This relatively new botnet compromises Android based TV boxes, many which ship with default mode which allows remote access!
Two million devices are part of the Kimwolf botnet allowing a great increase in ad fraud and DDoS attacks.
A tool to check your Android based TV or streamer here.
Update: Some Android digital picture frames may be infected before and delivery.
Update: A list of known infected or vulnerable devices:
Here’s a clean, search‑verified list of the Android TV boxes most commonly infected by the Kimwolf botnet, based directly on the sources you pulled.
Kimwolf overwhelmingly targets cheap, no‑name, uncertified Android TV boxes — many of which come pre‑infected or ship with exposed ADB that allows instant compromise.
✅ 1. “TV BOX” (generic label)
A huge number of infected devices simply report themselves as “TV BOX”, a catch‑all name used by many unbranded Chinese manufacturers.
✅ 2. SuperBOX
Frequently appears in infected device pools.
✅ 3. HiDPTAndroid
Another common generic Android TV box name seen in Kimwolf infections.
✅ 4. P200
A widely cloned board used in many low‑cost TV boxes.
✅ 5. X96Q
One of the most frequently mentioned infected models.
✅ 6. XBOX / X‑BOX (not Microsoft Xbox)
A misleading brand name used by several no‑name Android TV box vendors.
✅ 7. SMART_TV / SMART TV (generic)
Generic “Smart TV” labeled devices with Android builds.
✅ 8. MX10
Another common low‑cost box repeatedly seen in botnet telemetry.