BADBOX Supply-Chain Botnet Infected Android TV Boxes and Smart Devices

Researchers and independent analysts linked a large Android supply-chain botnet known as BADBOX to preinfected TV boxes, smart TVs, and some smartphones, with malware embedded in firmware or silently installed through privileged system components. Reports described more than 190,000 compromised devices, including low-cost Android TV boxes built on AllWinner and RockChip platforms as well as higher-profile products such as Yandex 4K QLED TVs and the Hisense/Instawall T963. The malware survives factory resets, contacts command-and-control servers at boot, uploads device identifiers and telemetry, and can fetch secondary payloads used for ad fraud, account abuse, remote code installation, and residential proxying.