Cheap 'free movies' boxes already rent your home internet to criminals. Now they're being used to deliver fresh malware on top.

Picture a small box next to your TV, the one sold as a deal: a one-time purchase for "free movies" or "free TV," no subscription, no monthly bill. Most owners never read the small print, because the movies stream the way the box promised. The trade they didn't sign up for is happening in the background: that box has been renting out their home internet to paying criminals, and new research now shows it is also being used to push more malware onto the same household.

Plume Security Lab's SuperProxy Part 2 report, published this week, uses SuperBox as the named example of a wider category of cheap Android streaming boxes that arrive with the operating system's built-in defenses turned off. Ars Technica's write-up of the same research walks through what that means in practice.

Out of the box, SuperBox's apps run as root, the highest permission level on Android, with no review screen, no Play Protect scan, and unknown-source installation unrestricted, according to Plume. The Google Android Enterprise Security White Paper describes those four controls as the baseline every consumer Android device is supposed to keep on by default. On this category of device, all four are off.

The Android Debug Bridge (ADB) port is exposed to the public internet, and the su binary, the program that grants root access on a Linux system, runs without authentication. A single command installs any app silently. Every default Android protection is bypassed at once.

The box reaches out, on its own, to a paid "residential proxy" service: a network that rents ordinary home internet connections to other paying customers so those customers can route their traffic through the owner's address. The connection is outbound and encrypted, so home firewalls and routers see no incoming attack and no obvious reason to block it. To the network operator, the box looks like a normal video stream. The owner's home internet is, in effect, a paid highway for strangers.

Plume's researchers set up a controlled honeypot, a fake vulnerable device used to observe attacker behavior, posing as a Popanet exit node, one endpoint on a residential proxy network, for more than three weeks. They recorded 1,352 distinct attempts to reach the same ADB ports, 5555 and 5858, through the proxy channel.

Google Cloud Threat Intelligence's write-up on the Popanet disruption describes Popanet as one of the larger residential proxy networks taken down this year. Even Popanet's operators try to keep paying customers off the device's own local network, blocking local IP ranges by default. Plume found that proxy customers sidestep the block with a wildcard: 0.0.0.0, or a wildcard DNS trick like nip.io, which Android on the SuperBox then routes to 127.0.0.1, the device's own loopback address. From there, the attacker can reach the rest of the local network: the laptop on the same Wi-Fi, the NAS in the closet, the smart speaker on the kitchen counter.

The same compromised box is now being targeted with additional malware, paid for by the proxy customers themselves, on hardware the owner already paid for. Plume's earlier SuperProxy Part 1 research and the company's newsroom summary call this out as a category problem, not a SuperBox-only problem: dozens of similar cheap boxes share the same shape, and the operator's email, info@mysuperboxtv.com, did not respond to Ars Technica's request for comment before publication.

A non-technical owner can run three quick checks. The router's admin page, usually at 192.168.0.1 or 192.168.1.1, lists every device on the network. Anything you do not recognize is worth unplugging. Unexplained outbound traffic at odd hours, especially when the TV is off, is the second tell. The box stays awake even when the screen is dark. A box that arrived with "free" apps or "free" streaming services preloaded is the third tell. The trade is the bandwidth, the IP reputation, and now the device itself.

The "residential proxy" pattern will show up again around cheap IoT gadgets, free VPN apps, and browser extensions that promise free content. Recognizing the shape once, on a familiar device, makes the next one easier to spot.