Google has filed a lawsuit against the Badbox 2.0 botnet operators, after identifying over 10 million infected Android devices:
These devices lack Google's security protections, and the perpetrators pre-installed the Badbox 2.0 malware on them, to create a backdoor and abuse them for large-scale fraud and other illicit schemes.
While updates to Google Play Protect kept the malware away from devices running Google services and automatically blocked associated applications, the fresh lawsuit is meant to help the internet giant dismantle the criminal operation behind the botnet.
Badbox 2.0 "is already the largest known botnet of internet-connected TV devices, and it grows each day. It has harmed millions of victims in the United States and around the world and threatens many more," Google notes in its complaint, a copy of which was shared with SecurityWeek.
[...] According to Google, Badbox 2.0 is operated by multiple cybercrime groups from China, each having a different role in maintaining the botnet, such as establishing infrastructure, developing and pre-installing the malware on devices, and conducting fraud.
Originally spotted on Schneier on Security.
Previously: Thousands of Android Devices Come With Unkillable Backdoor Preinstalled
Related Stories
Somehow, advanced Triada malware was added to devices before reaching resellers:
When you buy a TV streaming box, there are certain things you wouldn't expect it to do. It shouldn't secretly be laced with malware or start communicating with servers in China when it's powered up. It definitely should not be acting as a node in an organized crime scheme making millions of dollars through fraud. However, that's been the reality for thousands of unknowing people who own cheap Android TV devices.
In January, security researcher Daniel Milisic discovered that a cheap Android TV streaming box called the T95 was infected with malware right out of the box, with multipleotherresearchers confirming the findings. But it was just the tip of the iceberg. This week, cybersecurity firm Human Security is revealing new details about the scope of the infected devices and the hidden, interconnected web of fraud schemes linked to the streaming boxes.
Human Security researchers found seven Android TV boxes and one tablet with the backdoors installed, and they've seen signs of 200 different models of Android devices that may be impacted, according to a report shared exclusively with WIRED. The devices are in homes, businesses, and schools across the US. Meanwhile, Human Security says it has also taken down advertising fraud linked to the scheme, which likely helped pay for the operation.
[...] Human Security's research is divided into two areas: Badbox, which involves the compromised Android devices and the ways they are involved in fraud and cybercrime. And the second, dubbed Peachpit, is a related ad fraud operation involving at least 39 Android and iOS apps. Google says it has removed the apps following Human Security's research, while Apple says it has found issues in several of the apps reported to it.
(Score: 3, Disagree) by DadaDoofy on Monday July 28 2025, @10:38AM (3 children)
It's kind of ironic that Google is suing after they were the ones who set up the conditions for this to occur. Android? Thanks but no thanks. This is exactly why Apple customers (outside Europe) are quite happy with our walled garden.
(Score: 3, Informative) by shrewdsheep on Monday July 28 2025, @11:20AM (2 children)
I'm not exactly sure what you mean, but being able to root my phone and install a de-Googled version of Android is a good thing in my book. It's just the case, again, that free stuff is never really free (and fools and their money, and so on).
An insightful comment on Schneier on Security points out that apparently click and ad-fraud was conducted and this was what triggered Google. Google doesn't care in general as long their ad business not affected.
(Score: 2) by DadaDoofy on Monday July 28 2025, @01:37PM (1 child)
"a de-Googled version of Android"
I'm not exactly sure how you could accomplish that given Android itself is a Google product.
(Score: 3, Touché) by Anonymous Coward on Monday July 28 2025, @04:00PM
Dude! Are you sure you're a nerd?
https://de-googled.com/ [de-googled.com]
(Score: 5, Touché) by Mojibake Tengu on Monday July 28 2025, @12:14PM
So, Google is now legally upset because Google devices autoclick nagging Google advertisings a lot?
Very funny.
The kinder you are, the easier it is for wicked people to morally coerce you.