Germany Sinkholes BadBox Malware Preinstalled on Android IoT Devices
Malware Intelligence · 2 sources · Updated 3mo ago · First seen Dec 12, 2024
Germany's Federal Office for Information Security (BSI) disrupted the BadBox malware operation by sinkholing command-and-control DNS traffic from more than 30,000 infected Android-based IoT devices sold in the country. The malware was found preinstalled in device firmware, particularly on internet-connected products such as digital picture frames, media players, and streaming devices, with officials warning that additional categories may also be affected, including smartphones and tablets. BSI said the compromised devices often run outdated Android versions and old firmware, increasing exposure to further botnet activity beyond BadBox.
Authorities said BadBox can steal data, capture two-factor authentication codes, download additional malware, create email and messaging accounts for disinformation campaigns, commit ad fraud, and turn devices into residential proxies for criminal abuse. Internet service providers are expected to notify affected owners, and BSI advised consumers to disconnect suspected devices and consider returning or discarding them because the firmware itself cannot be trusted. Google said the impacted off-brand products were not Play Protect-certified Android devices.
