Loading story…
Germany's Federal Office for Information Security (BSI) disrupted the BadBox malware operation by sinkholing command-and-control DNS traffic from more than 30,000 infected Android-based IoT devices sold in the country. The malware was found preinstalled in device firmware, particularly on internet-connected products such as digital picture frames, media players, and streaming devices, with officials warning that additional categories may also be affected, including smartphones and tablets. BSI said the compromised devices often run outdated Android versions and old firmware, increasing exposure to further botnet activity beyond BadBox.
Authorities said BadBox can steal data, capture two-factor authentication codes, download additional malware, create email and messaging accounts for disinformation campaigns, commit ad fraud, and turn devices into residential proxies for criminal abuse. Internet service providers are expected to notify affected owners, and BSI advised consumers to disconnect suspected devices and consider returning or discarding them because the firmware itself cannot be trusted. Google said the impacted off-brand products were not Play Protect-certified Android devices.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
BSI said internet providers would notify affected customers and urged owners to disconnect suspected devices immediately. Because the malware was embedded in firmware, the agency warned the devices should not be trusted and recommended returning or discarding them.
BSI said it disrupted communications between up to 30,000 BadBox-infected devices in Germany and attacker-controlled infrastructure by redirecting the malware's traffic to sinkhole servers under Section 7c of the BSI Act. The action prevented infected devices from receiving commands and exfiltrating data while the measure remained active.
On 12 December 2024, Germany's Federal Office for Information Security warned that internet-connected IoT devices, especially digital picture frames and media players, were being sold with BadBox malware preinstalled and outdated Android versions.
Google later stated that the compromised off-brand devices were not Play Protect certified Android devices and therefore lacked recorded Android security and compatibility test results.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Finnish authorities warned that some Android smart devices sold to consumers, particularly televisions, TV boxes, and other home-networked endpoints, have been found with **BadBox 2.0** malware already present before purchase. The malware has been linked especially to low-cost products from lesser-known manufacturers and can also spread through malicious apps and suspicious websites. Officials said the backdoor may be inserted during the production chain, turning affected devices into covert criminal infrastructure while they continue to appear to function normally. BadBox 2.0 allows attackers to remotely load additional modules, collect data, and abuse infected devices for operations including botnet activity and denial-of-service attacks. The malware is considered especially hard to detect and effectively impossible for users to remove because the backdoor resides in firmware that cannot be rewritten without manufacturer support. Estonia's Information System Authority reported more than **7,000** infected devices in the country, underscoring the broader supply-chain security problem. Finland's Cyber Security Centre urged consumers to disconnect suspected devices immediately, install official vendor updates if available, and stop using and dispose of devices if the manufacturer does not provide a fix.
Jun 29, 2026
Researchers and independent analysts linked a large Android supply-chain botnet known as **BADBOX** to preinfected TV boxes, smart TVs, and some smartphones, with malware embedded in firmware or silently installed through privileged system components. Reports described more than **190,000** compromised devices, including low-cost Android TV boxes built on AllWinner and RockChip platforms as well as higher-profile products such as **Yandex 4K QLED TVs** and the **Hisense/Instawall T963**. The malware survives factory resets, contacts command-and-control servers at boot, uploads device identifiers and telemetry, and can fetch secondary payloads used for ad fraud, account abuse, remote code installation, and residential proxying.
Aug 21, 2026
Researchers reported the first documented Android malware campaign targeting automotive head units, after attackers abused the legitimate update mechanism of the `TWCore` system app on DoFun devices to deliver a multi-stage infection chain. The campaign used a stage-1 dropper known as **JarService**, followed by a stage-2 loader and a stage-3 payload that enabled ad-click fraud and deployed the **zhima** reverse-proxy module. Kaspersky said the operation was discovered in June 2026 and that DoFun later fixed the security issues that allowed the malicious updates to be distributed. The activity was attributed with high confidence to **MoYu Group**, an actor tied to the broader **BADBOX** ecosystem previously linked to large-scale fraud operations on consumer Android devices. HUMAN Security's reporting on **BADBOX 2.0** described a botnet monetizing infected devices through multiple schemes, including ad fraud and proxy abuse, aligning with the tactics seen in the automotive infections. The overlap in infrastructure and naming suggests the operators extended BADBOX-style monetization from consumer electronics into internet-connected vehicles, creating a new foothold inside Android-based in-car systems.
Aug 24, 2026