> But many government employees aren’t issued an approved card reader device that lets them use these cards at home or remotely, and so turn to low-cost readers they find online.

It’s pretty common knowledge in many gov’t agencies to not procure devices from Amazon or other unauthorized vendors and connect them to gov’t machines. So I’m surprise to read that.

This is an ongoing problem with many USB peripherals from Amazon and Aliexpress. For personal use I only buy peripherals from Apple, Dell, Belkin or Logitech. Any other brand I consider untrusted.

I also highly recommend virustotal. Anything I download goes through it.