Readers on our Malaysian pages, shopping for a cheap way to make an old television smart, are splitting their clicks between two very different kinds of device. In our product-click data for August to October 2026, with October counted to date, readers clicked TV boxes and streaming sticks on our Malaysian pages 901 times. Of those, 469 clicks went to mainstream names, Xiaomi with 255, Google with 202 and Amazon with 12, while 432 went to Android boxes sold under little-known brands. That 432 is nearly half the total. An unfamiliar brand name is one of the warning signs the FBI listed in 2025, the year it and Google both went public about a malware botnet built out of uncertified Android devices.
Contents
- 901 clicks, nearly half to little-known brands. In our click data for August to October 2026, October counted to date, 432 of 901 clicks on TV boxes and streaming sticks went to Android boxes sold under brands other than Xiaomi, Google and Amazon.
- The FBI issued a consumer advisory on 5 June 2025, warning that the BADBOX 2.0 botnet had infected millions of home devices, including TV streaming boxes. It lists unrecognizable brand names and the absence of Play Protect certification among the warning signs, while stating that an indicator alone does not prove a device is compromised.
- Google says the botnet spans over 10 million uncertified Android devices and sued its operators in July 2025.
- What a mainstream-brand box costs today. Malaysian retailer DirectD displayed the Xiaomi TV Box S (3rd Gen) at RM329, against a crossed-out reference price of RM409, when we checked on 25 October 2026.
What our readers are clicking
The most-clicked single product was the Xiaomi Mi Box S (2nd Gen), with 128 clicks. But the little-known boxes add up quickly once you count them together. The most popular of them was the MECOOL KM2 at 119 clicks, just ahead of the Q Plus TV Box at 102, followed by boxes sold under names like EVPad, TX3, X99 and MXQ. We are grouping these simply by brand, as boxes sold under names other than Xiaomi, Google and Amazon; that is a description of who makes them, not a test of any one box. We did not check any individual model for certification or malware, an unfamiliar brand name alone does not prove a box is uncertified or compromised, and in the FBI's words an indicator on its own does not establish malicious activity. What the brand name does tell a shopper is when to look closer.
Why these boxes worry the FBI
In a public advisory on 5 June 2025, the United States Federal Bureau of Investigation warned that a botnet it calls BADBOX 2.0 had turned millions of home devices into tools for online crime. The affected hardware, it said, included "TV streaming devices, digital projectors, aftermarket vehicle infotainment systems, digital picture frames and other products", most of them made in China. Some arrived with the malware already installed; others were infected during setup when they downloaded apps carrying hidden backdoors. Its warning signs describe how such boxes are often sold, naming "IoT devices advertised from unrecognizable brands", "generic TV streaming devices advertised as unlocked or capable of accessing free content", and "Android devices that are not Play Protect certified". The FBI is careful to say an indicator alone does not prove a device is compromised, but a box that is compromised can quietly route criminal traffic through your home internet connection.
Google took the botnet to court
A month later, Google filed suit against the people behind BADBOX 2.0. It said the botnet had compromised "over 10 million uncertified devices running Android's open-source software", the version of Android that, in its words, "lacks Google's security protections". That is the line that matters for a buyer. A device that is Play Protect certified is eligible for Google's licensed apps and security protections that the open-source version does not carry, which is why Google also updated its Play Protect malware scanner to block known BADBOX apps.
How to lower the risk
There is no way to guarantee any device will never be compromised. But the FBI's warning signs point to a simple precaution: favour a box that is Play Protect certified over a generic Android box advertised as "unlocked" or able to stream everything free. You can check whether a box is Play Protect certified on the device itself: open the Google Play Store, go to Settings, and look under About for a "Play Protect certification" line. Google explains what the certification covers on its Android certified page. One mainstream-brand example: Malaysian retailer DirectD displayed the Xiaomi TV Box S (3rd Gen) at RM329, against a crossed-out reference price of RM409, when we checked on 25 October 2026. We keep our picks and their prices up to date in our guides to the best Android TV boxes for Netflix in Malaysia and the best Android TV boxes in Malaysia.
Our click data covers ProductNation pages only. It measures clicks, not purchases or Malaysian buyers at large, and it cannot establish whether any device a reader clicked or bought was compromised. What it does show is that nearly half of those clicks are for Android boxes from outside the mainstream brands, and an unfamiliar brand name is one of the warning signs the FBI listed, which for a shopper is a reason to look closer before buying.
