# Android device and application security threats > Live situation record from CLSTR: https://clstr.news/situations/android-device-and-application-security-threats > Updated: 2026-10-26T06:36:20.000Z. Sources: 33. Developments: 2. Cybersecurity experts and authorities have issued warnings regarding various threats targeting Android and Smart TV users. Initial warnings focused on the Xuper TV APK, a successor to Magis TV. Because the application is not available through official stores, users must sideload it from third-party websites, often disabling system protections. Security firms and Spain’s National Cybersecurity Institute (INCIBE) have noted that the app requests invasive permissions, such as access to SMS and storage, which can allow hackers to steal banking passwords and personal documents. In a separate but related development, authorities have identified the BadBox malware, which is pre-installed on inexpensive Android TV boxes and tablets from unknown manufacturers. This malware converts devices into bots and residential proxies to facilitate fraud, account takeovers, and ransomware. The FBI has warned of a campaign involving over one million infected devices. Recent reports highlight the scale of the BadBox threat. In Germany, the Federal Office for Information Security (BSI) identified BadBox as the top observed botnet as of September 2026, noting that 55.6 percent of observed infected systems were unique IP addresses. Criminals utilize these residential proxies to route illicit traffic through legitimate household IP addresses, allowing them to bypass security systems used by banks and retailers. In one German investigation near Würzburg, a single private internet connection was found to have been used by more than 1,000 different devices during a cyberattack. ## Claims - Inexpensive Android TV boxes can be pre-installed with malware from the factory. (corroborated by 4 sources) - Criminals use infected devices as residential proxies to route traffic through victims' IP addresses. (corroborated by 4 sources) - The BSI disconnected approximately 30,000 such devices from the network in Germany in December 2024. (corroborated by 4 sources) - The FBI warned of a global campaign involving more than one million infected devices. (corroborated by 4 sources) - A private internet connection in the Würzburg region was used by more than 1,000 different devices during a cyberattack. (corroborated by 3 sources) - BadBox was the number one observed botnet in Germany according to the BSI September 2026 report. (single source) - BadBox malware can turn devices into bots, backdoors, and proxies. (single source) - The proportion of unique IP addresses in the BSI observed infected systems was 55.6 percent. (single source) ## Timeline ### 2026-10-26: BadBox malware infects millions of Android TV boxes globally Authorities warn that BadBox malware, pre-installed on cheap Android TV boxes, turns devices into residential proxies for global cybercrime, affecting over one million devices worldwide. 30 sources. https://clstr.news/cluster/badbox-malware-infects-android-devices-via-firmware ### 2026-10-21: Xuper TV APK poses security risks for Android and Smart TV users Security experts warn that Xuper TV APK, a third-party streaming app, poses significant risks including data theft and device hijacking due to invasive permissions and lack of official store vetting. 3 sources. https://clstr.news/cluster/xuper-tv-apk-poses-security-risks-for-android-and-smart-tv-users --- Cite as: Android device and application security threats. CLSTR, https://clstr.news/situations/android-device-and-application-security-threats