Vo1d Android Botnet Infections via Compromised Smart Devices

Security researchers have identified that certain Android-based digital photo frames, particularly those using the Uhale platform, are downloading and executing malware at boot time. The devices, which are rooted by default and have disabled SELinux, automatically update their Uhale app from China-based servers and subsequently download malicious payloads linked to the Vo1d botnet and Mzmess malware families. The vulnerabilities, including over a dozen security issues with 11 assigned CVEs, allow the malware to persist and execute on every reboot, with the manufacturer failing to respond to multiple security notifications.

The Vo1d malware, first observed in September 2024, has rapidly evolved into one of the most widespread Android botnets, targeting smart TVs, TV boxes, and now digital photo frames. Vo1d is capable of installing additional payloads, running proxy services, and conducting ad fraud, with infection estimates reaching up to 1.6 million devices globally. The malware employs domain generation algorithms for resilient command-and-control, and recent activity has shown a surge in infections, particularly in South Africa. The sophistication of Vo1d, including obfuscation and encryption, makes detection and remediation challenging for affected users and organizations.