Generic TV streaming boxes and the BADBOX 2.0 botnet: what the FBI's 2025 and 2026 warnings say

TV streaming boxes are among the devices the FBI has named in two public warnings about hijacked home networks. On June 5, 2025, the FBI published a public service announcement for the United States, alert number I-060525-PSA, saying cyber criminals were using compromised internet-connected devices in people's homes to commit crimes through a botnet called BADBOX 2.0. The devices it named were TV streaming devices, digital projectors, digital picture frames and aftermarket vehicle infotainment systems, among other products. On March 12, 2026, a second FBI announcement, on residential proxy networks, named TV streaming devices again. This guide sets out what the two warnings say, what Google said about the botnet, and what the certification the FBI refers to means. It does not assess any device or brand.

What the FBI and Google said about BADBOX 2.0

According to the FBI, the first BADBOX campaign was identified in 2023 and mainly involved Android devices that carried backdoor malware before anyone bought them. That campaign was disrupted in 2024, and BADBOX 2.0 was found afterwards. The newer version still compromises devices before sale, the FBI said, but it can also infect them by making owners download malicious apps from unofficial marketplaces. The FBI put the botnet at millions of infected devices and said most of them were manufactured in China.

The FBI credited Google, HUMAN Security, Trend Micro and the Shadowserver Foundation with contributing to its announcement. Google gave its own account on July 17, 2025. It said its researchers had worked with HUMAN Security and Trend Micro to uncover what it called “the largest known botnet of internet-connected TVs”. In Google's description, the botnet had compromised more than 10 million uncertified devices running the open-source version of Android, the Android Open Source Project, which does not include Google's security protections. Google said the criminals used the devices for large-scale ad fraud and other crimes, that it had updated Google Play Protect to block apps linked to BadBox automatically, and that it had filed a lawsuit in federal court in New York against those behind the botnet.

Why an infected box matters to its owner

The FBI described two ways a device ends up in the botnet. Some are loaded with malicious software before anyone buys them; others pick up backdoors through apps the device has to download, usually during setup. Once a compromised device joins a home network, the FBI said, it is at risk of being drawn into the botnet and into residential proxy services known for malicious use.

The March 2026 announcement explained what a residential proxy is. It routes other people's internet traffic through a household's connection, so websites see that household's IP address rather than the real user's. The FBI said this lets criminals hide who and where they are while “making the consumer appear responsible”. It listed uses ranging from phishing and logging in to accounts with stolen credentials to creating fake accounts and getting around purchase limits on concert tickets, sneakers and trading cards.

The same announcement said some devices leave the factory with malware already on them and may still carry it after a factory reset, and that malicious software often stays on a device even after the app that first brought it in is uninstalled. Antivirus software may be able to clean such a device, the FBI said; if not, the operating system may have to be reinstalled.

The warning signs the FBI listed

The FBI attached a caution of its own: no single sign proves malicious cyber activity or a crime, and the signs should be weighed in context. It urged people to check the internet-connected devices in their homes for signs of compromise and to consider disconnecting any that look suspicious.

What Play Protect certification means

Two of those signs turn on Google Play Protect, which Google describes as Android's built-in protection against malware and unwanted software. On its certification page, read on November 13, 2026, Google says it certifies Android devices whose makers choose to pre-install its apps, using hundreds of tests that check the Android security and permissions model and whether the software includes recent security updates. Certified devices must ship without pre-installed malware and must include Play Protect, according to Google, which tells shoppers to look for the Google Play Protect logo. For a device that is not certified, Google says it has not ensured basic security features, and that “your device may not be secure”.

That is the certifying company's own account of its program. In our reading, it matches the way Google described the BadBox devices in July 2025: uncertified, and running Android's open-source code without its protections.

What the FBI advised in 2025, and in 2026

In June 2025 the FBI's suggested mitigations were general. It advised monitoring traffic on home networks, checking connected devices for suspicious activity, avoiding apps from unofficial marketplaces that advertise free streaming content, and keeping operating systems, software and firmware up to date.

The March 2026 announcement was more direct about streaming hardware. The FBI recommended steering clear of TV streaming devices that promise free sports, TV shows and movies, warning that they may hide malware or backdoors. It pointed people to official app stores, and said that sideloading unofficial apps onto streaming sticks or Android TV boxes makes a malware infection more likely.

Where things stand

On November 13, 2026, both announcements were posted on the website of the FBI's Internet Crime Complaint Center (IC3), which is where the FBI asks anyone who believes they have been the victim of an intrusion to file a report. Google's July 2025 post did not say when its lawsuit might be decided, and we could not confirm the case's current status from an official page. For how long makers say they will keep connected devices updated, see our guide to smart device update periods.