Is it possible for the badbox2 virus to affect WiiM firmware?

[Golana]

Hello, has anyone else come across a message or issue like this in connection with a WiiM device?


I’ve received the following message from my internet provider, but I can’t link it to any device (smartphone/tablet):


"...A security risk has been detected on your 1&1 broadband connection.

We have received reports that a device connected to your 1&1 broadband connection has been infected by a virus. This poses a security risk, as, for example, unknown parties could gain access to your personal data via the virus, or the compromised device could be misused to launch attacks against third parties.

Details of the risk:

Your IP address at the time: .....
Time of detection: 2026-04-02 12:31:13
Virus name: android.badbox2"

 

[jfbuk]

AFAIK Linkplay is not Android based so I would look to another device on your network being the issue.

 

[Wiimer]

Hello, has anyone else come across a message or issue like this in connection with a WiiM device?


I’ve received the following message from my internet provider, but I can’t link it to any device (smartphone/tablet):


"...A security risk has been detected on your 1&1 broadband connection.

We have received reports that a device connected to your 1&1 broadband connection has been infected by a virus. This poses a security risk, as, for example, unknown parties could gain access to your personal data via the virus, or the compromised device could be misused to launch attacks against third parties.

Details of the risk:

Your IP address at the time: .....
Time of detection: 2026-04-02 12:31:13
Virus name: android.badbox2"

Just to be sure, are you certain that email actually came from your ISP? You’ve confirmed that it’s not a phishing email, right?

 

[cc_rider]

AFAIK Linkplay is not Android based so I would look to another device on your network being the issue.

Nope, WiiM devices don't use Android. Some of its competitors' devices, sadly, do.

 

[hoohoohoo]

Hello, has anyone else come across a message or issue like this in connection with a WiiM device?


I’ve received the following message from my internet provider, but I can’t link it to any device (smartphone/tablet):


"...A security risk has been detected on your 1&1 broadband connection.

We have received reports that a device connected to your 1&1 broadband connection has been infected by a virus. This poses a security risk, as, for example, unknown parties could gain access to your personal data via the virus, or the compromised device could be misused to launch attacks against third parties.

Details of the risk:

Your IP address at the time: .....
Time of detection: 2026-04-02 12:31:13
Virus name: android.badbox2"

From what I've read, BadBox2 is a supply-chain attack meaning that it came pre-installed on some device's firmware. So, it's likely on an off-brand cheap device that's running Android under the hood. It's unrecoverable because badbox2 is part of the firmware and if you recall adding such a device, get rid of it.

 

[Golana]

First of all, many thanks for the quick reply.

It’s good to hear that the problem with Badbox2 clearly has nothing to do with my Wii devices.

Now I just need to figure out how to identify the device in question.

@Wiimer As for whether it could be phishing, no,
I checked the email thoroughly before responding to any such information.
It actually comes from my internet provider and concerns my account.

Regards, Oliver

 

[slartibartfast]

Now I just need to figure out how to identify the device in question.

How many dodgy Android boxes do you have?

 

[Golana]

How many dodgy Android boxes do you have?

3 (Samsung smartphones) in constant use, 2 (Honor and Samsung) now and then. Plus 1 Sebbe tablet, now and then. All have been scanned with Norton Internet Security and Malwarebytes.

All devices are marked as certified in the Google Play Store...

So which one is the dodgy one? I’m afraid I don’t know...

 

[slartibartfast]

3 (Samsung smartphones) in constant use, 2 (Honor and Samsung) now and then. Plus 1 Sebbe tablet, now and then. All have been scanned with Norton Internet Security and Malwarebytes.

All devices are marked as certified in the Google Play Store...

So which one is the dodgy one? I’m afraid I don’t know...

Sebbe isn't on the certified list of partners. I was thinking more about TV streaming boxes etc.

 

[Golana]

Ok, on TV the amazon fire stick 4k..

 

[Wiimer]

I guess Sebbe is the most suspicious.

 

[slartibartfast]

Ok, on TV the amazon fire stick 4k..

That should be OK.

 

[Burnside]

I guess Sebbe is the most suspicious.

Yeah, a review of a sebbe tablet on Amazon also talks about this malware - that's what I'd put my money on

www.amazon.com.be/-/nl/Tablet-Android-Display-Octa-Core-Bluetooth/dp/B0C8659RTG?language=en_GB

 

[HansD-NL]

Yeah, a review of a sebbe tablet on Amazon also talks about this malware - that's what I'd put my money on

www.amazon.com.be/-/nl/Tablet-Android-Display-Octa-Core-Bluetooth/dp/B0C8659RTG?language=en_GB

Bingo!