Millions of Android TV Devices Infected with Secret Malware

New research reveals that over a million Android-based TV boxes, tablets, projectors, and car infotainment systems are infected with hidden malware.

These compromised devices are being used for cybercrime without their owners realizing it.

Security experts uncovered a large-scale cybercrime operation known as Badbox 2.0. This scheme infects inexpensive Android-based devices, adding them to a botnet used for ad fraud, data theft, and illegal proxy services.

Cheap, unbranded Android TV boxes are prone to malware, malfunctions, DDoS attacks, and infections from malicious softwares.

How These Devices Are Compromised

Initially, cybercriminals tampered with firmware before these devices reached consumers. But Badbox 2.0 has shifted tactics.

Now, hackers distribute malware through:

• Preinstalled apps – Some devices come infected straight from the factory.
• Fake app downloads – Malicious apps trick users into installing them from unofficial sources.
• Drive-by downloads – Simply visiting a compromised website can install malware without user interaction.

Once infected, the device secretly runs background processes that route internet traffic for cybercriminals, making it harder for law enforcement to trace illegal activities.

Which Devices Are Affected?

Most compromised devices are cheap “fully loaded” Android TV boxes and other gadgets. Many run on Android’s open-source software but lack Google’s security protections.

The worst-hit products include devices from the TV98 and X96 families. While infections have been found worldwide, the highest concentration appears in South America, particularly Brazil.

Google’s Response and Industry Efforts

Google has worked with researchers to shut down malicious advertising accounts linked to the fraud. Cybersecurity firms, including Shadow Server, have also tried to disrupt the Badbox 2.0 botnet by redirecting its traffic away from scammers (a technique called sinkholing).

Despite these efforts, cybercriminals continue to evolve their tactics, making it difficult to eliminate the threat entirely.

How to Protect Yourself

Many users have no idea their device is compromised because the malware operates in the background. However, there are steps you can take to reduce your risk:

1. Avoid cheap, generic Android TV boxes – Stick to reputable brands like Google or NVIDIA.
2. Check for Google certification – Ensure the device is part of Google’s protected ecosystem.
3. Avoid questionable third-party applications – Not all third-party apps are dangerous, but there are security risks of installing them.
4. Monitor network activity – Use router logs or security software to check for unusual traffic.
5. Use a VPN – While it won’t remove malware, a VPN can help limit some risks by masking your internet traffic.

Final Thoughts

The Badbox 2.0 campaign highlights the dangers of unverified Android devices. Cybercriminals are taking advantage of cheap gadgets, using them for fraud while owners remain unaware.

If you own a budget Android TV box it’s worth checking whether your device is compromised. In the long run, spending a little more on a trusted brand can save you from serious privacy and security risks.

For more information on this story, refer to story from Wired and the in-depth report from Human Security.

We want to know your thoughts on this story. What do you think about millions of Android boxes being infected with malware? Let us know in the comment section below!

Be sure to stay up-to-date with the latest streaming news, reviews, tips, and more by following the TROYPOINT Advisor with updates weekly.