{"id":127136,"date":"2025-06-06T22:57:55","date_gmt":"2025-06-06T17:27:55","guid":{"rendered":"https:\/\/www.techworm.net\/?p=127136"},"modified":"2025-06-06T22:57:55","modified_gmt":"2025-06-06T17:27:55","slug":"badbox-20-infects-million-android-devices","status":"publish","type":"post","link":"https:\/\/www.techworm.net\/2025\/06\/badbox-20-infects-million-android-devices.html","title":{"rendered":"BADBOX 2.0 Infects Over a Million Android Devices, FBI Warns"},"content":{"rendered":"

The Federal Bureau of Investigation (FBI) on Thursday issued a fresh warning about BADBOX 2.0, a dangerous Android malware campaign that has quietly infected more than a million internet-connected devices in homes around the world. This malware is turning every day, lower-budget, and uncertified consumer electronics into tools for cybercriminals.<\/p>\n

What Is BADBOX 2.0?<\/strong><\/p>\n

BADBOX 2.0 is the latest version of the original BADBOX malware that was discovered in 2023. It is primarily found on Chinese-manufactured Android-based devices\u2014including digital streaming boxes, unbranded smart TVs, aftermarket vehicle infotainment systems, digital picture frames, low-budget tablets and projectors, and other Internet of Things (IoT) gadgets.<\/p>\n

Often, these devices come preloaded with malware, or they get infected shortly after app downloads containing hidden backdoors.<\/p>\n

“The BADBOX 2.0 botnet consists of millions of infected devices and maintains numerous backdoors to proxy services that cyber criminal actors exploit by either selling or providing free access to compromised home networks to be used for various criminal activity,”\u00a0warns the FBI<\/a>.<\/p>\n

“Cyber criminals gain unauthorized access to home networks by either configuring the product with malicious software prior to the users purchase or infecting the device as it downloads required applications that contain backdoors, usually during the set-up process,” the FBI added.<\/p>\n

“Once these compromised IoT devices are connected to home networks, the infected devices are susceptible to becoming part of the BADBOX 2.0 botnet and residential proxy services4 known to be used for malicious activity.”<\/p>\n

According to the FBI, once a device is infected, it links up with the attacker\u2019s command-and-control (C2) servers, which then execute instructions for malicious tasks. For instance, the malware masks cyberattacks by routing hacker traffic through victims\u2019 home networks, clicks ads in the background to generate fake revenue, and uses stolen credentials (such as usernames and passwords) to break into accounts while hiding behind residential IPs.<\/p>\n

How Did It Spread So Widely?<\/strong><\/p>\n

Initially found pre-installed in cheap, no-name Android TV boxes like the T95, BADBOX quickly spread across the globe. Although Germany\u2019s cybersecurity agency briefly disrupted the original version in 2024, a resurgence followed.<\/p>\n

Just a week after the takedown, 192,000 new infections were detected by the researchers\u2014 this time affecting not only obscure devices but also mainstream brands like Yandex TVs and Hisense smartphones.<\/p>\n

In March 2025, security firm HUMAN\u2019s Satori Threat Intelligence reported that BADBOX 2.0 had infected more than a million devices across 222 countries. The hardest-hit regions include Brazil (37.6%), the U.S. (18.2%), Mexico (6.3%), and Argentina (5.3%).<\/p>\n

“This scheme impacted\u00a0more than 1 million consumer devices. Devices connected to the BADBOX 2.0 operation included lower-price-point, “off brand”, uncertified tablets, connected TV (CTV) boxes, digital projectors, and more,”\u00a0explains HUMAN Security.<\/p>\n

“The infected devices are Android Open Source Project devices, not Android TV OS devices or\u00a0Play Protect certified Android devices<\/a>. All of these devices are manufactured in mainland China and shipped globally; indeed, HUMAN observed BADBOX 2.0-associated traffic from\u00a0222 countries and territories worldwide.”<\/p>\n

Indicators of a BADBOX-infected device include:<\/p>\n