Vo1d

Vo1d is a large-scale Android malware operation targeting unofficial Android-based TV boxes and related consumer streaming devices. It is widely described as a backdoor-driven botnet that has infected well over a million devices globally, with public estimates placing its footprint around 1.3 to 1.6 million devices across more than 200 countries. The malware ecosystem is associated with low-cost or unofficial smart TV hardware and pirated or modified streaming applications, and some reporting indicates infections may be preinstalled on devices before sale. Vo1d has also been discussed alongside other Android botnet ecosystems such as BADBOX and Triada, with some infrastructure overlap noted between Vo1d-related components and Triada modules, although a definitive operational relationship is not established.

A notable component associated with Vo1d is Popa, a plugin or SDK-like module that enrolls infected devices into a residential proxy network. In this role, compromised devices act as relay or exit nodes for third-party traffic, maintaining encrypted tunnels and opening communication channels on demand. Research linking Popa to the broader Vo1d ecosystem indicates that Vo1d-infected Android TV devices can be monetized through proxying activity rather than solely through traditional botnet tasks. This proxy layer has been tied to large-scale scraping, account abuse, and infrastructure obfuscation, and has been observed sharing backend architecture with proxy components embedded in consumer software outside the Android TV ecosystem.

Vo1d primarily targets Android-based TV boxes and similar embedded consumer devices. Public reporting has not conclusively established the original infection vector, but the campaign has been repeatedly associated with unofficial devices and bundled streaming software. The malware’s scale, persistence in the Android TV ecosystem, and use of modular proxy functionality make it one of the more prominent Android botnet families affecting consumer media devices.