When searching for the best streaming device, it can be tempting to look for the least expensive option that offers all the features of more expensive models at a fraction of the price. While that can result in the purchase of a spectacularly cheap product like the Roku Streaming Stick 4K, it can also result in the purchase of a rather sketchy device with malware pre-installed, according to a new report.

The devices in question for distributing malware were manufactured by two China-based companies, AllWinner and RockChip, and have hundreds of five-star reviews on Amazon.

Models like the AllWinner T95, first discovered by Redditor Daniel Milisic and corroborated by independent security researchers interviewed by TechCrunch, are currently selling for $35 on Amazon and in homes worldwide connected to a botnet of thousands of other devices in homes around the world. All of these devices are now instructed to secretly download clickbots that click on ads in the background, generating money for the device manufacturers.

This is fairly harmless malware, but the way malware distribution works is that the botnet could be reprogrammed at any time for more nefarious purposes (such as stealing user data) and the owner knows nothing.

Thankfully, Milisich reported the botnet network to the Internet hosting company that was hosting these servers, and the company took these servers offline. However, they could easily be brought back online at any time with a new provider. [I think] the only way to mitigate this problem is to impose higher standards on retailers," Milisic told TechCrunch. Why is it that [Amazon] is not allowed to sell children's toys made of spinning razor blades, but a small, unknown vendor is allowed to sell computers that operate maliciously without the owner's knowledge?"

While the point is valid, Amazon officials declined to comment on whether the company would take steps to prevent such problems in the future.

This leaves users with a tough choice: throw away the Android TV box they just bought and buy one from a more reputable company, or continue to use the one they have and risk future consequences if/when the bot network comes back online. We are faced with a choice.

According to Anthony Spadafora, senior editor of Security & Networking at Tom'sGuide, "Always be careful when buying an Internet-connected device. It may seem like a good deal to buy something cheap at first, but if your data is stolen or your identity is stolen by hackers, that cheap Android TV box will end up costing you more. That's why we recommend sticking with well-known vendors and doing plenty of research before buying a gadget; even at Amazon, Walmart, and other well-known sites, these dangerous devices can slip through the cracks and put you and your family at risk."

Thankfully, not all Android TV boxes come with malware pre-installed.

In my experience, the best Android TV box with the best specs, performance, and customization flexibility is the Nvidia Shield. It's on the expensive side at $149, but it offers ambitious AI upscaling and surprisingly solid game streaming with Nvidia's GeForce Now service. if you plan to use your Android TV device for more than just streaming the latest Netflix shows. It's a great option if you plan to use it for more than just streaming the latest Netflix shows.

If you want something cheaper, though, the Onn Android TV UHD streaming device is similar to those made by Chinese companies without malware. It is the cheapest Android TV device for basic streaming needs, although it is not as powerful.

An intermediate option is the Chromecast with Google TV, which is like an improved version of Android TV. It still has many of the same features as Android TV, including the ability to cast shows and movies from your phone, but the Google TV interface does a much better job of surfacing and recommending new content for you to watch.