Android TV box botnet: how to tell if yours is infected

An Android TV box is probably working for someone else if it is not certified by Google, pushes traffic at night while the TV is off, installs apps on its own and returns to the same behavior after a factory reset. That is exactly how devices in the Vo1d, BadBox 2.0 and Kimwolf botnets behaved. Between 2023 and 2025 these operations captured, depending on who was counting, anywhere from several million to more than 10 million cheap TV boxes. Below: which boxes are at risk, how to check one through its menu, the home router and ADB, and why the reset button barely helps.

Which botnets infect Android TV boxes

A TV box botnet is boring by design. Thousands of small devices take orders from one server and quietly carry them out while their owners watch football. The orders vary: load invisible ads and click them, relay strangers’ traffic, join DDoS attacks, download new modules.

Over three years researchers documented four large families in detail.

Botnet	First described	Scale	Researchers	What it does
BadBox	2023	about 74,000 devices; in December 2024 the BSI cut 30,000 German devices off from control	HUMAN Security, BSI	firmware backdoor, ad fraud
Vo1d	September 2024	1.3 million boxes in 197 countries; up to 1.59 million by January 2025	Doctor Web, XLab	backdoor in the system partition, module loader, proxy
BadBox 2.0	March 2025	over 1 million per HUMAN, over 10 million per Google’s lawsuit	HUMAN Satori, Google, Trend Micro, Shadowserver	residential proxies, ad fraud, silent app installs
Kimwolf	late 2025	1.8 to 2 million devices	XLab, Synthient, KrebsOnSecurity	DDoS, proxies, scanning home networks

The numbers cannot simply be added up. Some devices sat in several botnets at once, and each company counted differently: some by unique IP addresses, others by daily active devices. The order of magnitude is still clear.

The geography is familiar too. HUMAN’s BadBox 2.0 report put Brazil first with 37.6% of infected devices, followed by the United States with 18.2%, Mexico with 6.3% and Argentina with 5.3%. Doctor Web’s Vo1d report listed Brazil, Morocco, Pakistan, Saudi Arabia, Argentina and Russia near the top. These are markets where people buy a box for free channels and movies, and a price of 25 or 40 dollars decides everything.

Kimwolf deserves a separate note. According to XLab, over a few days in November 2025 the botnet sent roughly 1.7 billion DDoS attack commands to its devices. Researchers at Synthient and journalist Brian Krebs described how it spread: through residential proxy networks, meaning through other infected boxes, reaching neighboring devices inside home networks.

Why cheap boxes get infected

Most no-name boxes do not run Google’s Android TV. They run bare Android Open Source Project, open code that any manufacturer can build on its own. Such builds carry no Google license, never passed a security review and receive no updates.

The second problem is a fake system version. In Doctor Web’s report, boxes that called themselves Android 10.1 and Android 12.1 in their settings turned out, by build number NHG47K, to be Android 7.1.2. That is a 2017 system missing years of patches. The label in the menu is worth exactly what it costs to type.

The third problem is root and debugging out of the box. Many firmware images ship with superuser rights and network ADB enabled. Convenient for the assembler, an open door for the owner.

The fourth and nastiest is the factory backdoor. The first BadBox wave lived in firmware before the box ever reached a warehouse. The buyer downloaded nothing and clicked nothing. The device was infected at the moment of purchase.

The fifth is app stores offering free content. BadBox 2.0 also spread through third-party catalogs of movie and IPTV apps. HUMAN also found related apps in Google Play, and Google removed them.

Which models showed up in the reports

Reports named T95 and X88 Pro 10 (BadBox), R4, TV BOX and KJ-SMART4KVIP (Vo1d), plus many variants of MXQ Pro and X96Q. BadBox 2.0 also hit tablets, projectors and car infotainment units without Google certification.

A model list has limited value. The same board sells under a dozen names, and one marketplace name can hide three different boards. Checking behavior and certification status is more reliable than checking the box.

How to check whether a box is Google certified

This is the easiest test, and in its June 2025 warning the FBI named the lack of certification as the main risk factor.

Steps:

1. Open Google Play on the box.
2. Tap the profile icon and go to Settings.
3. Open About.
4. Find the line Play Protect certification.

If it says Device is not certified, the box was built without Google’s review. If there is no Google Play at all and an unknown store sits in its place, it is almost certainly a bare AOSP build. Google publishes its list of certified partners on android.com under certified partners.

Certification does not guarantee a clean device. But every large botnet in this article lived on uncertified hardware.

Which infection signs are visible without tools

Some symptoms show up without a computer. None of them proves infection on its own, but two or three together paint a confident picture.

Sign	What may be behind it	Reliability
No Play Protect certification	AOSP build without review	risk factor, not proof
Box is hot while idle	CPU busy with background tasks	medium
Traffic at night with the TV off	proxy node or DDoS participation	high
Apps appear on their own	module loader	high
Play Protect is off and will not turn on	system tampering	high
Constant captchas on other home devices	home IP on blocklists	medium
Slow internet for the whole household	bandwidth used by foreign traffic	low

The captcha point needs explaining. When a box works as a residential proxy, strangers’ requests go out through the home IP: password guessing, fake account sign-ups, ad fraud. Google, Cloudflare and banks flag that address and start challenging everyone behind it, including the owner’s laptop and phone.

How to see the box’s traffic on the router

The router sees everything the box sends to the internet, and the box cannot fool it. Most home models show per-device statistics under Clients, Devices or Traffic Monitor.

The best test is simple: turn the TV off in the evening, leave the box plugged in, and check in the morning how much it downloaded and uploaded overnight.

Mode	Download	Upload	Comment
Idle, clean box	up to 100 MB per day (estimate)	tens of MB (estimate)	updates, time sync
Watching 4K	up to 7 GB per hour	a few percent of download (estimate)	normal load
Residential proxy	hundreds of MB to gigabytes per day (estimate)	close to download	runs around the clock
DDoS participation	bursts	upload exceeds download	minutes or hours at a time

The main red flag: upload almost equals download while nobody is watching anything. A normal box mostly downloads. A proxy node downloads and immediately sends it back out.

The second data source is DNS. If the home network runs AdGuard Home, Pi-hole or a router with a query log, it shows which domains the box contacts. According to XLab, Vo1d used a domain generation algorithm. In a log this looks like a stream of requests to meaningless names, strings of random letters across different domain zones.

On OpenWrt routers, the number of open connections from the box takes one command:

# replace 192.168.1.50 with the box address from the client list
grep 192.168.1.50 /proc/net/nf_conntrack | wc -l

A few dozen connections from an idle box look normal. Hundreds or thousands at night (estimate) mean someone is working through it.

How to check the box with ADB

ADB (Android Debug Bridge) is a debugging tool that lets a computer look inside Android. It needs Google’s platform-tools package and debugging enabled under Developer options on the box.

First, find out which system is really installed:

adb connect 192.168.1.50:5555
adb shell getprop ro.build.version.release
adb shell getprop ro.build.id
adb shell getprop ro.build.fingerprint

If the menu says Android 12 but ro.build.id shows NHG47K or another Android 7 era build, the manufacturer lied about the version. Same picture as in the Vo1d report.

Next, the list of third-party apps and the traces Doctor Web described for Vo1d:

adb shell pm list packages -3
adb shell ls -l /system/xbin/ /system/bin/ | grep -E 'vo1d|wd|debuggerd|daemonsu'
adb shell cat /system/bin/install-recovery.sh
adb shell which su

According to Doctor Web, boxes infected with Vo1d contained the files /system/xbin/vo1d and /system/xbin/wd, a replaced debuggerd system file with the original copied to debuggerd_real, and a modified install-recovery.sh script that launches the malicious code on every boot. Unfamiliar packages named like system services in the third-party list also deserve a closer look.

Network connections and debugging status:

adb shell cat /proc/net/tcp
adb shell settings get global adb_enabled

One more point: if the box accepted a connection on port 5555 without a confirmation prompt on screen, that alone is a vulnerability. According to Synthient, open network ADB is exactly what Kimwolf used to spread inside home networks.

A clean result does not prove the box is clean. Advanced malware with root rights can hide files and processes from commands that run on the same system. The router is more reliable here, because it looks from the outside.

Does a factory reset help

In most cases, no. A reset wipes the user partition: apps, settings, cache. Vo1d’s code lived in the system partition, and BadBox lived in the firmware itself. After a reset the box boots the same infected system and within minutes reconnects to its command server.

In theory, reflashing a clean official build helps. In practice, no-name boxes rarely have a clean official firmware: the manufacturer is unknown, there is no support site, and builds from forums are a gamble of their own. In the BadBox reports researchers stated plainly that factory-infected devices have no reliable cleanup method.

Why an infected box is a problem for its owner

The first risk is strangers’ business under the home IP. Residential proxies are bought by those who need to look like ordinary users: ad fraudsters, account crackers, spammers. The logs of attacked services record the box owner’s address. Captchas and blocks are the soft outcome. The hard one is questions from the ISP or the police.

The second risk is bandwidth. During a DDoS attack the box uploads as much as the plan allows. The whole apartment’s internet sags, and some ISPs disconnect subscribers whose addresses send attack traffic.

The third risk is the neighbors on the network. Kimwolf, according to researchers, scanned the local network for other vulnerable devices. The box becomes a foothold inside the home, next to cameras, NAS drives and laptops.

The fourth risk is accounts. If the box is signed in to Google, YouTube or streaming services, malware with root rights potentially has access to those session tokens.

What Google, the FBI and Germany’s BSI did

In December 2024 Germany’s BSI seized BadBox command domains and cut at least 30,000 devices in Germany off from their operators: media players, digital photo frames, TV boxes.

In March 2025 HUMAN, together with Google, Trend Micro and the Shadowserver Foundation, sinkholed part of the BadBox 2.0 infrastructure. Researchers tied the operation to several groups that split the roles: one built firmware, another sold traffic, a third ran ad fraud.

In June 2025 the FBI issued a public warning about BadBox 2.0 listing the signs: uncertified devices, promises of free content, apps from unofficial stores, disabled Play Protect, suspicious network traffic.

In July 2025 Google filed a lawsuit in federal court in New York against 25 unnamed individuals in China whom the company considers the BadBox 2.0 operators. In the complaint Google put the number of infected devices at more than 10 million. The lawsuit lets the company legally take down botnet infrastructure, but the boxes themselves are still sitting in living rooms.

Ten-minute check: summary table

Step	Where to look	Red flag
Certification	Google Play, About section	Device is not certified, or no Google Play at all
Night traffic	router client statistics	hundreds of MB or more with the TV off, upload close to download
DNS log	AdGuard Home, Pi-hole, router log	requests to random meaningless domains
Real Android version	ADB, ro.build.id	build older than the menu claims
System files	ADB, /system/xbin and /system/bin	vo1d, wd, debuggerd_real, su
Open ADB	connection on port 5555	access without on-screen confirmation
Reset	after factory reset	symptoms come back

A cheap box saves money once, at checkout. After that, if it landed in one of these botnets, it spends years working for other people on someone else’s electricity, someone else’s bandwidth and someone else’s reputation online.