Some Smart TVs Are Infected With Malware Before You Even Open the Box

What the FBI is warning about

The FBI issued a public service announcement describing an active botnet called BADBOX 2.0, built from millions of infected Internet of Things devices connected to home networks. Cyber criminals gain access two different ways. Some devices, mostly TV streaming boxes, digital projectors, aftermarket vehicle infotainment systems, and digital picture frames, are configured with malicious software before the customer even buys them. Others get infected during setup, when a “required” app the device asks you to install turns out to carry a hidden backdoor. Most of the affected products were manufactured in China and sold under unfamiliar, generic brand names, often marketed as unlocked or capable of accessing free streaming content.

Once one of these devices connects to your home network, it becomes part of the botnet, quietly used by criminals as a residential proxy. In plain terms, your internet connection gets rented out to route someone else’s illegal traffic, without your knowledge and often without any obvious sign anything is wrong.

Why “it still works fine” doesn’t mean it’s clean

This is what makes BADBOX 2.0 unusually hard to catch. An infected device generally keeps doing exactly what you bought it for. It streams your shows, it plays your music, nothing about daily use tips you off. The compromise happens quietly in the background, using your bandwidth and your home IP address as cover for someone else’s activity, which is exactly why the FBI is asking people to actively check for signs rather than wait to notice a problem.

The practical takeaway

The FBI lists specific indicators worth checking for. Devices from unrecognizable or generic brands, especially ones advertised as “unlocked” or promising free access to premium content. Any device or app that asks you to disable Google Play Protect during setup. Requirements to download apps from marketplaces outside the official Google Play Store. And more generally, unexplained spikes in internet traffic or a home network that’s noticeably slower than usual for no clear reason.

If you’re shopping for a streaming box, projector, or similar device, sticking to recognized, established brands rather than the cheapest unbranded option is a genuinely meaningful safeguard here, not just a vague preference. If you suspect a device on your network is already compromised, the FBI recommends disconnecting it and filing a report at IC3.gov.

The FBI is explicit that none of these indicators alone proves a device is compromised. They’re signals worth paying attention to together, in context, not a checklist where any single match means you’re infected.