Malware Mayhem: 1.3 Million Android TV Boxes in 200 Countries Compromised – Is Yours at Risk
- Security firm Dr.Web reports that nearly 1.3 million Android-based TV boxes in 197 countries around the world have been infected with a malware called Android.Vo1d.
- Android.Vo1d is said to have the ability to place its own components in the system storage area and secretly download additional malware through a backdoor.
- In August 2024, Doctor Web received several reports from users that Doctor Web’s antivirus software had detected changes within the system file area.
Android TV Boxes Infected with Malware: A Growing Concern
Malware Infection on a Large Scale
Security firm Dr.Web reports that nearly 1.3 million Android-based TV boxes in 197 countries around the world have been infected with a malware called Android.Vo1d.
Android.Vo1d is said to have the ability to place its own components in the system storage area and secretly download additional malware through a backdoor.
Investigation and Findings
In August 2024, Doctor Web received several reports from users that Doctor Web’s antivirus software had detected changes within the system file area.
Investigation revealed that several TV boxes were infected with similar malware.
TV boxes are devices that can be connected to a home TV to access streaming services, and have become widely popular along with the growth of streaming services.
Technical Details of the Malware
Android.Vo1d modifies objects on the TV box such as install-recovery.sh, daemonsu, etc. and creates four new files in the file system: /system/xbin/vo1d, /system/xbin/wd, /system/bin/debuggerd, /system/bin/debuggerd_real.
The main function is hidden in /system/xbin/vo1d and /system/xbin/wd, and it is said to download and execute files according to commands sent from the attacker’s server, or monitor the specified directory to install APK files.
Affected Devices and Regions
TV boxes infected with Android.Vo1d were running older Android-based firmware, including Android 7.1.2; R4 Build/NHG47K, Android 12.1; TV BOX Build/NHG47K, Android 10.1; KJ-SMART4KVIP Build/NHG47K.
Countries with a particularly high number of devices infected with Android.Vo1d include Brazil (28%), Morocco (7%), Pakistan (5.1%), Saudi Arabia (4.9%), Argentina (3.8%), and Russia (3.8%).