The Weak Link This Week Wasn't Code. It Was Trust.

Key points

• Home streaming boxes and consumer routers were quietly enlisted into proxy networks that hide criminal traffic behind ordinary household IP addresses.
• Clean-looking open source projects pulled in tampered dependencies, so developers who did nothing obviously wrong still shipped malware.
• Password reset flows and single sign-on shortcuts were abused to take over accounts without cracking a password.
• AI assistants were tricked by hidden instructions buried in documents and web pages, a technique known as prompt injection.
• Fake proof-of-concept exploit code posted on developer sites installed malware on the researchers who ran it.

A streaming box shouldn't need a threat model. Neither should a login screen, a reset flow, or a browser pop-up asking for permission.

And yet, this week, every one of those ordinary things became the way in. Not through clever zero-days, meaning brand-new flaws nobody had seen before. Through misplaced trust. Systems assumed something was safe because it looked safe. Attackers noticed.

What actually happened this week?

Several separate stories, one shared weakness.

First, home devices. Researchers tracked criminal groups turning consumer gear, cheap Android TV boxes and older routers, into what security people call a proxy botnet: a network of hijacked household connections that criminals rent out to route their traffic. When a fraudster logs in from what looks like a neighbour's broadband, the bank's fraud checks tend to shrug. The device owner sees nothing, the bandwidth cost is negligible, and the trust banks place in residential IP addresses is exactly the point.

Second, the software supply chain. Developers pulled in open source packages with clean commit histories that quietly depended on other packages which had been tampered with. The top layer was trustworthy; the layer underneath wasn't, and nobody checked all the way down.

Third, identity. Attackers kept finding ways around passwords rather than through them: weak reset flows, single sign-on tokens that lived too long, help desks that reset multi-factor authentication (the second code you type after your password) for anyone who sounded stressed enough on the phone. No password was cracked. None needed to be. We've covered the identity beat in 80 stories over the past 90 days, and the help-desk social-engineering angle keeps surfacing.

Fourth, AI. Assistants that read documents or summarise emails were tricked by instructions hidden inside the content they were reading. A malicious web page tells the assistant, in text the user never sees, to send private data somewhere. The assistant, trained to be helpful, obliges. We reported on 2 July how the BioShocking technique turns agentic browsers into credential thieves using exactly this class of manipulation, and our 24 June piece on AI agents being manipulated through the data they trust laid out what defenders need to understand before deploying agents at scale.

Why does this keep happening?

Because trust is cheap to grant and expensive to verify.

A bank trusts residential IPs because checking every login properly is slow. A developer trusts a popular package because reading every dependency is impossible. A help desk trusts a caller because being unhelpful gets complaints. An AI trusts the text in front of it because that's what it was built to do. Each shortcut is reasonable alone. Stacked together, they're the attack surface.

The zero-trust model turned 15 this year and still struggles to take hold, largely because organisations treat a security philosophy like a product purchase.

Should you worry?

Yes, selectively. The practical steps aren't dramatic.

If you own a cheap streaming box or a router more than five years old, check whether the maker still issues updates. Replace it if not, and disable remote access you don't use.

For accounts that matter, use a password manager and enable multi-factor authentication via an app rather than SMS. Passkeys are worth adopting where a service offers them.

Be careful with AI tools that browse the web or read your inbox. They're useful and genuinely gullible. Don't grant them access to anything you wouldn't hand a stranger.

What strikes me most this week isn't the technical variety of the attacks. It's how little any of them had to do with breaking something. Each one worked by convincing a system that everything was fine. That's a harder problem to patch.