Loading story…
Security researchers have identified that certain Android-based digital photo frames, particularly those using the Uhale platform, are downloading and executing malware at boot time. The devices, which are rooted by default and have disabled SELinux, automatically update their Uhale app from China-based servers and subsequently download malicious payloads linked to the Vo1d botnet and Mzmess malware families. The vulnerabilities, including over a dozen security issues with 11 assigned CVEs, allow the malware to persist and execute on every reboot, with the manufacturer failing to respond to multiple security notifications.
The Vo1d malware, first observed in September 2024, has rapidly evolved into one of the most widespread Android botnets, targeting smart TVs, TV boxes, and now digital photo frames. Vo1d is capable of installing additional payloads, running proxy services, and conducting ad fraud, with infection estimates reaching up to 1.6 million devices globally. The malware employs domain generation algorithms for resilient command-and-control, and recent activity has shown a surge in infections, particularly in South Africa. The sophistication of Vo1d, including obfuscation and encryption, makes detection and remediation challenging for affected users and organizations.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Quokka reported the vulnerabilities and malware-related findings to ZEASN, now branded as Whale TV, the company behind the Uhale platform used by many rebranded digital frames. According to the report, ZEASN did not respond.
Quokka reported that the downloaded payloads showed indicators of links to the Vo1d botnet and the Mzmess/Mezmess malware families. The firm also identified 17 security issues in affected frames, including insecure TLS handling, command injection in the update process, unauthenticated file upload, and insecure WebView behavior.
Some Android-based digital picture frames using the Uhale platform were observed auto-updating the Uhale app to version 4.2.0, after which the app downloaded and executed a JAR/DEX payload from China-based servers on every subsequent boot. Researchers said the initial infection vector remained unclear.
Darktrace published research focused on detecting the Vo1d botnet, adding technical visibility into the threat's activity and behavior. The publication indicates ongoing industry analysis of Vo1d around the same period as the photo frame findings.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Doctor Web reported that the **Android.Vo1d** backdoor infected nearly **1.3 million Android-based TV boxes** across **197 countries**, making it one of the larger botnet-style compromises seen in consumer smart TV hardware. The malware persists by altering multiple startup paths, including `install-recovery.sh`, `daemonsu`, and `debuggerd`, and uses cooperating components named `vo1d` and `wd` to maintain execution, deploy an encrypted daemon, and install attacker-supplied APKs. The highest infection volumes were observed in countries including Brazil, Morocco, Pakistan, Saudi Arabia, Russia, Argentina, Ecuador, Tunisia, Malaysia, Algeria, and Indonesia, while the initial intrusion vector remained unconfirmed. Additional public reporting tied **Vo1d** to an apparent supply-chain compromise in an **AODIN X1BQ** smart projector sold on Amazon, where the malware was allegedly embedded in firmware before purchase and operated silently as a residential proxy node. The disclosure said the device contacted `ota.triplesai[.]com` after boot, received proxy assignment from `sd002.jaguar-distributor.syslogcollector[.]com`, and sent recurring UDP heartbeat traffic to `o.fecebbbk[.]xyz`, with the firmware build date indicating the compromise predated the buyer's receipt of the device. Malware library entries for variants including **Android.Vo1d.1**, **Android.Vo1d.3**, and **Android.Vo1d.5** indicate the threat has multiple tracked forms, reinforcing concerns that Vo1d is spreading both through post-sale compromise and potentially through preinstalled malicious firmware.
Aug 15, 2026
Researchers and independent analysts linked a large Android supply-chain botnet known as **BADBOX** to preinfected TV boxes, smart TVs, and some smartphones, with malware embedded in firmware or silently installed through privileged system components. Reports described more than **190,000** compromised devices, including low-cost Android TV boxes built on AllWinner and RockChip platforms as well as higher-profile products such as **Yandex 4K QLED TVs** and the **Hisense/Instawall T963**. The malware survives factory resets, contacts command-and-control servers at boot, uploads device identifiers and telemetry, and can fetch secondary payloads used for ad fraud, account abuse, remote code installation, and residential proxying.
Aug 21, 2026
The Kimwolf botnet has rapidly infected over 1.8 million Android-based devices worldwide, with security researchers warning that the true number may exceed 2 million. The malware primarily targets Android TV boxes, digital photo frames, and other IoT devices, many of which are distributed through major online retailers and often ship with weak security controls or pre-installed malicious software. Kimwolf leverages advanced techniques such as DNS-over-TLS, blockchain-based command and control via Ethereum Name Service (ENS), and residential proxy networks to evade detection and takedown efforts. The botnet enables attackers to launch high-volume DDoS attacks, monetize proxy bandwidth, and conduct lateral movement within local networks, posing a significant threat to both enterprise and consumer environments. Security experts have identified that two-thirds of Kimwolf infections are Android TV boxes lacking basic authentication, making them especially vulnerable. The operators behind Kimwolf, previously linked to the Aisuru botnet, are known for their technical sophistication and rapid adaptation to takedown attempts. Their monetization strategies include ad fraud, DDoS-for-hire services, and the resale of residential proxy bandwidth. The malware often spreads through bundled mobile apps and games, exploiting the global supply chain of low-cost Android devices. Organizations and individuals are urged to identify, isolate, and remediate infected devices to prevent further exploitation and participation in criminal infrastructure.
Jun 29, 2026