Google Dismantles 1.3 Million‑Device Android TV Botnet, Blames Manufacturer for Pre‑Installed Malware

Google announced on Tuesday that it had taken down a sprawling network of more than 1.3 million compromised Android TV streaming boxes that were being used as residential proxy nodes for cyber‑criminal activity.

The operation, dubbed the XCPE botnet by security researchers, turned ordinary set‑top boxes into a global proxy service that could route traffic through seemingly legitimate home IP addresses. The scale of the network, which spanned dozens of countries, made it one of the largest IoT‑based botnets uncovered to date.

Investigators traced the malware back to Videostrong, a Chinese‑based manufacturer of low‑cost Android TV hardware. According to the findings, the company embedded a malicious payload in the firmware of devices it shipped worldwide and then offered access to the compromised units through a subscription service aimed at cyber‑criminals.

Google said it worked with law‑enforcement partners to seize the command‑and‑control servers that coordinated the botnet, cut off the malicious code’s ability to receive updates, and began the process of cleaning affected devices where possible. The tech giant also issued a public advisory urging owners of Android TV boxes to verify the source of their hardware and to apply any available security patches.

The takedown highlights growing concerns over the security of Internet‑of‑Things devices that are often sold with minimal oversight. Experts note that manufacturers that prioritize rapid market entry over robust code review create a fertile environment for large‑scale abuse, and that the incident may spur tighter regulation of firmware distribution and supply‑chain transparency.

While the immediate threat has been neutralized, researchers warn that similar operations could reappear if vulnerable devices continue to flood the market. Consumers are advised to purchase hardware from reputable vendors, keep software up to date, and disable unnecessary network services. Google indicated that it will continue monitoring for remnants of the botnet and cooperate with authorities on any further illicit activity linked to the compromised hardware.