The Satori Threat Intelligence and Research Team of HUMAN Security exposed a massive fraud scheme called BADBOX 2.0. The criminal operation involves over 1 million consumer devices, utilizing backdoors to conduct a variety of malicious activities. Working together with Google, Trend Micro, Shadowserver, and others, Satori was able to partially impede the network. Satori provides details on the threat actors behind BADBOX 2.0, the technical underpinnings of the backdoor, and the forms of fraud perpetuated.