InfoSecBulletin Cybersecurity for mankind
Google is suing 25 unidentified cybercriminals thought to be from China for running BADBOX 2.0, a major global botnet with 10 million hacked devices. BADBOX uses internet-connected Android devices like smart TVs, streamers, digital frames, car systems, projectors, and inexpensive off-brand tablets made in China and sold worldwide.
It has infected over 10 million uncertified devices that use Android software but do not have Google’s security. On July 11th, Google sued a group called “Does 1-25” for causing serious harm.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
The lawsuit alleges that the group of cybercriminals tarnishes Google’s reputation when fraud occurs on its platforms, causing the company to expend substantial resources to detect, deter and disrupt BADBOX, which grows every day.
“Google has shown that Defendants – through their participation in, and operation of, the BadBox 2.0 Enterprise – have threatened the security of the internet, including Google platforms, by transmitting malware through the internet to configure, deploy, and operate a botnet,” the court document reads.
Cybercriminals sell access to hijacked devices to other criminals, who use them to conceal large-scale fraud and illegal activities.
“Google is entitled to recover treble damages plus costs and attorney’s fees from the Defendants,” the complaint reads.
Google announced in a blog post that it quickly responded to a threat and updated Google Play Protect to automatically block apps associated with BadBox. However, BADBOX comes preinstalled on the devices at the firmware level and cannot be easily removed. Full report here.
