Google Takes Down 1.3 Million‑Device Android TV Botnet, Cites Manufacturer for Built‑In Malware

On Tuesday, Google disclosed that it had dismantled a massive collection of over 1.3 million hijacked Android TV streaming boxes that were being employed as residential proxy points for criminal online operations.

Security analysts have labeled the scheme the XCPE botnet, which transformed standard set‑top boxes into an international proxy platform capable of channeling traffic via apparently authentic home IPs. Covering dozens of nations, its breadth placed it among the biggest IoT‑focused botnets identified so far.

Researchers linked the malicious code to Videostrong, a China‑based producer of inexpensive Android TV devices. The investigation revealed that the firm inserted a harmful payload into the firmware of its globally shipped units and subsequently marketed access to the infected boxes via a subscription service targeting cyber‑criminals.

Google reported collaborating with law‑enforcement agencies to confiscate the command‑and‑control servers that directed the botnet, block the malware from receiving further updates, and start cleaning the compromised devices where feasible. The company also released a public advisory asking Android TV box owners to confirm their hardware’s provenance and install any security updates.

This dismantling underscores rising worries about IoT device security, especially for products sold with little supervision. Analysts point out that manufacturers favoring swift market launch over thorough code audits foster conditions ripe for massive exploitation, and the episode could prompt stricter rules on firmware distribution and supply‑chain visibility.

Although the direct danger has been mitigated, researchers caution that comparable schemes may resurface if vulnerable devices keep entering the market. They recommend shoppers buy hardware from trusted sellers, maintain up‑to‑date software, and turn off superfluous network functions. Google affirmed it will keep tracking any leftover botnet fragments and work with officials on any additional illegal activity tied to the tainted hardware.