Your $25 Streaming Stick Is Renting Out Your Home Internet to Criminals

You’ve seen the listing. An Android TV stick for less than $25, Netflix and YouTube included, remote in the box, free shipping. It costs about as much as two coffees. Security researchers have been repeating the same warning for years: a lot of those devices arrive compromised before you ever open the packaging.

The malware ships from the factory

Ordinary malware needs you to make a mistake. Click a sketchy link. Sideload an app from a forum. The family of infections researchers named BADBOX skips that step entirely. The malicious code lives in the firmware.

That detail matters more than it sounds. Android’s security model assumes apps sit below the system, sandboxed and permission-limited. Malware on the system partition isn’t below anything — it’s above the tools you’d use to find it. Antivirus apps come up clean. A factory reset does nothing, because a reset wipes the user data partition and leaves the firmware exactly where it was.

The infected hardware isn’t limited to TV sticks either. Researchers have documented tablets, digital photo frames, car infotainment head units, and projectors. The pattern is consistent: uncertified Android Open Source builds, brand names that return nothing useful in a search, prices well below anything comparable.

Your IP address is the product

So why target a cheap streaming stick? There’s barely any data on the thing worth stealing.

Because the target was never the data. It’s the IP address — specifically, a residential one, handed out by a consumer ISP. The industry term for what gets built on top of this is a residential proxy network.

The mechanics are simple. The stick in your living room quietly phones home to a command server and announces that it’s available. Someone else pays for access to that slot. Their traffic then exits the internet not from a data center in Virginia, but from a normal house in Ohio, or an apartment block in Seoul.

For an attacker, that swap is everything. Cloud provider IP ranges are public, well-catalogued, and treated as suspicious by default — Cloudflare, Akamai, and every major fraud vendor score them accordingly. Residential ranges are far harder to block, because real customers are mixed in with the abuse. Which is why credential stuffing, ad-click fraud, sneaker and ticket bots, and bulk fake-account creation all pay a premium for residential exit nodes.

You bought a streaming device for $25. What the seller actually sold was the right to route traffic through your home connection. That revenue stream dwarfs the hardware margin, which is exactly why the device can be sold below cost and still turn a profit.

Why takedowns keep failing

Law enforcement and security firms have knocked over BADBOX command infrastructure more than once. Google has pulled associated apps and sued the operators. Each time, the infected device count dips, then climbs back. The reason is that the vulnerability isn’t in software. It’s in the supply chain.

Look at how a cheap Android device actually gets made. The company whose logo goes on the box, the factory that assembles the board, and the vendor that flashes the firmware image are three different companies, often in three different cities. That firmware image passes through several hands, and at each stop somebody bolts on an ad SDK or a monetization module. Tracing which link inserted the malicious payload is, in practice, impossible.

These devices also receive no updates. Ever. The sale is the end of the relationship. There’s no entity responsible for shipping a security patch and no commercial reason to build one. Once a unit leaves the warehouse it stays exactly as it is until someone unplugs it — and a stick forgotten in a drawer keeps working for the botnet as long as it has power.

The distribution channel makes it worse. These products move in volume through Amazon, AliExpress, eBay, and Walmart Marketplace, where nobody verifies Play Protect certification, listings carry thousands of reviews, and the seller name has quietly changed by the following week.

How to check your own house

A few things to look for.

Start with the device itself. A genuinely Google-certified Android TV device shows a Play Protect certification notice in its settings. If that’s missing and an unfamiliar app store is preinstalled as the default, be suspicious. If you search the brand name and can’t even find a manufacturer website, same conclusion.

Then check the network. If the device is moving data while nobody is watching anything, that’s not normal. If your router’s admin page breaks out traffic per device, look at the overnight window. Steady chatter at 3 a.m. with the TV off is the classic signature.

The most effective fix is also the least satisfying: unplug it. As covered above, a reset won’t clear a firmware infection, so if you suspect a device is compromised, don’t try to rehabilitate it. Throw it away. If that’s not an option today, move it onto your router’s guest network, which at least keeps it away from your NAS, your laptop, and everything else on the main LAN.

A note on what this piece doesn’t cover

Being straight about it: while writing this I went looking for fresh community discussion from the past month and came up empty. So this draws on the accumulated body of security research and on how this class of attack works structurally, rather than on breaking news. That’s also why you won’t find specific brand names or a current infection count here. If you want a concrete device list, go to the published advisories from security vendors and national CERTs — those get updated, and this doesn’t.

The takeaway

Anything close to free is usually being paid for somewhere else. Here, the currency is your home internet connection. No invoice arrives, which is the whole reason nobody notices what they’re spending.

That small unlabeled box behind your TV, or the one in the drawer with the tangled cables — when did you last actually turn it on?