Is the HY300 projector safe? How to check a cheap projector for malware

It depends on the unit. Security researchers have found hidden apps in the firmware of some cheap Android projectors, including HY300 Pro and Pro+ units sold online, that use the owner's internet connection without asking. But HY300s and similar no-brand mini projectors are sold by dozens of sellers with different software, and you can check yours in a few minutes. If you'd rather not take the chance, you don't need the projector's Wi-Fi at all: an HDMI cable from your phone works with every HY300 while the projector stays offline.

We see a lot of these projectors. HY300-series models are the most common projectors among people using Lazy Lighting Link, our receiver app for Android-based projectors, so we'd rather you run these checks before you install Link or put any cheap Android projector on your home Wi-Fi. Sources are listed at the end. Disclosure: we make Lazy Lighting and Lazy Lighting Link.

In February 2026, researcher Zane St. John published an analysis of an HY300 Pro+ he had bought on AliExpress for about $35. Within minutes of joining his Wi-Fi, before he had opened a single app, his network filter logged the projector contacting suspicious domains.

In May 2026, Azerbaijan's national cybersecurity team (CERT) republished the findings and said similar components had been reported on other low-cost projector brands, including Hotack, Huyukang and Nonete. Other owners have posted matching findings on GitHub.

According to the analysis, the preinstalled apps included:

• Remote access: an app called com.hotack.silentsdk that can download and run more code from a remote server.
• A residential proxy: software that rents out the owner's connection to a proxy service, so other people's internet traffic leaves through your home IP address.
• Ads and tracking: apps that upload device information and inject ads.
• Self-defense: an update service that downloads over unencrypted connections and can reinstall removed parts, plus a startup script that switches off Google Play Protect.

No one has shown that every HY300, or every cheap projector, is affected. HY300 is a design rather than a single product: near-identical models are sold under dozens of brand names, often with different software. The researcher traced his unit's firmware to a manufacturer called Hotack, which he says supplies the same hardware to many of those brands, and other low-cost projector brands have been named in similar reports.

At least one HY300 brand has responded. In April 2026 it said the flagged files on its older units, built on the Allwinner H713 chip, are needed for local services rather than malware, that its newer models on the H726 chip don't include them, and that it offers a fix installed offline from a USB drive. Researchers describe those files very differently, and we haven't seen independent tests of the newer chip.

So treat the chip and the brand as clues, not a verdict: the unit in the main report ran Android 11 on the H713, and H726 models report Android 14 (see Settings, then About). Run the checks below whichever HY300 or no-brand projector you have.

BADBOX 2.0 is the best-known case of the same pattern. In March 2025, HUMAN Security's Satori team, working with Google, Trend Micro and the Shadowserver Foundation, disclosed a network of more than a million cheap, uncertified Android devices, including TV boxes, tablets and digital projectors, carrying backdoors that were often installed before sale. They were used for ad fraud and as residential proxies. Brazil had the most infected devices, followed by the United States, Mexico and Argentina.

In June 2025 the FBI warned that criminals were exploiting devices like these, digital projectors included. Its warning signs include devices that aren't Play Protect certified, that require Play Protect to be turned off, that use unofficial app stores, or that create unexplained internet traffic. In July 2025 Google sued 25 unnamed people and companies in China it says ran the botnet, which it says had compromised more than 10 million uncertified devices. In January 2026 it disrupted IPIDEA, a residential proxy network it links to BADBOX 2.0.

The FBI and Google described types of devices rather than naming the HY300, and we haven't found a published report tying the HY300 to BADBOX itself. But they describe what researchers later found on HY300 units: inexpensive Android hardware that arrives with proxy software already installed.

Do this before you sign in to anything or install apps. The checks need the Play Store, and so the internet, so start on a separate network.

1. 1

   Use a guest network. Many routers can run a guest Wi-Fi network that keeps its devices away from your phones and computers. Connect the projector there.

2. 2

   Check Play Protect certification. In the projector's Google Play Store, select your profile icon, then Settings, then About, and look under Play Protect certification. If asked to sign in, use a spare Google account, not your main one. Google says uncertified devices "may not be secure" and may miss updates. No Play Store means not certified.

3. 3

   Make sure Google Play Protect is on. In the Play Store, select your profile icon, then Play Protect, then Settings, and turn on Scan apps with Play Protect (menus vary by version). If it's off and you didn't turn it off, that's a red flag.

4. 4

   Look through the apps. In Settings, open Apps and show all apps, including system apps. Note anything you can't explain, especially apps you can't uninstall or that come back.

5. 5

   Watch for warning signs: pop-up ads on the home screen or over videos, apps appearing on their own, a slower network whenever the projector is on, or traffic from the projector while it sits idle (many router apps show this).

6. 6

   Update only from the official source. Use the projector's own system update or the seller's support page, never firmware from download sites.

7. 7

   Install Lazy Lighting Link only from Google Play. We don't publish an APK, so a Link APK on any other site isn't from us.

Lazy Lighting runs on your iPhone, iPad or Android phone, and the phone does the mapping. The projector only shows the picture, so you decide how much it touches your network. Lazy Lighting is free to download; Pro removes the watermark on the projector output and unlocks the full library.

• Connect your phone with a cable → adapters for iPhone, iPad and Android, step by step.
• Set up Lazy Lighting Link → pairing, Live Cast, Playback and manual connection.
• Not connecting? → Lazy Lighting's own troubleshooting steps.

• Take it off your Wi-Fi. Forget your network in the projector's settings so it can't reconnect. The FBI suggests disconnecting suspicious devices.
• Keep using it offline. It still works as a screen with an HDMI cable or a USB drive.
• Secure your accounts. From another device, remove the projector from your Google account's device list and change the passwords of any accounts you signed in to on it.
• Contact the seller. Ask for a return or for clean firmware. Some sellers offer a fix you install offline from a USB drive.
• Report it. In the US, the FBI asks people who think they've been victimized to report it at ic3.gov.
• Replace it if you can't trust it. Malware built into firmware is very hard to clean, so replacing the projector is the surest fix. Or keep it offline and add a Chromecast with Google TV for wireless.

• Are all cheap Android projectors unsafe? No. The risk is highest on projectors and TV boxes that aren't Play Protect certified and run no-name firmware, which is what the FBI and Google warned about. Some budget projectors run certified Google TV. Check yours with the steps above before you put it on your home Wi-Fi.
• Will a factory reset remove HY300 malware? No. In the reported cases the apps are part of the firmware, so a reset restores them. Reset a second-hand projector anyway to clear the last owner's accounts.
• Can a projector's malware reach my phone? We haven't seen a report of an HY300 attacking other devices, but a guest network limits the risk. With a cable and the projector's Wi-Fi off, it has no connection to misuse.
• Is Lazy Lighting Link safe to install? Link is our app, published only on Google Play. It needs no account, has no ads or third-party analytics, and receives your show directly from your phone over your local network, not through our servers. It can't fix a projector's firmware, so check the projector first.
• What's a safer alternative to an HY300? A projector with Google TV or Android TV built in from a brand on Google's Android TV partner list, or your HY300 kept offline with a Chromecast with Google TV plugged in. For indoor projection mapping we use the Nebula Capsule 3 Laser from Anker, which is on that list.
• Is the HY300 electrically safe? In August 2026 UK authorities rejected a shipment of HY300 projectors at the border because the plug didn't meet the UK standard and posed a shock risk. Buy from a seller who supplies the right plug for your country.

• Zane St. John: Reverse engineering Android malware with Claude Code ↗ (February 5, 2026). The HY300 Pro+ firmware analysis.
• HY300 manufacturer statement on APK files ↗ (April 22, 2026). The H713 and H726 details and the offline fix.
• CERT Azerbaijan: A $35 projector has turned into a source of hidden cyberthreats ↗ (May 25, 2026).
• HUMAN Security: The BADBOX 2.0 operation ↗ (March 5, 2025).
• BleepingComputer: BadBox malware disrupted on 500K infected Android devices ↗ (March 5, 2025). Device types and the country breakdown.
• FBI: Home Internet Connected Devices Facilitate Criminal Activity ↗ (June 5, 2025).
• Google: Taking legal action against the BadBox 2.0 botnet ↗ (July 17, 2025).
• Google Threat Intelligence: Disrupting the world's largest residential proxy network ↗ (January 2026).
• Google Play Help: Check and fix Play Protect certification status ↗ Where to find your projector's certification.
• Google Play Help: Use Google Play Protect ↗ How to turn Play Protect on.
• GOV.UK: Product safety report, LCD Projector HY300 ↗ (August 21, 2026).