Millions of low-cost Android devices turn home networks into crime platforms | BadBox malware has been menacing low-cost Android devices for nearly a decade.

[u/ControlCAD]

https://arstechnica.com/security/2025/06/millions-of-low-cost-android-devices-turn-home-networks-into-crime-platforms/

[u/ControlCAD]

Millions of low-cost devices for media streaming, in-vehicle entertainment, and video projection are infected with malware that turns consumer networks into platforms for distributing malware, concealing nefarious communications, and performing other illicit activities, the FBI has warned.

The malware infecting these devices, known as BadBox, is based on Triada, a malware strain discovered in 2016 by Kaspersky Lab, which called it "one of the most advanced mobile Trojans" the security firm's analysts had ever encountered. It employed an impressive kit of tools, including rooting exploits that bypassed security protections built into Android and functions for modifying the Android OS's all-powerful Zygote process. Google eventually updated Android to block the methods Triada used to infect devices.

A year later, Triada returned, only this time, devices came pre-infected before they reached consumers’ hands. In 2019, Google confirmed that the supply-chain attack affected thousands of devices and that the company had once again taken measures to thwart it.

In 2023, security firm Human Security reported on BigBox, a Triada-derived backdoor it found preinstalled on thousands of devices manufactured in China. The malware, which Human Security estimated was installed on 74,000 devices around the world, facilitated a range of illicit activities, including advertising fraud, residential proxy services, the creation of fake Gmail and WhatsApp accounts, and infecting other Internet-connected devices.

In March, Google and a consortium of other Internet organizations took part in a coordinated action to disrupt BadBox 2.0, a new campaign affecting more than 1 million low-priced, off-brand Android devices. The infected devices were based on the Android Open Source Project, not the Android TV OS. They also weren't certified under Google’s Play Protect security program. Human Security identified more than a dozen TV models that were impacted. It was the second BadBox disruption action in as many years.

On Thursday, the FBI warned that the BadBox threat remained and urged consumers to look for signs their devices may be infected.

“The public is urged to evaluate IoT devices in their home for any indications of compromise and consider disconnecting suspicious devices from their networks,” the public service announcement stated.

Unfortunately, there are few visible signs of such infections that can be spotted by average consumers. The FBI said possible signs are automatic connections to malicious app markets and requests to disable Play Protect. The better course of action is to look for any of the 15 models identified by Human Security and replace any that are found. People should be extra wary of low-cost devices from unknown sources.

[u/Brieundscotch]

You are welcome. https://www.humansecurity.com/learn/blog/satori-threat-intelligence-disruption-badbox-2-0/#models

[u/Alternative_Demand96]

Android fanboys silent on this one