Zane St. John plugged in a $35 projector from AliExpress and pointed it at a bedroom wall. Within minutes of connecting it to WiFi, the home Pi-hole security portal lit up due to issues.
When I powered it on, the experience was more professional than expected. Android 11 (API 30), production build (not signed with test keys!), and not rooted out of the box. But the polished launcher couldn’t fully mask the sketchiness underneath—as my Pi-hole had already made clear.
Armed with
adband jadx, I started examining the pre-installed apps. The first red flag: a litany ofcom.htc.packages on a device that isn’t made by HTC. It’s made by a company called Hotack (sold under brand names like Magcubic). A thin disguise.I’d been using Claude Code with mixed success (mostly positive) for software engineering work, and I suspected it could do more than just speed up the tedious parts of reverse engineering.
Working through each decompiled APK, Claude Code mapped a coordinated suite of vendor malware.
I expected adware. Maybe a tracking pixel. What Claude Code found was a multi-stage RAT with active C2 infrastructure, firmware-level persistence, a plugin system, and a direct pipeline into a commercial residential proxy network—all pre-installed at the factory on a device sold openly on major marketplaces.
See the details of what was found inside the software on the device and more in the article here and on GitHub.
from Adafruit Industries – Makers, hackers, artists, designers and engineers! https://ift.tt/fISvoDB
via IFTTT
