A knowledge base article about BadBox Malware: What You Need to Know provided by the UC Berkeley IT Service Hub - Knowledge Portal
BadBox is malware (malicious software) that mostly infects cheap, off-brand Android streaming devices and TV boxes. Unlike typical computer viruses that spread through downloads or suspicious links, BadBox comes pre-installed on these devices straight from the factory.
Once on your network, BadBox quietly performs criminal activities in the background, including:
All of this happens while you're just trying to watch your shows.
If you purchased a budget-friendly streaming box from an online marketplace, especially one with an unfamiliar brand name, it likely arrived already infected.
Commonly affected devices include:
Cybercriminals intentionally sell these pre-compromised devices to build large networks of infected electronics they can control remotely.
BadBox is different from standard viruses because it's baked directly into the device's core system software (firmware). This means:
Since the infection can't be safely removed, the device cannot be trusted on any network.
1. Locate the infected device: Find the streaming box or Android TV device you suspect is infected
2. Disconnect it: Unplug it from power and remove it from your network
3. Don't reconnect it anywhere: Not to a friend's Wi-Fi, your phone's hotspot, or any other network
If you need a streaming device, purchase one from a reputable manufacturer that actively maintains security updates:
These companies regularly patch security vulnerabilities and take device safety seriously.