AllWinner and RockChip might not be household names, but the two China-based companies manufacture several wildly popular Android TV boxes that are sold on Amazon. These Android-powered television set-top boxes are typically cheap and are highly customizable, packing several streaming services into a single device, rather than buying separate hardware. Their listings on Amazon boast four-out-of-five star ratings and collectively racked up thousands of praiseworthy reviews. But security researchers say the models are sold preloaded with malware capable of launching coordinated cyberattacks. Last year, Daniel Milisic bought an AllWinner T95 set-top box and discovered it was infected with malware. Milisic found that the Android-powered set-top box was communicating with command and control servers and awaiting instructions on what to do next. His ongoing investigation, which he published on GitHub, found that his T95 model was out-of-the-box connecting to a larger botnet of thousands of other malware-infected Android TV boxes in homes and offices across the globe. Milisic said the malware’s default payload is a clickbot, essentially code that generates ad money by surreptitiously tapping on …