Malware in Low-Cost Android Devices Compromises Home Networks

Millions of inexpensive Android-based devices, such as media streamers and video projectors, are being sold with pre-installed malware known as BadBox, according to the FBI. This malware, which evolved from the infamous Triada malware first identified in 2016, turns home networks into hubs for cybercrime. Devices are infected during the manufacturing process, primarily affecting unbranded models built on the Android Open Source Project rather than Google’s certified Android TV OS. These compromised devices are capable of distributing malware, operating as residential proxies, and creating fake online accounts. Google and several Internet organizations attempted to disrupt BadBox operations in March 2025, but the FBI warns that the threat still exists. There are limited visible signs of infection, although users may notice unusual behavior such as connections to rogue app markets or prompts to disable Google Play Protect. The FBI urges consumers to evaluate their IoT devices, especially those of unknown or off-brand origin, and replace any that match the affected models identified by Human Security. The situation highlights ongoing risks in the global tech supply chain, especially involving devices lacking proper certification and oversight.