Name of Malware: Vo1d

Type of Malware: Loader, Proxy, Ad Fraud

Affected Operating Systems: Android

Affected Device Types: TV Boxes

Impact: high

What is Vo1d?

Vo1d is a malware which infects non Play-Protect Certified Android TV Boxes. It allows the attacker to install arbitrary malware on the device. Currently, Vo1d is used to create a proxy network and for automated clicking on ads (Ad Fraud). The proxy network allows the attackers to route arbitrary traffic through the infected device. This way, criminal activity can be masked as originating from the internet connection of the victim.

How did I get infected with Vo1d?

How exactly devices are infected with Vo1d is currently unknown. It is possible, that Vo1d comes pre-installed with the firmware of affected devices.

What do I have to do now?

It is recommended not to use the infected device any longer

Technical specifications

Further information on this malware can be found on the website of our project partner Fraunhofer FKIE.