- TrendAI says over 1.3 million Android boxes shipped with a hidden agent, and about 1.33 million devices were scheduled for proxy and ad-fraud modules.
- Data-center blocklists could not catch this traffic, TrendAI says. It places the operation in the same ecosystem as BADBOX 2.0.
- TrendAI reports no corporate cases. If such a device sat on your network it could expose it, so inventory low-cost Android devices and recheck how you trust home IP addresses.
A box that arrives already compromised
A TV box that arrives infected is compromised before anyone plugs it in. The owner has done nothing wrong. Yet the owner's home connection can become someone else's income.
TrendAI links the operation to the ecosystem around BADBOX 2.0, an earlier botnet that was disrupted in March 2025. The report does not say the two are the same operation. Our view is that a buyer cannot rule out this kind of device by remembering one earlier takedown.
The new case involves more than 1.3 million TV boxes, projectors and other Android devices. TrendAI Research passed intelligence on the control servers to investigators over several months. Google then banned the manufacturer for good from building certified Android devices. The ban reaches future affiliates and software supplied to certified vendors. TrendAI adds that Google has changed its review process.
How a living-room box became a revenue stream
TrendAI says the firmware came from a manufacturer in Shenzhen. That company makes Android boxes sold under many other brands. Buyers received the agent with the device. It was called x.cpe and looked like routine device-management software.
It was built to slip past security tests run before release. It fetched updates from a GitHub page, as expected. It also held a link to an MQTT server, which is a lightweight messaging system. Through that link the operator had full remote control. Apps could be added or removed without the owner noticing, and settings could change.
One delivered component was called com.abc.nexus. TrendAI says it ran with system privileges. Its job was to sign boxes up to services that pay for shared bandwidth. The named examples are Traffmonetizer, Grass and Honeygain.
Those schemes took several forms. A box could serve as an exit point for a residential proxy. That means strangers' traffic leaves through a home connection and looks like a household. A box could click on ads for fraud. It could also join a PCDN. TrendAI says PCDNs are common in China. They borrow spare home bandwidth to deliver video and pay owners for it.
The operator could switch each module on or off per device. Later versions added protection against analysis and removed rival malware. The owner saw a TV box that worked.
What was measured, and the limits
TrendAI measured the operation from June to October 2026. Its own telemetry counted 1,472,554 infected devices. They covered 206 models in more than 170 countries. Partners' snapshots differ a little, so the shared figure is above 1.3 million.
Not every infected box ran the money-making code. TrendAI says the operator pushed the payload to only some devices running x.cpe. A channel setting decided which ones. About 1.33 million devices were scheduled for proxy and ad-fraud modules.
In the same report, TrendAI describes roughly 90 percent of the devices under the operator's control as earning money. Its proxy product put about 180,000 genuine home addresses up for use on a normal day. TrendAI cautions that collection was intermittent. Every figure is a floor, not a full count.
Malaysia, Brazil, Iraq, Mexico and Taiwan recorded the most devices. In five Western markets, the United States, Germany, the United Kingdom, Australia and Canada, TrendAI counted between about 26,000 and 42,000 devices each. Kaspersky has tied com.abc.nexus to an actor it calls IPMoyu.
Why blocklists could not catch it
The traffic left from addresses run by ordinary home broadband and mobile carriers. TrendAI says this traffic comes from the same kinds of networks as an organization's customers and staff working from home. In its words, blocklists of data-center ranges "would not and did not" catch it.
The lesson here: an IP address says where traffic came from, not who is behind it. A home address used to suggest a person. In this case it could be a rented exit point.
Where the risk could reach organizations
TrendAI does not report any corporate victims. It says only that an attacker could reach an internal network if such a device were part of it. The risk applies only in that case.
The devices also gathered Wi-Fi details and Bluetooth settings. The operator could run shell commands on them. These are reasons to check, not proof of exposure.
Questions to put to your teams
Ask IT whether any low-cost Android devices sit on your networks. TrendAI's account covers projectors and other Android devices as well as TV boxes. Meeting-room screens and lobby displays are easy to forget.
Ask whether those devices share a network with business systems. Separate networks limit what a hijacked box could see.
Ask procurement what checks happen before purchase. The agent was built to evade pre-release security tests. Passing such tests is therefore not proof of a clean device.
Ask fraud and security teams how they treat residential IP addresses. If a home connection counts as proof of a real customer, add a second check.
A device compromised before it ships can turn its owner's connection into someone else's product. Look past the address on the packet.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Ars Technica.
