Google Takes Down 2 Million Device Proxy Network

Google's Threat Intelligence Group, working alongside the FBI and networking firm Lumen, has significantly disrupted NetNut — a residential proxy network (a service that rents out real home internet addresses so that other people's traffic can be disguised as ordinary household browsing) that had quietly embedded itself into at least 2 million home devices, including smart TVs and streaming boxes, according to The Hacker News.

Here is what that means in practice: once NetNut's software lands on your device, it becomes an "exit node" — a doorway that other people's internet traffic flows through. Your home IP address gets credited for whatever that traffic does, whether it is credential stuffing (automated password-guessing attacks run against thousands of accounts at once) or hiding the location of espionage groups. In a single week last June, Google counted 316 distinct threat groups using suspected NetNut exit nodes.

The software arrives two ways: pre-installed on cheap off-brand hardware, or bundled into free apps that never clearly ask for your consent. Researchers tested over 20 apps carrying this software and found that not one of them showed users a consent prompt. NetNut's parent company, Israeli firm Alarum Technologies, rejects the botnet label and calls the research inaccurate. The researchers' testing tells a different story.

Google describes this as degradation, not elimination. NetNut runs a reseller program, so its network lives inside dozens of brands that look independent but draw from the same pool.

What you should do: Check your home network's device list for anything unfamiliar — especially cheap streaming sticks or off-brand smart TVs. If you bought a no-name streaming device cheaply, consider replacing it with a trusted brand. Running your router's connected-devices list monthly is a good habit regardless.

Traditional corporate identity systems were built around one assumption: every account belongs to a person with a job title, a manager, and an eventual leaving date. AI agents have none of those things, and according to analysis covered by The Hacker News, that gap is becoming a significant governance risk.

When a human employee joins a company, HR triggers the access they need. When they leave, it gets switched off. AI agents skip that entire process — they are created by engineers or automated systems, dropped into production environments with whatever permissions the developer set, and then largely forgotten. There is no manager to revoke their access and no HR system flagging them for a review.

The practical risk: an AI agent provisioned with broad permissions for a short task can retain that access indefinitely, long after the task is complete. Think of it like giving a contractor a master key and never asking for it back.

What you should do: If your organisation uses AI agents or automation tools, ask your IT team whether those accounts are included in regular access reviews. If they are not, they should be.

What Cursor is: Cursor is an AI-powered code editor used by software developers to write, edit, and review code, with a built-in AI agent that can execute terminal commands automatically on the developer's behalf.

What it is: Researchers at Cato Networks discovered a critical flaw, part of a vulnerability set referred to as DuneSlide (the collective name given to this pair of related flaws by Cato), that allows an attacker to break out of Cursor's sandbox (the restricted environment designed to contain what the AI can touch) and execute commands directly on the underlying operating system. A companion flaw also exists but is tracked separately. Full details are in the Security Week advisory.

Who's at risk: Developers running Cursor on any operating system who have not yet updated to version 3.0.

CVSS: 9.8 — Critical. Patch today.

Root cause: Cursor's sandbox is supposed to restrict the AI agent's terminal commands to the current working directory. However, when a non-default value is assigned to the working_directory parameter, that path gets added to the system's allow list without proper validation. This means an attacker-controlled value can expand the sandbox boundary to include locations outside the project — locations the developer never intended the AI to touch.

Attack vector: An attacker embeds a malicious payload inside content that Cursor's AI agent is asked to read — for example, inside a file, a prompt, or a connected MCP server request (a type of external service integration). The injected instruction tells the AI to set its working directory to an attacker-chosen path. From there, the attacker can overwrite Cursor's own sandbox executable, meaning all subsequent commands run outside any sandbox restrictions entirely. The attacker achieves full remote code execution (the ability to run arbitrary commands on your machine) without ever needing direct access to your system.

Detection strategies:

• Check application logs for unexpected changes to the working_directory parameter, particularly paths outside your active project folder.
• Monitor for modifications to the cursorsandbox executable on disk — changes to this file outside of an official update are a strong indicator of compromise.
• Look for unusual outbound network connections originating from Cursor's process, especially to unfamiliar external addresses.

Recommended actions:

1. Update Cursor to version 3.0 or later immediately — patches for this flaw were included in that release.
2. Until updated, avoid opening or ingesting files from untrusted or external sources inside Cursor.
3. Review any MCP server integrations connected to your Cursor installation and remove any you did not explicitly configure.

ClickFix attacks work by tricking you into copying a dangerous command, usually disguised as a verification step or a helpful fix, and then pasting it directly into your computer's terminal. The result is malware running with your own permissions, bypassing most security tools entirely.

Opera has introduced Paste Protect, a feature that blocks suspicious commands before they ever reach your clipboard. When it detects a harmful pattern, it stops the copy action, shows you a warning, and flags a red indicator in the address bar. You can still review the first 120 characters of what was blocked and approve it manually after a short delay if you know it is safe.

The feature is on by default in the latest Opera release. You can manage it at Settings → Privacy & Security → Paste Protect.

Get Opera at opera.com — it is free. Full details on Paste Protect via Bleeping Computer.

A US Supreme Court ruling that allows presidents to remove members of independent agencies at will has thrown the EU-US Data Privacy Framework (DPF) — the legal agreement that permits European personal data to flow to US companies — into doubt. Privacy advocate Max Schrems, who has successfully invalidated two previous versions of this agreement in European courts, has announced plans to sue again, arguing the FTC (Federal Trade Commission) can no longer be considered independent. The DPF underpins an estimated $1.9 trillion in annual transatlantic trade. If it collapses, businesses transferring EU user data to US servers would need to find alternative legal mechanisms fast. Full story at The Record.