Thermoforming: Shaping Curvy Grilles With No Supports

Making sure the heatgun is on ‘low’ and gloves are on while pushing on the mold. (Credit: Zion Brock)
Although hobbyists these days most often seem to use thermoplastics as a print-and-done material in FDM printers, there’s absolutely nothing stopping you from taking things further with thermoforming. Much like forming acrylic using a hot wire or hot air, thermoplastics like PLA can be further tweaked with a similar method. This can be much less complex than 3D printing the design with supports, as demonstrated by [Zion Brock].

For this classically styled radio project the front grille was previously 3D printed with the curved shape, but to avoid an ugly edge it had to be printed with most of the grille off the print bed, requiring countless supports and hours of printing time. To get around this, [Zion] opted to print the grille flat and then thermoform its curved shape. Of course, due to the unusual shape of the grille, this required a bit more effort than e.g. a spherical form.

This is similar to what is used with sheet metal to get detailed shaped, also requiring a mold and a way to stretch the flat shape over the mold. With the flat form designed to have all the material in the right places, it was able to be printed in less than an hour in PLA and then formed with a heatgun aimed at the part while the two-section mold is slid together to create the final form.

You can find the design files and full instructions on the website for the radio project.

youtube.com/embed/z20IXm1w-Fo?…

hackaday.com/2026/02/11/thermo…

FLOSS Weekly Episode 864: Work Hard, Save Money, Retire Early

This week Jonathan chats with Bill Shotts about The Linux Command Line! That’s Bill’s book published by No Starch Press, all about how to make your way around the Linux command line! Bill has had quite a career doing Unix administration, and has thoughts on the current state of technology. Watch to find out more!

• linuxcommand.org/
• nostarch.com/linux-command-lin…

youtube.com/embed/9zpSG6sAJiY?…

Did you know you can watch the live recording of the show right on our YouTube Channel? Have someone you’d like us to interview? Let us know, or have the guest contact us! Take a look at the schedule here.

play.libsyn.com/embed/episode/…

Direct Download in DRM-free MP3.

If you’d rather read along, here’s the transcript for this week’s episode.

Places to follow the FLOSS Weekly Podcast:

• Spotify
• RSS

Theme music: “Newer Wave” Kevin MacLeod (incompetech.com)

Licensed under Creative Commons: By Attribution 4.0 License

hackaday.com/2026/02/11/floss-…

Motorola’s Password Pill Was Just One Idea

Let’s face it; remembering a bunch of passwords is the pits, and it’s just getting worse as time goes on. These days, you really ought to have a securely-generated key-smash password for everything. And at that point you need a password manager, but you still have to remember the password for that.

Well, Motorola is sympathetic to this problem, or at least they were in 2013 when they came up with the password pill. Motorola Mobility, who were owned by Google at the time, debuted it at the All Things Digital D11 tech conference in California. This was a future that hasn’t come to pass, for better or worse, but it was a fun thought experiment in near-futurism.

Dancing with DARPA

Back then, such bleeding-edge research was headed by former DARPA chief Regina Dugan. At the conference, Dugan stated that she was “working to fix the mechanical mismatch between humans and electronics” by doing things such as partnering with companies that “make authentication more human”.
Image by HeungSoon from Pixabay
Along with Proteus Digital Health, Dugan et. al created a pill with a small chip inside of it and a switch. Once swallowed, your various stomach acids serve as the electrolyte. The acids power the chip, and the switch goes on and off, creating an 18-bit ECG-like signal.

Basically, your entire body becomes an authentication token. Unlock your phone, your car door handle, and turn on your computer, just by existing near them.

It should be noted that Proteus already had FDA clearance for a medical device consisting of an ingestible sensor. The idea behind those is that medical staff can track when a patient has taken a pill based on the radio signal. Dugan said at the conference that it would be medically safe to ingest up to thirty of these pills per day for the rest of your life. Oh yeah, and she says the only thing that the pill exposes about the taker is whether they took it or not.

Motorola head Dennis Woodside stated that they had demonstrated this authentication technology working and authenticating a phone. While Motorola never intended to ship this pill, it was based on the Proteus device with FDA clearance, presumably so they could test it safely.

The story of Proteus Digital Health is beyond us here, but for whatever reason, their smart pills never took off. So we’re left to speculate about the impact on society that this past future of popping password pills would have had.

About That Government Influence

Redford and Poitier in Sneakers (1992). Image via IMDb
While it sounds sorta cool at first, it also seems like something a government might choose to force on a person sooner or later. Someone they wanted to insert behind enemy lines, perhaps, or just create an inside job that otherwise wouldn’t have happened.

Taking off my tin foil hat for a moment, I’ll compare this pill with existing modern biometrics. A face scan, a fingerprint, or even my voice is my passport, verify me are all momentary actions.

With these, you’re more or less in control of when authentication happens. A pill, on the other hand, must run its course. You can’t change the signal mid-digestive cycle. Plus, you’d have to guard your pills with your life, and if a couple pills pass through you every day, you’d better have a big pillbox.

Authentication Can Be Skin Deep

Image by MC10 via Slashgear
So the password pill never came to pass, but it’s worth mentioning that at the same conference, Dugan debuted another method of physical authentication — a temporary password tattoo they developed along with MC10, a company that makes stretchable circuits and has since been acquired by a company called Medidata.

More typically, their circuits are used to do things like concussion detection for sports, or baby thermometers that continuously track temperature.

Dugan said that the key MC10 technology is in the accordion-like structures connecting the islands of inflexible silicon. These structures can stretch up to 200% and still work just fine. The tattoos are waterproof, so go ahead and swim or shower. Of course, the password tattoo never came to be, either. And that’s just fine with me.

hackaday.com/2026/02/11/motoro…

Vintage Film Editor Becomes HDMI Monitor

With the convenience of digital cameras and editing software, shooting video today is so easy. But fifty years ago it wasn’t electronics that stored the picture but film, and for many that meant Super 8. Editing Super 8 involved a razor blade and glue, and an editing station, like a small projector and screen, was an essential accessory. Today these are a relatively useless curio, so [Endpoint101] picked one up for not a lot and converted it into an HDMI monitor.

Inside these devices there’s a film transport mechanism and a projection path usually folded with a couple of mirrors. In this case the glass screen and much of the internals have been removed, and an appropriate LCD screen fitted. It’s USB powered, and incorporates a plug-in USB power supply mounted in a UK trailing socket for which there’s plenty of space.

There’s always some discussion whenever a vintage device like this is torn apart as to whether that’s appropriate. These film editors really are ten a penny though, so even those of us who are 8 mm enthusiasts can see beyond this one. The result is a pleasingly retro monitor, which if we’re honest we could find space for ourselves. The full video is below the break. Meanwhile it’s not the first conversion we’ve seen, here’s another Hanimex packing a Raspberry Pi.

youtube.com/embed/YTQoNQL0R9E?…

hackaday.com/2026/02/11/vintag…

The game is over: when “free” comes at too high a price. What we know about RenEngine

We often describe cases of malware distribution under the guise of game cheats and pirated software. Sometimes such methods are used to spread complex malware that employs advanced techniques and sophisticated infection chains.

In February 2026, researchers from Howler Cell announced the discovery of a mass campaign distributing pirated games infected with a previously unknown family of malware. It turned out to be a loader called RenEngine, which was delivered to the device using a modified version of a Ren’Py engine-based game launcher. Kaspersky solutions detect the RenEngine loader as Trojan.Python.Agent.nb and HEUR:Trojan.Python.Agent.gen.

However, this threat is not new. Our solutions began detecting the first samples of the RenEngine loader in March 2025, when it was used to distribute the Lumma stealer (Trojan-PSW.Win32.Lumma.gen).

In the ongoing incidents, ACR Stealer (Trojan-PSW.Win32.ACRstealer.gen) is being distributed as the final payload. We have been monitoring this campaign for a long time and will share some details in this article.

Incident analysis

Disguise as a visual novel

Let’s look at the first incident we detected in March 2025. At that time, the attackers distributed the malware under the guise of a hacked game on a popular gaming web resource.

The website featured a game download page with two buttons: Free Download Now and Direct Download. Both buttons had the same functionality: they redirected users to the MEGA file-sharing service, where they were offered to download an archive with the “game.”

Game download page

When the “game” was launched, the download process would stop at 100%. One might think that the game froze, but that was not the case — the “real” malicious code just started working.

Placeholder with the download screen

“Game” source files analysis

The full infection chain

After analyzing the source files, we found Python scripts that initiate the initial device infection. These scripts imitate the endless loading of the game. In addition, they contain the is_sandboxed function for bypassing the sandbox and xor_decrypt_file for decrypting the malicious payload. Using the latter, the script decrypts the ZIP archive, unpacks its contents into the .temp directory, and launches the unpacked files.

Contents of the .temp directory

There are five files in the .temp directory. The DKsyVGUJ.exe executable is not malicious. Its original name is Ahnenblatt4.exe, and it is a well-known legitimate application for organizing genealogical data. The borlndmm.dll library also does not contain malicious code; it implements the memory manager required to run the executable. Another library, cc32290mt.dll, contains a code snippet patched by attackers that intercepts control when the application is launched and deploys the first stage of the payload in the process memory.

HijackLoader

The dbghelp.dll system library is used as a “container” to launch the first stage of the payload. It is overwritten in memory with decrypted shellcode obtained from the gayal.asp file using the cc32290mt.dll library. The resulting payload is HijackLoader. This is a relatively new means of delivering and deploying malicious implants. A distinctive feature of this malware family is its modularity and configuration flexibility. HijackLoader was first detected and described in the summer of 2023. More detailed information about this loader is available to customers of the Kaspersky Intelligence Reporting Service.

The final payload can be delivered in two ways, depending on the configuration parameters of the malicious sample. The main HijackLoader ti module is used to launch and prepare the process for the final payload injection. In some cases, an additional module is also used, which is injected into an intermediate process launched by the main one. The code that performs the injection is the same in both cases.

Before creating a child process, the configuration parameters are encrypted using XOR and saved to the %TEMP% directory with a random name. The file name is written to the system environment variables.

Loading configuration parameters saved by the main module

In the analyzed sample, the execution follows a longer path with an intermediate child process, cmd.exe. It is created in suspended mode by calling the auxiliary module modCreateProcess. Then, using the ZwCreateSection and ZwMapViewOfSection system API calls, the code of the same dbghelp.dll library is loaded into the address space of the process, after which it intercepts control.
Next, the ti module, launched in the child process, reads the hap.eml file, from which it decrypts the second stage of HijackLoader. The module then loads the pla.dll system library and overwrites the beginning of its code section with the received payload, after which it transfers control to this library.

Payload decryption

The decrypted payload is an EXE file, and the configuration parameters are set to inject it into the explorer.exe child process. The payload is written to the memory of the child process in several stages:

1. First, the malicious payload is written to a temporary file on disk using the transaction mechanism provided by the Windows API. The payload is written in several stages and not in the order in which the data is stored in the file. The MZ signature, with which any PE file begins, is written last with a delay.

   
   Writing the payload to a temporary file

2. After that, the payload is loaded from the temporary file into the address space of the current process using the ZwCreateSection call. The transaction that wrote to the file is rolled back, thus deleting the temporary file with the payload.
3. Next, the sample uses the modCreateProcess module to launch a child process explorer.exe and injects the payload into it by creating a shared memory region with the ZwMapViewOfSection call.

   
   Payload injection into the child process

   Another HijackLoader module, rshell, is used to launch the shellcode. Its contents are also injected into the child process, replacing the code located at its entry point.

   
   The rshell module injection

4. The last step performed by the parent process is starting a thread in the child process by calling ZwResumeThread. After that, the thread starts executing the rshell module code placed at the child process entry point, and the parent process terminates.
   The rshell module prepares the final malicious payload. Once it has finished, it transfers control to another HijackLoader module called ESAL. It replaces the contents of rshell with zeros using the memset function and launches the final payload, which is a stealer from the Lumma family (Trojan-PSW.Win32.Lumma).

In addition to the modules described above, this HijackLoader sample contains the following modules, which were used at intermediate stages: COPYLIST, modTask, modUAC, modWriteFile.
Kaspersky solutions detect HijackLoader with the verdicts Trojan.Win32.Penguish and Trojan.Win32.DllHijacker.

Not only games

In addition to gaming sites, we found that attackers created dozens of different web resources to distribute RenEngine under the guise of pirated software. On one such site, for example, users can supposedly download an activated version of the CorelDRAW graphics editor.

Distribution of RenEngine under the guise of the CorelDRAW pirated version

When the user clicks the Descargar Ahora (“Download Now”) button, they are redirected several times to other malicious websites, after which an infected archive is downloaded to their device.

File storage imitations

Distribution

According to our data, since March 2025, RenEngine has affected users in the following countries:

Distribution of incidents involving the RenEngine loader by country (TOP 20), February 2026 (download)

The distribution pattern of this loader suggests that the attacks are not targeted. At the time of publication, we have recorded the highest number of incidents in Russia, Brazil, Turkey, Spain, and Germany.

Recommendations for protection

The format of game archives is generally not standardized and is unique for each game. This means that there is no universal algorithm for unpacking and checking the contents of game archives. If the game engine does not check the integrity and authenticity of executable resources and scripts, such an archive can become a repository for malware if modified by attackers. Despite this, Kaspersky Premium protects against such threats with its Behavior Detection component.

The distribution of malware under the guise of pirated software and hacked games is not a new tactic. It is relatively easy to avoid infection by the malware described in this article — simply install games and programs from trusted sites. In addition, it is important for gamers to remember the need to install specialized security solutions. This ongoing campaign employs the Lumma and ACR stylers, and Vidar was also found — none of these are new threats, but rather long-known malware. This means that modern antivirus technologies can detect even modified versions of the above-mentioned stealers and their alternatives, preventing further infection.

Indicators of compromise

12EC3516889887E7BCF75D7345E3207A – setup_game_8246.zip
D3CF36C37402D05F1B7AA2C444DC211A – __init.py__
1E0BF40895673FCD96A8EA3DDFAB0AE2 – cc32290mt.dll
2E70ECA2191C79AD15DA2D4C25EB66B9 – Lumma Stealer

hxxps://hentakugames[.]com/country-bumpkin/
hxxps://dodi-repacks[.]site
hxxps://artistapirata[.]fit
hxxps://artistapirata[.]vip
hxxps://awdescargas[.]pro
hxxps://fullprogramlarindir[.]me
hxxps://gamesleech[.]com
hxxps://parapcc[.]com
hxxps://saglamindir[.]vip
hxxps://zdescargas[.]pro
hxxps://filedownloads[.]store
hxxps://go[.]zovo[.]ink

Lumma C2
hxxps://steamcommunity[.]com/profiles/76561199822375128
hxxps://localfxement[.]live
hxxps://explorebieology[.]run
hxxps://agroecologyguide[.]digital
hxxps://moderzysics[.]top
hxxps://seedsxouts[.]shop
hxxps://codxefusion[.]top
hxxps://farfinable[.]top
hxxps://techspherxe[.]top
hxxps://cropcircleforum[.]today

securelist.com/renengine-campa…