There is an old saying I keep coming back to: nothing is free. That goes double for anything that plugs into your home internet.

This week Google announced it had taken down a botnet called XCPE that was running on more than 1.3 million Android TV boxes. (A botnet is a big group of hijacked devices that a criminal controls from a distance, all without the owners knowing.) Google says the company that made those boxes built the backdoor in on purpose and sold access to other criminals. That is a good reason to talk about what may be sitting under your TV right now.

The “free cable” box

You have probably seen them. Little Android TV boxes sold online, and sometimes by street vendors, promising free cable, free movies, free sports and free pay-per-view. Many of them are cheap, no-name boxes made in China.

Here is the catch. The FBI has warned that many of these devices come with malicious software already installed before you ever open the box, or they get infected during setup when they ask you to download apps from unofficial app stores. In June 2025 the FBI put out a public warning about a criminal operation called BADBOX 2.0, which it said had infected millions of devices, mostly made in China. That includes TV streaming boxes, digital projectors, digital picture frames and aftermarket car stereo systems.

Google has called BADBOX 2.0 the largest known botnet of internet connected TVs and says it infected over 10 million devices. Google sued the people behind it in federal court in New York in July 2025.

The FBI’s warning signs are worth knowing:

  • A streaming box advertised as “unlocked” or able to get “free content”
  • A brand you have never heard of
  • A box that asks you to turn off Google Play Protect, the built-in Android safety scanner
  • Apps that come from some app store other than Google Play

Your internet, rented out to criminals

So what do the criminals actually do with your box? One of the biggest uses is something called a residential proxy.

First, a quick definition. Your IP address is like the return address on an envelope. Every website you visit sees it, and it points back to your home internet connection.

A residential proxy lets someone else send their internet traffic through your home connection, so to the rest of the world it looks like it came from your house. Criminals sell access to these hijacked connections. The FBI says the people running BADBOX 2.0 sell, or even give away, access to compromised home networks for all kinds of criminal activity.

That means when a criminal logs into a stolen bank account, sends out scam emails, or breaks into a company network, the trail can lead back to your IP address, not theirs. In a March 2026 warning, the FBI said this can make the consumer appear responsible for the crime. You paid for the internet. They used it. You may be the one who gets the knock on the door.

And again, nothing is free. That “free cable” may be paid for with your internet connection and your good name.

Why criminals want to look local

A lot of companies and websites use geoblocking, which simply means blocking or flagging traffic that comes from certain countries. A bank in Fargo might get suspicious if someone logs into your account from overseas.

So criminals work around it by borrowing an internet connection that looks local. The FBI says people renting residential proxies can choose the country, and even the city and state, they want to appear to come from. If a criminal has your bank password, they can rent an IP address in your own city so your bank is less likely to notice.

Nation states do this too. In August 2026 the Justice Department and FBI shut down a hacking network used by a Chinese state-sponsored group. According to the Justice Department, it was built from thousands of hacked “internet of things” devices around the world, so attacks looked like they came from outside China and sometimes even from near the targeted network. North Korea has used a related trick. In June 2025 the Justice Department announced searches of 29 suspected “laptop farms” in 16 states, where people in the U.S. hosted work laptops so North Korean IT workers could get remote jobs at U.S. companies while appearing to work from inside the United States.

When the fridge gets hacked

This is not just a home problem. Just this week, supermarkets across Europe had their refrigerators and freezers tampered with remotely. According to Belgium’s national cybersecurity center, attackers got into the internet connected control systems for store refrigeration, often through systems that were exposed to the open internet, out of date, or still using the default password. They forced the units into defrost cycles as high as 50°C, about 122°F, overnight. Stores in Belgium, Sweden, Ireland, Estonia and other countries had to throw out food. This came a few weeks after a similar wave of attacks on hundreds of stores in France. As of this writing, nobody has been confirmed as responsible.

Here is the lesson. There is a big difference between monitoring a temperature and controlling it. A system that only reports “this freezer is at 0°F” can warn you when something is wrong. A system that can also change the setting from anywhere on the internet can be turned against you. If you only need to watch something, don’t give it the power to be controlled from the outside.

My rule: if it doesn’t need internet, it shouldn’t have it

Does your dishwasher need the internet? Your washing machine? Your toothbrush? Your toaster? Your fridge? Your garage door opener? Your light bulbs?

For most of us, the honest answer is no. Every one of those gadgets is a small computer, and every small computer on your network is one more door a criminal can try. Many of them never get security updates. If a device works fine without being online, keep it offline.

Why I pulled out my smart lights

I’ll tell you a personal one. I had smart lights in my house, and my firewall caught them sending botnet traffic. I took them out.

Here is what was going on. Hijacked devices “phone home” to what’s called a command-and-control server. Think of it as the criminal’s headquarters. It is a server that sends orders to thousands of hijacked devices at once. One of the most common orders is “everybody flood this website right now.” That is called a DDoS attack, short for distributed denial of service. It is like thousands of cars all pulling into one small parking lot at the same moment so real customers can’t get in. One light bulb doesn’t do much. Thousands of them together can knock a business offline.

Attacks for rent

The scariest part? You don’t even have to be a skilled hacker anymore. You can rent one.

Criminals sell DDoS-for-hire services, sometimes called “booters” or “stressers,” which let anyone pay to knock a website offline. Police around the world keep going after them. In April 2026, a Europol supported operation called PowerOFF involving 21 countries took down 53 websites, made 4 arrests and sent warnings to more than 75,000 users of these services. In a related U.S. case, an FBI agent bought a plan from one of these services that offered a month of attacks for $45.

It goes beyond DDoS. There is hacking-as-a-service, where criminal groups sell their tools and skills to paying customers. The Chinese group the Justice Department disrupted in August is described in court papers as offering hacking services to paying customers, including China’s own government agencies.

None of this needed AI

Everyone is talking about AI right now, and AI is changing things. But I want to be clear: everything in this post predates AI. Botnets made of hacked cameras, routers and video recorders were knocking websites offline back in 2016 with a botnet called Mirai, which at its peak had hundreds of thousands of hijacked devices. BADBOX was first spotted in 2023. This is old fashioned greed, not science fiction.

What you can do

  • Skip the “free everything” streaming box. The FBI specifically says to avoid TV streaming devices that claim to offer free sports, TV shows and movies. If you already have one from a brand you don’t recognize, unplug it.
  • Don’t count on a factory reset. The FBI warns some devices come from the factory with malware that survives a reset. Replacing a cheap box is often the safest fix.
  • Buy from brands you know, and stick to the official app store.
  • Be wary of free VPNs and apps that pay you to “share your internet.” The FBI says these can quietly enroll you in a proxy network.
  • If it doesn’t need internet, don’t connect it.
  • Keep everything updated, including your router and firewall.
  • Put smart gadgets on a separate guest network if your router offers one, so a hijacked gadget can’t easily reach your computers and phones.

Nothing is free. If a deal seems too good to be true, someone else is probably getting paid, and it might be with your internet connection.

If you’re not sure what’s on your network, give us a call. We’re happy to help.

Jeff Carney, DarkHorse IT, Moorhead

Join us Thursdays at 7:40 AM on KFGO 790 AM.

Sources