Smart Devices and Cyberattacks: What’s Really Happening

Author : Arnav Badhan

Think about your morning. Your phone alarm goes off, the smart bulb flicks on, the router hums, and the TV box loads your show. On the way out you tap a kiosk for a ticket or a snack. You’ve touched about five tiny computers before breakfast, and most of them can’t defend themselves.

Attackers know this. Over the last year, hacks on everyday connected devices have stopped being “what if” stories and turned into front-page news. Here are six recent ones, what they tell us, and what you can do about it.

First, what is an IoT device?

IoT (Internet of Things) means any everyday object with a small computer inside and an internet connection: smart TVs, TV boxes, CCTV cameras, thermostats, kiosks, freezer controllers, even solar panels. They’re built to be cheap and convenient, and security often comes last.

This isn’t new. Back in 2014, researchers found 100,000+ smart devices, including TVs and even a fridge, sending 750,000 spam emails [15]. People laughed at the “zombie fridge.” Twelve years later, it’s no longer a joke.

Example 1: Supermarket freezers turned into heaters (Oct–Nov 2026)

This is the freshest and strangest one. Attackers remotely pushed fridge and freezer temperatures up to 50°C overnight, while shops were closed, at more than 500 shops and supermarkets in France (investigation ongoing) [1]. Big names including E-Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U were hit, and in some cases the heat sparked fires or melted equipment [1].

It spread. A new wave on Monday, November 2, hit stores in Sweden, the Netherlands, Belgium, Ireland, Luxembourg and Estonia (investigation ongoing) [2]. The CEO of a Belgian refrigeration company said the units’ evaporators had been switched into defrost mode [2].

The attack appears to have used the freezers’ internet connection, which exists so staff can monitor and change temperatures remotely [3]. The manufacturer said most affected controllers were legacy products running outdated firmware, and that customers had been told to update them [1]. Who is behind it is still unclear [1].

Researchers had also flagged the risk earlier. Security firm Armis found 10 flaws (called Frostbyte10) in Copeland controllers used in supermarkets, and chained together they could allow remote code execution [4]. A fix existed, but it still has to be installed everywhere.

Example 2: Kimwolf, the botnet living in cheap TV boxes (2025–2026)

You buy a budget Android TV box and it works fine. Meanwhile it may be working for someone else.

Kimwolf was first documented in December 2025 and has enlisted more than 2 million Android devices, mostly off-brand smart TVs and set-top boxes [6]. It exploits low-cost devices that run customized operating systems with insecure software and don’t get regular security updates [5].

Indian readers should note this one. Bkav’s analysis lists Vietnam, Brazil, India and Saudi Arabia among the most affected countries, largely because unbranded TV boxes of unclear origin are so widely used [5]. Instead of breaking the device, Kimwolf turns it into an internet relay point that uses the owner’s legitimate IP address [5].

It also reaches past the TV. The US Justice Department said these botnets infected devices that are traditionally firewalled from the internet, getting into home networks that routers usually protect [6]. One bad gadget can become a doorway to everything else on your Wi-FiExample 3: BADBOX 2.0, infected before you even open the box

In July 2025, Google sued the operators of BADBOX 2.0, a botnet that compromised over 10 million Android devices, mostly cheap TV boxes, tablets and projectors that lacked Google Play Protect certification [7].

The scary part is when the infection happens. According to reporting on an FBI warning, many devices are compromised before the buyer even opens the box, or during setup when apps are downloaded from unofficial marketplaces [8]. You can do everything “right” at home and still start with a compromised gadget.

Example 3: BADBOX 2.0, infected before you even open the box

In July 2025, Google sued the operators of BADBOX 2.0, a botnet that compromised over 10 million Android devices, mostly cheap TV boxes, tablets and projectors that lacked Google Play Protect certification [7].

The scary part is when the infection happens. According to reporting on an FBI warning, many devices are compromised before the buyer even opens the box, or during setup when apps are downloaded from unofficial marketplaces [8]. You can do everything “right” at home and still start with a compromised gadget.

Example 4: Your home internet, rented out (July 2026)

Not every attack wants your data. Some just want your connection. In July 2026, Google’s Threat Intelligence Group worked with the FBI, Lumen and others to disrupt NetNut, a residential proxy network spanning home devices [9]. Google estimated it held at least 2 million devices, including smart TVs and streaming boxes [10].

A residential proxy means strangers route their traffic through your home IP so it looks like normal household browsing. Your connection could end up carrying scraping, fraud, or worse, and your IP picks up the reputation.

Takedowns aren’t a cure either. They remove the control servers but don’t fix the underlying weaknesses, so millions of vulnerable devices stay online for the next variant [8].

Example 5: When one vendor’s breach grounds flights (Sept 2025)

Public kiosks and check-in systems show how one supplier can affect thousands of people. The EU cybersecurity agency ENISA confirmed that a third-party ransomware incident caused the outage that hit Heathrow, Berlin Brandenburg and Brussels airports, with dozens of flights cancelled [11].

Reports differ on exactly what failed. One outlet said the cloud-based check-in outage knocked out self-service kiosks across multiple hubs [12]. Another said check-in desks and baggage drops were affected but not the self-service kiosks [13]. Either way, the lesson holds: you can be perfectly secure and still go down because your supplier didn’t.

Example 6: The 1.3 million TV box takedown (Nov 2026)

This one landed just days ago. Google took down a massive Android TV botnet that had infected over 1.3 million TV boxes, but Android Central notes that infected devices remain dangerous even after the takedown [14].

Get Arnav Badhan’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

That sums up the pattern. Law enforcement and tech giants can cut the head off a botnet, but the devices are still sitting in living rooms, running old software, waiting for the next operator.

The common thread

Across all six, the causes are boring:

• Outdated firmware nobody installed
• Devices that never needed to be online but are
• Cheap, uncertified gadgets that ship weak or already infected
• Third-party suppliers that become a single point of failure
• Owners who can’t see anything wrong, since the TV still plays and the fridge still hums

One more point from the French case: the small computers inside these appliances tend to be “dumb,” often unable to tell when they’re being misused [3].

How this affects normal people

• Money: spoiled stock, ransomware and eventually higher prices
• Privacy: cameras, speakers and TVs that can be watched or abused
• Disruption: cancelled flights, dead kiosks, empty shelves
• Your internet, borrowed: slower speeds, a bad IP reputation, unwanted traffic from your home
• Physical safety: overheating equipment, as the fires in France showed

What could happen next

An analyst quoted after the French attacks warned that such attacks could evolve to target medical or energy systems, and that connected infrastructure live on the internet can be hacked [1]. That’s an expert’s opinion, but the Frostbyte10 research and the repeat wave in November suggest it’s a realistic concern.

How to protect yourself

At home

1. Change default passwords on every device, router included.
2. Update firmware and enable auto-updates where possible.
3. Put smart devices on a separate Wi-Fi network. Keep TV boxes, cameras, smart speakers and robot vacuums on one network, and phones, NAS units and computers on the main one [7].
4. Buy from reputable brands. Choose certified TV boxes with Google Play Protect, or buy from reputable telecom operators and ISPs [7].
5. Return suspicious devices. A cheap streaming box isn’t worth risking your banking data or your IP address’s reputation [7].
6. Turn off what you don’t use, such as remote access and microphones, and enable two-factor authentication on device apps.

For businesses and campuses

1. Disconnect equipment from the internet or restrict access. France’s cybersecurity agency advised affected operators to do exactly this, and to run software updates [1].
2. Keep an inventory of every connected device. You can’t patch what you don’t know exists.
3. Ask your vendors hard questions about updates and security.

The takeaway

Smart doesn’t mean secure. Every connected gadget is a tiny computer, and tiny computers need passwords, updates and a little suspicion. The next big attack might not need your laptop. It might just need your TV box, your freezer controller, or a supplier you’ve never heard of.

So update that firmware, change that default password, and look at your gadgets a little differently.

References

1. Al Jazeera, “French fridge fright: Why supermarkets have become target for hackers” (Oct 13, 2026): link
2. NBC News, “Supermarkets across Europe hit by new fridge cyberattacks”: link
3. Scientific American, “How hackers are turning grocery store freezers into heaters”: link
4. TechRadar, “Supermarket freezers and other food storage could have been hacked following flaws discovery” (Frostbyte10): link
5. Bkav, “Low-cost TV Boxes and Smart TVs in Vietnam turned into nodes of a global botnet network” (Jan 2026): link
6. The Hacker News, “DOJ disrupts 3-million device IoT botnet” (Mar 2026): link
7. Kaspersky, “Is your TV box renting out your network?” (BADBOX 2.0, SuperBox): link
8. WebProNews, “Your Smart Home Devices Are Quietly Fueling Global Botnets”: link
9. The Hacker News, Smart TV category (NetNut disruption, July 2026): link
10. The Hacker News, Smart TV category (NetNut/Popa device estimate): link
11. Claims Journal, ENISA statement on European airport outage (Sept 22, 2025): link
12. Tom’s Hardware, “Hackers attack Europe’s automatic flight check-in systems”: link
13. Biometric Update, “EU airport disruptions caused by ransomware attack on Collins Aerospace MUSE”: link
14. Android Central, “Google takes down a massive Android TV botnet, but infected devices remain dangerous” (Nov 3, 2026): link
15. TechRadar, “Smart fridge goes rogue, helps spam 750,000 email accounts” (2014): link