App Cloner for Fire TV Contains Malware

If you have recently sideloaded an application called App Cloner (dev.app.cloosi) onto your Amazon Fire TV, Firestick, or Android TV box to bypass app restrictions, you need to take immediate action. Recent investigations have revealed that this popular utility hides malicious residential proxyware that sells access to your home internet connection to strangers.

Due to these severe security findings, App Cloner has been permanently removed from the TROYPOINT Toolbox.

What is the App Cloner Malware Doing?

Users initially downloaded App Cloner to duplicate blocked streaming applications and give them a new digital signature, bypassing Amazon’s “harmful app” blocklist. While the app does successfully clone apps, it secretly installs a background service that runs continuously every time you boot up your device.

Security researchers discovered that the app contains code for residential-proxy tunneling. Here is what it does behind the scenes:

• Rents out your IP Address: It establishes over 30 open connections at all times, routing other people’s internet traffic through your home network.
• Bypasses VPNs: The malware is specifically designed to bypass VPN split-tunneling, ensuring that the traffic goes directly out of your real home ISP connection.
• Causes Device Lag: The hidden background service consumes anywhere from 60 to 120 MB of RAM constantly. On a streaming device, this leads to heavy system lag, buffering, and an unresponsive remote.
• Blacklists your IP: Because strangers are using your network to route their traffic, your home IP address may get flagged. This can result in endless CAPTCHA requests while browsing the web or your IP being blacklisted.

How to Completely Remove the App Cloner Malware

A simple uninstall of the main app is the first step, but there are extra precautions you must take to ensure your device is completely clean.

1. Uninstall App Cloner Immediately: Go to your device’s Settings > Applications > Manage Installed Applications, find App Cloner, and select Uninstall.
2. Delete All Cloned Apps: While proxyware traffic generally stops once the main App Cloner is removed, you should uninstall any and all applications you created using App Cloner. Since these clones were generated by compromised software, they should not be trusted.
3. Check for Hidden Apps: The proxyware runs behind a blank notification. Look closely through your list of installed applications for any blank icons or apps you do not recognize, and uninstall them.
4. Restart Your Network & Device: Once uninstalled, reboot both your streaming device and your internet router to kill any lingering network connections.

Note: If your device is still acting suspiciously after following these steps, perform a full Factory Reset to wipe the system completely clean.

Is There a Clean, Modded Version of App Cloner?

Currently, there is no “clean” or modded version of this specific App Cloner available. The proxyware components are baked deeply into the application’s core code by the developer.

Rather than risking your network security with cloning workarounds, we recommend these long-term solutions:

• Switch to Unblocked Apps: Move away from blocklisted APKs and switch to safer alternatives like Nuvio, which is unblocked, ad-free, and contains no malware.
• Move to Unrestricted Devices: Consider migrating to an Android TV/Google TV Box so you don’t need to deal with ridiculous Amazon blocks anymore.