Germany’s Federal Office of Information Security (BSI) has successfully disrupted a major malware operation affecting thousands of Android devices across the country. The operation, known as BADBOX, was discovered pre-installed on approximately 30,000 internet-connected devices, including digital picture frames, media players, and various mobile devices.

The malware, first identified by HUMAN’s Satori Threat Intelligence team in October 2023, primarily targeted devices running outdated Android versions. Operating through a Chinese-based network, BADBOX incorporated the Triada Android malware and a sophisticated ad fraud botnet called PEACHPIT.

Key Features of BADBOX:
– Data collection capabilities, including authentication codes
– Additional malware installation
– Ad fraud through spoofed Android and iOS apps
– Residential proxy service functionality
– Unauthorized account creation on platforms like Gmail and WhatsApp

The BSI has implemented countermeasures by:
– Sinkholing command-and-control server domains
– Directing internet providers to redirect malicious traffic
– Advising immediate disconnection of affected devices

The operation exploited supply chain vulnerabilities, allowing malware to be pre-installed on low-cost Android devices before reaching consumers. Users could unknowingly purchase and connect these compromised devices, exposing themselves to security risks and contributing to the fraudulent ad network.