Did You Unexpectedly Receive A Smartwatch In The Mail? It's Probably Laced With Malware

Over the years, there have been unintended military endeavors or accidents, such as the launch of a Strava app that leaked the locations of military bases through a published heatmap of deployment locations. Now, however, threat actors are either incredibly sophisticated, or companies are trying to tighten their crackdown on Amazon by sending potentially malware-infected smartwatches to US military personnel.

In early June, the Army Criminal Investigation Division (CID) issued an alert regarding smartwatches received in the mail. According to reports, soldiers from all branches of the military have received random unwanted smartwatches in the mail. When these watches are used, they automatically connect to Wi-Fi and connect to cell phones without prompting, giving them access to an "unlimited amount of user data." The problem is that senders of these unwanted smartwatches may contain malware that sends back banking information, contact details and account credentials, among other potentially sensitive information.

A possibly less serious cause of this unwanted smartwatch ordeal is so-called "brushing". Here, a scammer, usually a foreign online seller, sends the product to the product's address to give the impression that the recipient is a verified buyer of the product. Then, as a recipient, they can write a review to increase fraudulent online activity statistics, resulting in increased potential sales that offset the cost of lost products.

Whether it's a sinister intelligence operation behind it or a company simply rejecting fake reviews, no one is encouraged to use free unsolicited items in the mail. For the military, CID requires that if you receive a "free" smartwatch, you do not turn it on, report it to your local intelligence agency or security officer, or submit information through the CID reporting portal.