Technology

MAGA’s next wave of influencers saved TikTok

Published

10 months ago

April 29, 2025

MAGA’s next wave of influencers saved TikTok

The death knell for American TikTok should have been on March 13th, 2024, when Congress voted on an overwhelmingly bipartisan basis to force its parent company to sell the app or face an outright ban. Rarely do you ever see Republicans and Democrats in agreement over anything, but both sides saw the app as a national security threat and worried that the Chinese government would use it to sow misinformation and secretly harvest its users’ personal data. After the bill was signed into law by President Joe Biden and negotiations with ByteDance dragged on, a ban seemed inevitable, even if his adversary Donald Trump won.

After all, MAGA had always been consistent about hating two things that happen to proliferate on TikTok: the Chinese Communist Party, whom they believed were secretly bankrolling the Bidens; and people who openly support Palestine. And in 2020, Trump signed an executive order attempting to ban TikTok, partially after seeing how TikTok was boosting support for his then-rival Joe Biden.

But months after the law officially kicked in, Trump sits in the Oval Office, TikTok remains online under Chinese ownership, and its fate hinges on whether the US and China can come to an agreement that would end an international trade war that’s already wiped out over $5 trillion. Trump has repeatedly extended a (dubiously legal) pause on enforcing the ban, which could well be pushed back even farther. And this time, you really can blame the kids for this one.

Every old elected official has an army of younger, ambitious staffers supporting them — drafting the bills, filling their schedules, and staying up late to run files up and down the halls. And the day that bill passed, the Republican Hill staffers were glued to the app, binging on aspirational content from right-wing TikTokers as their bosses railed about threats to national security next door. It was those younger, ambitious staffers who eventually got in Trump’s ear as he conducted his alternative media blitz to the White House.

It had taken a few years for them to come around, but young MAGA influencers were less inclined to see the app as a Chinese psy-ops machine. One of the final blows came when a 2022 Washington Post investigation revealed that Meta, a company they widely loathed for its content moderation policies and meddlesome CEO, had been paying a Republican comms firm called Targeted Victory to push a narrative tying TikTok to the CCP. (If there’s anything they hate more than Big Tech, it’s GOP establishment consultants working in cahoots with Big Tech.)

Any lingering hesitations on Trump’s part vanished weeks after the law’s passage. The New York Times reported in May of 2024 that TikTok’s internal metrics revealed users vastly preferred Trump over Biden: there had been 1.29 million pro-Trump posts versus 651,000 pro-Biden posts since November 2023.

“That was a big wake-up call for a lot of us, when we saw that Gen Z was really supportive of President Trump,” a Republican digital operative familiar with the campaign’s strategy told The Verge. Trump soon launched his own account, TikTokers soon started reposting his content, and as the operative put it: “His account just crushed.”

One reelection and 100 days later — after his collabs were served into the feeds of Logan Paul and Aiden Ross’s followers outside the right-wing media ecosystem, after viral trends turned his awkward old-man dances into NFL touchdown celebration fodder, and after he promised to keep TikTok alive in the US in defiance of the Republican olds — Trump’s TikTok presence is now his crucial lifeline to the zoomers, who would have dismissed him as a boomer if he hadn’t packaged his attacks on the press and dehumanization of undocumented immigrants into an account speaking in their language of deep-fried 4Chan memes, aggressive use of emoji in captions, AI-generated images of Trump heroically protecting the border, and pro-Trump content hopping on the latest trending songs. (But in a based and red-pilled way, not a cringe way).

While Congress was passing its TikTok ban, congressional staffers were glued to their feeds

Over its roughly one-year lifetime, according to journalist Kyle Tharp, the campaign account @TeamTrump has garnered 2.8 billion views, the most of any campaign or politician on the platform. In contrast, the Democrats’ TikTok account has roughly 670 million views, while @KamalaHQ, the official account of Kamala Harris’s campaign, has been inactive since December. The momentum has carried past the election, too: since January 1st, @TeamTrump has gained a staggering 230 million views and 16 million likes. That month, Trump posted an infographic on Truth Social showing his performance on the platform and asked: “Why would I want to get rid of TikTok?”

Trump is best known as an all-caps microblogger, and he’s several decades older than the vast majority of TikTok’s users. (Roughly 70 percent of American TikTok users are between 18 and 34.) But ever since the 1980s, Trump’s spent his entire adult life shamelessly feeding outrageous quotes and juicy, scandalous stories about himself to New York City tabloids and reality television, two voracious media ecosystems where all attention is good attention. Trump is basically doing the same thing in 2025, just with some technology involved. As a new media consultant might put it, he’s generating nonstop, attention-grabbing content for a social media platform — one that rewards creators who consistently upload content that viewers find engaging enough, whether out of entertainment or anger, to watch for more than two seconds. “TikTok is primarily an entertainment app,” noted the digital operative, “and our usage of it was just significantly more savvy than [the Democrats].”

Say what you will about geopolitical security and trade wars: if your goal is to convince enough Americans that you are a good president, it is absolutely worth keeping TikTok around for that reach alone. (Perhaps in a show of gratitude for swaying Trump and saving their company, TikTok sponsored a glitzy DC party on the eve of the inauguration in honor of MAGA’s biggest content creators.)

America has a long history of right-wing demagogues who grow their power via mass communication, from Father Coughlin on the radio in the 1930s, to Roger Ailes on cable television in the 2000s. The MAGA social media influencers are their digital descendants. They’re building a massive audience, holding their attention, and getting them to vote a certain way or boycott a certain thing — a political skill, no matter how you cut it, just like knocking on doors and kissing babies.

MAGA influencers see TikTok as a relatively stable platform for their work

Granted, they were not the first to the game: Barack Obama famously used Twitter to reach out to younger voters, raise hundreds of millions of dollars, and bypass traditional media. But the Democrats were never able to replicate his success, whereas the Republicans paid attention, studied his tactics, and launched training camps to create their own digital influencer army. By the time of the 2024 Republican primaries, their power was such that Ron DeSantis was actively trying to draft influencers to serve as his online surrogates, and Trump had stacked his war room with his own influencers, who ultimately persuaded him to get on TikTok.

MAGA influencers also view TikTok as a relatively reliable platform to publish pro-Trump content without fear that their accounts will get demonetized, restricted, or worse, deactivated. After the events of January 6th, the MAGA influencer-industrial complex faced an existential crisis when tech companies began clamping down on their accounts: AWS booted the right-wing social media network Parler from its servers, while Facebook and Twitter shut down the accounts of election-denying content creators and influencers — including the ones that belonged to the President of the United States — causing them to suddenly lose their massive follower counts, and in some cases, their livelihoods.

TikTok had adopted the industry’s content moderation best practices at the time, removing QAnon content, vaccine conspiracies, and covid misinformation. Its broader policies around violence and sexually suggestive words helped inspire the rise of self-censoring “algospeak.” But it escaped right-wing scrutiny at the time — there largely were no high-profile MAGA accounts, much less any as high-profile as the President, to deplatform.

This left the door open for pro-Trump influencers to have a fresh start on TikTok, albeit with tempered expectations. The benefits of reaching a new audience began to override suspicions of Chinese interference. “It was a slow burn,” Vish Burra, the executive secretary of the New York Young Republicans Club who’s previously served as a communications adviser for Matt Gaetz and George Santos, told The Verge. “People on the right, especially young people, were appreciative of TikTok for being around and not canceling people and still paying people out.” They also realized that TikTok content could be uploaded to other platforms, whether on purpose or whether it just happened naturally. All good viral TikToks eventually end up on Instagram Reels and YouTube Shorts — a trend the Trump campaign leaned into by reposting its favorite pro-Trump TikToks to its X account.

Many MAGA creators don’t believe that TikTok labels their political views (regressive as they may be) as hate speech violating its terms of service agreements. “Maybe they take your video down, but they don’t, like, crush your whole channel,” says Burra.

“These fucking people are worthless, and you can’t trust them”

Giving the MAGA influencers access to the app preserves their ability to push Trump’s message to a Gen Z audience, and in turn, gives him more momentum to steamroll over Republicans’ traditional third-rail issues: the China hawks, the pro-Israel officials who believe the app serves up too much pro-Palestine content, the evangelicals who think the app is turning the children into enbies, the business lobby terrified that a fight over an entertainment app for young people could prolong a trade war. It also fits into his biggest brand attribute: being good at deals. (In a Supreme Court filing opposing the ban, the administration bragged about Trump’s “consummate dealmaking expertise” and mentioned, without any specifics, that his first term was “highlighted by a series of policy triumphs achieved through historic deals.”)

None of this has translated into actual trust that TikTok will remain friendly, however. Due to its foreign ownership, MAGA users feel the algorithm and content moderation policies are somewhat insulated from American political changes. But given that whoever’s in the White House directly controls whether Google and Apple can keep it on their app stores, that insulation looks threadbare. And TikTok is still theoretically looking to sell to a US owner. Over the past several months, these users have watched tech CEOs like Mark Zuckerberg and Jeff Bezos (who are far less legally vulnerable than TikTok) rapidly restructure their companies’ core values — cutting DEI programs, eliminating content moderation policies, even turning a legacy newspaper into a “free market” mouthpiece — hoping to appease Trump and get tariff exemptions in return. And if a tech CEO can turn MAGA overnight for business purposes, they believe, there’s nothing stopping them from flipping back if a Democrat becomes president.

“The moment a Democrat is in, these fucking people are worthless, and you can’t trust them,” Burra says. “[The CEOs] will just start fucking canceling people and tweaking algorithms once the Democrats come and say, ‘We’re gonna fucking regulate you if you don’t.’”

But TikTok posing a national security threat — the reason that MAGA initially wanted a ban — now seems to be a nonissue. Besides, Burra says, he and his peers grew up under the assumption that some mysterious entity somewhere was already spying on them: a corporation, the CIA, China, whatever. “Everyone has my data except me. At least can’t I enjoy it? Can’t I make some money?”

Related Topics:policy Politics Social Media Tech

Click to comment

Technology

Jikipedia turns Epstein’s emails into an encyclopedia of his powerful friends

Published

6 hours ago

February 14, 2026

Press Room

Jikipedia turns Epstein’s emails into an encyclopedia of his powerful friends

The folks behind Jmail are at it again with a clone of Wikipedia that turns the treasure trove of data in Epstein’s emails into detailed dossiers on his associates. Entries include known visits to Epstein’s properties, possible knowledge of Epstein’s crimes, and laws that they might have broken. The reports are dense, listing how many emails they exchanged with Epstein, basic biographical information, and details about how they’re connected.

Beyond that, there are entries for the properties Epstein owns, detailing how they were acquired and the alleged activities that took place there. There are also entries for his business dealings, including his relationship with JPMorgan Chase.

It is worth noting that the entries are AI-generated. While a casual glance seems to suggest Jikipedia is citing its sources, it’s still possible (if not likely) that there are some inaccuracies contained within them. The Jmail X account said that they’ll be implementing the ability for users to report inaccuracies and request changes soon.

Technology

Android malware hidden in fake antivirus app

Published

6 hours ago

February 14, 2026

Press Room

Android malware hidden in fake antivirus app

NEWYou can now listen to Fox News articles!

If you use an Android phone, this deserves your attention.

Cybersecurity researchers warn that hackers are using Hugging Face, a popular platform for sharing artificial intelligence (AI) tools, to spread dangerous Android malware.

At first, the threat appears harmless because it is disguised as a fake antivirus app. Then, once you install it, criminals gain direct access to your device. Because of this, the threat stands out as especially troubling. It combines two things people already trust — security apps and AI platforms.

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

MALICIOUS GOOGLE CHROME EXTENSIONS HIJACK ACCOUNTS

Researchers say hackers hid Android malware inside a fake antivirus app that looked legitimate at first glance. (Kurt “CyberGuy” Knutsson)

What Hugging Face is and why it matters

For anyone unfamiliar, Hugging Face is an open platform where developers share AI, NLP and machine learning models. It is widely used by researchers and startups and has become a central hub for AI experimentation. That openness is also what attackers exploited. Because Hugging Face allows public repositories and supports many file types, criminals were able to host malicious code in plain sight.

The fake antivirus app behind the attack

The malware first appeared in an Android app called TrustBastion. On the surface, it looks like a helpful security tool. It promises virus protection, phishing defense and malware blocking. In reality, it does the opposite.

Once installed, TrustBastion immediately claims your phone is infected. It then pressures you to install an update. That update delivers the malicious code. This tactic is known as scareware. It relies on panic and urgency to push users into tapping before thinking.

FAKE ERROR POPUPS ARE SPREADING MALWARE FAST

The fake TrustBastion app mimics a legitimate Google Play update screen to trick users into installing malware. (Bitdefender)

How the malware spreads and adapts

According to Bitdefender, a global cybersecurity company, the campaign centers on a fake Android security app called TrustBastion. Victims were likely shown ads or warnings claiming their device was infected and were instructed to manually install the app.

The attackers hosted TrustBastion’s APK files directly on Hugging Face, placing them inside public datasets that appeared legitimate at first glance. Once installed, the app immediately prompted users to install a required “update,” which delivered the actual malware.

After researchers reported the malicious repository, it was taken down. However, Bitdefender observed that nearly identical repositories quickly reappeared, with small cosmetic changes but the same malicious behavior. That rapid re-creation made the campaign harder to fully shut down.

What this Android malware can actually do

This Trojan is not minor or annoying. It is invasive. Bitdefender says the malware can:

Take screenshots of your device

Show fake login screens for financial services

Capture your lock screen PIN

Once collected, that data is sent to a third-party server. From there, attackers can move quickly to drain accounts or lock you out of your own phone.

What Google says about the threat

Google says users who stick to official app stores are protected. A Google spokesperson told CyberGuy, “Based on our current detection, no apps containing this malware are found on Google Play.

“Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services.

“Google Play Protect can warn users or block apps known to exhibit malicious behavior, even when those apps come from sources outside of Play.”

BROWSER EXTENSION MALWARE INFECTED 8.8M USERS IN DARKSPECTRE ATTACK

Once installed, the malware could capture screenshots, fake login details and even your lock screen PIN. (Kurt “CyberGuy” Knutsson)

How to stay safe from Hugging Face Android malware

This threat is a reminder that small choices matter. Here is what you should do right now:

1) Stick to trusted app stores

Only download apps from reputable sources like Google Play Store or the Samsung Galaxy Store. These platforms have moderation and scanning in place.

2) Read reviews before installing

Look closely at ratings, download counts and recent comments. Fake security apps often have vague reviews or sudden rating spikes.

3) Use a data removal service

Even careful users can have personal data exposed. A data removal service helps remove your phone number, email and other details from data broker sites that criminals rely on. That reduces follow-up scams, fake security alerts and account takeover attempts.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy.

These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

4) Run Play Protect and use strong antivirus software

Scan your device regularly with Play Protect and back it up with strong antivirus software for added protection. Google Play Protect, which is built-in malware protection for Android devices, automatically removes known malware. However, it is important to note that Google Play Protect may not be enough. Historically, it hasn’t been 100% effective at removing all known malware from Android devices.

The best way to protect yourself against malicious links that install malware and potentially access your private information is to have strong antivirus software installed on all your devices. This protection can also help you detect phishing emails and ransomware, keeping your personal information and digital assets safe.

Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com

5) Avoid sideloading APK files

Avoid installing apps from websites outside the app store. These apps bypass security checks, so always verify the publisher name and URL.

6) Lock down your Google account

Your phone security depends on it. Enable two-step verification (2FA) first, then use a strong, unique password stored in a password manager to prevent account takeovers.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

7) Be cautious with permissions

Be cautious with accessibility permissions. Malware often abuses them to take control of your device.

8) Watch app updates closely

Malware can hide inside fake updates. Be cautious of urgent fixes that push you outside the app store.

Kurt’s key takeaways

This attack shows how quickly trust can be weaponized. A platform designed to advance AI research was repurposed as a delivery system for malware. A fake antivirus app became the threat it claimed to stop. Staying safe no longer means avoiding sketchy-looking apps. It means questioning even those apps that appear helpful and professional.

Have you seen something on your phone that made you question its security? Let us know your thoughts by writing to us at Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

Technology

The DJI Romo robovac had security so poor, this man remotely accessed thousands of them

Published

18 hours ago

February 14, 2026

Press Room

The DJI Romo robovac had security so poor, this man remotely accessed thousands of them

Sammy Azdoufal claims he wasn’t trying to hack every robot vacuum in the world. He just wanted to remote control his brand-new DJI Romo vacuum with a PS5 gamepad, he tells The Verge, because it sounded fun.

But when his homegrown remote control app started talking to DJI’s servers, it wasn’t just one vacuum cleaner that replied. Roughly 7,000 of them, all around the world, began treating Azdoufal like their boss.

He could remotely control them, and look and listen through their live camera feeds, he tells me, saying he tested that out with a friend. He could watch them map out each room of a house, generating a complete 2D floor plan. He could use any robot’s IP address to find its rough location.

“I found my device was just one in an ocean of devices,” he says.

A map like the one I saw, with robots and packets trickling in.

Image: Gonzague Dambricourt

On Tuesday, when he showed me his level of access in a live demo, I couldn’t believe my eyes. Ten, hundreds, thousands of robots reporting for duty, each phoning home MQTT data packets every three seconds to say: their serial number, which rooms they’re cleaning, what they’ve seen, how far they’ve traveled, when they’re returning to the charger, and the obstacles they encountered along the way.

I watched each of these robots slowly pop into existence on a map of the world. Nine minutes after we began, Azdoufal’s laptop had already cataloged 6,700 DJI devices across 24 different countries and collected over 100,000 of their messages. If you add the company’s DJI Power portable power stations, which also phone home to these same servers, Azdoufal had access to over 10,000 devices.

Azdoufal says he could remote-control robovacs and view live video over the internet.

When I say I couldn’t believe my eyes at first, I mean that literally. Azdoufal leads AI strategy at a vacation rental home company; when he told me he reverse engineered DJI’s protocols using Claude Code, I had to wonder whether AI was hallucinating these robots. So I asked my colleague Thomas Ricker, who just finished reviewing the DJI Romo, to pass us its serial number.

With nothing more than that 14-digit number, Azdoufal could not only pull up our robot, he could correctly see it was cleaning the living room and had 80 percent battery life remaining. Within minutes, I watched the robot generate and transmit an accurate floor plan of my colleague’s house, with the correct shape and size of each room, just by typing some digits into a laptop located in a different country.

Here are two maps of Thomas’ living space. Above is what we pulled from DJI’s servers without authentication; below is what the owner sees on their own phone.

Screenshots by The Verge

Here’s a fuller floor plan from Gonzague Dambricourt, who tried out a read-only version of Azdoufal’s tool.

Image: Gonzague Dambricourt (X)

Separately, Azdoufal pulled up his own DJI Romo’s live video feed, completely bypassing its security PIN, then walked into his living room and waved to the camera while I watched. He also says he shared a limited read-only version of his app with Gonzague Dambricourt, CTO at an IT consulting firm in France; Dambricourt tells me the app let him remotely watch his own DJI Romo’s camera feed before he even paired it.

Azdoufal was able to enable all of this without hacking into DJI’s servers, he claims. “I didn’t infringe any rules, I didn’t bypass, I didn’t crack, brute force, whatever.” He says he simply extracted his own DJI Romo’s private token — the key that tells DJI’s servers that you should have access to your own data — and those servers gave him the data of thousands of other people as well. He shows me that he can access DJI’s pre-production server, as well as the live servers for the US, China, and the EU.

DJI has MQTT servers associated with the US, EU, and China. I’m not sure what VG stands for.

Screenshot by Sean Hollister / The Verge

Here’s the good news: On Tuesday, Azdoufal was not able to take our DJI Romo on a joyride through my colleague’s house, see through its camera, or listen through its microphone. DJI had already restricted that form of access after both Azdoufal and I told the company about the vulnerabilities.

And by Wednesday morning, Azdoufal’s scanner no longer had access to any robots, not even his own. It appears that DJI has plugged the gaping hole.

But this incident raises serious questions about DJI’s security and data practices. It will no doubt be used to help retroactively justify fears that led to the Chinese dronemaker getting largely forced out of the US. If Azdoufal could find these robots without even looking for them, will it protect them against people with intent to do harm? If Claude Code can spit out an app that lets you see into someone’s house, what keeps a DJI employee from doing so? And should a robot vacuum cleaner have a microphone? “It’s so weird to have a microphone on a freaking vacuum,” says Azdoufal.

It doesn’t help that when Azdoufal and The Verge contacted DJI about the issue, the company claimed it had fixed the vulnerability when it was actually only partially resolved.

“DJI can confirm the issue was resolved last week and remediation was already underway prior to public disclosure,” reads part of the original statement provided by DJI spokesperson Daisy Kong. We received that statement on Tuesday morning at 12:28PM ET — about half an hour before Azdoufal showed me thousands of robots, including our review unit, reporting for duty.

Not just robovacs — DJI’s power stations also use this system.

Screenshot by Sean Hollister / The Verge

To be clear, it’s not surprising that a robot vacuum cleaner with a smartphone app would phone home to the cloud. For better or for worse, users currently expect those apps to work outside of their own homes. Unless you’ve built a tunnel into your own home network, that means relaying the data through cloud servers first.

But people who put a camera into their home expect that data to be protected, both in transit and once it reaches the server. Security professionals should know that — but as soon as Azdoufal connected to DJI’s MQTT servers, everything was visible in cleartext. If DJI has merely cut off one particular way into those servers, that may not be enough to protect them if hackers find another way in.

Unfortunately, DJI is far from the only smart home company that’s let people down on security. Hackers took over Ecovacs robot vacuums to chase pets and yell racist slurs in 2024. In 2025, South Korean government agencies reported that Dreame’s X50 Ultra had a flaw that could let hackers view its camera feed in real time, and that another Ecovacs and a Narwal robovac could let hackers view and steal photos from the devices. (Korea’s own Samsung and LG vacuums received high marks, and a Roborock did fine.)

It’s not just vacuums, of course. I still won’t buy a Wyze camera, despite its new security ideas, because that company tried to sweep a remote access vulnerability under the rug instead of warning its customers. I would find it hard to trust Anker’s Eufy after it lied to us about its security, too. But Anker came clean, and sunlight is a good disinfectant.

DJI is not being exceptionally transparent about what happened here, but it did answer almost all our questions. In a new statement to The Verge via spokesperson Daisy Kong, the company now admits “a backend permission validation issue” that could have theoretically let hackers see live video from its vacuums, and it admits that it didn’t fully patch that issue until after we confirmed that issues were still present.

Here’s that whole statement:

DJI identified a vulnerability affecting DJI Home through internal review in late January and initiated remediation immediately. The issue was addressed through two updates, with an initial patch deployed on February 8 and a follow-up update completed on February 10. The fix was deployed automatically, and no user action is required.
The vulnerability involved a backend permission validation issue affecting MQTT-based communication between the device and the server. While this issue created a theoretical potential for unauthorized access to live video of ROMO device, our investigation confirms that actual occurrences were extremely rare. Nearly all identified activity was linked to independent security researchers testing their own devices for reporting purposes, with only a handful of potential exceptions.
The first patch addressed this vulnerability but had not been applied universally across all service nodes. The second patch re-enabled and restarted the remaining service nodes. This has now been fully resolved, and there is no evidence of broader impact. This was not a transmission encryption issue. ROMO device-to-server communication was not transmitted in cleartext and has always been encrypted using TLS. Data associated with ROMO devices, such as those in Europe, is stored on U.S.-based AWS cloud infrastructure.
DJI maintains strong standards for data privacy and security and has established processes for identifying and addressing potential vulnerabilities. The company has invested in industry-standard encryption and operates a longstanding bug bounty program. We have reviewed the findings and recommendations shared by the independent security researchers who contacted us through that program as part of our standard post-remediation process. DJI will continue to implement additional security enhancements as part of its ongoing efforts.
Advertisement

Azdoufal says that even now, DJI hasn’t fixed all the vulnerabilities he’s found. One of them is the ability to view your own DJI Romo video stream without needing its security pin. Another one is so bad I won’t describe it until DJI has more time to fix it. DJI did not immediately promise to do so.

And both Azdoufal and security researcher Kevin Finisterre tell me it’s not enough for the Romo to send encrypted data to a US server, if anyone inside that server can easily read it afterward. “A server being based in the US in no way, shape, or form prevents .cn DJI employees from access,” Finisterre tells me. That seems evident, as Azdoufal lives in Barcelona and was able to see devices in entirely different regions.

“Once you’re an authenticated client on the MQTT broker, if there are no proper topic-level access controls (ACLs), you can subscribe to wildcard topics (e.g., #) and see all messages from all devices in plaintext at the application layer,” says Azdoufal. “TLS does nothing to prevent this — it only protects the pipe, not what’s inside the pipe from other authorized participants.”

When I tell Azdoufal that some may judge him for not giving DJI much time to resolve the issues before going public, he notes that he didn’t hack anything, didn’t expose sensitive data, and isn’t a security professional. He says he was simply livetweeting everything that happened while trying to control his robot with a PS5 gamepad.

“Yes, I don’t follow the rules, but people stick to the bug bounty program for money. I fucking don’t care, I just want this fixed,” he says. “Following the rules to the end would probably make this breach happen for a way longer time, I think.”

He doesn’t believe that DJI truly discovered these issues by itself back in January, and he’s annoyed the company only ever responded to him robotically in DMs on X, instead of answering his emails.

But he is happy about one thing: He can indeed control his Romo with a PlayStation or Xbox gamepad.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.