Loading story…
Attackers compromised Bluetooth-enabled pedestrian crosswalk buttons in multiple US cities, replacing standard walk prompts with unauthorized political and celebrity-impersonation audio. Roughly 20 intersections in Silicon Valley, including Menlo Park, Redwood City, and Palo Alto, were affected, while similar incidents were later reported in Seattle and Denver. In Denver, two newly installed crosswalks were altered to broadcast anti-Trump messages instead of normal pedestrian instructions.
Reporting indicates the intrusions were enabled by weak or factory-default credentials on Polara Enterprises devices, including the widely cited default password 1234, combined with a publicly available configuration app. City officials in Denver changed passwords after the incident and police opened investigations, but authorities in other cases were unable to identify the perpetrator because the devices did not log audio uploads and surveillance footage provided little value. The incidents have intensified scrutiny of cybersecurity requirements for public infrastructure used by visually impaired pedestrians and exposed gaps in municipal oversight of connected safety systems.
Map this exposure pattern across your cloud, code, and identities.
5 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting and expert analysis indicated the attacker likely exploited weak default passwords, including '1234,' together with a publicly available configuration app used for Polara Enterprises crosswalk buttons. The disclosures also highlighted missing logging and weak municipal cybersecurity requirements around the devices.
After the Silicon Valley incidents, similar concerns reached Seattle and Denver as officials examined whether comparable pedestrian crossing devices had been compromised. The cases were reported as part of the same broader pattern of abuse involving insecure crosswalk audio systems.
In April 2026, an attacker altered Bluetooth-enabled pedestrian crosswalk buttons at roughly 20 intersections in Menlo Park, Redwood City, and Palo Alto. Standard walk prompts were replaced with spoofed recordings imitating Mark Zuckerberg and Elon Musk.
Following the Denver incident, city officials changed the passwords on the affected crosswalk devices and police opened an investigation. The response focused on unauthorized access enabled by default credentials.
Two pedestrian crosswalks in Denver, Colorado, were reportedly compromised and made to play a political message instead of standard walk instructions. The affected devices were described as newly installed and still using factory-default credentials when accessed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Malicious actors have exploited unsecured US radio transmission equipment to hijack broadcasts, injecting profanity-laden and offensive content by abusing the Emergency Alert System (EAS) tones. The Federal Communications Commission (FCC) issued a warning after a series of incidents in Texas and Virginia, where attackers targeted Barix network audio devices, reconfiguring them to stream attacker-controlled audio that included simulated or real EAS alert tones followed by explicit material. Some stations, such as HTX Media in Houston, confirmed their broadcasts were overtaken, with listeners reporting repeated emergency tones and vulgar tracks during live programming. The FCC attributed these intrusions to unsecured studio-to-transmitter links and default or weak device configurations, allowing unauthorized access to critical broadcast infrastructure. In response, the FCC published a checklist of best practices for broadcasters, urging immediate firmware updates, replacement of default passwords, network segmentation, and vigilant monitoring of equipment logs. The agency also referenced prior guidance and encouraged direct engagement with equipment manufacturers to ensure robust security measures are in place, particularly for Barix hardware commonly used in the affected systems.
Jun 29, 2026
A newly disclosed vulnerability, **CVE-2026-18411**, affects Acrisure **KARR BT** and **DR-100** automotive anti-theft systems by using a shared hard-coded Bluetooth authentication key across devices. The flaw, classified as **CWE-321**, allows an attacker within Bluetooth range to send unauthorized commands without prior privileges or user interaction, creating a direct path to compromise protected vehicle functions. Security reporting and government advisories warn that successful exploitation could let an attacker unlock doors and interfere with engine immobilization on affected vehicles. The issue carries a **CVSS v3.1** score reflecting high integrity and availability impact (`AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`), and has been referenced by both a **CISA ICS advisory** and a **CERT-PY** notice covering the Bluetooth product vulnerability.
Aug 8, 2026
Researchers at the University of California San Diego disclosed severe flaws in the dealer-installed aftermarket **KARR Security System**, a Bluetooth-enabled alarm and anti-theft device estimated to be present in more than **2 million U.S. vehicles**. The vulnerabilities allow an attacker within Bluetooth range to silently unlock doors, disable alarms, trigger horns and lights, and even block the engine from starting, creating both theft and roadside immobilization risks. The researchers said the issue stems in part from a shared embedded authentication key used across KARR devices, which they extracted by reverse-engineering the official mobile app and validating with a proof-of-concept Android tool. The findings also raised privacy concerns because KARR devices broadcast identifiable Bluetooth signals that could be correlated with public WiGLE data to estimate deployment and potentially infer vehicle movements or frequently visited locations. **Acrisure Protection Group**, which sells the KARR system, released a firmware update after responsible disclosure, but remediation requires owners or dealerships to identify the hardware and manually apply the patch through the KARR smartphone app. Researchers warned that many drivers may not realize the device is installed, because it is often added by dealerships and can remain in vehicles after resale.
Aug 5, 2026