A hot potato: The resurgence of BadBox 2.0 poses new risks that consumers should be aware of. As unregulated, low-cost IoT devices become increasingly common in households around the world, it’s essential to understand the potential dangers they present.

A new wave of cyberattacks is targeting household technology, as the FBI has issued a warning about the resurgence of the BadBox 2.0 botnet. This sophisticated network of compromised Internet of Things devices is being exploited by cybercriminals to infiltrate home networks on a massive scale, raising fresh concerns about the security of everyday smart devices. The campaign’s global footprint spans more than 220 countries and territories, with infections reported in everything from budget streaming boxes to uncertified digital photo frames.

The original BadBox operation first came to light in 2023, when security researchers discovered that certain Android-based devices – primarily off-brand, low-cost gadgets not certified by Google Play Protect – were being sold with malware embedded directly in their firmware. These devices, often manufactured in China and shipped worldwide, included streaming boxes, digital projectors, and even vehicle infotainment systems.

While the initial BadBox campaign was partially disrupted in 2024 through coordinated action by cybersecurity firms, tech companies, and international law enforcement (including a joint operation between German authorities and Google), the threat quickly adapted. The botnet evolved to bypass many of the countermeasures deployed against it, signaling a dangerous new phase in IoT-focused cybercrime.

BadBox 2.0, the latest iteration of the botnet, has proven even more insidious than its predecessor. While the original version primarily infected devices during manufacturing, BadBox 2.0 can compromise hardware both at the factory and after it reaches consumers. Devices may arrive with firmware-level backdoors already installed or become infected during initial setup if users download apps from unofficial marketplaces.

Security analysts have identified at least four interconnected groups behind the botnet – SalesTracker, MoYu, Lemon, and LongTV – each specializing in a different phase of the operation, from malware distribution to monetizing stolen data.

Once a device is compromised, it becomes part of a sprawling botnet. Cybercriminals use these infected endpoints as residential proxies, allowing them to route illicit activity through home networks and obscure their true origins. In addition to facilitating ad fraud and DDoS attacks, the botnet enables credential stuffing to hijack online accounts, intercepts one-time passwords for financial fraud, and deploys malicious code to further expand its network. The malware’s ability to execute arbitrary commands gives attackers the flexibility to repurpose infected devices for virtually any cybercriminal goal.

The roots of BadBox trace back to earlier malware such as Triada, a sophisticated Android Trojan first discovered in 2016. Triada was known for deeply embedding itself into systems and evading detection. Over the years, its tactics have evolved into the modern supply chain attacks seen in BadBox and BadBox 2.0. This lineage helps explain the botnet’s resilience and adaptability, built on nearly a decade of development and refinement.

Detecting a BadBox 2.0 infection is difficult for most consumers. The malware typically operates silently, with few obvious symptoms. Subtle signs may include the appearance of unfamiliar app stores, unexplained device overheating, or sudden changes to network settings. The FBI warns that devices advertising free access to premium content or marketed as “unlocked” pose a particularly high risk.

If a device is suspected of being infected, users should isolate it from the internet immediately, review all connected devices for unauthorized apps or activity, and consider performing a full reset or replacing the hardware.

To minimize risk, experts recommend:

• Purchasing devices certified by Google Play Protect.

• Avoiding uncertified or off-brand hardware.

• Keeping firmware and apps updated.

• Monitoring home network traffic for anomalies.

• Checking security bulletins for compromised model lists and known indicators of compromise.

Crypto-focused media outlet Watcher Guru confirmed that its official X account was hacked to promote a fake report claiming Ripple and SWIFT were close to a deal to use XRP in global payment systems.

The unauthorized post went live on March 21 at 2:05 A.M. UTC. It falsely stated that Ripple would soon partner with SWIFT and that billions of XRP had been locked in escrow as liquidity reserves.

The post quickly gained attention and sparked excitement in the XRP community, with many users believing it was true. For context, Bitrue, a prominent pro-XRP crypto exchange, mistakenly shared the fake news, amplifying the confusion.

Shortly after, Watcher Guru clarified the situation, confirming that the post did not come from their team.

According to the media outlet:

“Our X account has been hacked and the previous post (now deleted) was posted by a hacker. We have 2FA enabled and have taken extreme measures to avoid hacks.”

Due to automation, the same false report was also shared on Watcher Guru’s other social media accounts, including Telegram, Facebook, and Discord. The team said the reposting bot pushed the content to all channels before the issue was spotted.

Meanwhile, Watcher Guru stated that the attacker had blocked Ripple’s official X account and that of its CEO Brad Garlinghouse to “presumably slow down a ‘false report’ response from their team.”

This marks the second major breach of a prominent crypto platform on X. Earlier this week, DB News’ X account was hacked and used to spread a fake report about Donald Trump’s TRUMP memecoin and a false BlackRock ETF filing for Hyperliquid.

Understanding the breach

Watcher Guru believes the breach may have started weeks earlier as its team had received a suspicious X link through Telegram on March 5.

According to the team:

“We noticed the link was formatted in a strange way. It was an official X Developer staging site using X’s official domain, however it included a specific path and ‘token’ query string which X links do not normally have.”

Watcher Guru stated that its team flagged the link and contacted X’s Head of Cybersecurity, Christopher Stanley, but received no reply.

Watcher Guru continued that while it cannot confirm the link that caused the hack, the firm noted that its breach resembled that of DB News, another crypto media outlet.

According to Watcher Guru, its account, like DB News, had two-factor authentication enabled, no connected apps, and no API tokens were used to post the false information.

It concluded:

“At this time, we have not yet determined the exact source or method behind the hack. All unauthorized posts have been removed, and our account has been secured. We are contacting X for further clarification.”

Mentioned in this article

Malwarebytes, a cybersecurity company, has discovered that scammers are promoting a modified version of the platform, which secretly installs harmful software designed to steal personal information and drain crypto wallets.

According to a March 18 blog post, the fraudsters are active on crypto-related subreddits, where they post download links for what they claim is a cracked version of TradingView Premium.

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

What is a Crypto Mining Rig? Is it Worth it? (EASILY Explained)

According to Jerome Segura, a senior researcher at Malwarebytes, these posts include Windows and Mac installers that contain two types of malware, Lumma Stealer and Atomic Stealer.

Lumma Stealer, identified in 2022, is known for extracting login details, cryptocurrency wallet credentials, and data from two-factor authentication (2FA) browser extensions. Atomic Stealer, which surfaced in 2023, goes after passwords stored in system keychains, including administrator credentials.

Victims of this malware have reported losing their crypto holdings, with scammers even taking control of their accounts to send phishing messages to their contacts.

Additionally, Segura explained, “Files are double zipped, with the final zip being password protected. For comparison, a legitimate executable would not need to be distributed in such fashion”. This tactic prevents antivirus programs from detecting harmful files before they are extracted and executed.

Investigations into the origins of the malware revealed that the files were hosted on a website linked to a Dubai cleaning company, while the command-and-control server was registered in Russia just a week before it was discovered.

Recently, Microsoft identified a new remote access Trojan (RAT) called StilachiRAT. What does this malware do? Read the full story.