New Malware Is Taking Over Home Routers and Cameras. How to Protect Your Devices

Researchers at QiAnXin's XLab discovered a new type of malware called RustDuck that is taking control of home routers, IP cameras, Android TV boxes, and poorly secured servers. Once infected, these devices are linked together into a network that attackers use to knock websites and online services offline. The researchers have been tracking this threat since February 2026 and note that it is changing rapidly. This affects families who use home routers, security cameras connected to the internet, and Android streaming boxes. If your router or camera still has the default password that came from the factory, or if you never change the admin password, your device could be vulnerable. The malware targets devices with weak security settings.

Take these steps right now to protect your home devices.

1. Change the password on your home router. Log into your router's settings (check the sticker on the device or your manual for instructions) and create a new, strong password.
2. Change passwords on all internet-connected cameras and smart devices. Never leave them on factory default settings.
3. Check for firmware updates for your router and cameras, and install them.
4. If you have an Android TV box or streaming device, make sure it is from a reputable brand and keep it updated. Going forward, treat your router and smart home devices like you treat your phone. They need strong passwords and regular updates. When you buy a new router, camera, or smart device, changing the default password should be the very first thing you do. Set a calendar reminder every six months to check for firmware updates on these devices.