brand Android TV devices. If you recall the fake AI video of Donald Trump and Elon Musk appearing on TVs at the Department of Housing and Urban Development, that was most likely caused by a malicious actor using the Vo1d botnet. 

Those same researchers also found Popa, a legitimate network protocol plug-in that turned consumer devices into residential proxy nodes with the user’s consent. But the version researchers found was being installed on the hacked Android TV devices without user consent. According to the FBI, a residential proxy node is “an intermediary server between individuals and websites they visit to make their connections appear to originate elsewhere.” 

Residential proxy networks are legal in the US, and businesses that use them usually sell access to enterprise customers, where they’re often used for security penetration testing, ad verification, gathering marketing data and unlocking geo-locked websites. Since residential nodes use real IP addresses from someone’s home, the company or person using the node is seen by the World Wide Web as just an ordinary user, and their true identity is hidden. 

Android TV devices that were part of the Vo1d botnet and infected with Popa allowed cybercriminals to conduct attacks, scrape data from infected devices looking for sensitive information like passwords, and even hijack the device to perform malicious tasks, all while the hacker appeared to originate from the house across the street or the apartment across the hall without actually being there. 

That is where NetNut comes in. NetNut is a public-facing residential proxy network operator owned by Alarum Technologies, a publicly traded company out of Israel. Per Google, it was one of the largest residential proxy network operators in the world.

On the surface, NetNut appeared to be a legitimate business and even had an official website where you could buy its services. However, late last month, multiple researchers confirmed that traffic generated by the Popa botnet was from NetNut users. This meant that NetNut was effectively selling its botnet out in the open to anyone, for both legitimate and illegitimate uses, which gave authorities enough evidence to take the company down.

Stay safe from the next attack

The good news is that making sure you don’t wind up as part of the next Android TV-powered botnet is actually pretty easy. According to Google and security researchers, the overwhelming majority of the hacked devices were no-name Android TV streamers that you can freely find on Amazon, Temu, AliExpress and other online outlets.

Many of those streaming sticks and boxes are quite cheap, but they do work. The problem is that nearly all of them run ancient versions of Android, which are easier to hack since those devices don’t have the modern protections afforded by newer versions. 

Some brands sell streaming boxes that promise free streaming with no subscriptions. These are often advertised on Instagram and TikTok by fresh-faced influencers who claim to offer a no-subscription streaming TV solution. Security researchers found that many of those streamer boxes came prehacked with botnet software installed out of the box. 

So, step one to avoid becoming part of a botnet is to only buy Android TV devices from reputable companies like Sony, Nvidia, Google and others. Try to buy one that runs a modern version of Android and still gets security updates. You should also avoid those “one price, no subscriptions” boxes on social media, since they definitely come with malware preinstalled. 

Botnets like this aren’t unique to Android TV. Smart home devices are also consistently included in botnets, so step two to keeping yourself safe is to make sure you apply all of the above advice to your smart home products as well. You should also keep up with the latest trends, like promptware, a new kind of malware that hacks your devices by asking the onboard AI to do it on behalf of the hacker. 

The incident serves as an important reminder to be wary of low-quality, cheap tech peddled by influencers — or you risk having your personal ID information stolen. The usual array of things helps as well, like making sure to have a robust password, learning how to avoid phishing emails and not revealing any personal details to suspicious characters online.

Meta is working on a tool to ID images and video created with its new image generation model, Muse Image. The company showed off a preview of the web-based tool that can check for the invisible watermarks used by the new model.

This watermarking system, called Content Seal, remains in place “even when cropped, compressed, resized, or screenshotted,” Meta explains in a blog post. “We’re previewing a detection tool that lets you check whether an image carries a Content Seal watermark, providing an initial way to help you better understand if an image was made with Meta AI.”

Content Seal seems to be a somewhat new approach for Meta. The version that’s part of Muse Image is proprietary, though the company has previously released open-source versions of the tech, Meta told Engadget. Meta’s new models don’t include any visible watermarks, like some previous versions of Meta AI that added a small logo to the bottom right corner.

For now, Meta AI’s detection abilities are limited to images that are created or edited with Muse Image, though the company said it plans to expand Content Seal watermarks to AI-generated and edited videos as well. Meta is also working on a separate video generation model called Muse Video that will be “coming soon.”

I tried out the new detection feature on images I created today with Meta AI and the web-based tool was able to detect a watermark for edited images and entirely AI-made creations (like the one pictured above). It also found the watermark in screenshots of my images. “A positive result means that the image was generated or edited using the Meta AI app or meta.ai,” the company explains in an FAQ. “A negative result means it is unlikely that the image was processed using Meta AI app or meta.ai.”

Interestingly, Meta AI’s new detection abilities don’t seem to be part of the Meta AI app yet. When I asked Meta’s app-based assistant about an image the web tool had identified as AI-made, it replied that it did not have the ability to check. “I can’t tell you definitively if this specific image was made with Meta Al just by looking at it,” it said. “Meta Al doesn’t automatically watermark images, and I don’t have a tool that can detect which Al model made an existing image.”

Meta has previously faced some criticism for how it labels and identifies AI-generated material in its apps. The Oversight Board told the company earlier this year that it was “concerned” that Meta was “inconsistently implementing” digital watermarks on AI content created by its own tools.

The new feature does still seem to have some other limitations, though. Content Seal is not compatible with SynthID or C2PA Content Credentials, two established watermarking methods used by other companies. The web-based feature was unable to identify images created or edited with earlier versions of Meta’s AI models in my testing. When I added images created in older chats with Meta AI, it was unable to tell me if the image was made with its AI. The feature also appears, for some reason, to be subject to Meta’s rate limits. After uploading a handful of examples, I was alerted that I had reached my “daily limit on identification checks.”

TikTok has become one of the most famous social networking apps in the world, where users can enjoy short clips and share their own. To make the platform more accessible, the company also offers TikTok Lite, a smaller and lighter version of the app. It has been created with the needs of users who use older mobile phones or have low internet connectivity in mind. Despite the two apps offering a similar experience, there are differences in terms of performance, storage space, features, and safety options. In this guide, we’ll compare TikTok and TikTok Lite to help you understand which version is right for you.

TikTok vs. TikTok Lite: Key Differences

Although both applications offer a similar experience, there are quite a few differences between TikTok and TikTok Lite. TikTok Lite is considerably smaller than the former. It requires less space and fewer resources, which makes it run easily on older smartphones and devices with limited storage. The app also features a data-saving mode that helps reduce mobile data usage. It performs better on slower internet connections as well.

Both apps provide video-watching capabilities, enable uploading and downloading of videos, and allow editing, liking, commenting on, sharing posts, and sending direct messages. TikTok Lite has limited functionality compared to TikTok, lacking advanced browsing features and content management tools. The lite version has fewer safety features compared to the full version of the TikTok application. The standard version includes AI-generated content, misleading information, and harmful content, as well as enhanced comment filters and content controls. As TikTok Lite lacks many of these security tools, the complete version is superior from a safety perspective and for efficient use of the app.

Which One Should You Choose?

The TikTok Lite app would be perfect for people using older Android phones with low storage space and slower internet connections. Also, the TikTok Lite app is suited for people who do not want to use much mobile data but still want to use TikTok’s services. However, the regular TikTok app will be suitable for people using new phones, providing all features alongside increased security options.

In conclusion, your choice depends solely on the nature of your device and what you need. If you are looking for something that uses less storage space, draws less power from your battery, and uses less mobile data, then TikTok Lite is the best option.

A hidden authentication backdoor has been found in multiple Tenda router firmware versions, potentially allowing an attacker to gain administrative access to the device’s web management panel.

According to a security bulletin from the CERT Coordination Center, the issue remains unfixed because the Chinese maker of the networking equipment couldn’t be reached.

CERT/CC says the issue, tracked as CVE-2026-11405, is caused by an undocumented authentication mechanism in the ‘login()’ function of the ‘/bin/httpd’ web server binary.

If a user attempts to log in, the router firmware will perform standard MD5-based authentication. If that fails, it will retrieve an alternate password from the ‘sys.rzadmin.password’ configuration value and compare it directly to the plaintext password supplied by the remote user.

If the passwords match, the device grants administrator (role=2) access and creates a valid session, regardless of the username entered.

So any username will be accepted by the mechanism as long as the backdoor password is supplied.

CERT/CC says this mechanism isn’t documented anywhere, or mentioned on the administrative interface, leaving users unaware of the risk.

“Successful exploitation grants full administrative access to the device’s web interface, regardless of the configured administrator account credentials,” describes CERT/CC.

“With administrative control, an attacker can reconfigure the device, alter network settings, and disable security features, enabling broader compromise of the local network.”

CVE-2026-11405 impacts the following Tenda firmware versions and devices:

• US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD – Tenda FH1201 (WiFi router)
• US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE – Tenda W15E (WiFi router)
• US_AC10V1.0re_V15.03.06.46_multi_TDE01 – Tenda AC10 (WiFi router)
• US_AC5V1.0RTL_V15.03.06.48_multi_TDE01 – Tenda AC5 (WiFi router)
• US_AC6V2.0RTL_V15.03.06.51_multi_T – Tenda AC6 V2 (WiFi router)

CERT/CC reports that no patch is currently available, and Tenda users are advised to disable the remote web management panel to prevent internet access to the vulnerable interface.

Additionally, it is recommended to restrict local network exposure by changing the default LAN IP address to reduce opportunistic discovery by automated scanners.

CVE-2026-11405 was discovered and reported to CERT/CC by an anonymous researcher.

While no mention of active exploitation exists, the issue is very likely to be targeted by botnets focusing on router flaws in the coming period.

BleepingComputer has contacted Tenda for comment, and we will add their response if we receive one.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Dynaudio is pulling out of North America.

In a tersely worded statement from Skanderborg, Denmark, the Danish loudspeaker manufacturer announced that it will refocus its future market development efforts on Europe and Asia. As part of that shift, Dynaudio says it will “cease operations of its commercial activities in North America and permanently shut down its U.S. subsidiary in the fall of 2026.”

That is not a small distributor adjustment. That is not a quiet change in rep coverage. That is Dynaudio exiting the North American market as a direct commercial operation.

The statement acknowledges that Dynaudio has achieved sales growth in North America in recent years, which makes the decision even more notable. The company points instead to ongoing economic challenges and market uncertainty as the reason for prioritizing markets it believes offer stronger strategic opportunities.

In other words, North America may not have been a disaster. It may simply have become too expensive, too unpredictable, or too low-priority to justify the investment required to keep a full U.S. subsidiary operating.

For a brand with Dynaudio’s history, dealer footprint, studio credibility, and recent product momentum, that is a significant industry development.

Dynaudio’s Statement

Dynaudio has not yet provided the detailed transition plan that dealers, customers, and service partners will want to see. The company says continuity of product support and customer service will be addressed and communicated shortly.

That will be the critical part of this story.

Owners of Dynaudio loudspeakers, custom installation products, automotive systems, and professional monitors will want to know whether warranty support, parts availability, repairs, and dealer service will continue in the U.S. and Canada after the subsidiary closes.

Dynaudio also currently lists North American service contacts for Dynaudio Pro, including Dynaudio North America in Illinois and additional service partners in the U.S. and Canada. That may provide a temporary support bridge, but it does not answer the bigger question: what happens after fall 2026?

The Timing Is Strange

The timing is hard to ignore.

Dynaudio did not look like a brand retreating from the U.S. market in 2026. Quite the opposite.

At AXPONA 2026, Dynaudio had one of its most visible recent North American showings, highlighted by the Dynaudio Legend, a luxury passive bookshelf loudspeaker that made its public debut in Chicago. The Legend was positioned by Dynaudio as a handcrafted, premium bookshelf speaker using matched natural rosewood veneer panels, Brazilian cherry corner pieces, and Danish assembly at Dynaudio headquarters.

The room created real interest because Legend felt like a reminder of what Dynaudio does best: elegant Danish industrial design, serious driver engineering, and loudspeakers that don’t need to look like they were designed by a committee of enraged refrigerator manufacturers.

eCoustics had two Dynaudio reviews planned this year, including an anticipated review of the Legend. That review has now been delayed, and in light of today’s announcement, the delay takes on a very different meaning.

Dynaudio also had a major presence at HIGH END Vienna 2026. The company’s Symphony Opus One immersive audio system was at the center of its demonstrations in Vienna before its June launch in Copenhagen. Dynaudio’s forthcoming Confidence i series was also previewed for High End Vienna, showing that the company was still pushing hard into the upper end of the market.

That is why this announcement lands with a thud. Dynaudio was not invisible. It was not quiet. It was not showing signs of creative exhaustion.

It was showing up.

From North American Expansion to Exit

The reversal becomes even sharper when you look back at Dynaudio’s North American investment.

In 2019, Dynaudio opened a 25,000-square-foot North American headquarters and Experience Center in Northbrook, Illinois. The facility was designed for product demonstrations, dealer and sales rep training, and warehousing to support regional demand.

That was a serious commitment.

Seven years later, Dynaudio is preparing to shut that U.S. subsidiary down.

The company has not said whether a third-party distributor will take over North American sales. It has not said whether existing dealers will continue to receive product. It has not said whether Canada will be handled differently from the United States. It has not said whether Dynaudio Pro, Custom Install, Home Audio, and Automotive are all affected equally.

Until Dynaudio clarifies those points, the safest reading is that Dynaudio is ending its own commercial operation in North America, while promising some form of future support continuity.

That distinction matters.

Dynaudio products may not vanish from every shelf overnight. Existing dealer inventory may remain in the market. A future distribution arrangement is possible. But none of that has been confirmed.

Tariffs, Greenland, and the Danger of Easy Explanations

It is tempting to speculate.

The current U.S. trade environment has created real pressure for European manufacturers, and the U.S. and European Union trade framework has involved a 15% tariff structure on many EU exports. That kind of cost pressure matters when you are shipping large, heavy, premium loudspeakers into a dealer-driven market.

There is also the bizarre timing of President Donald Trump’s renewed comments that Greenland should be controlled by the United States rather than Denmark, a position that has strained relations between Washington and Copenhagen.

But there is no evidence at this stage that Greenland, tariffs, or any single political issue caused Dynaudio’s decision.

The more practical explanation is probably less theatrical and more painful: North America is expensive. Warehousing is expensive. Dealer support is expensive. Shipping is expensive. Product demos are expensive. Customer support is expensive. And in a market where high-end loudspeaker sales can be slow, seasonal, and dealer-dependent, even growth may not be enough if the margin math no longer works.

Not every retreat is a collapse. Sometimes it is a spreadsheet with a knife.

The Bottom Line

Dynaudio’s decision to exit North America is one of the more surprising hi-fi industry developments of 2026.

This is a company with a deep loudspeaker legacy, strong engineering credibility, a meaningful presence in home audio and professional audio, and recent show momentum at both AXPONA and High End Vienna. The brand was visible. The products were interesting. The Legend looked like a serious statement piece. Opus One suggested a more ambitious design-led future.

And yet Dynaudio has decided that its future market development efforts belong elsewhere.

GoerTek’s 2014 acquisition gave Dynaudio access to Chinese engineering, electronics, and wireless expertise, and Dynaudio’s 2016 management update referenced GoerTek-linked Asia-Pacific experience at the executive level. That does not mean China is “the reason,” but Europe and Asia as priority markets are consistent with Dynaudio’s ownership and long-term product direction. 

That does not mean the brand is finished in North America forever. It does mean that the current structure is finished.

For customers, the immediate concern is support. For dealers, it is inventory, warranty coverage, and continuity. For the industry, it is another reminder that the North American hi-fi market may look attractive from the outside, but it is increasingly difficult to serve profitably from the inside.

Danish loudspeakers are not the problem.

The business of selling them here might be.

For more information: dynaudio.com

Related Reading:

I know a frozen-treat machine isn’t the most obvious thing to buy in the middle of winter, but Amazon‘s Prime Day sale has dropped both the Ninja Creami Deluxe and Ninja Slushi to all-time low prices.

That makes these two deals a lot more tempting than they have any right to be in July, especially if you want to get ahead before summer or you just like ice cream, frozen drinks and weekend entertaining year-round.

The Slushi is the one I can speak to personally. I bought mine on June 3 last year for AU$424.15, which was the lowest price I’d seen at the time, and I’ve since made hundreds of frozen drinks with it across summer and winter.

The Creami Deluxe is the one I’d consider first if you’re more interested in ice cream than drinks. With the Deluxe version now at an all-time low, splurging feels a lot easier to justify, and I’m tempted to grab one myself.

All the deals below are Exclusive Prime prices, so if you don’t have a membership already, sign up now and get a 30-day free trial that you can cancel at any time.

Ninja products tend to attract a lot of attention, and the Slushi is one of the few that I think mostly deserves it. While you might assume one of the best blenders could do a similar job, it really can’t.

A blender crushes ice into a drink, which usually waters it down. The Slushi chills and churns the liquid itself, so the texture is much closer to a proper frozen drink.

The useful bit is Ninja’s RapidChill technology, which keeps the liquid moving while it freezes. Chilling your drink first can speed things up, but I usually find the Slushi is ready in under 30 minutes, and then it will keep it icy for as long as you need.

That’s important at parties, because people can keep coming back for refills without the mix turning into a block of ice or melting into a watery mess.

The main caveat is that the drinks need sugar to freeze properly. The machine will alert you if the sugar level is too low, so completely sugar-free drinks are not really the point here.

You also need to be careful with alcohol, because too much will stop the mixture from freezing. In practice, I’ve found it works best when you treat recipes as a starting point and adjust them after a batch or two.

Frozen cocktails are the obvious use, but spiced winter drinks that would normally be served hot are surprisingly fun as slushies, too.

At this all-time low Prime Day price, it’s much easier to recommend, and it gives you plenty of time to master a few recipes before the weather warms up again.

Chinese hackers tracked as ‘UAT-7810’ are actively evolving their malware to expand their Operational Relay Box (ORB) network by compromising internet-facing networking devices, primarily unpatched Ruckus routers.

According to Cisco Talos researchers, the ORB network serves as a secure relay infrastructure for other China-aligned advanced persistent threats (APTs), including UAT-5918.

This type of infrastructure, which was previously documented by Google Mandiant, allows threat actors to proxy their network traffic through regional devices, making it appear to originate from legitimate local infrastructure to evade detection and complicate attribution.

The Talos analysts have identified new malware in the campaign, including LONGLEASH, a new version of the previously documented SHORTLEASH backdoor, DOGLEASH, a Linux backdoor, JARLEASH, an administrative tool, and LEASHTEST, a testing utility.

The researchers report that UAT-7810 primarily exploits known (n-day) vulnerabilities to gain initial access, including CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717 in Ruckus routers, as well as CVE-2025-2492 in ASUS AiCloud routers.

LONGLEASH malware

The newly discovered LONGLEASH malware is an upgraded version of SHORTLEASH, first documented by SecurityScorecard in 2025, that significantly expands its capabilities.

The malware builds on the previous version, which supported command-and-control (C2) communications, web server hosting, network tunnel management, and operation as both a C2 server and client.

In addition to those, Talos researchers have now also observed the following capabilities:

• Reverse shell
• HTTP, DNS, SOCKS, TCP, ICMP, and UDP proxying with traffic redirection
• SMTP client/server functionality
• TLS and PKI support
• Self-removal for when tampering or other suspicious activity is detected
• Ability to act as an intermediate C2 server, forwarding commands and data between infected nodes

DOGLEASH, JARLEASH, and LEASHTEST

Apart from LONGLEASH, the researchers have also discovered DOGLEASH, a lightweight Linux backdoor deployed via web shell scripts.

Upon launch, it opens a listening TCP port and authenticates incoming requests using a hardcoded password, supporting shell command execution, file access and modification, OS information retrieval, and arbitrary code execution directly in the host’s memory.

JARLEASH is a Java-based administrative tool that provides web-based file management and includes FTP, SFTP, and Netcat server functionality.

Finally, the threat actors have developed LEASHTEST, which can be used to verify whether an MIPS IoT device can perform functions related to malware operations, likely to help refine LONGLEASH’s MIPS support.

Cisco Talos concludes that UAT-7810 continues to expand its ORB infrastructure, actively replacing or extending SHORTLEASH with the more capable LONGLEASH while broadening its toolkit with new malware.

A complete list of the indicators of compromise (IoCs) linked to UAT-7810 activity and the latest toolset is available at the bottom of Cisco Talos’ report.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

When it comes to home cleaning, you can never be too prepared as there’s no telling what spills and stains you might have to deal with. A tipped-over glass of wine or a forkful of pasta that’s hit the floor is more of an inevitability, no matter how careful you are, but if you don’t have any gadgets to hand that can help you clean it all up, it can take ages to sort with a manual touch. This is why you need one of the best steam cleaners to hand.

Although the best hard floor cleaners are the perfect solution for everyday messes, steam cleaners provide a more heavy-duty approach when it comes to sanitising the mess in question. For instance, cleaning up a bit of mud left by your shoes after a long hike is an easy enough task for a hard floor cleaner, but something left behind by a pet or a child (if you catch our drift) is where steam cleaners come into effect.

As you may have guessed from their name already, steam cleaners operate by boiling water to produce a mess-targeting vapour which can then be concentrated to remove whatever it is that’s found its way to your floor. These appliances can work wonders, but because they are a more heavy-duty solution, they work best with sealed floors such as varnished wood or concrete. Anything less may be warped by a steam cleaner over time.

There’s a good variety of steam cleaners available, each with different power settings and accessories designed to target certain messes. It can all be a bit overwhelming if you’re approaching the market for the first time, but this is where the hard work of our expert testers comes in, as they’ve done the hard work for you to find out which of the bunch are actually worth buying.

All of the options selected for this list have performed brilliantly in our testing process, and we’ve made sure to keep a few budget-friendly options in the mix too for anyone who doesn’t want to spend too much money. Keep on reading to see which picks we currently recommend, and if you need other cleaning solutions for your home then we’ve got you covered with the best vacuum cleaners and the best carpet cleaners.

Best Steam Cleaner at a glance

SQUIRREL_ANCHOR_LIST