Android TV boxes with hidden malware: how to tell if you have one at home, and what to do

A cheap Android TV box from an online marketplace promises to turn an ordinary TV into a smart TV for just a few euros. However, some of them come with something extra: malicious software installed before shipment. How can you tell if you have it, and what should you do?

What’s Happening

Malware preinstalled on cheap Android devices has been appearing since 2023. The first wave of the campaign, which researchers dubbed BADBOX, was disrupted in 2024, but its successor, BADBOX 2.0, emerged shortly thereafter. In June 2025, the FBI warned that more than one million devices had been affected, and in July 2025, Google reported that more than 10 million uncertified devices were involved.

In early November 2026, Google, together with its security partners, announced the disruption of another botnet targeting TV boxes. According to researchers involved in the operation, more than 1.3 million devices were affected, including tens of thousands of households in a single country. Even after the takedown, the operators continued to add fake “system” apps, so the absence of suspicious apps does not mean the device is clean.

Why This Is a Problem

Such a device isn’t just your TV running less secure software. It becomes part of a botnet. According to the FBI and security firms, compromised devices are used, for example, for ad fraud and to reroute third-party internet traffic through your home network. Your connection can thus be used for activities you didn’t initiate and aren’t aware of. Furthermore, the device is located on your home network, where it may have access to other devices.

How the infection occurs

• Pre-installed malware. The device already has it when you unbox it, without any action on your part.
• An app from an unofficial store. During initial setup or later, you download an app that contains a backdoor. The FBI’s warning specifically concerns the installation of apps from unofficial sources on streaming devices.

Which devices are at risk

Most often, these are cheap, unbranded, and uncertified devices running an open-source version of Android: TV boxes, projectors, tablets, digital photo frames, and sometimes even in-car multimedia systems. A red flag is a price significantly lower than that of verified manufacturers and a seller whose origin is unclear.

Warning signs: check these at home

None of these on its own confirms an infection, but each is worth a closer look.

1. The device is sold as “unlocked” or offers free access to paid content. The FBI lists this as a possible sign. A “steal” offer is a common bait.
2. It is not certified. Check to see if the device is on the operating system manufacturer’s list of certified devices. Certification is no guarantee of safety, but its absence is a bad sign.
3. It offers unknown app stores or prompts you to install apps from outside the official store.
4. Play Protect is turned off or cannot be enabled.
5. Unusual network activity. Check the app or your router’s settings to see how much data the device is transferring, especially when no one is watching the TV.
6. Unknown apps with system-like names. Look through your app list for apps you don’t recognize that appear to be part of the system.
7. The device isn’t receiving updates or is running an old version of Android that isn’t being updated.

What to Do If You Suspect a Problem

1. Disconnect the device from the network. Unplug the network cable or turn off Wi-Fi so it doesn’t transmit data.
2. Do not enter any passwords or credit card information on it. If you’ve logged into any accounts (streaming services, email) on it, change your passwords from another device and enable two-factor authentication.
3. Try restoring the device to factory settings and installing an update, but keep in mind that this may not remove malware embedded in the firmware.
4. If you still have concerns, stop using the device. This is the safest option.
5. Return it to the seller if the cancellation period is still open (usually 14 days for online purchases), and explain the reason. If you purchased it through a marketplace, contact the marketplace’s support.
6. Check other devices on your network, especially if they’re behaving strangely. Also check your bank and email accounts for any unusual logins.

How to Buy a More Secure Router

• Buy from verified manufacturers and stores you’re familiar with. The operating system manufacturer maintains a list of certified partners.
• Be wary of unnaturally low prices and sellers with no track record.
• Find out how long the manufacturer promises to provide updates.
• Avoid “unlocked” set-top boxes and apps that promise free TV or movies. These are often the gateway to infection.
• Do not use unofficial app stores, and do not allow installations from unknown sources.

If you already have a cheap set-top box and don’t want to throw it away, at least connect it to a guest network so it can’t access your computer or phone. This is a stopgap measure, not a guarantee.

Summary

Malware in cheap TV boxes is not an exception but a long-standing and recurring problem. The best way to avoid this issue with such a device is to buy from a trusted manufacturer. If you already own one, watch for warning signs, unplug it if you suspect anything, and don’t use it to access important accounts. And if the price seems too good to be true, it probably is.