Google Shuts Down Massive Android TV Box Botnet, Accuses Manufacturer of Selling Access

Google announced that it had dismantled a botnet comprising more than 1.3 million Android devices, the majority of which were internet‑connected TV set‑top boxes. The operation, which concluded in late October, cut off the malicious servers that were controlling the compromised hardware.

The network of hijacked devices had been used to run a variety of illicit activities, ranging from click‑fraud schemes to the distribution of unwanted advertisements. Because the boxes run a modified version of Android, they were attractive to attackers seeking a large pool of low‑cost, always‑on endpoints that could be remotely managed.

According to Google, the device maker Videostrong is at the center of the controversy. The company is alleged to have deliberately embedded a backdoor into its TV boxes and then offered that access to third‑party buyers who could exploit the devices for profit. Google says the evidence points to an intentional scheme rather than a simple security oversight.

Google’s security team detected the anomalous traffic patterns in early October and coordinated with partners to seize control of the command‑and‑control infrastructure. By disabling the servers that issued instructions to the compromised boxes, the company effectively rendered the botnet inoperable. Google described its confidence in the takedown as “high,” noting that the compromised devices lost any ability to receive further commands after the operation.

The disruption is expected to reduce the volume of fraudulent ad impressions and other automated abuse that relied on the botnet’s scale. While the exact financial impact on the criminal operators is unclear, cutting off the command channel removes a critical tool from their arsenal and may deter similar schemes that rely on bulk‑purchased, insecure hardware.

Security experts say the case underscores a growing problem in the Internet of Things ecosystem, where manufacturers sometimes prioritize rapid market entry over robust security practices. Android‑based TV boxes, in particular, have been flagged in recent years for weak default passwords and unpatched software, making them fertile ground for botnet recruitment.

Google has not indicated whether it will pursue legal action against Videostrong, but the public attribution may invite regulatory scrutiny and potential lawsuits. Industry observers recommend that consumers check for firmware updates on any connected TV devices and consider disabling unnecessary network services. The incident also serves as a reminder for manufacturers to adopt stricter security standards and for platform providers to monitor for abuse more proactively.