TLDR Tech / InfoSec
$10 Domain Could Have Handed Hackers 25k Endpoints, Including in OT and Gov Networks
A cheap browser plugin infected Windows machines and ran PowerShell to shut down antivirus, stop updates, and stay hidden using scheduled tasks and WMI. It stored future malware in folders that Microsoft Defender ignores by default. A single unregistered update domain could have let an attacker silently push code to about 25,000 computers in 124 countries, including OT, government, healthcare, and big-company networks.
Read the full story