Security researchers have broken up a large criminal operation that secretly turned more than two million Android TV streaming boxes into hidden internet relays. The operation, linked to a company called NetNut, was using sneaky software pre-installed or downloaded onto cheap, off-brand TV boxes to quietly route other people’s — often criminals’ — internet traffic through your home connection, all without your knowledge or permission.
If your streaming box was caught up in this, it may have been running slower than usual, eating into your monthly internet data allowance, or exposing your home network’s address to strangers online. The good news is that researchers have already cut off the network, and there are a few simple steps you can take right now to make sure your device is clean.
How to check if you’re affected
Affected devices are primarily budget Android TV streaming boxes — especially off-brand models running Android versions older than Android 11, such as T95, X88, X96, or similar no-name boxes sold cheaply online or in discount shops.
- Check your device’s software version: open Settings → About → Android Version. If it’s lower than Android 11, your device is in the highest-risk category.
- Browse your installed apps and remove anything you don’t recognize or didn’t install yourself.
- Consider doing a full factory reset (Settings → Storage → Factory Reset), then only reinstall apps from the official Google Play Store.