What we found
Googlebook: FGoogle built a cursor that watches everything on your screen.
Magic Pointer reads every pixel under the cursor — emails, documents, banking details, medical records — and sends context to Google servers for processing. No prompt required. Continuous screen capture via lightweight local heuristics combined with server-side multimodal encoders. Similar scrutiny as Circle to Search but at desktop scale.
Microsoft Surface Pro 11 (Copilot+): FYour laptop takes a screenshot of everything you do. Microsoft calls this a feature.
March 2026: TotalRecall Reloaded bypassed VBS Enclave via AIXHost.exe injection. Extracted screenshots, OCR text, CSV metadata in plaintext. Beaumont confirmed: "yep, you can just read the database as a user process." Also found undisclosed tracking fields. SECOND time researchers fully extracted the Recall database.
XPS 15: FDell installed a skeleton key on every laptop it sold.
In 2015, Dell shipped laptops with eDellRoot — a pre-installed root certificate with the private key included, enabling MITM attacks on HTTPS. The EFF called it Superfish 2.0. Dell had publicly mocked Lenovo for the identical Superfish scandal months earlier.
Spectre x360: FHP shipped 28 laptop models with an audio driver that secretly recorded every keystroke — passwords, private messages, banking credentials — and saved them t...
CVE-2017-8360: Researcher Thorsten Schroeder found Conexant's MicTray64.exe on 28 HP laptop models contained a keyboard hook that captured every keystroke to a world-readable log at C:\Users\Public\MicTray.log. Passwords, messages, everything typed was logged in plaintext since October 2016.
Aspire 5 A515-57: DAcer says it collects basic device info like your model number.
Acer UEIP Terms of Use (official Acer document) reveals collection goes far beyond device identification: lid switch status (knows when laptop is open/closed), audio mute state and volume levels, display on/off/dim status, user input methods (mouse/stylus/touchscreen/pen/fingerprint use), limited keyboard input, USB port usage, app install/uninstall events, taskbar pinned applications, desktop shortcuts, MAC addresses of nearby Wi-Fi access points, and HDD S.M.A.R.T. diagnostics. This constitutes real-time behavioral monitoring disguised as "device information" collection.
ThinkPad T14 Gen 4: DLenovo says it only collects anonymous, non-personal data to improve its software.
FTC settlement (2017) proved Lenovo pre-installed Superfish VisualDiscovery that performed man-in-the-middle interception of ALL encrypted HTTPS traffic — banking, medical, email — and sold captured browsing data to third parties. The root CA certificate used the trivially guessable password "komodia." This was not disclosed to consumers. CISA issued emergency alert TA15-051A. Lenovo paid $3.5M FTC fine and $7.3M class action settlement.
Google Chromebook: D170 million students use Chromebooks. Google sees every keystroke. The kids never had a choice.
Google is 77% advertising revenue. Core Services have no ads but YouTube ("Additional Service") operates under consumer privacy terms with full ad tracking. Google Search same. Students use both daily via same account. When students turn 18, ecosystem familiarity converts into advertising relationship.
ZenBook: DFor five months, every ASUS computer running the official update tool was potentially downloading malware — signed with ASUS's own certificates so antivirus ...
Operation ShadowHammer (2019): ASUS update servers compromised for 5 months pushing backdoored updates signed with legitimate certificates to 500K-1M computers. Attributed to APT41/BARIUM, Chinese state-sponsored group. CISA added to Known Exploited Vulnerabilities in 2025.