Vo1d Botnet Infects 1.59 Million Android TVs Worldwide
A malicious program called Vo1d has become a major threat to Android TV devices, infecting over 1.59 million of them across 226 countries at its peak on January 19, 2025. Brazil, South Africa, Indonesia, Argentina, and Thailand have been hit the hardest. In India, the infection rate skyrocketed from less than 1% to 18.17% in just one month, reaching 217,771 devices by February 25, 2025.
How Does Vo1d Work?
This malware is sneaky and hard to spot:
- It uses complex encryption (RSA and XXTEA) to hide its actions.
- It pretends to be the official Google Play Services app so users don’t suspect anything.
- It automatically starts up every time the TV is turned on.
How Does It Spread?
Experts aren’t entirely sure, but they suspect two main ways:
- Through unofficial updates (firmware) that people install themselves.
- Through issues during the production or shipping of devices, where the malware is already built in.
Google says the infected models are usually cheap, off-brand Android TVs that aren’t officially checked by Play Protect. These devices often run on open-source Android code (AOSP).
What Does Vo1d Do?
Vo1d turns infected TVs into an “army” controlled by hackers. They use it to:
- Create a network for rerouting internet traffic (proxies).
- Fake ad views to make money through trickery.
- Potentially launch bigger attacks or stream illegal content in the future.
Experts think the hackers rent out this “army” to other criminals. For example, they might use devices in one country for a specific job, then return them to the larger Vo1d network.
Why Is This Dangerous?
Vo1d has full control over the infected TVs. This means hackers could:
- Use them as weapons to attack websites or servers.
- Turn them into tools for fraud or spreading unauthorized content.
How to Stay Safe?
To protect yourself from Vo1d:
- Buy only certified Android TVs from trusted brands with official updates.
- Avoid downloading apps or updates from unknown websites or forums.
Source: The Hacker News
