Is Your Android TV Streaming Box Part of a Botnet?
Summary: Censys researchers examining Superbox Android TV streaming boxes sold at BestBuy and Walmart found the devices immediately contacted a Tencent QQ server and the Grass IO residential proxy service, and carried network tools including Tcpdump and Netcat plus a folder named 'secondstage.' Censys's Ashley said the box DNS-hijacked her router and performed ARP poisoning to assume its IP, while Google's July 2025 lawsuit targeted the BadBox 2.0 botnet of over ten million Android streaming devices and the FBI issued a June 2025 advisory on the same threat.
What you should know: A $400 streaming box that pays influencers 50 percent of each sale is not being sold for the hardware margin - Ashley's read is that it is about building a network, and that network runs through a buyer's home IP address.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026