Vo1d Backdoor Infected Over 1.3 Million Android TV Devices and Shipped in Firmware

Doctor Web reported that the Android.Vo1d backdoor infected nearly 1.3 million Android-based TV boxes across 197 countries, making it one of the larger botnet-style compromises seen in consumer smart TV hardware. The malware persists by altering multiple startup paths, including install-recovery.sh, daemonsu, and debuggerd, and uses cooperating components named vo1d and wd to maintain execution, deploy an encrypted daemon, and install attacker-supplied APKs. The highest infection volumes were observed in countries including Brazil, Morocco, Pakistan, Saudi Arabia, Russia, Argentina, Ecuador, Tunisia, Malaysia, Algeria, and Indonesia, while the initial intrusion vector remained unconfirmed.

Additional public reporting tied Vo1d to an apparent supply-chain compromise in an AODIN X1BQ smart projector sold on Amazon, where the malware was allegedly embedded in firmware before purchase and operated silently as a residential proxy node. The disclosure said the device contacted ota.triplesai[.]com after boot, received proxy assignment from sd002.jaguar-distributor.syslogcollector[.]com, and sent recurring UDP heartbeat traffic to o.fecebbbk[.]xyz, with the firmware build date indicating the compromise predated the buyer's receipt of the device. Malware library entries for variants including Android.Vo1d.1, Android.Vo1d.3, and Android.Vo1d.5 indicate the threat has multiple tracked forms, reinforcing concerns that Vo1d is spreading both through post-sale compromise and potentially through preinstalled malicious firmware.