MALWARE FAMILY

BADBOX

Internal ID: apk.badbox

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to BitSight, BADBOX is a large-scale cybercriminal operation selling off-brand Android TV boxes, smartphones, and other Android electronics with preinstalled malware.

Threat Analysis

BADBOX is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://censys.com/unpacking-the-badbox-botnet/

→https://github.com/DesktopECHO/T95-H616-Malware

→https://krebsonsecurity.com/2026/01/who-operates-the-badbox-2-0-botnet/

→https://www.badbox2serviceofprocess.com/

→https://www.bitsight.com/blog/badbox-botnet-back

→https://www.bleepingcomputer.com/news/security/android-tv-box-on-amazon-came-pre-installed-with-malware/

→https://www.bleepingcomputer.com/news/security/badbox-malware-botnet-infects-192-000-android-devices-despite-disruption/

→https://www.bleepingcomputer.com/news/security/germany-blocks-badbox-malware-loaded-on-30-000-android-devices/

→https://www.humansecurity.com/learn/blog/satori-threat-intelligence-disruption-badbox-2-0/

→https://www.ic3.gov/PSA/2025/PSA250605#fn2

Quick Facts

TypeMalware Family

Aliases1

Also Known As

apk.badbox

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search BADBOX