172: SuperBox

This episode of Darknet Diaries dives deep into the alarming rise of the 'Superbox'—a cheap, malicious Android streaming device marketed as a way to access thousands of pirated movies and TV shows. Initially dismissed as a harmless gadget, Deadass, a cybersecurity researcher, uncovered that these devices are far more dangerous: they beacon to Chinese infrastructure, run outdated Android systems with known vulnerabilities, contain remote access tools like TeamViewer, and actively scan and attack other devices on home networks. The Superbox is part of a larger 'bad box botnet' that has been used for DDoS attacks, residential proxy networks, and data exfiltration. Despite an FBI warning and growing evidence of malicious activity, these devices remain widely available on Amazon, Walmart, and Best Buy through third-party sellers. The episode reveals a sophisticated, multi-layered campaign involving influencer marketing, MLM-style reseller networks, and even physical delivery to unsuspecting users—particularly in high-value sectors like oil and gas. The story raises urgent questions about consumer trust, regulatory failure, and national security, suggesting that these devices may be part of a broader intelligence-gathering operation. Ultimately, the episode serves as a chilling warning: our homes may no longer be safe havens, and the line between entertainment and espionage has vanished.