BadBox Malware Compromises 30,000 Devices in Germany

The BSI disrupted the BadBox malware campaign after discovery of firmware-embedded malware pre-installed on Android IoT devices (digital photo frames, media players and possibly smartphones) affecting ~30,000 devices in Germany; BadBox maintains C2 connectivity to steal 2FA credentials, create fraudulent accounts, perform advertising fraud and provide residential proxying, and the BSI sinkholed infrastructure and instructed ISPs to notify owners to disconnect or discard compromised hardware.