How to spot a risky generic TV box before you buy it

The profile research keeps describing

When Google, the FBI, or regulators describe the devices caught up in botnets like BADBOX 2.0, the description is almost always the same: generic Android devices with no recognizable brand, no Google certification, and a very low price¹. The FBI warned that these devices can ship with malware already installed, or get infected later through firmware updates and malicious apps².

In Brazil, regulator Anatel tested uncertified TV boxes and found BADBOX 2.0 in two different brands. Reported figures put infected devices in that country alone above one and a half million³. The problem is not one specific model; it is a product category.

What "generic" means in practice

Online marketplaces are full of boxes with model names like "MX9", "MXQ Pro" and similar, sold by many different resellers. That name does not identify a manufacturer or a hardware revision: units sold under the same name can have different processors, memory, and firmware, and it sometimes changes from one batch to the next. That is why AMK does not claim that a model name is infected or clean. What matters is what is installed on the specific unit in your hands.

Signs a box is risky

• A price far below the market. A box promising "4K", "6K" or "8K" for a few dollars is cutting corners somewhere: components, support, or revenue that comes from elsewhere, such as reselling your connection.
• Inflated specs. Resolutions the processor cannot decode, or memory and storage that do not match what the system reports once it is powered on.
• No brand and no identifiable support. No official manufacturer site, no security updates, nobody to complain to.
• No Google certification (Play Protect). This is the most direct check, and we walk through it in How to Tell If Your Android TV Box Has Malware.
• Apps nobody installed. Alternative app stores, "optimizers," or services you do not recognize on first boot.

Why this matters to internet providers too

A compromised TV box does not only affect its owner. As we explain in Why your infected TV box might be wrecking your internet, these devices are used as residential proxies and to generate traffic that eats upload bandwidth. Across thousands of subscribers, that becomes a network problem for the provider, not just a problem for each customer. Several organizations in the industry are working on how to reduce that impact.

What to do if you already have one

A box being generic does not mean it is infected, and looking legitimate does not guarantee it is clean. The only way to know is to inspect the device's real system. AMK scans it and compares it against a catalog of known threats. If it is clean, you pay nothing.