When you buy a TV streaming box, there are certain things you wouldn’t expect it to do. It shouldn’t secretly be laced with malware or start communicating with servers in China when it’s powered up. It definitely should not be acting as a node in an organized crime scheme making millions of dollars through fraud. However, that’s been the reality for thousands of unknowing people who own cheap Android TV devices.

In January, security researcher Daniel Milisic discovered that a cheap Android TV streaming box called the T95 was infected with malware right out of the box, with multiple other researchers confirming the findings. But it was just the tip of the iceberg. Today, cybersecurity firm Human Security is revealing new details about the scope of the infected devices and the hidden, interconnected web of fraud schemes linked to the streaming boxes.

Human Security researchers found seven Android TV boxes and one tablet with the backdoors installed, and they’ve seen signs of 200 different models of Android devices that may be impacted, according to a report shared exclusively with WIRED. The devices are in homes, businesses, and schools across the US. Meanwhile, Human Security says it has also taken down advertising fraud linked to the scheme, which likely helped pay for the operation.

“They’re like a Swiss Army knife of doing bad things on the internet,” says Gavin Reid, the CISO at Human Security who leads the company’s Satori Threat Intelligence and Research team. “This is a truly distributed way of doing fraud.” Reid says the company has shared details of facilities where the devices may have been manufactured with law enforcement agencies.

Human Security’s research is divided into two areas: Badbox, which involves the compromised Android devices and the ways they are involved in fraud and cybercrime. And the second, dubbed Peachpit, is a related ad fraud operation involving at least 39 Android and iOS apps. Google says it has removed the apps following Human Security’s research, while Apple says it has found issues in several of the apps reported to it.

First, Badbox. Cheap Android streaming boxes, usually costing less than $50, are sold online and in brick-and-mortar shops. These set-top boxes often are unbranded or sold under different names, partly obscuring their source. In the second half of 2022, Human Security says in its report, its researchers spotted an Android app that appeared to be linked to inauthentic traffic and connected to the domain flyermobi.com. When Milisic posted his initial findings about the T95 Android box in January, the research also pointed to the flyermobi domain. The team at Human purchased the box and multiple others, and started diving in.

In total the researchers confirmed eight devices with backdoors installed—seven TV boxes, the T95, T95Z, T95MAX, X88, Q9, X12PLUS, and MXQ Pro 5G, and a tablet J5-W. (Some of these have also been identified by other security researchers looking into the issue in recent months). The company’s report, which has data scientist Marion Habiby as its lead author, says Human Security spotted at least 74,000 Android devices showing signs of a Badbox infection around the world—including some in schools across the US.

The TV devices are built in China. Somewhere before they reach the hands of resellers—researchers don’t exactly know where—a firmware backdoor is added to them. This backdoor, which is based on the Triada malware first spotted by security firm Kaspersky in 2016, modifies one element of the Android operating system, allowing itself to access apps installed on the devices. Then it phones home. “Unbeknownst to the user, when you plug this thing in, it goes to a command and control (C2) in China and downloads an instruction set and starts doing a bunch of bad stuff,” Reid says.

Human Security tracked multiple types of fraud linked to the compromised devices. This includes advertising fraud; residential proxy services, where the group behind the scheme sell access to your home network; the creation of fake Gmail and WhatsApp accounts using the connections; and remote code installation. Those behind the scheme were selling access to residential networks commercially, the company’s report says, claiming to have access to more than 10 million home IP addresses and 7 million mobile IP addresses.

The findings tally with those of other researchers and ongoing investigations. Fyodor Yarochkin, a senior threat researcher at security firm Trend Micro, says the company has seen two Chinese threat groups that have used backdoored Android devices—one it has researched deeply, the other is the one Human Security looked at. “The infection of devices is quite similar,” Yarochkin says.

Trend Micro has found a “front end company” for the group it investigated in China, Yarochkin says. “They were claiming that they have over 20 million devices infected worldwide, with up to 2 million devices being online at any point of time,” he says. Based on Trend Micro’s network data, Yarochkin believes these figures to be credible. “There was a tablet in one of the museums somewhere in Europe,” Yarochkin says, adding he believes it is possible that swaths of Android systems may have been impacted, including in cars. “It’s easy for them to infiltrate the supply chain,” he says. “And for manufacturers, it’s really difficult to detect.”

Then there’s what Human Security calls Peachpit. This is an app-based fraud element, which has been present on both the TV boxes as well as Android phones and iPhones, Reid says. The company identified 39 Android, iOS, and TV box apps that were involved. “These are template-based applications—not very high quality,” says Joao Santos, a security researcher at the company. Apps about developing six-pack abs and logging the amount of water a person drinks were included.

The apps performed a range of fraudulent behavior, including hidden advertisements, spoofed web traffic, and malvertising. The research says that while those behind Peachpit appear different from those behind Badbox, it is likely they are working together in some way. “They have this SDK that did the ad fraud part, and we found a version of this SDK that matches the name of the module that was being dropped on the Badbox,” Santos says, referring to a software development kit. “That was another level of connection that we found.”

Human Security’s research says the ads involved were making 4 billion ad requests per day, with 121,000 Android devices impacted and 159,000 iOS devices impacted. There had been 15 million downloads in total for the Android apps, the researchers calculate. (The Badbox backdoor was found only on Android, not on any iOS devices.) Reid says that based on the data the company has, which isn’t a complete picture due to the complexity of the ad industry, those behind the scheme could have easily earned $2 million in one month alone.

Google spokesperson Ed Fernandez confirms the 20 Android apps reported by Human Security have been removed from the Play Store. “The off-brand devices discovered to be Badbox-infected were not Play Protect–certified Android devices,” Fernandez says, referring to Google’s security testing system for Android devices. “If a device isn’t Play Protect certified, Google doesn’t have a record of security and compatibility test results.” The company has a list of certified Android TV partners. Apple spokesperson Archelle Thelemaque says that it found five of the apps Human reported breaching its guidelines, and the developers were given 14 days to make them follow the rules. Four of them have done so, as of publication.

Toward the end of 2022 and in the first part of this year, Reid says, Human Security took action against the advertising fraud elements of Badbox and Peachpit. According to data shared by the company, the amount of fraudulent ad requests from the schemes taking place now has completely dropped off. But the attackers adapted to the disruption in real time. Santos says when the countermeasures were first deployed, those behind the schemes started by sending out an update to obfuscate what they were doing. Then, he says, those behind Badbox took down the C2 servers powering the firmware backdoor.

While the attackers have been slowed, the boxes are still in people’s homes and on their networks. And unless someone has technical skills, the malware is very hard to remove. “You can think of these Badboxes as kind of like sleeper cells. They’re just sitting there waiting for instruction sets,” Reid says. Ultimately, for people buying TV streaming boxes, the advice is to buy branded devices, where the manufacturer is clear and trusted. As Reid says, “Friends don’t let friends plug in weird IoT devices into their home networks.”