A new study released today has raised serious alarms over the widespread use of illicit streaming devices (ISDs) in Taiwan, highlighting not just the scale of digital piracy but also the potential cybersecurity threats these devices could pose to consumers and national infrastructure.

The findings were unveiled during an enforcement workshop held in Taipei recently, co-hosted by the Taiwan Society of Convergence and the Asia Video Industry Association’s Coalition Against Piracy (CAP).

According to a press release from AVIA, the study was conducted by Professor Paul A. Watters of Cyberstronomy Pty Ltd and revealed that a significant number of ISDs in use across Taiwan are highly vulnerable to malware, remote hijacking, and other cyber threats.

The research exposed that nearly half of the apps commonly used on ISDs contained malware, with some registering as many as 20 security warnings on top-tier security platforms. Devices running these apps were found to have an average of 7.75 vulnerabilities, increasing the chances of them being exploited for malicious purposes, including command-and-control attacks, phishing, and even full device takeovers.

More disturbingly, one such app was found to employ “superuser” access—granting full control of the device and any connected network to cyber attackers. These threats are further exacerbated by the fact that ISD apps often operate via obscure and abuse-prone domains such as 6868c.cc and 1357c.cc, which are difficult to trace due to private domain registrations.

“Every ISD in Taiwan represents a potential node in a nationwide cyberattack,” warned Matt Cheetham, General Manager of the Coalition Against Piracy, “If left unregulated, these devices could be weaponised to compromise homes, businesses, and government networks.”

To address the growing threat, the study calls for a comprehensive three-pronged strategy—tightening regulations around the sale and distribution of ISDs, enhancing enforcement against malicious digital infrastructure supporting these devices, and implementing DNS or site blocking to limit access to known malware-distributing domains.