SuperBox

April 7, 2026

AI Summary

5 min read

SuperBox: The Trojan Horse in Your Living Room

Jack Rhysider opens this episode of Darknet Diaries with a simple question: has a computer ever been recalled because it was dangerous? A garlic press can be recalled after ten people cut their fingers, but what about a device that drains crypto wallets, steals Steam accounts, and compromises email? That question leads into one of the most unsettling stories the show has ever covered — a cheap streaming box sold on Amazon, Walmart, and Best Buy that comes pre-loaded with malware, probes every device on your home network, and may be part of a state-sponsored intelligence operation.

The Discovery

The story begins when Deadass, a security professional with a background in rhetoric and propaganda from UC Berkeley, visits her father — a senior executive at an oil and gas company. He's excited about a new device called the SuperBox that gives him thousands of channels, movies, and pay-per-view events for a one-time fee of $300. Her younger sister, also studying cybersecurity, mentions the home network has been slow ever since the boxes arrived. Multiple boxes.

Continue reading the full summary in the app — free to try.

Read Full Summary →

Free • No credit card required

Listen to Audio Summary Open in App

Never miss an episode of Darknet Diaries

Get every new episode summarized in your inbox — free, ~5 minutes to read.

No spam. Unsubscribe anytime.

What you'll learn

1 (00:00) **IKEA Recall & The Question of Dangerous Computers** - Jack opens with a story about an IKEA garlic press recall and asks if computers have ever been recalled for being dangerous.
2 (04:49) **Introducing Deadass** - Jack meets researcher Deadass at DEF CON and discusses her background in rhetoric and propaganda, which informs her security research.
3 (08:04) **The Superbox Discovery** - Deadass's father excitedly shows her a "Superbox" that gives him thousands of channels and movies for $300.
4 (09:56) **Initial Network Analysis: Tencent and SCADA** - Deadass sets up packet captures and watches the Superbox's network traffic.
5 (12:18) **Aggressive Network Reconnaissance** - The Superbox begins ARPing every device on the local network, overwhelming them and impersonating them.
6 (14:01) **The Search for the Manufacturer** - Deadass discovers the manufacturer, GBS Labs, is a shell company with fake LinkedIn profiles and stock photos.
7 (16:58) **The Influencer Campaign** - Deadass finds a network of small YouTube influencers being paid 50% of proceeds to promote the Superbox.

+ Full timestamped outline available in the app

Show Notes

What if there was a device which gave you endless movies and TV shows without ads? Ok great sign me up! In this episode we interview “D3ada55”, who found such a device, but as she gazed into it, she discovered it gazing back at her.

Sponsors

Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com.

This episode is sponsored by Meter, the company building networks from the ground up. Meter delivers a complete networking stack - wired, wireless, and cellular - in one solution that’s built for performance and scale. Alongside their partners, Meter designs the hardware, writes the firmware, builds the software, manages deployments, and runs support. Learn more at meter.com.

This episode is sponsored by Exaforce. Exaforce was created to handle the complete security operations workflow - detect, triage, investigate, respond. Exabots autonomously manage every stage, eliminating gaps between alert and action that slow down traditional security operations. And how it works is simple too: the exabots ingest all security data and then semantically connects it to understand the full context of security events and how they relate to each other. Learn more at exaforce.com/darknet-diaries.