When Your Smart ID Card Reader Comes With Malware
Summary: A government defense contractor employee bought a $15 Saicoo smart card reader from Amazon to use his PIV card at home, and the driver ZIP file from Saicoo's website was flagged as malicious by 43 security tools on VirusTotal, with the consensus pointing to the Ramnit trojan. Saicoo told KrebsOnSecurity the detection was likely a false positive from the customer's security software and advised ignoring it, while CERT/CC analyst Will Dormann noted the Ramnit infection touched only the included HTML files, not the executables.
Key Takeaway: Millions of federal employees and contractors hold CAC or PIV cards, and many buy readers off-the-shelf rather than through GSA's approved vendor list at idmanagement.gov, where Saicoo does not appear - so the driver download for a device that unlocks government buildings and networks is landing on home machines with no procurement oversight.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026