Over a million Android TV streaming boxes infected by Vo1d malware

Even if you are an iPhone user, there’s a solid chance you have an Android device somewhere in your house. If the device happens to be an Android TV streaming box, you should check and make sure it’s not infected with dangerous malware.

According to a report from antivirus provider Dr.Web, a new malware dubbed Android.Vo1d has been making the rounds lately. To date, the malware has infected around 1.3 million Android TV boxes in 197 countries, including Brazil, Morocco, and Pakistan.

Impacted users have reported unexpected changes in the device’s system files to Dr.Web on the following Android TV boxes and firmware versions:

• R4: Android 7.1.2; R4 Build/NHG47K
• TV BOX: Android 12.1; TV BOX Build/NHG47K
• KJ-SMART4KVIP: Android 10.1; KJ-SMART4KVIP Build/NHG47K

“The Android.Vo1d.1 module is responsible for Android.Vo1d.3’s launch and controls its activity, restarting its process if necessary,” Doctor Web explains. “In addition, it can download and run executables when commanded to do so by the C&C server. In turn, the Android.Vo1d.3 module installs and launches the Android.Vo1d.5 daemon that is encrypted and stored in its body. This module can also download and run executables. Moreover, it monitors specified directories and installs the APK files that it finds in them.”

The report says that the source of the backdoor infection is currently unknown, but hackers are likely targeting these devices because they frequently use outdated versions of Android. And as a result, they haven’t always been updated with the latest security patches. A streaming TV box might not contain the same sensitive data as a phone or computer, but you should still do your best to ensure it’s up to date with the latest software.