FBI warns of hidden 'malicious' threats lurking in widely used devices

The Star

5 days ago

The Federal Bureau of Investigation has issued a public service announcement alerting Americans to a growing cyber threat that may already be inside their homes – and it's a threat many people don't even realise.
According to the FBI, cybercriminals are hijacking TV streaming sticks, digital projectors, digital picture frames and more to launch malicious online activity through an evolving botnet known as BADBOX 2.0.
BADBOX was first discovered in 2023 and disrupted in 2024, but the new 2.0 version has resurfaced with more advanced techniques, according to the FBI. It continues to exploit Android-based devices, especially those not certified by Google Play Protect or promoted as 'unlocked' streaming tools capable of accessing free content, the bureau said.
The botnet, which reportedly consists of millions of compromised devices, allows criminals to create proxy networks out of unsuspecting users' home connections, the FBI said. The networks can then be exploited or sold to other criminals, enabling illegal activity that appears to originate from an innocent home network, according to the FBI.
Most of the infected devices were manufactured in China and are either preloaded with malware before purchase or compromised during setup through the download of unofficial apps, the FBI said. Once connected, the devices can silently become part of the BADBOX 2.0 botnet, giving criminals a hidden doorway into personal networks, the bureau added.
The FBI advised users to evaluate all devices in their home, especially those from unfamiliar or off-brand manufacturers, and watch for signs such as unusual Internet traffic, requests to disable Google security settings, or the use of unofficial app stores.
To reduce risk, experts recommended keeping firmware and operating systems up to date, avoiding unofficial app downloads, and monitoring home network activity regularly.
Anyone who suspects they may have been affected is encouraged to report the incident to the FBI through the Internet Crime Complaint Center. – cleveland.com/Tribune News Service