Loading story…
Doctor Web reported that the Android.Vo1d backdoor infected nearly 1.3 million Android-based TV boxes across 197 countries, making it one of the larger botnet-style compromises seen in consumer smart TV hardware. The malware persists by altering multiple startup paths, including install-recovery.sh, daemonsu, and debuggerd, and uses cooperating components named vo1d and wd to maintain execution, deploy an encrypted daemon, and install attacker-supplied APKs. The highest infection volumes were observed in countries including Brazil, Morocco, Pakistan, Saudi Arabia, Russia, Argentina, Ecuador, Tunisia, Malaysia, Algeria, and Indonesia, while the initial intrusion vector remained unconfirmed.
Additional public reporting tied Vo1d to an apparent supply-chain compromise in an AODIN X1BQ smart projector sold on Amazon, where the malware was allegedly embedded in firmware before purchase and operated silently as a residential proxy node. The disclosure said the device contacted ota.triplesai[.]com after boot, received proxy assignment from sd002.jaguar-distributor.syslogcollector[.]com, and sent recurring UDP heartbeat traffic to o.fecebbbk[.]xyz, with the firmware build date indicating the compromise predated the buyer's receipt of the device. Malware library entries for variants including Android.Vo1d.1, Android.Vo1d.3, and Android.Vo1d.5 indicate the threat has multiple tracked forms, reinforcing concerns that Vo1d is spreading both through post-sale compromise and potentially through preinstalled malicious firmware.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
In February 2026, the disclosure says the projector's infection was discovered after more than two months of use through manual packet capture and threat hunting. The observed activity included registration to ota.triplesai[.]com, proxy assignment via syslogcollector[.]com infrastructure, and recurring UDP heartbeats to o.fecebbbk[.]xyz.
The disclosure states the AODIN X1BQ smart projector was purchased on December 7, 2025, from Amazon under ASIN B0DGX51JPC. The report alleges the device was already infected with Vo1d malware at the time of sale.
A public disclosure reported that an AODIN X1BQ smart projector carried firmware version projector.20250910.101755 built on September 10, 2025, which the researcher cited as evidence the Vo1d infection was present before the device was sold.
In September 2024, Doctor Web reported that the Android.Vo1d backdoor had infected nearly 1.3 million Android TV boxes across 197 countries. The company said the malware used multiple persistence mechanisms and could download, install, and execute additional software under attacker control.
Doctor Web said users contacted the company in August 2024 after Dr.Web antivirus detected changes in the system file area of their Android-based TV boxes, prompting investigation of the malware activity.
The GitHub disclosure states that a formal complaint was submitted to Amazon requesting removal of ASIN B0DGX51JPC after the alleged pre-installed Vo1d infection was identified on the AODIN X1BQ projector.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcenews.drweb.com
Open sourcevms.drweb.com
Open sourcevms.drweb.com
Open sourcevms.drweb.com
Open sourcevms.drweb.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have identified that certain Android-based digital photo frames, particularly those using the Uhale platform, are downloading and executing malware at boot time. The devices, which are rooted by default and have disabled SELinux, automatically update their Uhale app from China-based servers and subsequently download malicious payloads linked to the Vo1d botnet and Mzmess malware families. The vulnerabilities, including over a dozen security issues with 11 assigned CVEs, allow the malware to persist and execute on every reboot, with the manufacturer failing to respond to multiple security notifications. The Vo1d malware, first observed in September 2024, has rapidly evolved into one of the most widespread Android botnets, targeting smart TVs, TV boxes, and now digital photo frames. Vo1d is capable of installing additional payloads, running proxy services, and conducting ad fraud, with infection estimates reaching up to 1.6 million devices globally. The malware employs domain generation algorithms for resilient command-and-control, and recent activity has shown a surge in infections, particularly in South Africa. The sophistication of Vo1d, including obfuscation and encryption, makes detection and remediation challenging for affected users and organizations.
Jun 29, 2026
Researchers and independent analysts linked a large Android supply-chain botnet known as **BADBOX** to preinfected TV boxes, smart TVs, and some smartphones, with malware embedded in firmware or silently installed through privileged system components. Reports described more than **190,000** compromised devices, including low-cost Android TV boxes built on AllWinner and RockChip platforms as well as higher-profile products such as **Yandex 4K QLED TVs** and the **Hisense/Instawall T963**. The malware survives factory resets, contacts command-and-control servers at boot, uploads device identifiers and telemetry, and can fetch secondary payloads used for ad fraud, account abuse, remote code installation, and residential proxying.
Aug 21, 2026
Finnish authorities warned that some Android smart devices sold to consumers, particularly televisions, TV boxes, and other home-networked endpoints, have been found with **BadBox 2.0** malware already present before purchase. The malware has been linked especially to low-cost products from lesser-known manufacturers and can also spread through malicious apps and suspicious websites. Officials said the backdoor may be inserted during the production chain, turning affected devices into covert criminal infrastructure while they continue to appear to function normally. BadBox 2.0 allows attackers to remotely load additional modules, collect data, and abuse infected devices for operations including botnet activity and denial-of-service attacks. The malware is considered especially hard to detect and effectively impossible for users to remove because the backdoor resides in firmware that cannot be rewritten without manufacturer support. Estonia's Information System Authority reported more than **7,000** infected devices in the country, underscoring the broader supply-chain security problem. Finland's Cyber Security Centre urged consumers to disconnect suspected devices immediately, install official vendor updates if available, and stop using and dispose of devices if the manufacturer does not provide a fix.
Jun 29, 2026