Streaming devices are more popular than ever, but consumers should be extremely cautious of so-called “free TV” or “super box” devices that promise unlimited access to live sports, movies, and premium channels at no monthly cost.

These devices are often marketed as “fully loaded,” “plug-and-play,” or “user friendly,” with access to services like Netflix, HBO, Hulu, Prime Video, and live television, all supposedly included for free. Many are Android-based devices sold under unfamiliar brand names such as X96, MX10, VSeeBox, SuperBox, and countless others.

If that sounds too good to be true, it usually is.

Behind the convenience and low upfront cost can be serious cybersecurity, privacy, and legal risks that most users never realize.

Why These Devices Appeal to Consumers

The appeal is easy to understand:

A one-time purchase instead of paying monthly streaming subscriptions
Access to movies, sports, and TV without recurring costs
Simple setup marketed as “plug-and-play”
Sold openly through online marketplaces, social media, and even local sellers
Widespread normalization, “everyone has one”

With the average American household now spending significant money each month on streaming subscriptions, many consumers see these devices as an easy way to save money.

Unfortunately, the hidden cost can be far greater than a monthly subscription bill.

What We’re Seeing Happen to Real Customers

This is not just a theoretical risk.

We are actively seeing and hearing about real problems caused by unauthorized streaming devices in homes and businesses right here in our communities.

These are our neighbors.

Severely Slowed Internet Networks

Customers have contacted us complaining that their internet suddenly became slow, unstable, or unreliable.

After investigating, we discovered that certain free streaming devices were continuously transmitting massive amounts of data in the background, even when the television was turned off.

In several cases, once the device was unplugged, the network problems immediately improved.

Some of these devices were uploading an average of 1 terabyte (TB) of data every week.

To put that into perspective, that is roughly equivalent to:

Uploading 250 high-definition movies every week
Uploading approximately 250,000 photos every week

That level of unexplained outbound traffic is highly abnormal for a legitimate streaming device.

Why Constant Uploading Is a Major Red Flag

Legitimate streaming devices primarily download content while you are actively watching something.

Many of the unauthorized devices we have encountered do the opposite, they constantly upload data from inside the customer’s network.

That behavior strongly suggests the device may be:

Collecting personal or network information
Communicating with unknown third-party servers
Acting as part of a larger botnet or malicious network
Being remotely controlled without the owner’s knowledge

Once connected, the device sits inside the home network, the same network used for:

Online banking
Work-from-home systems
Smartphones and laptops
Security cameras
Smart home devices
Personal communications

In other words, the device is already behind your firewall and inside your private network.

Many of These Devices Lack Basic Security Standards

A major concern is that many of these products are not certified Android TV devices.

Instead, they often run modified versions of the Android Open Source Project (AOSP) without the security protections and safeguards found on legitimate certified devices.

Security researchers and law enforcement agencies have warned that some low-cost Android streaming boxes may already contain malware before they are even sold.

This is sometimes referred to as a “supply chain infection.”

Users typically never see any warning signs.

Malicious software on these devices can disguise itself as legitimate applications or even impersonate other trusted devices on the network.

The FBI Has Issued Warnings

The FBI has publicly warned consumers about low-cost Android TV streaming devices sold under unfamiliar brand names.

According to recent public warnings, malware campaigns have infected millions of internet-connected devices, including TV streaming boxes. Some devices may already contain hidden malware when purchased, while others become infected during setup or software installation.

Once connected to a home network, infected devices can quietly become part of a botnet, allowing criminals to:

Use the customer’s internet connection for illegal activity
Launch cyberattacks
Conduct scams or fraud
Steal data
Hide malicious traffic behind residential internet connections

Most users never realize it is happening.

What Is a Botnet?

A botnet is a collection of internet-connected devices infected with malware and remotely controlled by cybercriminals.

Hackers commonly target weaker Internet of Things (IoT) devices such as:

Streaming boxes
Cameras
Smart TVs
Thermostats
Routers
Other connected home devices

Once one device inside a network becomes compromised, malware can potentially spread or interact with other systems on the same network.

That means a seemingly har...

Alliance Communications

Message History

Delivery option(s)