That Free TV Box May Be Renting Out Your Home Internet

Streaming boxes sold with a promise of free movies, sports and channels have been caught doing three things besides showing unlicensed video: renting your home internet connection to strangers, giving outsiders a way into the box and sometimes onto the rest of your home network, and running ad fraud and other software you cannot remove. If you have one, unplug it, do not trust a factory reset, replace it with a device from a maker you can name, then check your router and change the passwords that were used on it.

Two Malwarebytes reports by Pieter Arntz prompted this post: free streaming boxes may be routing criminal traffic through your home (September) and a hidden backdoor put 1.3 million set-top boxes to work for criminals (November). Behind them sit Google's report on the XCPE botnet, FBI warnings from June 2025 and March 2026, and Plume's SuperBox research.

If you bought one, you have plenty of company, and you were probably told it was legal. SuperBox's website, as quoted by Krebs on Security, said "you won't encounter a law issue unless uploading, downloading, or broadcasting content to a large group." This post is about what else came in it.

A few terms first. A set-top box is the small computer that plugs into your TV, like a cable box without the cable company. Most boxes in these reports run Android, the system on many phones. Android TV is Google's licensed TV version; Google says certified devices have passed Android compatibility testing. Generic Android is the free open source code anyone can load onto a box, the way anyone can copy a recipe from a public cookbook. Google described the BADBOX 2.0 devices as "uncertified devices running Android's open-source software."

What happened: two findings this fall

SuperBox, September. Malwarebytes reported that certain SuperBox devices and apps could quietly enroll household connections into a proxy network. The research came from Plume, which supplies home Wi-Fi software to internet providers and so sees traffic from many homes. Its May 28, 2026 post says: "Close to 10,000 of these devices are active within Plume's user base today." That counts only networks Plume manages. Plume puts the price at $300 to $500 a box, sold on a pay once, no subscription pitch.

Plume found that Cyberflix TV, an app in the box's own app store, carried a hidden add-on called Popanet that signs the box up as a node in a commercial residential proxy network. Its first paper tested a SuperBox S6MAX. A second paper found a similar add-on, Netway, in AppLinked, another app from the SuperBox store. These are Plume's findings on devices it tested; SuperBox's side is not in them. Krebs reported in 2025 that SuperBox's parent company did not answer repeated questions, and that its website says "We only sell the hardware device."

XCPE, November. On November 2, 2026, Google's Threat Intelligence Group wrote that it and partners had taken apart the XCPE backdoor, which had pulled more than 1.3 million set-top boxes into a botnet. Google names the maker: "We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co." That is Google's assessment, not a court finding, and the report carries no reply from Videostrong. Google says the code was built into many device models and brands over several years and names no retail models. BleepingComputer reported that the firm Synthient found it preinstalled on a "MECOOL KM9PRO Max Android TV box."

A note on the word "certified." The Malwarebytes summary says Google found "1.3 million certified Android TV boxes." Google doesn't say it that way. It says Videostrong passed Google's compatibility and security tests by hiding its code "to exploit a gap in our tests and load malicious code after the device's first boot," and it has now banned Videostrong from building or selling certified Android devices. The precise phrase is boxes from a manufacturer that had passed Google's certification tests. Google does not say how many of the 1.3 million were certified.

The takedown did not clean the boxes. Malwarebytes notes that the backdoor stays in the firmware, and that Google has not published a complete list of affected models.

What "renting out your internet" means

Your home connection has an IP address, the number the internet sees, like the return address on an envelope. A residential proxy borrows it. The FBI's definition, in full, from its March 12, 2026 warning:

"A residential proxy is an intermediary server between individuals and websites they visit to make their connections appear to originate elsewhere. Legitimate IP addresses assigned by an Internet Service Provider (ISP) to consumers' Internet of Things (IoT) devices, such as TV streaming devices, digital picture frames, smartphones, tablets, and routers are used to route traffic. Once an internet-connected device is compromised, the device's IP address can be used by threat actors to mask their online illegal activity, making the consumer appear responsible."

Picture a stranger mailing letters with your return address on them, and the box in your living room is the mailroom. In proxy jargon your box becomes an exit node, the last stop where a stranger's traffic leaves for the open internet carrying your address.

Your router doesn't stop this, because the box starts the conversation. A proxy box can hold an encrypted connection to a remote server, Malwarebytes explains, "creating a channel that the home router treats as legitimate traffic initiated from inside the network." Routers block calls coming in and let calls going out, and strangers ride back in on that open line.

Who buys the access? The FBI's list includes account takeovers, password guessing that hops between addresses to dodge lockouts, fake social media and shopping accounts, bulk buying of concert tickets and sneakers to resell, and hiding where criminals really are. Its bank example: with a leaked login, "criminals could obtain a residential proxy IP address in the same city as the victim and login to the compromised bank account." The bank, the FBI notes, is then less likely to flag it.

Plume looked at what flowed through SuperBox connections. Its post lists "account management requests for EA (Electronic Arts), WhatsApp verification codes, search queries across Google and Bing covering medical topics and personal services" and attempts to get past website bot defenses, at tens of thousands of connection requests per box per day.

┌──────────── Your home ────────────┐
│  router ◀── the box               │
│  phone      laptop                │
└────┬──────────────────────────────┘
     │ (1) one outgoing connection your router allows
     ▼
  proxy operator ◀──▶ paying customers you will never meet
     │
     ▼ their traffic comes back through the box
  websites, logins, stores  (2) arrives looking like you

What else the box can do:
  Plume, SuperBox: open debug port, root access with no password
  Google: screenshots, injected key presses, more malware loaded
  FBI: malware can stay after a factory reset

What else you are adding to your network

Each item below says which device it was documented on.

A way in from the inside. The Android Debug Bridge (ADB) is a repair port that lets a technician control the device from another computer, like the diagnostic plug under a car's dashboard. Root access is full control, the master key to every room. On the SuperBox it tested, Plume found ADB open on port 5858 to any device on the home network with no approval, and root granted with no password. In plain words, any other device on your Wi-Fi can take over that box, including a visitor's phone carrying malware. Krebs describes that path: a houseguest's infected phone joins your Wi-Fi, outsiders tunnel in through it, and they infect an unprotected TV box on the same network.

A way in from the outside. Plume's second paper found that requests sent through the Netway proxy "were successfully routed to devices on the local network" of the box's owner, including a Linksys router's admin page and a cable modem status page, and warns that router admin pages often still use default passwords. Plume also ran its own test node on the Popanet network for over three weeks and recorded 1,352 separate attempts to reach the debugging port through a gap in that network's filtering. Google says the same of NetNut, a separate proxy network: "bad actors can access other private devices on the same home network."

Software you cannot remove. Firmware is the software built in at the factory, the box's foundation. A backdoor, as the FBI defines it, is a hidden, unauthorized way in, like a spare key the builder kept. Google says the XCPE backdoor lives in the firmware and reinstalls itself on reboot if a user removes it. It also switches off Google Play Protect, Google's built in app scanner, so it can add software without asking. A factory reset returns the box to how it shipped, like repainting a room while the wiring in the walls stays the same. The FBI says some devices "may contain malware even if a 'factory reset' is performed."

Someone watching and driving the box. Google observed XCPE operators capturing live screenshots, injecting keystrokes, taking account and device information off the box, and opening remote command sessions. Injecting keystrokes means sending key presses to the box, as if someone else held the remote. It is not recording what you type, and none of these sources says typed passwords were captured.

Ad fraud and extra malware. Google says most add-ons it found were proxy and bandwidth sharing modules, and it also saw ad fraud modules that load pages and fake clicks in the background, plus backdoors that load still more modules.

Being part of attacks on others. A botnet is a crowd of infected devices one group controls together, like a fleet of cars someone else holds the keys to. They steer it from command and control servers, the dispatch office that sends orders. TV boxes have filled several botnets, each counted by a different group at a different time. These counts overlap and measure different things, so do not add them up.

The Vo1d 1.3 million is a different group of devices from XCPE. Cloudflare's late 2025 report describes the Aisuru-Kimwolf botnet as "primarily Android TVs," estimates 1 to 4 million infected hosts, blames it for a December 2025 wave of attacks on Cloudflare and its customers, and reports a record 31.4 Tbps attack in 2025 without naming the botnet behind it.

Your internet slowing down. Plume says proxy traffic was, in documented cases, heavy enough to destabilize home networks.

What has not been documented. We looked for cases where an internet provider cut off a customer, or police came to a home, because of a proxy box, and found none. What is documented is quieter: a connection that gets "flagged as suspicious or blocked by providers" (Google), strangers' logins and verification codes passing through your line (Plume), an address whose reputation "now reflects whatever those bots utilize it for" (Plume), and the FBI's warning above that it can make the owner look responsible. Google's unusual traffic help page adds that "Some malware can cause Google to show this message."

The copyright part, briefly

The main US criminal law on piracy streaming, 18 U.S.C. 2319C, covers people who willfully run a streaming service "for purposes of commercial advantage or private financial gain," with up to 3 years in prison, 5 for works not yet released and 10 for repeat offenses. Its sponsor, Sen. Thom Tillis, said it "would apply only to commercial, for-profit streaming piracy services" and "Individuals who might use pirate streaming services will not be affected." That statement covers the criminal law only. Civil copyright claims are a separate matter.

Sellers have lost in civil court. TorrentFreak reported in 2018 that TickBox TV and its owner agreed to a $25 million stipulated judgment and permanent injunction. In June 2026 it reported that a federal judge in New York found a Queens electronics store liable for contributory and vicarious copyright infringement for selling preloaded IPTV boxes and ordered the remaining boxes destroyed, with damages still to be decided. Neither case names SuperBox. This is not legal advice; for a question about your own box, ask a lawyer where you live.

How to tell what you have

Start with the FBI's six warning signs from its June 2025 BADBOX 2.0 warning, quoted exactly:

• "The presence of suspicious marketplaces where apps are downloaded."
• "Requiring Google Play protect settings to be disabled."
• "Generic TV streaming devices advertised as unlocked or capable of accessing free content."
• "IoT devices advertised from unrecognizable brands."
• "Android devices that are not Play Protect certified."
• "Unexplained or suspicious Internet traffic."

The FBI adds: "An indicator alone does not accurately determine malicious cyber activity or a crime." One sign means look closer; several mean unplug.

Check certification. Play Protect is Google's built in app scanner, a guard at the door. Play Protect certification is separate, as Google's help page says: it means the device passed Google's testing. The page gives this path in the Google Play Store app: "Open the Google Play Store app," "At the top right, tap the profile icon," "Tap Settings," then "To check if your device is Play Protect certified, tap About." It is written for phones and tablets and does not mention TVs; TV menus differ by model, so look for the Play Store's settings and an About entry. Google also says only certified devices can include Google apps such as the Play Store, and that Google apps on uncertified devices are not licensed or real.

Certification is necessary and not sufficient. The FBI treats a missing certification as a warning sign. The November case shows the other side: Videostrong passed Google's tests and loaded its code afterward. Use certification as a floor, then watch what the device does.

What a legitimate device looks like. Google advises buying set-top boxes from reputable manufacturers and points to its Android TV partner list. In our view that means a maker you can look up, with a support page and a record of updates; Google's help page warns uncertified devices may not get system or app updates. It uses the app store it shipped with; the FBI warns that sideloading unofficial apps onto streaming sticks or Android TV boxes raises the chance of malware. (Sideloading is installing apps from outside the official store, like buying groceries off the back of a truck.) It never asks you to turn off Play Protect. And it does not promise everything free forever; the FBI tells people to avoid streaming devices that claim to offer free sports, shows and movies. The name on the box tells you little: Krebs found these boxes "marketed under a dizzying range of no-name brands and model numbers."

See what is on your network. CISA's home network guidance says to "Use your router manufacturer's website to monitor for unauthorized devices joining or attempting to join your network." Open your router's app or admin page, find the list of connected devices, and match each one to something you own. An unknown device usually shows as a string of letters and numbers or a maker name you don't recognize. Our IoT isolation post walks through router menus and splitting a network, and our ISP monitoring post covers other home devices that phone home.

What to do if you own one

1. Unplug it and take it off the Wi-Fi. Who: the owner. The FBI urges people to "consider disconnecting suspicious devices from their networks," and Malwarebytes says the same to SuperBox owners. Done when: the box has no power and no network cable.
2. Do not rely on a factory reset or uninstalling apps. Who: owner. The FBI says malware can survive both; Plume's first paper says preinstalled apps "can even survive a factory reset"; Google says XCPE reinstalls on reboot; Malwarebytes advises replacing a SuperBox. Done when: you have decided to replace it.
3. Ask the seller for a refund or clean firmware. Who: owner. Malwarebytes suggests asking about a fix or replacement; BleepingComputer notes owners "would need to install clean firmware to remove the infection." Expect little. Done when: your request is sent in writing and saved.
4. Dispose of it as electronic waste. Who: owner. Our advice: don't sell or give it away, because the next owner inherits the problem. Done when: it has gone to an e-waste drop-off.
5. Change the Wi-Fi password if the box knew it. Who: whoever runs the router. Our advice, in line with the FBI's advice to change passwords: the box stored it. Done when: your own devices have rejoined with the new one.
6. Change passwords for accounts signed in on the box. Who: each person who used it. Google says XCPE operators took account information. Done when: each of those accounts has a new password and two step sign in where offered.
7. Check the router. Who: whoever runs it. CISA says to "Change the router's default administrator password" and to update firmware. Done when: the admin password isn't the one on the sticker and firmware is current.
8. Watch your accounts. Who: everyone in the house. The FBI suggests alerts for suspicious logins and transactions. Done when: alerts are on for banking and email.
9. Report it if you were harmed. Who: the person harmed. The FBI asks victims to file at ic3.gov. Done when: you have a complaint number, or there was no loss to report.

What about a guest network? A guest network is a second Wi-Fi name on the same router, like a side door that opens only to the street. A VLAN keeps groups of devices in separate rooms of the same building. The two Malwarebytes articles differ here, and both make sense. In September, about a box that runs a proxy on purpose, Malwarebytes said it "should not be trusted on a household network, even on a separate guest network." In November, for TV boxes in general, it advised a separate network or VLAN, which "doesn't keep the devices themselves safe, but it does keep other devices separate." Our view: a separate network protects your laptop and phone from the box, and does nothing about strangers using your internet address, because the guest network leaves through the same address. A box that proxies has to go. For smart devices you do trust, the separate network in our IoT isolation post is still good practice.

If you run a small office, a rental or a waiting room

At work the stakes go up, because the office address is the one your bank, payroll service and email provider see every day, and the FBI's bank example shows why a criminal wants an address in the right city. The FBI's advice for businesses covers device policies that keep unauthorized devices off the network, network segmentation, firewall rules against unauthorized apps, and blocking addresses known to belong to residential proxy networks. In plain steps:

1. Write a one paragraph rule: nothing joins the office network without the owner's or IT person's okay.
2. Give TVs, guests and personal phones their own network, away from the computers that touch money and customer data.
3. No unknown streaming boxes on any office network, the lobby TV included. Whoever brought one isn't in trouble; the box goes home.
4. Check the router's device list monthly and match every entry to something you own.
5. Ask your IT provider whether your firewall can block known proxy networks.

Free and legal ways to watch

Free, ad supported services have their own apps. Pluto TV says "All free, no payment required. Ever." Tubi headlines its page "Watch Free Movies and TV Shows Online." Plex offers a free section to "Watch now without any payment or subscription." We have no tie to any of these and don't rank them.

What to remember

Nobody buys a TV box hoping to host strangers' traffic. The hidden price of free TV turned out to be your connection, your address and some control of your network. Unplug the box this week, look at your router's device list, and change the passwords it touched. Then watch something you don't have to think about.

Download the check kit

• Streaming box home network check kit (.md): a 20 minute home check with the FBI's six signs, removal steps, a printable note for family, a device rule for an office or rental, questions to ask before buying, and free legal options.

Related reading

• Isolating IoT devices on a consumer router: a three network setup that keeps smart devices away from your laptops.
• Your ISP already knows when you're home: what providers and home devices collect, and how to run monitoring yourself.
• FBI and CISA warn of attacks on refrigeration systems: finding connected equipment in a small business and closing easy doors.
• Microsoft 365 went down in 70+ countries: an outage plan for a business that depends on one email provider.
• Your password has probably been leaked: checking a password against known breaches without sending it anywhere.
• Six fraud reflexes for small business owners: habits for spotting AI era fraud, built on the FBI's 2025 crime report.

Fact-check notes and sources

All read November 14, 2026, UTC; Malwarebytes, Google XCPE, FBI and Plume newsroom pages also read in a desktop browser, 20:35 to 20:59.

• Malwarebytes, Pieter Arntz, September 4, 2026, read 21:02: SuperBox, outgoing channel, reset, guest network.
• Malwarebytes, Pieter Arntz, November 3, 2026, read 21:02: "certified" summary, takedown, seller, VLAN.
• Google Threat Intelligence Group, XCPE report, November 2, 2026, read 21:02: count, attribution, test gap, persistence, operator actions, ban, advice.
• FBI IC3, I-031226-PSA, March 12, 2026, read 21:02: definition, uses, reset, sideloading, business steps, reporting.
• FBI IC3, I-060525-PSA, June 5, 2025, read 21:02: indicators, BADBOX 2.0, disconnecting.
• Plume, newsroom post, May 28, 2026, read 21:02: count, price, ADB, root, traffic, instability.
• Plume Security Labs, Part 1 and Part 2, May and September 2026, read 21:02: S6MAX, reset, Netway, local network reach, 1,352 attempts, reputation. Both carry a confidentiality banner though Plume links them publicly.
• Krebs on Security, November 24, 2025 and January 2, 2026, read 21:04: SuperBox, Kimwolf, houseguest path, brands.
• BleepingComputer, Lawrence Abrams, XCPE report, November 2, 2026, read 21:04: MECOOL model, clean firmware.
• Google, BADBOX 2.0, July 17, 2025; IPIDEA, January 28, 2026; NetNut, July 2, 2026; all read 21:04.
• Doctor Web, Vo1d, September 12, 2024, and Cloudflare, 2025 Q4 DDoS report, February 5, 2026, read 21:04.
• Google certification help, Android TV partners, unusual traffic help, and CISA Home Network Security (February 1, 2021, archived), read 21:04.
• 18 U.S.C. 2319C, Sen. Tillis (December 10, 2020), and TorrentFreak on TickBox (2018) and the Queens store (June 11, 2026), read 21:04. Court records not read.
• Pluto TV and Plex, read 21:04; Tubi from our research file, read 20:53.
• Not found: a provider suspension or police visit over a proxy box; a full XCPE model list; replies from Videostrong or SuperBox.

This post is informational, not legal or security-consulting advice. Mentions of third parties are nominative fair use. No affiliation or endorsement is implied.