A Canadian system administrator discovered that an Android TV box purchased from Amazon was pre-loaded with persistent, sophisticated malware baked into its firmware.

In January, security researcher Daniel Milisic discovered that a cheap Android TV streaming box called the T95 was infected with malware right out of the box, with multiple other researchers ...

A number of popular Android TV boxes on Amazon have been found containing pre-loaded malware, compromising user security and perpetrating ad fraud.

The affected models include the AllWinner T95, AllWinner T95Max, RockChip X12-Plus, and RockChip X88-Pro-10. The malware within them is capable of launching coordinated cyberattacks.

This is when searcher Daniel Milisic bought a “T95” Android TV box. Milisic became suspicious of the device when it started to communicate with unknown websites.

A new and rising threat is hunting Android devices worldwide, with more than 192,000 infections linked to a malware called BadBox. Originally found in early 2023 on a T95 Android TV box sold on ...