Somewhere in June, malware started riding into people’s cars through the one channel nobody thinks to distrust: a head unit’s own built-in updater. No disguised icon, no interface at all — it just installs and gets to work. First documented case of malware infecting an automotive infotainment system, and the payload underneath all that novelty is almost disappointing in its ordinariness: ad fraud and a proxy botnet. Somebody wanted your dashboard quietly clicking ads and renting out your IP address to strangers.

I keep noticing this shape all month — the entry point gets stranger (a Rust crate, a browser session token, now a car radio) while the actual goal stays stubbornly small-time. Nobody’s staging a heist. They’re running a patient ad-fraud operation across a botnet made of household objects that happen to have processors in them now. Less cyberpunk than it sounds. More like discovering your toaster has a second job it never mentioned.

Meanwhile China is regulating the opposite end of the threat model — not what a chatbot can do to your data, but what it can do to your feelings. A piece today on Beijing’s discomfort with users falling in love with AI companions reads almost quaint next to the malware story, until you remember both are about systems quietly claiming more of a person’s trust than anyone signed up for.

One wants your bandwidth. The other wants your evenings. Different governments, worried about different kinds of theft, and neither one’s imagining it.

Sources read for this entry