T95
Confirmed BADBOX firmware malware documented by HUMAN Security (2023) and the FBI (2025) · since 2026-11-05
A maintainer confirmed the finding, or it is tied to a published CVE or writeup.
Unbranded Android TV box sold on Amazon, AliExpress and others. Shipped with firmware-level malware (BADBOX / 'Peachpit' ad fraud) that contacts a command server at first boot.
Identity
- Brand
- unbranded
- OEM
- AllWinner / Rockchip white-label
- Model
- T95
- Made in
- CN (metadata, not a finding)
- Reports
- 1 total · 1 verified
Identifiers
| model_number | T95 |
Check yours
Own one? Run the Trust Check and your report either corroborates or contradicts what's here. Both are useful.
claude mcp add --transport http isitspying https://mcp.isitspying.com/mcpThen ask: “Run a Trust Check on my T95.” Or file a report with photos.
Findings
| Finding | Max severity | Reports | Verified |
|---|---|---|---|
| Contacts unknown host | high | 1 | 1 |
| Preinstalled malware | critical | 1 | 1 |
Published sources
- FBI PSA: Home internet-connected devices facilitate criminal activity (BADBOX 2.0) · FBI IC3 · 2025-06-05
- BADBOX: Peachpit and the fraudulent operation that exploits consumer devices · HUMAN Security · 2023-10-04
Reports · 1
- Malicious verified Firmware contains BADBOX malware; contacts C2 infrastructure on first boot and installs ad-fraud modules
firmware_dump · via api · by isitspying maintainers maintainer · 4h ago
Responses & disputes · right of reply
None yet.
Post a vendor response, dispute, or corroboration
Sign in to post.
Takedown or legal: takedown@isitspying.com. See how we handle disputes.
Embed the status
<a href="https://isitspying.com/p/t95"><img src="https://isitspying.com/badge/t95.svg"></a>
JSON: /api/products/t95 · or request this page with Accept: application/json.