Vo1d is a large-scale Android botnet and backdoor ecosystem that primarily targets unofficial Android-based TV boxes and related embedded Android devices, with infections also reported on other Android-derived consumer hardware through firmware or supply-chain compromise.
Profile source: Mallory opens in a new tabVo1d
Vo1d is a large-scale Android botnet and backdoor ecosystem that primarily targets unofficial Android-based TV boxes and related embedded Android devices, with infections also reported on other Android-derived consumer hardware through firmware or supply-chain compromise. It has been observed at million-device scale globally and is associated with long-lived command-and-control infrastructure and modular proxy-enablement components such as Popa. Public reporting has also described Vo1d infections on Android-based projectors and linked infrastructure overlaps to other Android malware ecosystems including Triada, BADBOX, and Keenadu, although shared infrastructure does not by itself prove common operators.
Vo1d is notable for converting compromised devices into residential proxy nodes. Once active, infected devices silently relay third-party traffic through the victim’s network connection, enabling abuse such as scraping, account attacks, infrastructure obfuscation, and other criminal activity while masking the true origin behind residential IP space. Research on the associated Popa plugin and related clients indicates a tunneling architecture in which infected devices register with controller infrastructure, receive relay assignments, and proxy arbitrary traffic over persistent outbound connections. This design reduces visibility from the outside and supports large-scale proxy operations.
The infection vector for the original Vo1d botnet has not been conclusively established, but multiple investigations indicate firmware-level or supply-chain compromise for some affected Android devices. Vo1d has been repeatedly associated with unofficial streaming boxes and pirated streaming app ecosystems, and related proxy components have also been found bundled in modified streaming applications and other software. Kaspersky detections identify Vo1d as Android malware, and some reporting explicitly characterizes it as a backdoor. The malware’s operational role is primarily post-compromise monetization and proxy enablement rather than overtly destructive activity.
Vo1d has been discussed alongside broader Android proxy and botnet operations affecting consumer devices at scale. Its Popa component has been described as a plugin or networking layer within the larger Vo1d ecosystem, and separate research has linked shared backend characteristics to commercialized residential proxy services. The botnet has been observed across hundreds of countries and remains significant because it blends malware, supply-chain compromise, and proxy monetization on Android-based consumer hardware.
MITRE ATT&CK
Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.
