# Investigating IPTV Malware in the Wild
## 2 Background
This implies there is a significant chance of users obtaining infected with high-severity malware, especially if hackers are willing to pay a total of USD 70 million. Malware can be distributed to users of illegal IPTV websites when users download video files for watching IPTV content, such as MP4 files. When an infected file is opened, the malware will execute on the user's device, which could be anything from ransomware to a remote access trojan (RAT). Although users may not realise the risks of downloading files from an untrustworthy source, technically proficient users will be aware of the risks and are likely to mitigate the risk of infecting their devices by using an antivirus that scans files or a virtual machine (VM). However, this is not the only risk of using IPTV websites. Another risk is fileless malware. Fileless malware does not require a user to download a malicious file; rather, it exploits vulnerable applications on a victim's device to enable the injection of malicious code into its main memory [25]. Fileless malware is a high risk to users, as it is unlikely to be detected by antivirus signatures and could potentially infect a user as soon as they visit a website [26]. One study analysed the malicious codes in embedded PDFs. Moreover, malicious codes embedded into the PDF files present a prevalent way of infecting the main memory and using malicious JavaScript codes [11]. There are several recent data-dependent malicious URL identification and classification studies in the literature based on machine learning, deep learning, or an ensemble of classification algorithms [12; 27; 28; 29; 30; 31]. Furthermore, considering the methodology, our paper shows similarity in the collection of cyber threat intelligence with the works of [PERSON] et al. [30] and by the similarity of analysing the websites within a framework with the works of [PERSON] et al. [31]. However, our paper differentiates from the literature by providing an exemplar analysis for the niche domain of illicit IPTV websites' identification of malvertising and providing the tools and best practices that frame the investigation guideline. Furthermore, many threat intelligence platforms, such as VirusTotal and AlienVault Open Threat Exchange (OTX), do not recognise these sites as malicious. To illustrate, we scanned 1555 illicit IPTV websites and aggregators gained from an IPTV GitHub repository in VirusTotal. Of these websites, only 34 were identified as malicious or had an association with malware for both VirusTotal and AlienVault OTX even though many of these websites contained intrusive advertisements attempting to scam users into downloading potentially unwanted programs (PUPs) that may have been malicious. Infringing IPTV (Pro v7.0.6) software includes standalone desktop and mobile phone applications in addition to add-ons or plugins for legitimate IPTV software, such as Kodi. Using standalone applications to access IPTV content illegally often requires paid subscriptions. A study found that a business, SET TV, offered infringing IPTV content to over 180,000 users with a USD 20 monthly or USD 200 annual subscription via a standalone software application [7]. Again, it is less likely that providers will infect IPTV applications with malware if they are already making a profit. In comparison to using websites for IPTV, there is more incentive for IPTV website providers to include malware, as the content provided is usually free. However, downloading and executing an application infected with malware could have a greater impact if users do not have antivirus software installed. While studies suggest that standalone infringing IPTV applications have a considerable number of users, another study found that 26 million Kodi users (68% of the total user base) were pirating illegal IPTV content using Kodi (20.2) software add-ons [32]. Although these add-ons are often downloaded from likely benign GitHub repositories, the Digital Citizens Alliance found that third-party Kodi add-ons were used to distribute cryptocurrency-mining malware [2].