FBI Warns of BADBOX 2.0 Botnet Surge in Chinese Devices

A China-based botnet operation called BADBOX 2.0 has infected more than 1 million off-brand Android smart devices globally. The FBI is advising consumers to check their home networks for suspicious activity that could be linked to multiple fraud schemes.

See Also: Top 10 Technical Predictions for 2025

In a public service announcement Thursday, the FBI said the malware-laced devices, primarily manufactured in China, range from low-cost TV streaming devices and projectors to digital picture frames and car infotainment systems.

Most of the devices were compromised before they were shipped to consumers, while others were infected during the initial software setup process through malicious app downloads from unofficial marketplaces.

First identified by cybersecurity firm Human Security in 2023 and temporarily disrupted in late 2024, the BADBOX campaign has re-emerged with expanded capabilities. BADBOX 2.0 not only infects devices through supply chain backdoors but also spreads through counterfeit apps that mimic popular software. In many cases, cybercriminals trick users into disabling Google Play Protect to install these “evil twin” apps, resulting in further compromise (see: Malware-Infested Android Devices Fuel Global Botnet Fraud).

Once online, compromised devices are enrolled into a sprawling botnet and residential proxy network. Criminal actors then exploit these proxies to hide malicious traffic and carry out schemes such as click fraud, ad fraud and broader cybercrimes.

The infected devices connect to fake HTML5 gaming sites, which are not designed or playing. Instead, they serve up high-paying in-game ads that generate fraudulent ad revenue – all hidden from device users.

These devices also offer attackers a stealthy entry point into home networks and turn unsuspecting consumers into part of a global cybercrime operation, the FBI said.

The highest concentrations of infected devices have been reported in South America, particularly Brazil. Most affected models are generic brands such as TV98 and GameBox, which are not Play Protect-certified by Google.

Some compromised devices and apps appear to have connections to Longvision Media, a Malaysia-based company whose LongTV products were found to launch hidden web browsers that simulate game play to serve ads.

Human Security, Trend Micro, Google and the Shadowserver Foundation collaborated to disrupt parts of the infrastructure through sinkholing. But researchers caution the takedown hasn’t fully dismantled the botnet.

The FBI advises consumers to avoid off-brand Android devices, refrain from downloading apps from unofficial sources and monitor home network traffic for anomalies. Users should keep device firmware and software up to date and enabling Google Play Protect.