Short answer: a cheap, no-name Android TV box can be infected before you even open the box — the FBI has warned about the BadBox 2.0 campaign, and researchers have separately documented a backdoor called Android.Vo1d on roughly 1.3 million streaming boxes across 197 countries. An infected device quietly turns your home internet connection into a node in a residential proxy network or a DDoS botnet, clicks on ads in the background, and can harvest login credentials from installed apps. Factory reset usually does not fix it, because the malware lives inside the firmware itself. The fix is to check for the warning signs, isolate the box on a separate network, and replace it with a certified device if needed. A VPN still matters here — it protects the traffic of your OTHER devices on the same network — but it does not disinfect the infected box itself.
What's happening: why cheap TV boxes keep getting infected
In June 2025, the FBI published an Internet Crime Complaint Center (IC3) public service announcement about BADBOX 2.0, an evolution of the earlier BADBOX campaign that was disrupted in 2024. According to the FBI, infection happens either during manufacturing or later, through apps installed from unofficial app stores. Millions of devices are affected, and they're used as residential proxies to mask malicious traffic and to gain unauthorized access to home networks. The affected device types go beyond streaming boxes: projectors, aftermarket vehicle infotainment systems, digital picture frames, and other Android-based devices, most manufactured in China by unbranded vendors.
Separately, a September 2024 malware report documented the Android.Vo1d backdoor: roughly 1.3 million infected TV boxes across 197 countries, with the United States among the countries with the largest numbers of infections, alongside Brazil, Morocco, Pakistan, Saudi Arabia, and Argentina. The report names specific models — an R4 box running Android 7.1.2, a generic "TV BOX" running Android 12.1, and a KJ-SMART4KVIP box running Android 10.1. The backdoor sits in the system partition and silently downloads and installs additional software without the owner's knowledge.
The most recent development is Kimwolf, a botnet built on compromised Android TV boxes and used for DDoS attacks. Its seventh known version was identified in February 2026 by Palo Alto Networks' Unit 42. Kimwolf disguises its HTTP/2 traffic to look like ordinary Chrome browser requests, uses the Ethereum Name Service to resolve its command-and-control addresses, and falls back to the Tor network as a backup communication channel. Research from XLab put the number of affected devices above 1.8 million. Infections concentrate on older box models that expose the Android Debug Bridge (ADB) port to the network.
All three campaigns share the same root cause: budget streaming boxes run outdated versions of Android, rarely receive security updates, and ship with firmware written by small, unaudited vendors with no Google certification process behind it.
Why an infected box threatens your whole home network
- Residential proxy abuse. Someone else's traffic routes through your home IP address — which means your own IP can end up on blocklists, start triggering CAPTCHAs on ordinary sites, or get your own accounts flagged for "suspicious activity."
- DDoS participation. The box sends traffic toward attacker-chosen targets on command, consuming your bandwidth and creating a steady background load on your router.
- Hidden ad fraud. The device opens ads and clicks on them in the background, mimicking a real user — more wasted bandwidth and network load you never asked for.
- Credential theft. If you ever signed into accounts (streaming services, Google) on the box, the malware can potentially reach saved sessions and tokens for those services.
- Remote software installation. A firmware-level backdoor lets attackers push and install additional software without your knowledge — from a new ad module to tools for a follow-up attack.
- A foothold into other devices on your network. Sitting on the same local network as your laptop, phone, or NAS, an infected box can scan nearby devices for open ports and vulnerabilities.
How to tell if your box is infected: the warning signs
Red flags before you buy
Some of the risk is visible before you even buy the device. Be cautious if: the brand is unfamiliar and doesn't show up as an established manufacturer with a track record; there's no mention of Google or Android TV / Google TV certification; the listing uses words like "unlocked" or promises "free content with no restrictions" — the FBI specifically names this as one of the BadBox risk markers; the price is noticeably lower than comparable devices with the same specs; screenshots of the interface show a pre-installed third-party app store instead of Google Play.
Red flags once it's in use
If the box is already running, watch for these signals: Google Play Protect in Settings won't turn on, or the device shows as "uncertified"; the box feels warm or sluggish even while idle, when you haven't touched it; your router's activity log shows data traffic from the box at night, while the TV is off; unfamiliar apps appear on the device that you never installed.
How to check your box: a step-by-step process
You can run this check yourself, with no special tools, in about 15–20 minutes.
- Play Protect certification. Open the Google Play app → profile icon → Play Protect → settings icon. It should say the device is certified. A "not certified" status on a box that was sold as a regular Android TV device is a serious warning sign.
- Installed apps list. Go through your app settings and note anything you didn't install yourself. Separately check whether "install from unknown sources" is enabled — if it is and you didn't turn it on, that's another signal.
- Network debugging (ADB). In developer settings, check whether "USB debugging" is on and, more importantly, "network debugging" — an open ADB port over the network (usually 5555) is exactly what botnets like Kimwolf exploit. If you never enabled this yourself but it's active, turn it off.
- Device traffic from your router. Open your router's web interface or app and check per-device traffic statistics, specifically during a period when the TV was definitely off. Steady background traffic from a box that's "just sitting there" is worth investigating further. It also helps to double-check your full device list — see "Who Is Connected to My Wi-Fi" for a walkthrough.
- Android TV antivirus. An antivirus app installed from the official Google Play Store with Android TV support can catch already-known malware variants. It's a useful extra check, but not a guarantee: if the backdoor lives in the system partition without root access, an antivirus app simply can't see or remove it.
What to do if your box is infected
If the checks above turned up one or more warning signs, here's the order of operations.
Disconnect the box from the network right away — unplug the cable or turn off its Wi-Fi — to stop it from acting as a proxy or botnet participant immediately.
Don't rely on a factory reset. If the malware is baked into the system partition of the firmware — which is how Android.Vo1d has been documented to work — a factory reset simply restores the same infected firmware you started with, and the problem comes right back.
Reflash with official manufacturer firmware, if it exists. Established brands with real support may offer this. No-name Chinese boxes typically don't — in that case, it's simpler and safer to replace the device with a certified one than to try to clean it.
Change the passwords for any accounts you signed into on the box — your Google account, streaming services, anything else — and force-close active sessions for those accounts from each service's security settings.
Check your router too. The infected device may have sat on the same network as your router for a while, so it's worth confirming the router's own settings weren't changed. See "Secure Home Router Settings" for a baseline checklist. If the risk looks serious, consider filing a report at ic3.gov so the pattern gets tracked at scale.
How to isolate a TV box and other IoT devices
Even if your current box turns out to be clean, basic network hygiene limits the damage from any future infection — whether it's a streaming box, a smart speaker, a camera, or any other IoT device.
The baseline move is to put streaming boxes, cameras, smart speakers, and other consumer electronics on a separate guest Wi-Fi network with its own SSID and password, distinct from your main network. Most modern routers let you enable client isolation (sometimes called "AP isolation") on the guest network, blocking it from reaching devices on your main LAN — so even an infected box can't talk directly to your laptop or NAS. It's also worth disabling UPnP on the router, since this feature lets devices open ports to the outside world on their own, which malware frequently abuses. Router-level DNS filtering is another useful layer, blocking known command-and-control domains before an infected device can even reach them. For more on segmenting and protecting a smart home overall, see "Smart Home Privacy and Data Protection".
| Measure | What it protects against | Limitation |
|---|---|---|
| Guest network + client isolation | An infected device reaching computers and NAS on your main network | Doesn't stop the box's own outbound traffic to the internet |
| Disabling network ADB | Infection via an exposed port 5555 (the Kimwolf vector) | Doesn't protect against malware already baked in at the factory |
| Certified device (Google TV / Android TV) | Pre-installed backdoors and missing Play Protect | Doesn't rule out infection later via sideloaded apps |
| Timely firmware updates | Known vulnerabilities already patched by the vendor | Useless once a vendor stops supporting the model |
| VPN on phones and laptops on the same network | Interception of other devices' traffic content on the local network | Doesn't disinfect or block the infected box itself |
| Router-level DNS filtering | Devices contacting known command-and-control domains | Misses new or not-yet-known C2 addresses |
Will a VPN help against an infected box?
Honesty matters here: a VPN does not remove a backdoor from firmware, and it does nothing to stop an infected box from sending traffic to an attacker's servers — it's an encryption tool for your connection, not malware removal. If you install a VPN on the infected box itself, the malware keeps running exactly as before; its own traffic just gets wrapped in encryption too, which has no cleansing effect whatsoever.
A VPN on your OTHER devices on the same home network — your phone, laptop, tablet — solves a different, genuinely useful problem: it encrypts their traffic, so even if a compromised device on the network tries to intercept or inspect nearby traffic, the content of your messages, passwords, and banking sessions stays encrypted and unreadable. The WireGuard protocol used by modern VPN apps encrypts traffic with ChaCha20-Poly1305, which is fast and doesn't noticeably tax mobile devices.
For Android phones and tablets, LiMP VPN for Android keeps a VPN connection running in the background without requiring constant attention. For a fuller picture of what a VPN does and doesn't cover, see "What a VPN Protects Against".
How to choose a safer TV box
If the checks above led you to replace your device, a few simple criteria make the next purchase safer. First, look for Google TV or Android TV certification — that guarantees the device passed Google's review process and gets access to the official Play Store with working Play Protect. Second, pick an established brand that actually ships security updates for its models rather than just selling them. Third, make sure the official app store comes pre-installed instead of a third-party catalog of unknown origin. And treat any seller offering a "pre-loaded" box with third-party streaming apps already installed as a red flag — that's exactly the configuration the FBI calls out as a BadBox risk factor.
It's also worth checking what ACR tracking software already on your TV is collecting — see "Smart TV Tracking: How to Disable ACR" — and the general principles of keeping unpatched devices safe in "Smartphone Without Security Updates".
Checklist: what to do today
- Check Play Protect certification on every Android TV device in your home.
- Disable USB and network debugging (ADB) unless you deliberately use it.
- Remove third-party app stores and any APKs installed outside Google Play.
- Move TV boxes and other IoT devices onto a separate guest network with client isolation.
- Update router and box firmware to the latest available version.
- Change passwords for every account you ever signed into on the box.
- Turn on a VPN on phones and laptops that share the same home network.
- If you confirm signs of infection, replace the device with a certified one rather than trying to "cure" the firmware.
Frequently asked questions
Can a factory reset remove malware from a TV box?
Usually not. If the malicious code is built into the system partition of the firmware, as documented with Android.Vo1d, a factory reset just restores the same infected firmware — the problem doesn't go away.
Are Samsung and LG TVs with their own operating systems affected?
The documented BadBox, Vo1d, and Kimwolf campaigns target budget Android boxes from unbranded manufacturers; Tizen (Samsung) and webOS (LG) don't show up in these reports. That said, general hygiene — timely updates, a separate guest network for the TV — is good practice on any platform.
How do I check if my box is Google certified?
Open the Google Play app, go to your profile icon → Play Protect → settings icon. It will show either "Device is certified" or "Device is not certified."
Can an infected box steal data from my phone on the same network?
It can't reach your phone's files directly, but it can scan the network for vulnerable devices and attempt to intercept unencrypted traffic. Isolating devices on the network and encrypting your phone's traffic with a VPN both meaningfully reduce that risk.
Why have I started seeing CAPTCHAs and blocks on ordinary sites at home?
This is one possible sign that your home IP address is being used as a residential proxy for someone else's traffic — it's worth checking every device on your network, starting with cheap IoT gadgets and TV boxes.
Is it worth installing antivirus software on Android TV?
An antivirus app from the official Google Play Store can catch already-known malware variants and is a useful extra check. But if a backdoor is built into the system-level firmware without root access, an antivirus app can't fully remove it — replacing the device is simpler in that case.
Are TV boxes provided by an internet or cable provider safe?
Generally yes — provider-issued boxes are typically certified and receive updates directly from the provider, making them noticeably lower-risk than no-name boxes bought separately online.