03/11/2026
271 point-of-sale terminals. One week in October. 1,508 command-and-control alerts, all pointing to the same server.
The terminals shipped with a factory-installed Android app linked to a known malware family. No one on the customer’s side installed it.
FLOLIVE® network-level security monitoring flagged the traffic. Our team traced it through the alert history, packet captures, and a comparison across the fleet, without installing an agent on the devices.
The terminals were not under active attack during the analysis. Of the 1,508 connections, 1,497 went unanswered and the remaining 11 received empty replies. A quiet server does not make the devices safe.
The immediate containment step is to block the malicious hostnames on the customer’s sub-account APNs while the fleet is remediated with clean firmware.
Ahead of peak retail season, network visibility can expose traffic that a device does not report.
Link in the comments.