For a lot of households, cable and satellite are officially “in the past.” Streaming on smart TVs and streaming devices has become the new normal, with 83% of U.S. adults choosing these as their main way to watch TV.

But the bigger streaming gets, the more people try to take advantage of the large audience — including sellers pushing unauthorized streaming devices that promise free access to paid content or “all the channels” with no monthly bill. The FBI recently shared a warning that some of these devices may be compromised with malware, creating serious security concerns once they’re connected to your home network. (Click here to read the FBI’s official public service announcement about unauthorized streaming boxes.)

And what makes this one tricky is that the risk isn’t always obvious, or caused by something you intentionally did. In some cases, a streaming device may already be compromised when it’s purchased, or it can pick up malware during setup, especially when it nudges you toward unofficial app downloads.

Once a compromised device is connected to your home internet, it can quietly be “recruited” into a botnet — basically a group of infected devices controlled remotely. That can let criminals use your connection in the background for suspicious activity, often without any obvious signs.