- Google sues alleged BadBox 2.0 operators over a global Android botnet that infected over 10 million uncertified devices.
- The botnet was used for ad fraud and residential proxy schemes, prompting Google to update Play Protect and pursue legal action.
Google has taken legal action, filing a lawsuit in federal court in New York against 25 unnamed individuals, believed to be Chinese nationals, accused of operating the BadBox 2.0 botnet—a malicious network that has compromised more than 10 million uncertified Android-based devices globally.
According to the complaint, the botnet targets a range of off-brand hardware—TV streaming boxes, tablets, digital projectors, and car infotainment systems—which run on the Android Open Source Project (AOSP) and lack protections like Google Play Protect. Devices were infected either through supply chain malware (preinstalled before purchase) or via malicious apps downloaded after setup. Once compromised, these devices connect to a remote command-and-control (C2) server, effectively becoming part of a vast criminal network.
The attackers monetized the compromised devices through several illicit schemes:
-
Selling access as residential proxies, enabling account takeovers, DDoS attacks, and other crimes
-
Ad fraud—generating millions of fake ad impressions and clicks using hidden browsers and deceptive “evil twin” apps that mimic legitimate ones.
Google argues the botnet has damaged its reputation and financial bottom line by causing it to pay for fake ad traffic and divert resources to combat the fraud.
Google’s Response & Legal Aims
To counter this threat, Google has:
-
Updated Google Play Protect to detect and block BadBox-related apps, even if they’re sideloaded.
-
Filed the lawsuit seeking an injunction and damages, and legal authority to dismantle the botnet infrastructure, including disabling command servers and disrupting proxy access.
Despite involvement from the FBI, extraditing suspects from China remains improbable due to limited international cooperation.
What Users Should Know
-
If you’re using cheap, uncertified Android devices, especially those sold without Google certification, consider upgrading or installing trusted security software.
-
Watch for suspicious preinstalled apps or ask if the device is certified with Google Play Protect.
-
Regularly scan using Play Protect or reputable security tools, ensuring any infected apps are promptly removed.