Google Takes Down 1.3 Million‑Device Android TV Botnet, Blames Vendor for Pre‑Installed Malware

Google said Tuesday it had dismantled a massive network of over 1.3 million hijacked Android TV streaming boxes that were being exploited as residential proxy nodes for criminal activity.

Security researchers label the operation the XCPE botnet; it transformed ordinary set‑top boxes into a worldwide proxy service capable of routing traffic through apparently legitimate home IPs. Covering dozens of nations, the botnet ranks among the largest IoT‑based networks ever discovered.

Investigators linked the malicious code to Videostrong, a China‑based maker of inexpensive Android TV devices. The company allegedly baked a harmful payload into the firmware of units it shipped globally and then marketed access to the infected boxes via a subscription service targeting cyber‑criminals.

Google reported collaborating with law‑enforcement agencies to seize the command‑and‑control infrastructure that steered the botnet, block the malware’s update channel, and start cleaning compromised devices where feasible. The company also released a public advisory urging Android TV box owners to confirm their hardware’s provenance and install any pending security updates.

The removal underscores rising worries about IoT device security, especially products sold with little oversight. Experts warn that manufacturers chasing rapid market entry at the expense of thorough code review create fertile ground for large‑scale abuse, and that this case could drive stricter rules on firmware distribution and supply‑chain transparency.

Although the immediate danger has been mitigated, researchers caution that comparable schemes could re‑emerge if vulnerable devices keep flooding the market. Consumers should buy from trusted sellers, keep software current, and turn off unnecessary network services. Google said it will keep watching for botnet remnants and work with authorities on any further illicit activity tied to the compromised hardware.