Texas Throws Shade at TP-Link While Chinas Corgi Malware Steals Code and Nuclear Secrets Leak

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Hey listeners, Ting here with Digital Dragon Watch, your weekly China cyber alert, diving straight into the hottest threats from the past seven days ending January 26, 2026. Buckle up—China's cyber game is fiercer than a Shenzhen street food standoff. First off, Texas Governor Greg Abbott just dropped a bombshell, expanding the state's prohibited tech list after a Texas Cyber Command assessment led by Vice Admiral TJ White. We're talking bans on TP-Link routers, Hisense TVs, TCL gear, plus heavy hitters like SenseTime AI, Megvii facial recognition, iFlytek voice tech, Alibaba, Baidu, Xiaomi, and even drone makers Autel and battery giant CATL. Abbott's quote? "Rogue actors from the People's Republic of China shouldn't infiltrate Texas networks." This targets state gov hardware to block data harvesting—smart move against supply chain spies lurking in your Wi-Fi. Over in dev land, Koi Security exposed MaliciousCorgi: two fake AI VS Code extensions—ChatGPT Chinese Edition and ChatMoss—with 1.5 million installs. They autocomplete code like champs but secretly Base64-encode your every keystroke and file, beaming it to aihao123.cn in China, plus fingerprinting via Zhuge.io, GrowingIO, TalkingData, and Baidu Analytics. Developers, audit those extensions yesterday! The Telegraph revealed China hacked Downing Street senior officials' mobile phones for years—a classic SIM swap or zero-click op spying on UK policy wonks. And get this: China's second-in-command, Zhang, got fingered in a nuclear weapons data leak to the US, uncovered during an investigation of official Gu on January 19. Insider threat level: nuclear. No massive breaches pinned directly to China APTs this week, but Anthropic flagged an AI-led espionage campaign where state-linked hackers used autonomous agents for 80-90% of intrusions—from recon to exploits—hitting 30 orgs globally. Echoes of Salt Typhoon vibes, per 60 Minutes reports of Chinese hackers nesting in US utilities, ready to flip the switch. Sectors? Energy's bleeding—Malaysia's Perdana Petroleum Berhad got Dire Wolf ransomware, dumping 150GB of financials. Automotive too: Pwn2Own Tokyo exposed 76 zero-days in infotainment and EV chargers. New vectors: AI agents automating hacks, malicious dev tools, and vishing by ShinyHunters targeting Okta SSO for Microsoft 365 and Google Workspace access. US responses? Abbott's bans are state-level muscle; feds are watching Trump-Xi detente post-Busan 2025 truce, but export controls on semis loosen as trade bait. Experts at TXOne urge restricting Telnet access amid CVE-2026-24061 exploits since January 22. Protect yourselves, listeners: Patch Cisco Unified Comms (CVE-2026-20045) and SmarterMail now. Ban shady Chinese IoT—stick to vetted lists. Vet VS Code extensions like your source code depends on it. Enable strict MFA, segment dev environments, and deploy AI anomaly detectors for agent swarms. Run network scans for Ch This content was created in partnership and with the help of Artificial Intelligence AI.