Kastoo
BadBox 2.0 is a network of infected devices made up mainly of unbranded Android TV boxes, projectors and other cheap gadgets. The malware comes pre-installed at the factory or arrives with updates from dubious sources, and it uses your home connection for criminal activity without you noticing. The FBI issued a warning in June 2025, and in July that year Google sued 25 unnamed alleged operators in China. These are 2025 events, but such devices are still on sale.
What it is and what it does
- It turns the device into part of a “residential proxy” network: others use your connection to hide where they are.
- It is also used for ad fraud: the device loads ads and clicks on them in secret.
- According to Google, by April 2025 there were more than 10 million infected devices worldwide.
- It mainly affects devices running open-source Android (AOSP) without Google’s certification.
Warning signs according to the FBI
- The device comes with unfamiliar app stores pre-installed.
- It asks you to turn off Google Play Protect.
- It is sold as “unlocked” or with “free content”.
- It is from a brand you don’t know and gets no system updates.
How to check whether your device is certified
On many devices, the Google Play Store app shows a “Play Protect certification” entry in its settings (under About). If it says the device is certified, it is a Google-approved device. If it has no Google Play, or says it is not certified, be wary. Another clue: certified Android TV and Google TV devices show the Google logo on the box and on the manufacturer’s product page.
Which devices to buy
- Devices with certified Google TV or Android TV from well-known brands that receive updates.
- The smart TV itself, if your player is in its store.
- Avoid very cheap generic “Android TV boxes” from marketplaces.
See our recommendations in the best TV boxes for IPTV.
What about IPTV apps?
The BadBox problem is in the device, not in the player. Even so, install your apps only from the official store or from the developer’s website, never from links in forums or messages. Kastoo is downloaded from kastoo.es and never asks you to turn off Play Protect.
Frequently asked questions
Can an antivirus remove BadBox?
Usually not: the malware is in the device’s system from the factory. The safest thing is to stop using it.
Does it affect branded smart TVs?
The warnings refer to cheap, unbranded, uncertified devices. TVs and TV boxes from well-known brands with updates are not mentioned in them.
How do I know if my TV box is infected?
Watch for the FBI’s signs: unfamiliar app stores, being asked to turn off Play Protect, or being sold as “unlocked”. If in doubt, disconnect it.
Sources
- Home Internet Connected Devices Facilitate Criminal Activity (PSA) · FBI · IC3 (5 June 2025)
- Off-brand IoT devices are still vulnerable to BadBox botnet, FBI says · The Record
- Google sues 25 alleged BadBox 2.0 botnet operators · The Register (July 2025)
Free for 15 days with all features, no card needed. One licence covers 3 devices.
Kastoo is just a player: it does not sell, host or include lists, channels, movies or subscriptions. The screenshots use a demo list with openly licensed content.