Millions of gadgets caught in Badbox 2.0’s sneaky web

Just a heads up, if you buy something through our links, we may get a small share of the sale. It’s one of the ways we keep the lights on here. Click here for more.

The FBI has issued a public warning about a large-scale cybercrime operation known as BADBOX 2.0, which has quietly taken control of millions of smart devices across the US. 

These aren’t high-end systems, they’re everyday gadgets like TV streaming boxes, digital projectors, tablets, and even car infotainment systems that people use at home.

Once a device is infected, it doesn’t just slow down, it becomes part of a hidden “residential proxy network.” 

In simple terms, hackers secretly use your internet connection to disguise their own identities while committing crimes like ad fraud, scraping data, or launching attacks, all without you knowing.

Most infected devices are low-cost, Android-based electronics, often made in China and sold under generic brand names. 

Some of the worst-hit product families are “TV98” and “X96,” both of which are currently being sold on Amazon, sometimes even labeled “Amazon’s Choice.” 

Experts estimate that at least 1 million devices are actively infected.

There are two main ways these devices get compromised:

1. Pre-installed malware – Some gadgets come already infected straight out of the box.
2. Malicious app installations – Users are tricked into downloading dangerous apps from unofficial sources during setup.
   

This new wave of attacks is more advanced than the original BADBOX scheme. 

Instead of relying on hard-to-detect firmware hacks, BADBOX 2.0 uses software-based tricks and fake apps to expand faster and more widely.

Watch for these warning signs:

• The device asks you to turn off Google Play Protect
• It’s from an unfamiliar or no-name brand
• It claims to stream free content or is “unlocked”
• It pushes you to download apps outside official app stores
• You notice strange internet activity at home

To protect yourself, the FBI advises:

• Use only official app stores
• Be wary of too-cheap gadgets
• Monitor your network for unknown devices or odd traffic
• Keep your devices updated with security patches

If you think one of your devices is infected, disconnect it and report it to the FBI at www.ic3.gov.

Have you checked if your device could be affected by this? Do you follow best practices when it comes to protecting your devices from attacks? Let’s chat below in the comments, or via our Twitter or Facebook.