Daily Briefing for 11.03.26

Top stories.

1. Google disrupts a major Android botnet.
2. Apple warns German politicians of spyware targeting.
3. New VOLTA malware uses AI to automate victim analysis.
4. The UK’s NCSC warns of likely AI-powered attacks on critical infrastructure.

Google disrupts a major Android botnet.

KrebsOnSecurity reports that Google and industry partners have disrupted a botnet composed of more than 1.3 million backdoored Android TV set-top devices. The Google Threat Intelligence Group (GTIG) said in a blog post yesterday that the compromised devices were manufactured and knowingly backdoored by Videostrong Technology Co., a China-based Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM).

The botnet malware, dubbed “XCPE,” conducted ad fraud, enrolled victims’ Internet addresses into residential proxy services, and enabled the installation of additional malware. GTIG says Videostrong operated the botnet for financial gain, and the researchers “believe this campaign wasn’t an isolated rogue insider or a development oversight.”

Google used legal action to dismantle the botnet’s infrastructure, and the company has banned Videostrong from building and selling certified Android devices in the future.

Apple warns German politicians of spyware targeting.

Germany’s federal cybersecurity office, the BSI, has disclosed that several members of the German Bundestag were targeted by mercenary spyware, TechCrunch reports. The BSI says the politicians received threat notifications from Apple.

Apple last week sent out a new wave of threat notifications to users targeted by spyware, warning users in 99 countries that their devices were potentially compromised. While a threat notification does not necessarily mean a device was hacked, the BSI says users who received these notifications “assume that their device may have been compromised.”

New VOLTA malware uses AI to automate victim analysis.

Cisco Talos has published a report on VOLTA, a new Windows infostealer that uses AI to automatically profile victims and determine their potential value. The malware steals the victims’ data, then sends it to an LLM for analysis. The malware defaults to Anthropic's Claude Opus 4.6, with fallback options including Moonshot AI’s Kimi and Google’s Gemini. If the AI responds to the prompt with an answer containing “I can’t” or a similar refusal, the malware tries again with a more permissive model. Talos notes, “As AI integration in malware matures, refusal resilience may become a standard design requirement.”

The UK’s NCSC warns of likely AI-powered attacks on critical infrastructure.

The UK’s National Cyber Security Centre (NCSC) warns that AI-powered malware will feature heavily in ransomware attacks against critical infrastructure by 2028, Infosecurity Magazine reports. The NCSC’s CEO Richard Horne said in a speech today that the danger isn't necessarily new attack techniques, but AI's ability to discover and exploit existing vulnerabilities at unprecedented speed and scale.

The NCSC’s latest State of the Cyber Nation report states, “Cybercriminal adoption of AI will highly likely increase the scale and efficiency of ransomware operations, social engineering and vulnerability exploitation. Open source AI tools originally intended to assist security researchers are likely to be repurposed by cyber criminals to orchestrate and automate their existing workflows. This is expected to further reduce operational costs for criminals while increasing attack volumes against less resilient targets.”