{"id":26089,"date":"2026-09-14T11:59:32","date_gmt":"2026-09-14T07:59:32","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/?p=26089"},"modified":"2026-09-15T12:05:16","modified_gmt":"2026-09-15T08:05:16","slug":"smart-tv-box-residential-proxy-malware-threat","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/smart-tv-box-residential-proxy-malware-threat\/26089\/","title":{"rendered":"Trojan TV, or the new risks of malicious proxies"},"content":{"rendered":"

In 2026, the owner of an ordinary home router, smart TV, or TV box is a prime target for cybercriminals. These devices are readily recruited into botnets and residential proxy networks<\/a>, which we\u2019ve covered before.<\/p>\n

Criminals \u201csublease\u201d the infected device by letting outsiders pay to visit any website from the victim\u2019s IP address, so it looks like the device\u2019s owner is doing it. The service is in demand across all kinds of shady schemes: from ad fraud and spam campaigns to password bruteforcing and account hacking. In our previous post, we described how home routers get recruited into these proxy networks; today we\u2019ll look at an even more vulnerable and equally ubiquitous category of devices: smart TVs and TV boxes.<\/p>\n

These appeal to criminals for two reasons. First off, unlike computers and phones, TVs are almost always plugged into power and connected to fast internet. A dark screen doesn\u2019t mean the device is switched off. On top of that, the limited user interface and monitoring tools mean suspicious background processes can easily slip unnoticed past users.<\/p>\n

The threat is evolving and growing more aggressive. A recent study<\/a> found that once proxyware turns up on a set-top box, the risks to its owner go well beyond having their traffic siphoned off.<\/p>\n

Anatomy of the infection<\/h2>\n

The researchers focused on a popular TV box by SuperBox, which we already covered earlier in the post Is your TV box renting out your network?<\/strong><\/a><\/p>\n

SuperBox\u2019s marketing leans heavily on the promise of providing thousands of TV channels, with no subscription or monthly fees. But out of the box, the device can\u2019t actually do anything of the sort. To get access to pirated content, you need to install the brand\u2019s proprietary app store.<\/p>\n

Once you launch it and install additional apps, the promised TV channels do appear. Meanwhile behind the scenes, with no warnings or permission prompts, the device floods external sites with unauthorized requests. Network traffic spikes sharply.<\/p>\n

The researchers uncovered several alarming facts. First, the victim gets enrolled into as many as five botnets at once. The SuperBox runs clients for several proxyware networks simultaneously, which even try to compete with one another by blocking rival software from being installed.<\/p>\n

But the real shock was the attacks on the internal network. The TV box\u2019s proxyware places no limits on what its paying clients can actually do on the network. They can reach not only external sites but also devices inside your home network.<\/p>\n

Normally, your home router and ISP settings protect you from outside attacks. But proxyware bypasses these barriers, because it operates from inside the network. During an experiment, the researchers confirmed that an attacker on the internet can easily leverage the infected set-top box to open the admin panel of a home router, such as a Linksys, which is supposed to be accessible only to its owner when connected to the home Wi-Fi network. This means hackers can try to steal data from other devices at the same household or even encrypt a home network storage (NAS).<\/p>\n

At the same time, flaws in SuperBox\u2019s factory firmware let hackers remotely install and run any application with superuser privileges. The threat is anything but hypothetical. Over three weeks of monitoring, the test set-top box was hit by more than 1300 attacks through the home proxy network. Attackers installed three different types of malware, including a module for launching DDoS attacks.<\/p>\n

The malware uses several methods to gain a foothold in the system, and it survives reboots and power failures alike.<\/p>\n

How to tell if your set-top box is working for hackers<\/h2>\n

If you have a cheap TV set-top box or Android TV from a little-known brand, it\u2019s worth checking it for anomalies.<\/p>\n

The most reliable method is to review the network traffic. Use the statistics in your router\u2019s control panel\u00a0\u2014 note that some budget models may lack this feature. This feature is called Traffic Analyzer on Asus routers, Traffic Usage on TP-Link, and Traffic Monitor on Keenetic. Find your TV or set-top box in the device list and check the ratio of downloaded to uploaded data. They should consume a lot of traffic to download video while sending very little. If your box is quietly pushing gigabytes of data out or staying chatty on the network even while idle, that\u2019s a telltale sign it\u2019s infected.<\/p>\n

If traffic statistics aren\u2019t available, look for indirect signs:<\/p>\n