District court judge Timothy Kelly was ruling after the Trump administration blocked access to the three outlets in September
A federal judge ordered the White House on Tuesday to continue allowing journalists from CNN, MS Now and Politico to access the building as the media coalition’s lawsuit against the Trump administration plays out.
Timothy Kelly, a district court judge, had on 24 September granted a 14-day reprieve for the news organizations, which six days earlier had been banned by the president in an extraordinary move from entering the White House grounds “as a result of their constant ‘reporting’ FAKE NEWS”.
Investigation launched after five broadcasters last month ceased presidential coverage after CNN, MS Now and Politico were barred from White House
The US Department of Justice is investigating whether the decision of the White House television press pool to halt coverage of the US president, Donald Trump, last month violated antitrust law, an agency spokesperson said Saturday.
A spokesperson for the department said group boycotts among business competitors might violate US law. “The Antitrust Division is simply investigating to determine whether these news organizations have violated the antitrust laws,” they said.
Major TV networks were notified on Friday that the department was examining whether they violated antitrust laws when they suspended pool coverage of President Trump.
Democrats capitulate to MAGA media mogul. California Attorney General Rob Bonta (D) and 11 other states drop their lawsuit to block David Ellison's Paramount from acquiring Warner Bros. — and get little in return.
Extremely depressing news, so I've tried to include some pieces that emphasize the positive and re-commit to the fight.
First, here's more coverage:
The Ellisons Have Made This Movie Before
In exchange for the plaintiffs (all Democratic attorneys general, sigh) removing one of the last remaining roadblocks to Paramount's $111 billion takeover of Warner Bros. Discovery, Paramount signed on to commitments with no real enforcement behind them. Even modest concessions — like $5 million a year for independent film — sunset within five years. There are no divestitures. And some terms are just laughable, like granting the conglomerate's owners oversight of the editorial independence of CNN and CBS News (which is probably why two of the attorneys general openly objected to this term).
But with Paramount, you don't need a catalog of failed consent decrees to understand what is to come. You only need the record of the family making the promises: David Ellison, CEO of Paramount, and his father, tech billionaire and Trump ally Larry Ellison.
And here's Matt Stoller looking for positives in this bleak situation:
Happy Oligarch Day as Trump-Aligned Billionaires Take Over Hollywood
So what does this whole collapse mean? Well, I'm in a strangely good mood. This acquisition, while certain to damage Hollywood and the media, required immense amounts of political capital to get through.
Consider what it took: An aggressive President, a right-wing Congress, a deeply morose California Democratic establishment, California Governor Gavin Newsom and NJ Governor Mikie Sherrill, LA Mayor Karen Bass, stars like Tom Cruise and James Cameron, major movie theater chains like AMC, Regal, and Cinemark, unions like IATSE and the Director's Guild, JP Morgan's CEO Jamie Dimon, much of Wall Street, every global antitrust enforcer, plus a highly dishonest and corrupt press all had to put their thumb on the scale to beat what was essentially a group of frustrated artists led by Mark Ruffalo, the Writer's Guild, some outraged antitrust lawyers, and a surly public.
They had to lie, cheat, and steal. And they did. That is not strength, it is weakness. It is very different than earlier mergers, like Disney-Fox, that went through without any meaningful opposition. In this case, everyone saw the deal could have been blocked, a judge had already ruled multiple times that the case was reasonable, and Bonta just flip-flopped. When the Paramount-Warner deal turns out badly, and it probably will, everyone will know who to blame.
Monopoly Round-Up: Paramount-WB Isn't Just a Loss, It's a Prelude
We learned two important things in this battle. The first is what happens when an elected leader tries to say no to an oligarch after 45 years of unfettered rule by capital. That is, they get extremely angry and vicious. As G.K. Chesterton once said, "The poor have sometimes objected to being governed badly; the rich have always objected to being governed at all."
Ellison threatened the entire state of California with moving Paramount out of the state, his legal team said they'd destroy antitrust law by appealing to a Supreme Court whose members they know personally, his allies controlled most of the media narrative about the case, and he engaged in an extreme version of corruption vis-a-vis the President....
The second level is about the Democrats, which is a political party few people really understand. The most important thing to get about the older generation of Democrats is they are fundamentally uninterested in the real world. They have a form of politics, but it is unrelated to governing....
Now, I've been careful to say that it's an older generation of Democrats who cosplay as substantive. This cycle is going to see a bunch of new people elected. Last year is when New York Mayor Zohran Mamdani won, and he definitely is perceived to have a different approach. How different is an important question. Abdul El-Sayed, who is probably the most important figure, is quite smart. We interviewed him for Organized Money. Melat Kiros and Angie Nixon both prevailed on campaigns that promised to break up big medicine and take on corporate concentration. So did Aisha Wahab in California. In Arkansas, Hallie Shoffner is campaigning against corporate concentration of farming. There will be more of this.
They may show a different form of politics, taking the side of the anti-Ellison coalition, as it were. The point, though, is that what we just saw is not just a battle we lost. It is a prelude of the kind of tactics and coalitions to come. Right now, it's clear that billionaires don't have to follow the law. It's also clear there is now a serious challenge to that framework. It wasn't quite powerful enough to block the merger. But now we know how they are going to play the game.
A website built to look almost exactly like CNN’s homepage is telling visitors to download “the new CNN app.” But it’s not CNN’s app, and has nothing to do with the news company.
The campaign doesn’t stop at CNN. It also uses fake Stremio and Avast installers hosted on similarly convincing lookalike sites, all targeting Windows users. The installers are part of the same campaign to trick people into installing legitimate remote-management software that’s already linked to the attacker’s account.
Instead of downloading the software they expected, victims install O&O Syspectr, a genuine, digitally signed remote administration tool used by IT teams to manage computers. In the wrong hands, that tool can give an attacker remote access to a victim’s PC, allowing them to run commands, install additional software, or explore files and data. The CNN, Avast, and Stremio lures all point back to the same Syspectr account.
Another lookalike site uses a fake crypto-mining browser game instead of a trusted brand, but delivers the same software from a different Syspectr account.
Here’s what we found, why your antivirus has no reason to stop it, and the one 10-second check that would have caught it every time.
What the fake CNN page looks like
The site copies CNN’s real homepage closely enough that most people wouldn’t look twice. It has current headlines, the same layout, and even a red “Live Updates” tag on a real story. A pop-up interrupts almost immediately: “Get the latest news first in the new CNN app—it’s live and free,” with a red Download button underneath.
The file behind that button is named CNN_App.setupad4693fd-d903-4791-8f58-975261c93ca2.exe—the same Syspectr installer that shows up under different branding elsewhere, down to the account ID embedded in the filename.
The same trick, impersonating other brands
A lookalike site at avast-premium[.]shop mimics Avast’s real download page closely, including the logo, review scores, and a blue “Free download” button for “Avast One.” The file behind it is named AVAST_App.setup4693fd-d903-4791-8f58-975261c93ca2.exe.
Another malicious site, stremiotv[.]online, copies Stremio, a legitimate media-center app. The file it pushes visitors to download is named Stremio_App.setup4693fd-d903-4791-8f58-975261c93ca2.exe.
Both carry the same account ID found in the CNN installer.
By impersonating trusted brands, the attackers trick visitors into installing the legitimate O&O Syspectr remote-access tool, which gives the attackers remote access to the victims’ computers.
A different kind of bait
Not every lure needs a trusted brand, however.
syncminer[.]xyz invents its own hook instead: an “idle miner” browser game showing a slowly-ticking cryptocurrency balance, with a “Download Miner Plugin” button promising faster payouts. The identical site also runs at idleminer[.]pro with the same layout, same game, and same download.
Both distribute the same file, named oo-syspectr-setup9158bf2a-ff25-4290-b96c-2dc5eb310391.exe outright, carrying its own account ID that is different from the CNN, Avast, and Stremio lures we saw.
It’s not malware, which is why antivirus can miss it
Every one of these files is a real, digitally signed piece of software from O&O Software GmbH, a legitimate German company. Syspectr is sold openly to IT departments and gives an operator remote desktop control and an admin-level command line on whatever machine it’s installed on.
That’s why antivirus software may not stop it. Antivirus is designed to detect malicious software, not flag a legitimately signed business tool just because of how it arrived on a computer. The attacker only has to convince victims to install a legitimate remote-management tool that’s already linked to the attacker’s account.
The 10-second check that gives it away
On Windows, right-click any installer like this, choose Properties, and open the Details tab. Two fields—File description and Product name—identify every installer we examined as O&O Syspectr, alongside a copyright notice for O&O Software GmbH.
The filename can be changed by anyone distributing the file, but those embedded details come from the signed software itself. Changing them would invalidate the digital signature, so they reveal what the installer really is.
How we know these are connected
Every Syspectr installer includes the account ID of whoever generated it, embedded directly in the filename. The CNN-, Avast-, and Stremio-branded files all carry the exact same account ID, showing they were created from a single Syspectr account and simply reskinned for different lures.
The Syspectr installer distributed through the fake crypto-mining game carries a different account ID, suggesting either a second operator using the same playbook or the same group operating under another account.
What this tool can actually do
Syspectr is designed to let IT administrators manage computers remotely. Depending on the subscription level, that can include viewing system information, monitoring running processes and services, managing Microsoft Defender, and restricting USB devices.
The paid plans add the features that matter most to attackers. They allow an operator to remotely control the victim’s computer, browse files, run commands, install additional software, and make changes to the system as though they were sitting in front of it. Higher tiers add tools for managing large numbers of devices and, on compatible hardware, even allow remote access when Windows won’t boot.
These remote-control features aren’t available on free Syspectr accounts. They require a Premium subscription or higher.
O&O Software response
O&O responded quickly. Within days, the company disabled Remote Desktop and Remote Console access for free Syspectr accounts, restricting both to paid plans only.
O&O has since identified and suspended the abusive accounts, also blocking them from adding new devices. O&O’s analysis found the attackers relied exclusively on Remote Console, not Remote Desktop. The company says it will keep scanning for this pattern and tighten restrictions further if needed.
It’s a solid response and O&O clearly has a handle on how the abuse is happening. Not every vendor moves this quickly or this effectively when their software gets abused.
How to protect yourself
Only download software from the vendor’s actual website. Search results and ads can lead to convincing fakes.
Before running any installer you’re unsure about, on Windows you can right-click it, open Properties > Details, and check the File description and Product name fields.
If you find O&O Syspectr installed and didn’t set it up yourself, uninstall it through Settings > Apps and run a full antivirus scan.
If you ran an installer like this recently, change passwords for anything you accessed on that machine afterward from a clean machine.
Protect yourself while browsing online. Malwarebytes Browser Guard blocks known scam and lookalike pages before you land on them.
Remember
Fake download sites don’t always deliver malware. Sometimes they deliver legitimate software that’s been weaponized by the person distributing it. That’s why it’s important to download software from the real vendor and, if something doesn’t feel right, check what the installer actually is before you run it.
Login
