Loading story…
Finnish authorities warned that some Android smart devices sold to consumers, particularly televisions, TV boxes, and other home-networked endpoints, have been found with BadBox 2.0 malware already present before purchase. The malware has been linked especially to low-cost products from lesser-known manufacturers and can also spread through malicious apps and suspicious websites. Officials said the backdoor may be inserted during the production chain, turning affected devices into covert criminal infrastructure while they continue to appear to function normally.
BadBox 2.0 allows attackers to remotely load additional modules, collect data, and abuse infected devices for operations including botnet activity and denial-of-service attacks. The malware is considered especially hard to detect and effectively impossible for users to remove because the backdoor resides in firmware that cannot be rewritten without manufacturer support. Estonia's Information System Authority reported more than 7,000 infected devices in the country, underscoring the broader supply-chain security problem. Finland's Cyber Security Centre urged consumers to disconnect suspected devices immediately, install official vendor updates if available, and stop using and dispose of devices if the manufacturer does not provide a fix.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The Finnish Cyber Security Centre advised consumers to immediately disconnect suspected devices, install official vendor updates if available, and dispose of devices if no official fix exists. It also urged buyers to avoid cheap, anonymous, or poorly supported products that lack trustworthy security updates.
Finland's Cyber Security Centre warned that some Android smart devices sold on the Finnish consumer market, especially televisions, TV boxes, and other home-networked devices, were found to be infected before purchase. The advisory said the embedded backdoor cannot be removed by users and may allow devices to be abused as part of criminal infrastructure such as botnets.
The Estonian Information System Authority (RIA) reported observing more than 7,000 infected devices in Estonia. This highlighted the scale of the BadBox 2.0 problem and its spread in consumer Android devices.
BadBox 2.0 was identified in multiple incidents involving inexpensive Android devices from lesser-known manufacturers, with malware either preinstalled during manufacturing or later delivered through malicious apps and suspicious websites. The malware enables remote module execution, data collection, and other malicious activity while remaining difficult to detect and remove because the backdoor resides in device firmware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BitSight TRACE reported that off-brand **H96 Android TV streaming boxes** were used in a large ad-fraud and residential-proxy operation linked to **Zhejiang Fengwo IoT Technology Co., Ltd.**, also known as **Fengwo Group**. Researcher Pedro Falé gained visibility into the activity by registering an expired domain previously used by the devices for telemetry, exposing tens of thousands of boxes that spoofed themselves as mobile phones from brands including Samsung, Vivo, Huawei, and Xiaomi. The devices allegedly ran two Fengwo-linked apps that coordinated fake ad clicks against AI-generated websites built to serve ads only to the spoofed mobile identities. BitSight estimated that about **38,000** devices were contacting one observed Fengwo domain and that the ad-fraud component alone could produce nearly **$50,000 per day**, not including revenue from proxy services. The report also described the broader **Fuyao Enterprise** as an Android TV botnet supporting ad fraud at scale, with references to more than **120,000 AI digital humans** used in the scheme. Researchers said the boxes switched roles depending on use, acting as residential proxies while the TV was on and performing ad-fraud tasks while it was off, underscoring the privacy, botnet, and supply-chain risks posed by insecure generic streaming devices.
Aug 1, 2026
The Kimwolf botnet has rapidly infected over 1.8 million Android-based devices worldwide, with security researchers warning that the true number may exceed 2 million. The malware primarily targets Android TV boxes, digital photo frames, and other IoT devices, many of which are distributed through major online retailers and often ship with weak security controls or pre-installed malicious software. Kimwolf leverages advanced techniques such as DNS-over-TLS, blockchain-based command and control via Ethereum Name Service (ENS), and residential proxy networks to evade detection and takedown efforts. The botnet enables attackers to launch high-volume DDoS attacks, monetize proxy bandwidth, and conduct lateral movement within local networks, posing a significant threat to both enterprise and consumer environments. Security experts have identified that two-thirds of Kimwolf infections are Android TV boxes lacking basic authentication, making them especially vulnerable. The operators behind Kimwolf, previously linked to the Aisuru botnet, are known for their technical sophistication and rapid adaptation to takedown attempts. Their monetization strategies include ad fraud, DDoS-for-hire services, and the resale of residential proxy bandwidth. The malware often spreads through bundled mobile apps and games, exploiting the global supply chain of low-cost Android devices. Organizations and individuals are urged to identify, isolate, and remediate infected devices to prevent further exploitation and participation in criminal infrastructure.
Jun 29, 2026
Sophos reported that some Android devices were delivered to users with malware already embedded at the firmware level, indicating compromise somewhere in the device supply chain rather than through a typical post-sale infection. Because the malicious code resides below the application layer, it can survive resets, evade standard mobile security controls, and give attackers persistent access to the device. The finding raises concerns for enterprises that rely on Android endpoints for corporate access, especially where bring-your-own-device and low-cost handset procurement are common. Preinstalled firmware malware can expose credentials, communications, and managed applications from the moment a device is activated, making hardware sourcing, mobile threat defense, and strict device attestation critical parts of enterprise mobile security programs.
Jul 12, 2026