# BadBox 2.0 Botnet: What It Is and How to Protect Your Devices (2026)

> BadBox 2.0 is a botnet that HUMAN Security says infected more than 1 million off-brand Android devices across 222 countries — via supply-chain backdoors and trojanized apps — for ad fraud and residential-proxy abuse. What it is and how to defend against it.

Source: https://playciso.com/blog/badbox-2-0-botnet-what-it-is-and-how-to-protect-your-devices · Published: 2026-10-25 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-disruption-badbox-2-0/

---

BadBox 2.0 is a botnet built from cheap, uncertified Android devices. HUMAN Security's Satori threat-intelligence team, which disclosed it in 2025, says it identified **more than 1 million infected devices** across **222 countries and territories** — up from about 74,000 in the original 2023 BadBox. Here is what it is and how to defend against it. All figures below are HUMAN's or the FBI's, attributed inline. ## What BadBox 2.0 is It is a botnet made of low-cost, uncertified Android devices — TV streaming boxes, tablets, projectors and similar hardware based on the Android Open Source Project (AOSP) and _not_ Google Play Protect certified. HUMAN's Satori team reported more than 1 million infected devices, a large jump from the roughly 74,000 in the original BadBox scheme. The US FBI's IC3 issued a public-service announcement on **5 June 2025** confirming millions of compromised devices, listing smart-TV boxes, digital projectors, vehicle infotainment units, digital picture frames and other IoT devices. ## How devices get infected HUMAN describes two paths: - Supply-chain backdoor. Some devices ship already compromised — the malware is present before the box is opened. Because it is baked in, a factory reset does not reliably remove it. - Trojanized apps. Other devices are infected after purchase through apps carrying loader code, often from unofficial app stores. Either way, the device then connects to attacker infrastructure and joins the botnet. ## What it is used for HUMAN ties BadBox 2.0 to several fraud schemes running on the victim's hardware: - Programmatic ad fraud — loading and clicking ads invisibly in the background. - Click fraud. - Proxyjacking — reselling the device's internet connection as a residential proxy, so other criminals route traffic through a real home IP. - General botnet operation — the devices act as nodes for whatever the operators sell next. The common thread is monetising someone else's device and bandwidth without their knowledge. ## How it was disrupted HUMAN worked with **Google, Trend Micro, Shadowserver** and law enforcement on a disruption it describes as partial — the operators stayed active and HUMAN said it kept investigating further paths. Google removed offending apps and defends against the threat with Play Protect. An earlier action against the original BadBox's command-and-control servers was reported as only a temporary setback. In other words: meaningfully dented, not eliminated. ## How to protect your devices **Consumers:** avoid no-name, off-brand Android boxes; prefer devices that ship with Google Play Protect; be suspicious of any device or app that asks you to disable Play Protect; keep firmware updated; and treat unexpected heavy network traffic as a red flag. Because many infections are pre-installed, the safest fix is often to stop using the affected device. **Enterprises:** treat consumer-grade and IoT devices as untrusted. Four moves: - Segment IoT and consumer devices away from sensitive systems with network controls — practise the rules in the Firewall Rule Lab. - Monitor egress. Command-and-control beaconing and proxyjacking both show up as anomalous outbound traffic; baseline normal egress and alert on the rest in the Egress / Proxy Lab →, and write detections for the beaconing pattern in the Detection Lab. - Vet the supply chain. Extend procurement policy to exclude uncertified devices, and scope device risk with a structured threat model. - Have a response ready. Rehearse isolating and remediating a compromised device in the IR Playbook Lab. ## Frequently asked questions **BadBox 2.0 in one line?** A botnet of 1M+ uncertified Android devices (HUMAN Security) used for ad fraud, click fraud and residential-proxy abuse, spread by supply-chain backdoors and trojanized apps. **Are my phone and certified devices at risk?** The scheme targets uncertified off-brand Android hardware, not Play-Protect-certified phones and tablets. **Does a factory reset fix it?** Often no — pre-installed/supply-chain infections can survive a reset; stopping use of the device is safest. **What's the enterprise takeaway?** Segment untrusted IoT, monitor egress for C2 and proxy behaviour, and exclude uncertified hardware from procurement.