In late 2025, a staggering 81% of broadband users were found to have never changed their router’s default administrative password, opening the door to significant malware risk.

This widespread negligence was revealed in Broadband Genie’s fourth major router security survey, where 3,242 users were polled to gauge progress on consumer cybersecurity awareness.

Despite regulatory pushes and increased media attention, most users remain vulnerable, rendering their household networks and connected devices susceptible to compromise.

The roots of this problem trace back to an enduring blend of user unawareness and confusing router interfaces.

Many consumers equate router setup with minimal configuration: plug in, connect, and browse the web.

Yet, this leaves gateways open for attackers who can readily find manufacturer-default admin credentials on the open web.

Once these details are leveraged, malicious actors gain intimate access to the device, facilitating surveillance, DNS tampering, internal pivoting, or installation of persistent malware.

It is this architectural weakness that has empowered a new wave of malware to automate penetration campaigns against poorly-configured home routers across the globe.

Broadband researchers noted the malware’s swift adoption of credential brute-forcing and default-password attacks as a dominant vector.

Compromised routers become launchpads for botnets, phishing operations, and data exfiltration campaigns.

Case studies and reports highlight the ease with which threat actors automate exploitation: using known credential pairs and unauthenticated web interfaces, attackers deploy scripts that rapidly cycle through default logins across residential IP address blocks.

Attack Vector Deep Dive: Infection Mechanism

At the core of these attacks lies automated credential stuffing—the process of systematically attempting commonly-known router admin usernames and passwords until access is gained.

A typical payload delivered post-exploitation automates configuration theft and persistence. Below is a representative code snippet demonstrating how malware initiates a brute-force loop to hijack router admin panels using Python:-

import requests

def brute_force_admin(target_url, creds_list):
    for username, password in creds_list:
        response = requests.post(f"{target_url}/login", data={"user": username, "pass": password})
        if "dashboard" in response.text:
            print(f"Compromised: {username}:{password}")
            return True
    return False

# Example usage with common credentials
credentials = [("admin", "admin"), ("user", "1234"), ("root", "password")]
brute_force_admin("http://192.168.1.1", credentials)

Once successful, the malware may alter DNS settings, disable security updates, or establish remote backdoors, effectively enslaving the device. Real-world reports demonstrate that persistent router malware often abuses these unaltered credentials for repeated re-infection, even after device reboots.

This persistent threat landscape underscores the critical importance of changing default administrative credentials and highlights the ongoing role of broadband research in tracking and combating new strains of router malware.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post 81% Router Usres Have Not Changed Default Admin Passwords, Exposing Devices to Hackers appeared first on Cyber Security News.

The emergence of Pegasus and Predator spyware over the past several years has transformed the landscape of mobile device security.

These advanced malware strains—deployed by sophisticated threat actors for surveillance and espionage—have repeatedly demonstrated their ability to exploit zero-click vulnerabilities, leaving high-profile individuals and at-risk communities exposed.

Critical forensic analysis has long relied on remnants within iOS system logs, particularly the shutdown.log file, to discern traces of such infections even after the malware attempts to erase itself.

With the release of iOS 26, forensic methodologies face an unprecedented setback. iVerify analysts identified that Apple’s latest OS version now overwrites the shutdown.log file upon each device reboot, instead of appending new log entries.

This seemingly innocuous change—whether intentional or inadvertent—has significant consequences for digital evidence preservation.

Any device updated to iOS 26 that is subsequently restarted will see all prior shutdown.log content erased, destroying potential indicators of compromise linked to Pegasus, Predator, or similar threats.

Previously, sophisticated spyware like Pegasus would attempt to purge or tamper with shutdown.log as part of its anti-forensics tactics, a process that still left behind subtle indicators for vigilant analysts.

iVerify researchers have detailed that this “double erasure”—malware deletion followed by OS-level overwriting—now fully sanitizes this critical artifact, hampering investigations and masking successful compromises far more effectively than previous tactics.

Infection Mechanism and Evidence Erasure in iOS 26

Inspection of historic shutdown.log entries revealed unique markers left by Pegasus in past infections, such as references to processes like com.apple.xpc.roleaccountd.stagingcom.apple.WebKit.Networking.

Since iOS 26, such forensic signals are not merely buried—they are irretrievably deleted on the next boot.

Boot and reboot events (Source – iVerify)

The log’s prior structure, which appended each shutdown entry, offered investigators a chronological view vital for tracing infection timelines.

The technical transition to full overwriting shows a before-and-after comparison of the shutdown.log behavior after reboot.

This system-level change, reported by iVerify as the foremost group uncovering this development, alters the balance between attackers and defenders, raising urgent questions about digital evidence, user protection, and malware accountability.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post iOS 26 Deletes Pegasus and Predator Spyware Infection Evidence by Overwriting The ‘shutdown.log’ file on Reboot appeared first on Cyber Security News.