The BadBox 2.0 malware botnet is a cybercrime operation that utilizes infected Android Open Source Project (AOSP) devices, including smart TVs, streaming boxes, and other connected devices that lack security protections, such as Google Play Protect. These devices become infected either by threat actors purchasing low-cost AOSP devices, modifying the operating system to include the BadBox 2 malware, and then reselling them online, or by tricking users into downloading and installing malicious apps on their devices that contain the malware. Google has filed a lawsuit against the anonymous operators of the Android BadBox 2.0 malware botnet, accusing them of running a global ad fraud scheme against the company's advertising platforms. In December 2024, the original BadBox botnet was disrupted by Germany after the country blocked communication between the infected devices and their command and control (C2) infrastructure by sinkholing DNS queries. Once compromised, devices become part of the BadBox 2.0 botnet, where they are turned into residential proxies sold to other cybercriminals without the victims' knowledge or are used to conduct ad fraud. However, that did not stop the criminal enterprise, as the threat actors quickly launched BadBox 2.0, which is now believed to have infected over 10 million Android-based devices as of April 2025.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 17 Jul 2025 20:00:22 +0000