Google, cybersecurity firms Human Security and TrendAI, other companies and Japan’s police have disrupted a botnet involving at least 1.3 million Android devices, most of them TV set-top boxes, according to a report by The Register. The affected devices were spread across more than 200 countries, including Germany.
The botnet is said to have connections to people behind Badbox 2.0, a separate network that Google and its partners dismantled in 2025 and which involved more than 10 million Android TV boxes and other devices.
Google says Videostrong Technology, a Chinese manufacturer of home TV boxes and projectors, deliberately built a backdoor into its devices’ firmware and sold access to criminals. They could then install additional malware. When an affected device joined a home network, it could be used to create proxy networks that concealed malicious traffic, without the owner’s knowledge.
TrendAI said the malware agent presented itself as a standard remote-management client. It received updates from a dedicated GitHub page, while the devices also connected to a server that gave criminals full control over individual set-top boxes.
The takedown also blocked access to at least 10 million additional compromised devices, according to the report. Google has ended its relationship with Videostrong and says the company may no longer manufacture devices with Google apps preinstalled. Google also plans to strengthen its screening of device manufacturers.
Sources: t3n.