Media Literacy & Verification Resource Library

Security researcher Daniel Milisic purchased a T95 Android TV box from Amazon for $40 and discovered it came pre-loaded with persistent backdoor malware in the firmware — before he had ever turned it on or connected it to the internet. Malwarebytes confirmed the finding: the device was phoning home to a command-and-control server and silently joining an ad fraud botnet. The malware was embedded at the factory level, below the operating system, making it nearly impossible to remove by ordinary users.

Trend Micro researchers, presenting at Black Hat Asia 2023, documented a criminal group called "Lemon Group" that had embedded malware known as "Guerrilla" into approximately 8.9 million Android devices across 180 countries — including smartphones, smartwatches, TV boxes, and tablets — spanning over 50 device brands. The malware could silently load additional payloads, intercept one-time passwords (OTPs) from SMS texts (enabling account takeover), set up reverse proxies from the infected device, and infiltrate WhatsApp sessions. Lemon Group operated it as a commercial service: selling access to infected devices, SMS interception, and ad fraud capacity to other criminal customers.

HUMAN Security's Satori team formally named and documented the operation as "BADBOX" — a botnet built on backdoored Android Open Source Project (AOSP) devices shipped globally. The German government sinkholed a significant portion of the infrastructure in December 2024, partially disrupting the operation. However, the threat actors adapted quickly.

HUMAN Security's Satori team, working with Google, Trend Micro, and Shadowserver, uncovered BADBOX 2.0 — a major expansion involving at least four distinct criminal groups: SalesTracker Group, MoYu Group, Lemon Group, and LongTV. The botnet had infected over 1 million devices globally, concentrated in Brazil (37.6%), the United States (18.2%), Mexico, Argentina, and Colombia, with traffic observed from 222 countries and territories. BADBOX 2.0 added a new infection vector: beyond factory-preinstalled malware, devices could now also be infected by downloading trojanized apps from unofficial app marketplaces. Google removed 24 Play Store apps found to be distributing the malware.

The FBI's Internet Crime Complaint Center (IC3) issued Public Service Announcement I-060525-PSA, formally warning the U.S. public about BADBOX 2.0. The FBI confirmed the botnet compromises TV streaming devices, digital projectors, aftermarket vehicle infotainment systems, digital picture frames, and other IoT products — most manufactured in China. The announcement was coordinated with Google, HUMAN Security, Trend Micro, and the Shadowserver Foundation.

Google filed a federal lawsuit against 25 Chinese entities involved in the BADBOX 2.0 operation, revising the confirmed infection count to over 10 million devices. The lawsuit identified four specialized criminal groups within the operation: an Infrastructure Group managing command-and-control servers; a Backdoor Malware Group pre-installing malware at the factory; an Evil Twin Group creating fake versions of legitimate Google Play apps to serve hidden ads; and an Ad Games Group using fraudulent game apps to generate fraudulent ad revenue. Google updated Play Protect to automatically block BADBOX-related apps.