10 million devices. Malware installed at the factory. Before you even turned it on, your $30 Android TV box was already working for criminals — routing ad fraud, DDoS attacks, and stealing two-factor codes through your home network. Factory reset doesn't help. The malware is in the firmware. You bought a criminal tool disguised as a streaming device. The FBI warned the public. Google sued. The operators of the predecessor network were arrested. And the devices are still for sale on Amazon and Temu right now, under new brand names, with fresh malware. You can buy a pre-infected streaming box with same-day delivery. The marketplace knows. They keep selling.
What they claim: Budget Android TV boxes and streaming devices sold as affordable smart TV solutions
What we found: HUMAN Security uncovered BadBox 2.0 — the largest known botnet of connected TV devices. Malware was pre-installed in the firmware of cheap Android TV boxes, streaming devices, tablets, and digital picture frames manufactured in China. Over 10 million devices across 222 countries were compromised. The malware turns devices into residential proxies for ad fraud, DDoS attacks, and 2FA code theft. It survives factory resets.
What they claim: These devices are sold freely on Amazon, AliExpress, Temu, and other marketplaces
What we found: The FBI issued a public warning in June 2025 about BadBox-infected devices. Google filed a lawsuit in July 2025 against 25 unidentified defendants connected to the botnet. The operation was linked to IPidea, a rebrand of the sanctioned 911S5 Proxy network whose operators were arrested in 2024. The devices continue to be sold on major marketplaces under dozens of brand names.