Recommended Free Tools
BADBOX 2.0 is a botnet that can use compromised internet-connected home devices—including streaming boxes and other Android-based products—to route criminal activity through household internet connections. The FBI’s June 5, 2025 warning says devices may arrive infected or become compromised through apps; suspicious signs warrant investigation, but none proves infection on its own.
What is BADBOX 2.0?
BADBOX 2.0 is a botnet: a group of compromised devices that criminals can control or use for online activity. In its June 5, 2025 public service announcement, the FBI names TV streaming devices, digital projectors, aftermarket vehicle infotainment systems, digital picture frames and other internet-connected products as potential targets. The FBI says most infected devices were manufactured in China; that statement does not mean all products from China are affected or reveal where any particular device was made.
Why a compromised device can affect the whole household
A device enrolled in a residential-proxy service can route another person’s internet traffic through the home’s real residential IP address. To outside services, some activity may appear to come from that household. The FBI’s March 12, 2026 advisory describes proxy networks being used for phishing, identity theft, fake-account creation, data exfiltration, brute-force attacks and concealing an operator’s location. That creates risks beyond the compromised device’s own screen or stored files.
How can a device become infected?
Malware installed before purchase
The FBI says malicious software may be installed on a device before it is sold. In that case, setting up the device—or removing an app later—may not address the underlying problem.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall#1 Best Overall
- NIGHTHAWK WIFI 6 ROUTER FOR YOUR WHOLE HOME: Delivers fast, reliable WiFi across every room of your apartment or small home for streaming, gaming, video calls, and smart home devices, all running at the same time without slowing each other down.
- WORKS WITH YOUR EXISTING INTERNET SERVICE: Pairs with your existing modem or gateway via ethernet. Compatible with most cable, fiber, DSL, and satellite providers. Some gateways and modem router combos may require bridge mode. No coax needed.
- SET UP AND MANAGE YOUR NETWORK WITH THE NIGHTHAWK APP: Download the free Nighthawk app on iOS or Android for guided setup. Manage WiFi, run speed tests, pause devices, and set up guest networks from anywhere. Active internet required.
- READY FOR THE DEVICES YOU ALREADY OWN: Your phones, laptops, and TVs work right out of the box. WiFi 6 delivers speeds up to 1.8 Gbps across 2.4 GHz and 5 GHz bands. Backward compatible with WiFi 5 and earlier.
- COVERAGE IN EVERY ROOM: Covers up to 1,500 sq. ft. for up to 20 connected devices. Walls, floors, and interference can reduce range. Larger or multi-story homes may benefit from a NETGEAR Orbi mesh WiFi system.
A malicious app installed during setup or afterward
A device may download an app containing a backdoor during setup. BADBOX 2.0 can also spread through malicious apps from unofficial marketplaces. The FBI’s 2026 advisory specifically warns that sideloading unofficial apps onto streaming sticks and Android TV boxes increases the chance of installing malicious software.
What do the published scale figures show?
Three public statements describe the scale at different dates and in different terms. They are not a single reconciled count, and the sources do not provide enough shared methodology to compare them directly.
| Publisher and date | Reported figure | What the figure describes |
|---|---|---|
| HUMAN Security, March 2025 | More than 1 million | Devices its Satori team said it identified as infected. |
| FBI, June 5, 2025 | Millions | The FBI’s description of the botnet’s infected devices. |
| Google, July 17, 2025 | Over 10 million | Uncertified devices running Android’s open-source software that Google said BADBOX 2.0 had compromised. |
The figures come from HUMAN’s March 5, 2025 announcement, the FBI’s June 5, 2025 advisory and Google’s July 17, 2025 account of its legal action. They have different publishers, dates and descriptions. These statements do not establish a current global infection count.
Rank #2
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
How can I tell if my streaming box is safe?
The FBI lists the following as possible indicators of BADBOX 2.0 activity. Treat them as reasons to look more closely, not as a diagnostic checklist:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors- An app marketplace that appears suspicious or is not an official store.
- A prompt or requirement to disable Google Play Protect.
- A generic streaming device advertised as unlocked or offering free sports, television or movies.
- An unfamiliar brand, or an Android device that is not Play Protect certified.
- Unexplained or suspicious internet traffic.
The FBI cautions: “An indicator alone does not accurately determine malicious cyber activity or a crime.” An unfamiliar brand, uncertified status or a single traffic alert does not by itself confirm that a device is infected.
Check Play Protect certification
On an Android device with the Play Store, Google’s Android Help page gives this path: open Play Store, tap the profile icon, choose Settings, then About, and view Play Protect certification. Google says Play Protect checks apps and devices and recommends leaving it on.
Rank #3
- Wi-Fi 6 Mesh Wi-Fi - Next-gen Wi-Fi 6 AX3000 whole home mesh system to eliminate weak Wi-Fi for good(2×2/HE160 2402 Mbps plus 2×2 574 Mbps)
- Whole Home WiFi Coverage - Covers up to 6500 square feet with seamless high-performance Wi-Fi 6 and eliminate dead zones and buffering. Better than traditional WiFi booster and Range Extenders
- Connect More Devices - Deco X55(3-pack) is strong enough to connect up to 150 devices with strong and reliable Wi-Fi
- Our Cybersecurity Commitment - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement
- More Gigabit Ports - Each Deco X55 has 3 Gigabit Ethernet ports(6 in total for a 2-pack) and supports Wired Ethernet Backhaul for better speeds. Any of them can work as a Wi-Fi Router
Certification is a useful screening signal, not a guarantee against compromise. Google Director of Android Security & Privacy Engineering & Assurance Shailesh Saini, quoted by HUMAN on March 5, 2025, said: “If a device isn’t Play Protect certified, Google doesn’t have a record of security and compatibility test results.” That explains what certification status indicates; it does not establish that every uncertified device is infected.
How can you reduce the risk?
- Review what is connected. Make an inventory of internet-connected devices on the home network. If one appears suspicious, consider disconnecting it while you investigate, as the FBI advises.
- Use official app sources. Avoid unofficial marketplaces and sideloaded apps, especially on streaming sticks and Android TV boxes. Be wary of devices promoted as providing free sports, television or movies.
- Check a device before relying on it. Consider whether its manufacturer is familiar and provides support, whether it is Play Protect certified, whether it offers an official app store, and whether software or firmware updates are available. These checks can inform a device choice but cannot guarantee it is free of malware.
- Install available updates. Keep device operating systems, apps and firmware current. The FBI also advises prioritizing firewall vulnerabilities and known exploited vulnerabilities on internet-facing systems.
- Pay attention to network activity. Monitor for unexplained traffic and assess the internet-connected devices using the home network.
The FBI’s advisories recommend these precautions; they do not endorse a particular router, monitoring appliance, antivirus product or streaming device.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What should you do if a device may be compromised?
Disconnect and assess before resetting
If a device seems suspicious, consider disconnecting it from the network and review its apps, software and available firmware updates. Do not assume that uninstalling an app or performing a factory reset will remove the problem: the FBI’s March 12, 2026 advisory says some malware may survive a factory reset, particularly when it was installed before purchase.
Rank #4
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Understand the possible remediation limits
The FBI says antivirus software may sanitize some compromised devices, while others may require reinstalling the operating system. The right response depends on the device and the infection; neither a reset nor a security product is a guaranteed fix. If you cannot establish that the device is clean, avoid reconnecting it for routine use until it has been assessed or repaired.
Protect accounts and report an intrusion
If you believe an intrusion occurred, the FBI directs victims to report it through the Internet Crime Complaint Center (IC3). Its 2026 advisory also recommends contacting affected account providers, regaining control of accounts, changing passwords and setting alerts for suspicious logins or transactions.
Does the disruption mean BADBOX 2.0 is over?
Google said on July 17, 2025 that it had filed a lawsuit in New York federal court against alleged perpetrators and updated Play Protect to automatically block BADBOX-associated apps. HUMAN reported disruption work involving Google, Trend Micro, the Shadowserver Foundation and law enforcement. These are dated actions, not proof that every infected device or operator has been eliminated. The cited public statements do not establish that the threat has ended.
HUMAN’s CISO Gavin Reid described the scheme in the company’s March 5, 2025 release as “bigger and far worse than what we saw in 2023” in terms of targeted device types, infected-device numbers, fraud types and complexity. That is Reid’s characterization of HUMAN’s findings, not a current prevalence measurement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
