BadBox malware infects Android devices via firmware

The Federal Office for Information Security (BSI) has identified BadBox, a significant Android malware that is pre-installed in the firmware of various consumer electronics. Affected devices include streaming players, digital photo frames, tablets, smartphones, and TV boxes. Because the infection is embedded in the factory firmware, devices may be compromised even before their first use.

Once connected to the internet, these devices contact a control server to join a botnet. In its September 2026 report, the BSI noted that BadBox was the most observed botnet in Germany, accounting for 55.6 percent of the unique IP addresses within the BSI's monitored infected systems. The BSI classifies BadBox as a backdoor, bot, and proxy with high impact, capable of providing covert system access and automated control.

While authorities previously implemented sinkholing measures in December 2024 to disrupt communication between up to 30,000 devices and attackers, this does not constitute a permanent cleanup of the hardware. The nature of the infection requires specialized approaches to detection, damage mitigation, and disposal.