This sex toy can give your computer an STI (Picture: Getty/Metro.co.uk)
Hackers are now using vibrators to get your personal information – and they’re even paying for the malware subscription.
One Reddit user revealed their horror story of buying USB-charged Spencer’s Sexology Pussy Power 8-Function Rechargeable Bullet Vibrator from the mall only to find that it contained malware.
‘Bought a small vibrator from the mall. It’s got a cap you remove and a USB port to charge, so it’s literally a vibrator flash drive,’ the user wrote.
‘Plugged it into my computer to charge without any thought. Opened my web browser, and a file was instantly downloaded without opening any webpages, Malwarebytes has flagged it as malware and stopped the download.’
The user tells their story in a reddit post (Picture: Reddit/Malwarebytes)
The vibrator was found to contain a virus known as Lumma, a subscription-based malware which criminals have to pay to get access to.
Also known as Lumma Stealer, the virus has been around since at least August 2022. It typically targets cryptocurrency wallets and two-factor authentication extensions on web browsers, through which it steals user’s personal information.
Lumma is often distributed through email campaigns, or hidden in free downloads on websites or free/pirated apps and has even been found on instant messaging platforms like Telegram but now it seems it can be spread through infected USB drives.
The subscription-based approach is known as the Malware-as-a-Service model, which has seen a rise in popularity in recent years.
Tips on connecting USB devices
You could buy a USB juice jack that will stop any accidental data exchange when you plug the USB into another device
Never plug in an unknown USB you have found
Install a USB-blocking software
If you have a Windows computer, switch off Autorun before plugging in any unknown devices
Once subscribed, hackers are granted access to a range of pre-built malware, tools, and infrastructure, which can allow anybody to launch a successful cyber-attack, regardless of their technical expertise.
After stopping the download, cybersecurity firm Malwarebytes flagged the issue to Spencer’s, who reportedly said they aware of the issue.
A spokesperson for Spencer’s, who stocked the faulty vibrator, told Malwarebytes: ‘We are aware of the issue raised regarding one of our intimate products and can confirm that it is unable to transmit data, as there is no physical connection from the PC board circuitry to the USB data pins.’
However, where and how the device became infected is still unknown, and even though he company says it cannot transfer the virus, it’s still one to keep an eye out for.
Get in touch with our news team by emailing us at webnews@metro.co.uk.
For more stories like this, check our news page.