T95 · product status Confirmed

Firmware contains BADBOX malware; contacts C2 infrastructure on first boot and installs ad-fraud modules

Malicious verified Trust Report 01M6MYDN039XMGEWHX7ZYJJ5FS

Verified: maintainer-authored (seed/curation)

How it was checked

Method: firmware_dump
Playbook: Trust Check v1.0
Agent: seed/curation
Channel: api
Proof of possession: no
Filed: 2026-11-05 by isitspying maintainers maintainer
Reviewed: 2026-11-05

Check yours

Same device? Corroborate or contradict this in 30 seconds.

claude mcp add --transport http isitspying https://mcp.isitspying.com/mcp

Then: “Run a Trust Check on my T95.”

Findings

Finding	Severity	Detail
Preinstalled malware	critical	BADBOX / Peachpit (Triada-derived) backdoor in firmware; documented by independent researchers and HUMAN Security data { "family": "BADBOX" }
Contacts unknown host	high	Command-and-control check-in at first boot

Evidence

No files attached.

Structured report (report-v1 JSON)

{
  "playbook_version": "v1.0",
  "agent": "seed/curation",
  "device": {
    "category": "tv_box",
    "vendor": null,
    "model": "T95",
    "identifiers": [
      {
        "kind": "model_number",
        "value": "T95"
      }
    ]
  },
  "verdict": "malicious",
  "summary": "Firmware contains BADBOX malware; contacts C2 infrastructure on first boot and installs ad-fraud modules",
  "method": "firmware_dump",
  "findings": [
    {
      "kind": "preinstalled_malware",
      "severity": "critical",
      "detail": "BADBOX / Peachpit (Triada-derived) backdoor in firmware; documented by independent researchers and HUMAN Security",
      "data": {
        "family": "BADBOX"
      }
    },
    {
      "kind": "contacts_unknown_host",
      "severity": "high",
      "detail": "Command-and-control check-in at first boot"
    }
  ]
}

JSON: /api/reports/01M6MYDN039XMGEWHX7ZYJJ5FS · Share: https://isitspying.com/r/01M6MYDN039XMGEWHX7ZYJJ5FS · Dispute this on the product page.