The FBI says criminals have used home IoT devices in a botnet called BADBOX 2.0, with some devices infected before purchase or during setup. Warning signs include unrecognizable brands, devices that are not Play Protect certified, and setup that asks you to disable Google Play Protect.
What the FBI says happened
The FBI's public service announcement describes BADBOX 2.0 as a botnet that followed the original BADBOX campaign, which was disrupted in 2024. It says it has infected millions of devices and that criminals sell or give away access to compromised home networks. The botnet is linked to residential proxy services, which are used for malicious activity. The FBI notes that most infected devices were reportedly made in China.
Devices can be infected in three ways, per the announcement. The product can be configured with malicious software before purchase. It can download required applications that contain backdoors during setup. Or a user can download malicious apps from unofficial marketplaces.
Indicators the FBI lists
The FBI cautions that an indicator alone does not prove malicious activity or a crime, so weigh them together. They include:
- suspicious app marketplaces;
- being asked to disable Google Play Protect settings;
- generic TV streaming devices advertised as unlocked or offering free content;
- IoT devices from unrecognizable brands;
- Android devices that are not Play Protect certified;
- unexplained or suspicious internet traffic.
What to do before you buy
Buy streaming devices from brands that publish support periods and security contact details. Be wary of a box that promises free channels. Check that an Android based device is Play Protect certified, using the maker's documentation or the settings screen.
What to do if you own one
The FBI's recommendations include these steps.
- Monitor home network traffic and assess IoT devices for suspicious activity.
- Avoid apps from unofficial marketplaces that promise free streaming content.
- Keep operating systems, software and firmware updated.
- Consider disconnecting suspicious devices from the network.
- If you believe you are compromised, report it to the FBI's Internet Crime Complaint Center.
If you disconnect a device, treat any account you signed into on it as exposed. Change those passwords from another device.
How to check a box you already own
You can check some of the FBI's indicators in a few minutes without special tools.
- Open the device's settings and look for the Play Protect or security section, and see whether protection is on and whether the device reports itself as certified.
- Look at the app store it uses. If it is an unfamiliar store with free channel apps, that matches the FBI's description of suspicious marketplaces.
- Search the maker's name and model together with the word support. A real maker normally has a support page, a manual and a way to contact them.
- Check your router's list of connected devices for names or addresses you do not recognize, and for devices that are active when nobody is home.
None of these proves infection. Together they tell you whether the device deserves a place on your network.
A note on certainty
Owning a cheap box does not mean it is infected. The announcement is a warning about patterns. If your device matches several of the signs, replace it with a supported product from a known maker.
Quick check
Can a new device be infected out of the box?
The FBI says some devices were configured with malicious software before purchase.
Is changing my Wi-Fi password enough?
Not on its own. If the device itself is infected, it can reconnect. Disconnect or replace it.
Sources
Last reviewed: 19 October 2026.
